IRIS-NG-v1.4.1 release pass: drop the six pre-release banners, link + extend the changelog row (issue #93 fix, gunicorn 26.1.0, npm deps), bump Kubernetes to chart 0.8.1
Add Single Sign-On and Multi-Factor Authentication pages; document v1.4.1
Two new pages, split so the login mechanism and the second factor are not
conflated the way the upstream documentation conflates them:
Single-Sign-On OIDC, oidc_proxy, LDAP/AD, why none of it is
configurable in the GUI
Multi-Factor-Authentication TOTP, enrolment, exempt accounts, recovery
Written from the source rather than the upstream docs, which surfaced several
things that page gets wrong or omits: AUTHENTICATION_LOCAL_FALLBACK is
documented without its IRIS_ prefix and does not work under the documented
name; auto-provisioned OIDC users are created with no group, so they log in
successfully and see nothing, because IRIS_NEW_USERS_DEFAULT_GROUP is applied
only on the LDAP path; oidc_proxy calls exit(0) when discovery fails, so the
container stops rather than starting; LDAP certificate settings are bare
filenames resolved under certificates/ldap/, not paths; and the LDAP
provisioning attributes are absent from that page entirely.
MFA is TOTP (SHA-1 / 6 digits / 30s), so Microsoft Authenticator and Google
Authenticator both work. It is not LDAP - LDAP decides where the password is
checked, MFA adds a factor on top, and the two compose.
Also documents IRIS-NG-v1.4.1: exempt accounts, the Set up MFA label, and the
account actions moved back above the skills catalogue.
Security gains a Known trade-offs entry stating the administrator exemption
plainly - whoever holds that password bypasses MFA entirely on the most
privileged account - with the mitigation of keeping a second administrator,
which is subject to enforcement, for day-to-day work.
Troubleshooting gains an Authentication section covering the symptoms this
actually produced: no QR code on the profile page (there is a button, and
before v1.4.1 it sits below ~34 skill checkboxes), a greyed-out MFA button,
lockout with no recovery codes, IRIS_MFA_ENABLED appearing to do nothing, and
SSO users never being asked for a second factor.
v1.4.1 is NOT released. All six mentions of it carry a banner the wiki linter
can see, so the release pass is prompted to remove every one.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>