Version 0.9.7-rc

​

What’s new in v0.9.7-rc?

​

✨ New features & improvements

• Microsoft Entra ID, Okta & Keycloak: These are now available as OAuth sign-in providers, alongside Google and GitHub.
• Allowed email domains: Every sign-in provider can be restricted to specific email domains, and automatic account creation can be turned off per provider.
• SAML single sign-on: Signing in via SAML now completes the full sign-in flow end to end.
• SCIM group sync: Group memberships now stay in sync automatically through SCIM, including removals.
• SCIM token management: SCIM tokens can now be listed and revoked from Admin → Identity Providers, not just generated.
• Scheduled directory sync: LDAP / Active Directory sync can now run automatically on a schedule, in addition to manual syncs.

​

🛠 Stability & Maintenance

• Large directory sync: Fixed an issue where Active Directory environments with more than 1,000 users could have some users incorrectly deactivated during sync.
• Sync safety guard: Directory sync now pauses and asks for confirmation before an unusually large number of users would be deactivated in one run, protecting against misconfigured filters or a temporarily unreachable directory.
• Faster configuration changes: Identity provider settings now take effect immediately after saving, without restarting the application.

​

🔒 Security & Vulnerabilities

• OAuth client secrets are now encrypted at rest.
• Microsoft Entra ID sign-in now requires a specific organization (tenant) to be configured, so only accounts from your organization can sign in.
• Added safeguards to prevent an external sign-in from being matched to the wrong existing account when email domains are not restricted.