authentik/website/docs/releases/v2022.5.md at b20c384f5a63051904a22d3f746ddc579fd1fcd1

Archived

This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.

Jens Langhammer 6460245d5e website/docs: add missing docs for #2828

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

2022-05-23 20:42:00 +02:00

title	slug
Release 2022.5	2022.5

Breaking changes

Twitter Source has been migrated to OAuth2

This requires some reconfiguration on both Twitter's and authentik's side. Check out the new Twitter integration docs here
OAuth Provider: Redirect URIs are now checked using regular expressions

Allowed Redirect URIs now accepts regular expressions to check redirect URIs to support wildcards. In most cases this will not change anything, however casing is also important now. Meaning if your redirect URI is "https://Foo.bar" and allowed is "https://foo.bar", authorization will not be allowed. Additionally, the special handling when Redirect URIs/Origins is set to * has been removed. To get the same behaviour, set Redirect URIs/Origins to .+.

LDAP Outpost cached binding

Instead of always executing the configured flow when a new Bind request is received, the provider can now be configured to cache the session from the initial flow execution, and directly validate credentials in the outpost. This drastically improves the bind performance.

See LDAP provider
OAuth2: Add support for form_post response mode
Don't prompt users for MFA when they've authenticated themselves within a time period

You can now configure any Authenticator Validation Stage stage to not ask for MFA validation if the user has previously authenticated themselves with an MFA device (of any of the selected classes) in the Last validation threshold.
Optimise bundling of web assets

Previous versions had the entire frontend bundled in a single file (per interface). This has been revamped to produce smaller bundle sizes for each interface to improve the loading times.

Additionally, only the locales configured will be loaded on start, instead of all locales.

Certain parts of the application are purposefully still contained in the initial bundle, especially for commonly used pages and default routes.

*: decrease frequency of background tasks, smear tasks based on name and fqdn
api: fix OwnerFilter filtering out objects for superusers
core: add custom shell command which imports all models and creates events for model events
core: add flag to globally disable impersonation
events: fix created events only being logged as debug level
flows: handle flow title formatting error better, add user to flow title context
internal: add signal handler for SIGTERM
outposts/ldap: cached bind (#2824)
policies: fix current user not being set in server-side policy deny
providers/oauth2: add support for form_post response mode (#2818)
providers/oauth2: allow regex matches for allowed redirect_uri
providers/oauth2: don't create events before client_id can be verified to prevent spam
providers/saml: make SAML metadata generation consistent
root: export poetry deps to requirements.txt so we don't need poetry … (#2823)
root: handle JSON error in metrics
root: set SESSION_SAVE_EVERY_REQUEST to enable sliding sessions
sources/oauth: Fix wording for OAuth source names (#2732)
stages/authenticator_validate: remember (#2828)
stages/identification: redirect with QS to keep next parameters (#2909)
stages/user_delete: fix delete stage failing when pending user is not explicitly set
web: fix dateTimeLocal() dropping local timezone
web: lazy load parts of interfaces (#2864)
web/user: add missing checkbox element in user settings (#2762)

This release does not introduce any new requirements.

Download the docker-compose file for 2022.5 from here. Afterwards, simply run docker-compose up -d.

Update your values to use the new images:

image:
    repository: ghcr.io/goauthentik/server
    tag: 2022.5.1