New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.3

v26.4.3​

OEL images are no longer published to Cloudsmith​

Ory no longer publishes OEL images, their signatures, or their attestations to Cloudsmith (docker.cloudsmith.io/ory-corp/oel). New releases are available only from the Ory enterprise registries. Images already on Cloudsmith stay there, but receive no further versions.

Breaking changes​

Pull OEL images from the enterprise registry​

If you pull OEL images from docker.cloudsmith.io/ory-corp/oel, switch to the Ory enterprise registry to receive new releases. Contact Ory if you need access.

Failed SAML logouts show up in the Admin Portal​

A SAML single logout that fails, when Polis starts it or when the identity provider answers, now saves an SSO trace, as a failed sign-in does. The trace holds the tenant, product, connection, RelayState, the issuer and the LogoutRequest or LogoutResponse, and the Admin Portal labels it "SAML Single Logout". Its ID is the polis.sso_trace.id on the logout's span and log record. SSO traces gain an isSLO field.

The polis.idfed.logout.response log record and span now carry the tenant, product, identity federation app and upstream connection of the logout, and the log record carries the signed LogoutResponse Polis sends to the service provider as polis.saml.response, unless SSO_TELEMETRY_REDACT=true. Identity federation logouts started before this release still complete, without these attributes.

A signed LogoutResponse from the identity provider that cannot be parsed now fails with error.type=saml_invalid instead of _OTHER.

An identity federation logout now carries the polis.login.id of the login it ends. The SessionIndex of a federated SAML response holds the login ID in place of random digits, keeping its length, and Polis reads it back from the service provider's LogoutRequest. Unless the app verifies logout request signatures, the service provider chooses this value, so use it to correlate telemetry only.

ID tokens Polis issues now carry a polis_login_id claim, the ID of the login. /api/logout accepts an optional id_token_hint: send the ID token of the login being ended, expired or not, and the logout's log records and spans carry that login's polis.login.id. A hint Polis did not sign is ignored and the logout goes ahead.

A login that goes through the IdP selection page, or the app selection page of an IdP-initiated login, now keeps its polis.login.id after the user chooses, instead of starting again with a new one. Polis relays the ID through the page in a polis_login_id parameter, which is never forwarded to the IdP.

OIDC connection updates keep the provider metadata complete​

An update to an OIDC connection through PATCH /api/v1/sso that sent only some oidcMetadata fields, or an empty value, could save a connection without an issuer, authorization_endpoint, token_endpoint, userinfo_endpoint or jwks_uri, and logins through it then failed. This included switching a connection from its discovery URL to metadata. Polis now rejects such an update with 400 and keeps the connection as it was. Updates that leave all five fields in place, including ones that send only the fields that change, work as before.

SAML logout completes when the IdP answers with the HTTP-Redirect binding​

/api/logout/callback now accepts a LogoutResponse sent with the HTTP-Redirect binding. Previously an identity provider that answered a single logout this way always got an error, because the response was neither inflated nor checked against the signature on its query string.

Polis verifies the query-string signature with the IdP certificates stored on the connection that started the logout, and accepts SHA-256, SHA-384 and SHA-512 signatures only. An unsigned response, a response altered after signing, or a SAMLResponse or RelayState sent twice is refused with 403 Forbidden. If a connection stored only the IdP certificate's thumbprint, update it with the IdP metadata again.

The IdP selection page appears for every tenant with more than one connection​

When a tenant and product had more SSO connections than one database page holds, or an identity provider served more apps than that, Polis looked at the first page only and could send the user straight to the first connection or app instead of letting them choose. Polis now reads every connection before deciding, for SP-initiated logins, Identity Federation apps and IdP-initiated logins. An Identity Federation app that lists a tenant twice no longer offers that tenant's connections twice.