Kaeso 0.3.9 changes the sign-in-again dialog so that single sign-on is offered only when no password or sign-in link can confirm a recent sign-in, and providers that cannot confirm one are no longer offered. Integrations that read the sign-in-again, security or SSO fields, or handle the sso_error codes, must be updated because sends_auth_time is renamed and two codes are replaced. Operators gain the kaeso instance admin-sso command for choosing the organization whose single sign-on may administer an instance.
- Breaking: The
sends_auth_timefield of the security and SSO endpoints is renamed toconfirms_sign_in, and thestale_sign_inandno_auth_timecodes are replaced bycannot_confirm. Integrations should read the new field, handle the new code, and expectssoto be empty whenever a password, sign-in link or set-password option is available. (#361（在新标签页中打开）)
Contributors: @dvnold
Full changes: v0.3.8...v0.3.9（在新标签页中打开）
新增
- The
kaeso instance admin-ssocommand sets the organization whose single sign-on may administer the instance, or clears it withnone, from the server's shell. Installs without passwords or sign-in links could not set this before without editing the database. Each change is written to the audit log and applies at once. (#360（在新标签页中打开）)
变更
Documentation
- The GitHub release page keeps its tagline, highlights and breaking changes, then lists every changelog entry under its section heading instead of linking to the full changelog. (#359（在新标签页中打开）)
修复
- Sign-in again offers single sign-on only when no password or sign-in link can confirm the account, so people are no longer sent back to a dialog that single sign-on cannot satisfy. A confirmation whose ID token has no
auth_time, or a stale one, is refused with thecannot_confirmcode, and the provider is no longer offered for recent sign-in. (#361（在新标签页中打开）)