authn-server

What's Changed

• fix: null OAuth email behavior by @diegosperes in https://github.com/keratin/authn-server/pull/259

Full Changelog: https://github.com/keratin/authn-server/compare/v1.20.0...v1.20.1

What's Changed

• Fix links in readme by @cornerman in https://github.com/keratin/authn-server/pull/256
• Oauth unlink social accounts by @diegosperes in https://github.com/keratin/authn-server/pull/253

Full Changelog: https://github.com/keratin/authn-server/compare/v1.19.0...v1.20.0

What's Changed

• oauth: add sign-in with apple support (fixes #110) by @AlexCuse in https://github.com/keratin/authn-server/pull/243

Full Changelog: https://github.com/keratin/authn-server/compare/v1.18.2...v1.19.0

What's Changed

• Revert "oauth: get signing key from provider (#236)" by @AlexCuse in https://github.com/keratin/authn-server/pull/250

Full Changelog: https://github.com/keratin/authn-server/compare/v1.18.1...v1.18.2

What's Changed

• oauth: get signing key from provider by @AlexCuse in https://github.com/keratin/authn-server/pull/236
• CI: update maintained actions to eliminate node warnings by @AlexCuse in https://github.com/keratin/authn-server/pull/237
• chore: migrate deprecated ioutil usage to io package by @AlexCuse in https://github.com/keratin/authn-server/pull/238
• chore: use github.com/go-jose/go-jose/v3 over deprecated square package by @AlexCuse in https://github.com/keratin/authn-server/pull/240
• Remove duplicate print of PUBLIC_PORT by @cornerman in https://github.com/keratin/authn-server/pull/242
• Bugfix: authn initiates user login upon connection attempt by @diegosperes in https://github.com/keratin/authn-server/pull/246
• Bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.3 by @dependabot in https://github.com/keratin/authn-server/pull/244
• prepare 1.18.1 by @AlexCuse in https://github.com/keratin/authn-server/pull/247

New Contributors

• @cornerman made their first contribution in https://github.com/keratin/authn-server/pull/242
• @diegosperes made their first contribution in https://github.com/keratin/authn-server/pull/246

Full Changelog: https://github.com/keratin/authn-server/compare/v1.18.0...v1.18.1

What's Changed

• feat: add support for TOTP multi-factor authentication by @AlexCuse in https://github.com/keratin/authn-server/pull/220
• Bump golang.org/x/crypto from 0.0.0-20200622213623-75b288015ac9 to 0.1.0 by @dependabot in https://github.com/keratin/authn-server/pull/228
• Bump github.com/prometheus/client_golang from 0.9.0-pre1 to 1.11.1 by @dependabot in https://github.com/keratin/authn-server/pull/229
• admin: clear TOTP secret when expiring password by @AlexCuse in https://github.com/keratin/authn-server/pull/231
• claims: add amr for authentication method by @AlexCuse in https://github.com/keratin/authn-server/pull/230
• Bump golang.org/x/crypto from 0.1.0 to 0.17.0 by @dependabot in https://github.com/keratin/authn-server/pull/233
• prepare 1.18.0 by @AlexCuse in https://github.com/keratin/authn-server/pull/232

Full Changelog: https://github.com/keratin/authn-server/compare/v1.17.1...v1.18.0

What's Changed

• session: add option to use explicit expiry for refresh token cookies by @AlexCuse in https://github.com/keratin/authn-server/pull/208

Full Changelog: https://github.com/keratin/authn-server/compare/v1.16.0...v1.17.0

Added

• Usernames may not be passwords [#200]
• ID token contains Session ID claim (sid) [#205]

Added

• Added /jwks to both public and private routes [#198]

Added

• Added last_login_at and password_changed_at to Get Account API

Added

• Support for non-default Redis user [#191]
• Support for TLS connections to Redis with rediss [#190]

Added

• Update to go 1.17
• Flexible app domains with wildcard matching [#189]

Added

• Support for Redis Sentinel [#181]

Fixed

• Improved validation for AUTHN_URL and other ENV url values [#178]

Fixed

• Broken pipe error on Postgres [#174]

Fixed

• Usernames are now case insensitive on Postgres and SQLite. This requires a migration that can fail if the existing database has unintended duplicates! [#170]

Fixed

• CORS configuration allows content-type header

Fixed

• added a timeout to webhook sender

Added

• OAuth through Microsoft [#155]

Added

• endpoint for checking zxcvbn password score [#149]
• option to expire an account's sessions after a password change [#154]

Fixed

• improvements to constant time comparison in basic auth (thanks @lsmith130)