v26.4.14

v26.4.14

Check sessions against risk rules

Ory Kratos can now evaluate risk rules every time it checks a session at /sessions/whoami or /sessions/whoami-jwt/{template}. Configure up to 5 rules under session.whoami.rules. Each rule is a CEL condition over the session and the request, including the client IP address, its reputation labels, and its location, and an action: require_aal2 requires a second factor for the rest of the session, and revoke revokes the session.

SAML providers store their SP entity ID

Each SAML provider now has one SP entity ID, the audience its IdP sends, in sp_entity_id, on both the default and the native engine.

• In Ory Network, each SAML provider stores its SP entity ID, and you can set it to your own value. A save that leaves it out keeps the stored value, so switching a provider between engines, moving it to another organization, changing audience_override_base_url, or removing proxy_saml_audience_override no longer changes the audience your IdP must send. A new or changed proxy_saml_audience_override still sets it. A native provider no longer has an sp_entity_id_override field; set sp_entity_id instead. Providers that share one SAML connection on the shared ACS URL must have the same sp_entity_id. The identity configuration shows the stored sp_entity_id of each provider, and the acs_url of a provider on the default engine with its own ACS URL, which a save doesn't change.
• In Ory Enterprise License (OEL) deployments of Ory Kratos Identities, the native SAML engine reads the SP entity ID of a provider from sp_entity_id. sp_entity_id_override still works but is deprecated.