Changelog
What changed in each release candidate
Newest first, each with what it added to the one before. Nauthera is pre-1.0, in a design-partner program: its signed server and operator images and its Helm chart are public on the GitHub Container Registry, and teams can apply for one of five design-partner seats to pilot it with direct support. The source is private.
By Michael Beutler, FounderPublished Updated
Read from the server's releases, hourly · last
Not listed: maintenance, dependency updates, security fixes, fixes that touch sign-in, tokens, sessions or access, and changes that tighten what the server refuses, since any of those could be a security fix. To report a vulnerability, see Security.
v0.4.0-rc.2
Features (12)
- configLet a loopback deployment's outbound fetches reach a private address
- conformanceRun the OIDF Basic and Config OP plans; clear four Basic OP warnings
- dashboardShow where a client's secret is kept
- dcrLet a self-registered confidential client request offline_access
- dcrAccept a client's key set by value at registration
- factsPublish the dashboard's sections and the kinds of each operator reason
- factsGenerate the facts the website renders
- jarFetch a request object from the client's registered request_uri
4 more
- oauthServe the OpenID Connect implicit flow behind issuer.implicit_flow
- oidcHonor the claims request parameter
- oidcRelease every standard profile claim under the profile scope
- oidcSign UserInfo for a client that registered userinfo_signed_response_alg
Fixes (2)
- dashboardName the organization, not the issuer, in a client's manifest
- webKeep the sign-in and dashboard pages loading across a rolling update
v0.3.1-rc.1
Nothing listed: its changes are maintenance, dependency updates or fixes this page leaves out.
v0.3.0-rc.1
Features (11)
- configLet a loopback deployment's outbound fetches reach a private address
- conformanceRun the OIDF Basic and Config OP plans; clear four Basic OP warnings
- dcrLet a self-registered confidential client request offline_access
- dcrAccept a client's key set by value at registration
- factsPublish the dashboard's sections and the kinds of each operator reason
- factsGenerate the facts the website renders
- jarFetch a request object from the client's registered request_uri
- oauthServe the OpenID Connect implicit flow behind issuer.implicit_flow
3 more
- oidcHonor the claims request parameter
- oidcRelease every standard profile claim under the profile scope
- oidcSign UserInfo for a client that registered userinfo_signed_response_alg
Fixes (1)
- dashboardName the organization, not the issuer, in a client's manifest
v0.2.0
Nothing listed: its changes are maintenance, dependency updates or fixes this page leaves out.
v0.1.0-rc.24
Features (1)
- threatsRestructure the threat page and report the rule behind each signal
v0.1.0-rc.23
Features (4)
- dashboardRemove the sign-in security page
- federationLet an identity provider spare the second factor
- invitationSend the invitation again when an invited user asks for another link
- problemsShow what the operator could not apply, per organization and for the platform
v0.1.0-rc.22
Features (4)
- dashboardGive /admin a branded entry page
- dashboardShow the organization's issuer and profile in the overview header
- federationSign in with GitHub
- usersShow unverified addresses and second-factor enrollment to administrators
v0.1.0-rc.21
Features (2)
- chartShip roles that separate the platform, identity and application teams
- directoryStore, declare, reach and sign in through an organization's LDAP directory
v0.1.0-rc.20
Features (2)
- adminTell a caller who they are and what they may do
- dashboardFlag the country of every IP address the API places
v0.1.0-rc.19
Features (6)
- authShow the authenticator code as one box per digit
- dashboardLead the overview with what needs attention and how sign-in is going
- dashboardStep up in a sign-in window without leaving the page
- dashboardShow the signed-in administrator in the account menu
- runbookA runbook for every alert, problem and OAuth error, linked from each
- storageHold every entity id in a uuid column and mint sids and grant families as UUIDv7
v0.1.0-rc.18
Features (1)
- mfaAdd an opt-in email one-time code as a second factor
Fixes (1)
- mailShow the organization's logo and accent in its email
v0.1.0-rc.17
Features (1)
- dashboardShow a sign-in's network zones, spared factor and rules in the audit log
v0.1.0-rc.16
Features (2)
- adminSet zones, sparing and rules over the control plane, and forget remembered browsers
- oauthsrvKeep refresh tokens in the database
Performance (1)
- threatsCache by window length, count at once, read the sign-in shape apart
v0.1.0-rc.15
Features (1)
- mfaOffer a passkey after the one-time code where passwordless is open
Fixes (2)
- dashboardHold the sign-in until a prerendered page is shown
- dashboardDeclare the brand logo selector in the route test
v0.1.0-rc.14
Nothing listed: its changes are maintenance, dependency updates or fixes this page leaves out.
v0.1.0-rc.13
Features (1)
- authOffer a passkey after a password sign-in where passwordless is open
Fixes (1)
- dashboardKeep bar chart names on one line, whole on hover
v0.1.0-rc.12
Features (5)
- brandingServe inline branding images by digest instead of in every shell
- brandingName a served theme by its content, paint its first frame in its mode
- brandingHold a document's theme to the design system's contract at write
- operatorType a branding's theme in both resources
- rolesEmail a user when a role is granted to or revoked from their account
Fixes (1)
- dashboardScroll a dialog body that outgrows the viewport
v0.1.0-rc.11
Features (1)
- rolesGrant and revoke roles over the admin API and the dashboard, named <scope>-<job>
v0.1.0-rc.10
Features (1)
- dashboardShow identity providers and a user's linked accounts
v0.1.0-rc.9
Features (2)
- brandingWear an organization's color and radius tokens in the dashboard
- federationSign in and sign up through an organization's identity providers
v0.1.0-rc.8
Features (3)
- captchaDefault to the built-in altcha
- dashboardShow the threat page's cards while it loads
- metricsExport the threat signals and alert on their thresholds
Fixes (1)
- webDeclare bun 1.4.4 to match the Dockerfile's web stage
v0.1.0-rc.6
Features (1)
- dashboardWear the organization's branding in the admin dashboard
Fixes (1)
- threatsColour each signal's trend by its status
v0.1.0-rc.5
Features (8)
- auditLabel bot and AI-agent traffic in the request log and audit log
- brandingLet the branding document set the sign-in pages' favicon
- dashboardAdd a first-page button to the data table pager
- dashboardOffer no trace id when the server records no traces
- helmSign the audit checkpoints with a key the chart provides
- helmRoute the public listener through a Gateway API HTTPRoute
- threatsAdd a threat analytics page to the admin dashboard
- webOffer no way to register where sign-up is closed
v0.1.0-rc.4
Features (2)
- webShow the brand mark above the form in the split layout
- usersInvite users by email or create them directly from the dashboard
v0.1.0-rc.3
Nothing listed: its changes are maintenance, dependency updates or fixes this page leaves out.
v0.1.0-rc.2
Nothing listed: its changes are maintenance, dependency updates or fixes this page leaves out.
v0.1.0-rc.1
Features (101)
- orgConfigure the main organization from the Helm chart
- operatorWait out an unreachable server instead of retrying hard
- grpcReload the control-plane certificate and client CA at each handshake
- captchaAsk for it on emailed links and after failed sign-ins
- dashboardFill the sign-in calendar's width with more weeks
- dashboardTroubleshoot a failed request by its reference id
- dashboardLet pages use the full width on large screens
- dashboardChart a user's sign-ins as a calendar
93 more
- operatorPublish what the operator does as metrics
- operatorNotice a client changed outside the operator
- webLint React code with hooks, query, router and a11y rules
- operatorDecide what removing a manifest does to its client
- webLog every story callback and link click in the Actions panel
- operatorRegister a client declared in a manifest with the server
- authLink the new-sign-in alert to password reset
- dashboardShow and end a user's active and past sessions
- usersA user details page with sign-in activity, sessions and known devices
- dashboardSearch and filter the users table
- geoipName where a sign-in came from in its alert
- httpxConfigurable client-IP mode with reverse-proxy detection
- usersFilter admin users by status, lock, second factor and dates, and sort by last sign-in
- storageStore times as timestamptz and three JSON documents as jsonb on Postgres
- mailerAllow a relay without TLS when explicitly configured
- outboxDeliver queued mail from a durable outbox, once, from any replica
- helmRewrite the alerting rules as opt-in, tested groups
- cacheWait for replicas before a write counts
- cacheReach Redis through Sentinel or Cluster
- dashboardShow a spinner while the sign-in callback completes
- dashboardShow the client page's tabs and cards while it loads
- auditForward the stored log to pluggable exporters
- dashboardShow a navigation under way and a pending page while the next page loads
- dashboardShow a client's users and sessions over time
- clientsCount a client's daily, monthly and all-time users
- dashboardAdd a manifest view, tips and logos to the client page
- dashboardShow a client's configuration and a setup guide
- clientsShow one client's registered configuration in the admin API
- usersFind a user by name or email in the admin API
- sessionsList an organization's active sessions in the admin API and dashboard
- dashboardChart the audit log's volume above the log
- auditServe audit event counts over time for charts
- dashboardZoom and filter a time chart as the audit log's volume
- dashboardBuild the chart layer every page composes
- dashboardAdd audit log table with filters and time controls
- dashboardList an organization's OIDC clients in a searchable, filterable table
- adminList an organization's OIDC clients in the admin API
- adminLet members read their own organization and platform staff search every organization
- adminGive the dashboard's surfaces their own scopes and every console a signed-out return
- paginationSeal cursors so a link never carries a row's values
- dashboardFilter every list from a token bar backed by the contract's filters
- dashboardRender every list as one data table with server sorting and keyset paging
- rbacAdd the viewer, auditor, support, owner and platform roles
- auditFile events under the session's public id and the client they are about
- webLay out the dashboard in a themed, responsive shell with a top bar and global search
- webGenerate the dashboard's API client, query options, schemas and mocks from the contract
- webScaffold the admin dashboard on a pinned Astryx canary line
- apiPublish the problem-code vocabulary in the contract
- httpapiAuthorize admin operations by permission, read from the store
- operatorConnect to the central server from flags and mounted files, and report whether it works
- crdsEmit the resource definitions from the types the controller uses
- operatorAdd the operator module, its manager binary and its image
- client-authImplement private_key_jwt client authentication (RFC 7523 §2.2)
- deployAdd a Helm chart installable on a local kind cluster
- apiEmit the spec as one self-contained OpenAPI document
- logoutMake the front-channel logout URI registrable
- logoutRetire a session's refresh tokens when the session ends
- oidcKeep the session id on ID tokens minted at refresh
- logoutBind the ID token hint to the client at end_session
- sessionReturn session_state on the authorization response
- oidcMaintain the OP user-agent state across every session transition
- auditEnumerate the action and reason vocabularies in the API contract
- auditGive the audit vocabularies one definition shared with the API
- oapiMint named Go types for component enum schemas
- deviceBuild the user-code entry screen (RFC 8628 §3.3)
- grpcOrganization management RPCs, adminctl create-org, per-org FAPI e2e
- logoutAsk before ending a session, per RP-Initiated Logout section 2
- logoutFront-channel logout and session management endpoints
- webWire the consent screen to the server's validated prompt
- logoutPark RP-initiated logout behind a single-use confirmation handle
- fapiMandatory PAR as the FAPI 2.0 switch
- oauthPOST at the authorization endpoint
- oauthServe DPoP end to end
- oauthServe JAR and rich authorization requests
- oauthRFC 9396 authorization details and a client JWKS resolver
- oidcObtain an authorization decision before releasing data
- storagePersist consent grants
- consentThe grant model and decision rule
- oauthRFC 7591/7592 dynamic client registration
- oauthRFC 9126 pushed authorization requests
- oauthRFC 8628 device authorization grant
- oidcBack-channel logout and the sid claim
- oauthRFC 8707 resource indicators
- keysRS256 signing alongside ES256
- auditPartitioned audit log with a typed event catalog, levels and a REST read API
- apiReusable cursor pagination with has_more, order and bidirectional walks
- Multi-tenant organizations (Keycloak-style realms)
- mfaMandatory TOTP second factor - backend, hosted UI & e2e suite
- authInteractive password authentication + Grafana OIDC
- authuiHosted auth UI - Astryx SPA served by Go under /ui/
- httpxHTML error pages for browser-navigated auth endpoints
- oauthExtend OpenAPI to cover the OAuth 2.1 + OIDC RFC surface
- Initial nauthera-server - cloud-native OAuth2/OIDC identity server
Fixes (7)
- dashboardExplain the empty attributes card on the user page
- dockerLend the web stage the libatomic node 26 links against
- dashboardQuieter tips, even layout and an API guide on the client page
- crdsSettle the resource contract against what the server accepts
- webWrite a message for every error code the server emits
- composeEnable Tempo's metrics generator so TraceQL metrics work
- webLint against the TypeScript 6 API while typechecking on 7
Hear when the operator ships
One email when the operator ships. No newsletter.
By joining, you agree to our Privacy Policy and Terms.