v26.4.13

v26.4.13

Google Workspace sync reconciles directories of any size

The Google Workspace directory sync compared the users and group members it fetched from Google against only the first page of records in its own store, 50 by default. In a directory with more users than that, people removed from Google Workspace stayed provisioned, members who left a group were never removed, and every run raised a group.user_added webhook for each member past the first page. The sync now reads its store to the end, so removals are applied and no events are raised for unchanged memberships.

Updates that race each other no longer lose fields. A SCIM PATCH of a user, a group rename, an update to a directory, an SSO connection, an identity federation app or a product configuration is now written only if the record is still the one the update read; a record changed in between is read again and the update is merged into the latest record.

A group.user_added event is raised only when the membership is new. A SCIM request that adds a user who is already in the group changes nothing and now sends nothing, where before it repeated the event.

Two concurrent creates of the same thing now leave one record: a SAML connection whose entityID another tenant creates at the same moment, and a SCIM user whose userName is posted twice at once, each end with one stored and the other refused, where before both could be stored. A SCIM PUT or PATCH that renames a user to a userName another user in the directory holds is now refused with 409 uniqueness, where before both users answered to the name.

DB_SESSION_TTL (library option db.sessionTtl) sets the lifetime of the login session on its own. The session spans the user's visit to the identity provider, and it shared DB_TTL with the authorization code and the tokens, so a login that took longer than that, for example one with an MFA enrolment, failed with session_not_found on return, and the only remedy also lengthened every token. It defaults to DB_TTL, so nothing changes until it is set.

If you embed Polis as a library with a database driver of your own, the driver must now implement putIf, which writes a record only when its stored form matches the one a read returned. Deployments on the built-in drivers need no change.

SAML providers accept additional ACS URLs

A SAML provider on its own ACS URL route can now list up to 10 additional ACS URLs, for example further URLs of a proxy in front of Ory. SAML responses addressed to these URLs are then accepted as well as those addressed to the provider's own ACS URL.

• In Ory Network, set them in additional_acs_urls on the SAML provider. When you update a provider, leaving out additional_acs_urls, or sending null, keeps the list, and an empty list or a JSON Patch remove of the field removes it.
• In Polis, set them in additionalAcsUrls on the SAML connection. Polis checks them on the connection's own ACS route (acsUrlId). When you update a connection, leaving the field out keeps the list and [] removes it.