docs: update README and CHANGELOG for 2.4.0#704
Merged
Conversation
Added to README: - WebAuthn / passkey login - Enterprise SSO (SAML 2.0 IdP & SP, OIDC broker, verified domains, home realm discovery) - SCIM 2.0 provisioning - Multi-tenant / org-scoped admin - Migration guides (planned) Added to CHANGELOG [Unreleased]: - Service accounts as FGA subjects (#665) - SAML ACS CSRF exemption fix (#666) - Trusted-issuer token review config (#667) - Session revocation on password reset (#669, #673) - Multi-tenant SSO phases (#672, #674, #675) - OIDC discovery caching + Twitter PKCE fix (#668) - WebAuthn passkey support (#671) - Per-user TOTP lockout + hashed recovery codes (#670) - Server-side user search + org membership (#678, #680) - Per-method MFA availability signals (#681) - Consolidated MFA redesign narrative (#682-686) - SAML 2.0 IdP role (#691) - OAuth 2.1 / MCP hardening (#693) - SCIM group provisioning + FGA + SAML assertions (#694) - Provider template parity (#695) - Recent fixes (async tracking, AGENTS.md rules, security fixes, storage parity, error typing, panics, frontend fixes) (#696-702)
…CP entries Add exhaustive coverage of all PRs missed in the prior pass: **Machine Identity (M2M) — PRs #648, #641-647, #652, #651, #654, #659, #655:** - Unified OAuth Client registry with `kind` discriminator (interactive/service_account) - client_credentials grant for service accounts (RFC 6749 §4.4) - Secretless workload identity: RFC 7523 client_assertion, SPIFFE JWT-SVID, K8s TokenReview - Registry-authoritative client authentication (introspect/revoke/discovery) - Interactive client registry columns + reserved-client seed - Shared client-auth resolver + grant-matrix hardening **Agent Delegation (A2A) — PR #658:** - RFC 8693 token-exchange for agentic on-behalf-of with nested act chains - Scope attenuation (monotonic non-widening intersection) - Hard depth cap on nesting; reserved claims prevent forging **Multi-Tenant SSO/SCIM Foundations — PRs #653, #657, #660, #656:** - Organization + user-org membership entities (CR1) - Per-org OIDC SSO federation (Okta/Entra/Google as upstream IdPs) - Per-org SAML 2.0 Service Provider SSO (XML-DSIG, replay detection, JIT) - Per-org SCIM 2.0 user provisioning (+ 3 pre-existing storage bugs fixed) **Authorization & Transports — PRs #625, #620:** - OpenFGA ReBAC engine (replaces non-released bespoke FGA) - Multi-protocol API: GraphQL + gRPC + REST + MCP - MCP: authorizer mcp CLI subcommand for claude mcp add - Single proto source of truth with buf STANDARD enforcement **Dashboard & UI — PRs #662, #663, #605:** - Admin pages: /identity/clients (with secret rotation), /identity/trusted-issuers - Admin pages: /identity/organizations (with Members, SSO, SCIM tabs) - UI migration: Chakra UI → shadcn/ui + Tailwind CSS (full type safety) **Security & Compliance — PRs #604, #603, #606:** - OIDC/OAuth2 spec compliance (RFC 6749 errors, auth_time, TTL, discovery) - PKCE RFC-compliance (base64url padding tolerance, secret bypass prevention) - Introspection auth bypass fix + backchannel SSRF hardening **Bugfix — PR #664:** - Expose public client_id in Client API type (distinct from surrogate id) **README enhancements:** - M2M: Add "Machine-to-machine (service-to-service) authentication" bullet - A2A: Add "Agent-to-agent (A2A) delegation" bullet - OIDC/OIDC: Clarify Authorizer is both IdP, RP/broker, and both for multi-tenant SSO - Transports: Add MCP to "GraphQL, REST, gRPC" list; clarify admin API transports Verification: All 32 PRs now have explicit CHANGELOG entries (consolidated where appropriate).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
README's feature list and CHANGELOG's [Unreleased] section were significantly
behind — ~20 merged PRs since the last dated entry (multi-tenant SSO, WebAuthn
passkeys, the MFA redesign, SAML IdP, SCIM/FGA groups, OAuth 2.1/MCP hardening)
weren't reflected anywhere user-facing.
What
verified domains, home realm discovery), SCIM 2.0, multi-tenant/org-scoped
admin, and Email OTP MFA to the feature list. Added a "migration guides
coming soon" line to the Planned roadmap.
merged PRs (chore(async): track fire-and-forget goroutines, drain on shutdown #696-fix(web): dashboard CSV/InputField crashes, app login a11y #702). Consolidated the 5-PR MFA redesign (feat(mfa)!: enable MFA by default and make it optional #682/feat(mfa): add --disable-mfa one-way global kill switch #684/feat(mfa): optional MFA setup, passkey as a second factor, and close the EnforceMFA passkey bypass #685/feat(mfa): behavior redesign — withheld-token first-time setup, WebAuthn/Email/SMS as MFA factors, lockout + admin recovery #686)
into one coherent narrative describing the end state rather than fragmented
per-PR bullets. Every claim cross-checked against the actual merged PR, not
just the title.
Test plan
Docs only. No code change.