github.com/ory/kratos

Ory Kratos v1.1 is the most complete, most scalable, and most secure open-source identity server on the planet, and we are thrilled to announce its release! This release comes with over 270 commits and an incredible amount of new features and capabilities!

Don't forget to leave a GitHub star and check out our other open source projects while you're here :)

• Phone Verification & 2FA with SMS: Enhance convenient security with phone verification and two-factor authentication (2FA) via SMS, integrating easily with SMS gateways like Twilio. This feature not only adds a convenient layer of security but also offers a straightforward method for user verification, increasing your trust in user accounts.
• Translations & Internationalization: Ory Kratos now supports multiple languages, making it accessible to a global audience. This improvement enhances the user experience by providing a localized interface, ensuring users interact with the system in their preferred language.
• Native Support for Sign in with Google and Apple on Android/iOS: Get more sign-ups with native support for "Sign in with Google" and "Sign in with Apple" on mobile platforms. Great user experience matters!
• Account Linking: Simplify user management with new features that facilitate account linking. If a user registers with a password and later signs in with a social account sharing the same email, new screens make account linking straightforward, enhancing user convenience and reducing support inquiries.
• Passwordless "Magic Code": Introduce a passwordless login method with "Magic Code," which sends a one-time code to the user's email for sign-up and login. This method can also serve as a fallback when users forget their password or their social login is unavailable, streamlining the login process and improving user accessibility.
• Session to JWT Conversion: Convert an Ory Session Cookie or Ory Session Token into a JSON Web Token (JWT), providing more flexibility in handling sessions and integrating with other systems. This feature allows for seamless authentication and authorization processes across different platforms and services.

Note: To ensure a seamless upgrade experience with minimal impact, some of these features are gated behind the feature_flags config parameter, allowing controlled deployment and testing.

• Better reliability when sending out emails across different providers.
• Streamlining the HTTP API and improving related SDK methods.
• Better performance when calling the whoami API endpoint, updating identities, and listing identities.
• The performance of listing identities has significantly improved with the introduction of keyset pagination. Page pagination is still available but will be fully deprecated soon.
• Ability to list multiple identities in a batch call.
• Passkeys and WebAuthn now support multiple origins, useful when working with subdomains.
• The logout flow now redirects the user back to the return_to parameter set in the API call.
• When updating their settings, the user was sometimes incorrectly asked to confirm the changes by providing their password. This issue has now been fixed.
• When signing up with an account that already exists, the user will be shown a hint helping them sign in to their existing account.
• CORS configuration can now be hot-reloaded.
• The integration with Ory OAuth2 / Ory Hydra has improved for logout, login session management, verification, and recovery flows.
• A new passwordless method has been added: "Magic code". It sends a one-time code to the user's email during sign-up and log-in. This method can additionally be used as a fallback login method when the user forgets their password.
• Integration with social sign-in has improved, and it is now possible to use the email verified status from the social sign-in provider.
• Ory Elements and the default Ory Account Experience are now internationalized with translations.
• It is now possible to convert an Ory Session Cookie or Ory Session Token into a JSON Web Token.
• Recovery on native apps has improved significantly and no longer requires the user to switch to a browser for the recovery step.
• Administrators can now find users by their identifiers with fuzzy search - this feature is still in preview.
• Importing HMAC-hashed passwords is now possible.
• Webhooks can now update identity admin metadata.
• New screens have been added to make account linking possible when a user has registered with a password and later tries signing in with a social account sharing the same email.
• Ability to revoke all sessions of a user when they change their password.
• Webhooks are now available for all login, registration, and login methods, including Passkeys, TOTP, and others.
• The login screen now longer shows “ID” for the primary identifier, but instead extracts the correct label - for example, “Email” or “Username” from the Identity Schema.
• Login hints help users with guidance when they are unable to sign in (wrong social sign-in provider) but have an active account.
• Phone numbers can now be verified via an SMS gateway like Twilio.
• SMS OTP is now a two-factor option.

The following features have been shipped exclusively to Ory Network for this version:

• B2B SSO allows your customers to connect their LDAP / Okta / AD / … to your login. Ory selects the correct login provider based on the user’s email domain.
• Significantly better API performance for expensive API operations by specifying the desired consistency (strong, eventual).
• Finding users effortlessly with our new fuzzy search for credential identifiers available for the Identity List API.

Ory Kratos 1.1 is a major release that marks a significant milestone in our journey.

We sincerely hope that you find these new features and improvements in Ory Kratos 1.1 valuable for your projects. To experience the power of the latest release, we encourage you to get the latest version of Ory Kratos here or leverage Ory Kratos in Ory Network — the easiest, simplest, and most cost-effective way to run Ory.

For organizations seeking to upgrade their self-hosted solution, Ory offers enterprise support services to ensure a smooth transition. Our team is ready to assist you throughout the migration process, ensuring uninterrupted access to the latest features and improvements. Additionally, we provide various support plans specifically tailored for self-hosting organizations. These plans offer comprehensive assistance and guidance to optimize your Ory deployments and meet your unique requirements.
We extend our heartfelt gratitude to the vibrant and supportive Ory Community. Without your constant support, feedback, and contributions, reaching this significant milestone would not have been possible. As we continue on this journey, your feedback and suggestions are invaluable to us. Together, we are shaping the future of identity management and authentication in the digital landscape.

Contributors to this release in no particular order: moose115, K3das, sidartha, efesler, BrandonNoad ,Saancreed, jpogorzelski, dreksx, martinloesethjensen, cpoyatos1, misamu, tristankenney, nxy7, anhnmt

Are you passionate about security and want to make a meaningful impact in one of the biggest open-source communities? Join the Ory community and become a part of the new ID stack. Together, we are building the next generation of IAM solutions that empower organizations and individuals to secure their identities effectively.
Want to check out Ory Kratos yourself? Use these commands to get your Ory Kratos project running on the Ory Network:

brew install ory/tap/cli

scoop bucket add ory <https://github.com/ory/scoop.git>
scoop install ory

bash <(curl <https://raw.githubusercontent.com/ory/meta/master/install.sh>) -b . ory
sudo mv ./ory /usr/local/bin/

ory auth login

ory create project --name "My first Kratos project"

ory open account-experience registration

ory patch identity-config \
  --replace '/identity/default_schema_id="preset://username"' \
  --replace '/identity/schemas=[{"id":"preset://username","url":"preset://username"}]' \
  --format yaml

ory open account-experience registration

Breaking Changes

Pagination parameters for the list identities CLI command have changed from arguments to flags --page-token and page-size:

- kratos list identities 1 100
+ kratos list identities --page-size 100 --page-token ...

Furthermore, the JSON / JSON pretty output of list identities has changed:

-[
-  { "id": "..." },
-  { /* ... */ },
-  // ...
-]
+{
+  "identities": [
+    {"id": "..."},
+    { /* ... */ },
+    // ...
+  ],
+  "next_page_token": "..."
+}

Closes ory/sdk#284
Closes #3480

Bug Fixes

• oidc does not require a method in the payload (#3564) (b299abc):

  • fix: oidc does not require a method in the payload

  • refactor: only update strategies order in test

  • chore: update audit messages and comments

• Accept all 200 responses as OK in courier (#3401) (88237e2), closes #3399:

  • fix: accept all 200 responses as OK in courier

• Accept login_challenge after verification (#3427) (6b02350):

  Part of ory/network#320

• Add caching to Jsonnet snippet during session JWT tokenization (#3699) (1da8180)

• Add consistency flag (#3733) (fd79950)

• Add max-age to default cors headers (#3584) (c5b4aaa)

• Add missing tracing & attributes in oidc strategy (#3429) (09bcb71)

• Add return_to parameter to API spec of createRecoveryLinkForIdentity (#3711) (757a5e4)

• Add value code to authentication method enum (#3546) (95dc7a2):

  • fix: add value code to authentication method enum

  • chore: generate sdk

• Additional_id_token_audiences key in config schema (#3622) (9396bb0)

• Adjust tracing verbosity (976cd0d)

• Allow post recovery hooks to interrupt the flow (#3393) (6c1d2f1)

• Allow updating admin metadata from webhook responses (#3569) (22f61f0)

• Always return relative URLs in the Link header for pagination (fb229c9)

• Auto migrate old accounts to use code credential (#3581) (569b14a)

• Carry oauth2_login_challenge over to registration flow (#3419) (76241be):

  Fixes #3321

• Change ListIdentities to keyset pagination (e16fed1)

• Change shebangs and makefile from /bin/bash to /usr/bin/env bash (#3597) (1343bbb):

  • makefile fix

  • shebangs changed to /usr/bin/env bash

  Signed-off-by: nxy7 lolnoxy@gmail.com

• Check whoami aal before accepting hydra login request (#3669) (a2f79c3)

• Code method on registration and 2fa (#3481) (7aa2e29)

• Consider OIDC registration flows errored with duplicate credential to be completed by strategy (#3525) (3e3c789):

  Returning anything else here may cause Kratos to respond with two concatenated JSON objects: new login flow with actual error message as the first one and a very confusing '500, aborted registration hook execution' as the second one.

• Csrf token regenerate on browser flows (#3706) (e4908db), closes #3705

• Data race in test (ab6dc31)

• Do not encode full config in multiple places (#3500) (57a3273)

• Do not generate CSRF token for api flows (#3704) (d93570d)

• Do not initialize parts of the registry in parallel (#3534) (ff177db)

• Don't list org SSOs in settings (#3637) (6c7068c)

• Don't require code credential for MFA flows (#3753) (40ed809)

• Don't require session for OIDC verification (#3443) (e08f831)

• Don't return 500 on conflict for POST /admin/identities (#3437) (1429949)

• Don't return nil if code is invalid (#3662) (df8ec2b):

  • fix: don't return nil if code is invalid

  • chore: add test

• Error handling on identity import (#3520) (83bfb2d):

  When importing identities without any traits, or with malformed traits, 500s are returned. This improves the error handling and messaging.

• False-positives for requiring re-authentication on update (#3421) (ce8139f)

• Http courier using should use lower case json (#3740) (84149c4)

• Identity list pagination in CLI command and SDK (#3482) (1e8b1ae):

  Adds correct pagination parameters to the SDK methods for listing identities and sessions.

• Ignore CSRF middleware on Apple OIDC callback (309c506)

• Ignore more cloudflare cookies (#3499) (f124ab5)

• Improved SSRF protection (#3629) (6d08576):

  This also improves tracing in the OIDC strategy.

• Incorrect login accept challenge (#3658) (b5dede3)

• Incorrect sdk generator path (#3488) (ed996c0)

• Incorrect SMTP error handling (#3636) (ee138ec)

• Incorrect swagger spec for filter parameter (#3684) (2c1470a), closes #3676 #3675

• Increase connection-level timeouts and shutdown timeouts (#3570) (200b413):

  The admin API is generally expected to require longer timeouts, for example during bulk identity import.

• Issue session after verification after registration with OIDC SSO (#3467) (a28b523)

• Lint (e8740c3)

• Lower-case recovery & verification emails on import (#3571) (e2ac9ff):

  Emails that contained upper-case characters would be overwritten by the identity schema extension runner, because there all emails are lower-cased.

• Mark identity as optional in session struct (#3463) (7ae02ba), closes #3461:

  The identity is not always available in the session struct, for example when AAL2 is required.

• Omit irrelevant OIDC providers in forced refresh login flows (#3608) (912dccd):

  Whenever an user is asked to reauthenticate (e.g. because they wish to execute settings flow touching their credentials and their session is no longer privileged) they are asked to provide their credentials again. The forced-refresh login flow generated for such cases already excludes some strategies that are enabled in Kratos but cannot be used to authenticate as current identity, and for example the form presented to the user will not have a password field if the identity does not have a password credential.

  This, however, does not currently apply to OIDC providers; the user will always see the full set even if some of them can't be used to sign in as current identity. This change causes forced refresh login flows to also omit irrelevant OIDC providers in generated form in order to avoid confunding the user about which strategies/providers are valid and can actually be used to reauthenticate.

• On verification required after registration, preserve return_to (#3589) (6a0a914):

  • fix: on verification required after registration, preserve return_to

  • test: return_to on verification flow

  • chore: refactor

• Panic in recovery (#3639) (c25ddff)

• Pass context (#3452) (c492bdc)

• Properly normalize OIDC verified emails (#3450) (703b910)

• Redirect to verification URL even if login_challenge is set (#3412) (cd9e6a0):

  Fixes ory/network#320

• Reduce db lookups in whoami for aal check (#3372) (d814a48):

  Significantly improves performance by reducing the amount of queries we need to do when checking for the different AAL levels.

• Registration code ui nodes group (#3505) (6220184):

  • fix: registration code ui nodes group

  • style: format

• Registration should accept hydra login (#3592) (7a47827):

  • fix: registration should accept hydra login

  • fix: oauth2 registration flow with session

  • wip: registration oauth flow tests

  • wip: refactor oauth flows test

  • wip: refactor op_registration_test

  • wip: oauth provider registration test

  • wip: refactor oauth flows test

  • fix(test): oauth provider login

  • style: format

• Registration with verification (#3451) (77c3196)

• Reject obviously invalid email addresses from courier (8cb9e4c)

• Remove earliest_possible_extend default in schema (#3464) (7e05b7d)

• Remove duplicate message ID usage (#3468) (dfcbe22)

• Remove requirement for smtp section (#3405) (59a3f14)

• Remove slow queries from update identities (#3553) (d138abb)

• Rename "phone" courier channel to "sms" (#3680) (eb8d1b9)

• Respect gomail.SendError in mail queue (#3600) (9c608b9)

• Respond with 422 when SPA identity requires AAL2 (#3572) (df18c09):

  If you submit a browser login flow with an Accept header of application/json, but the login flow requires AAL2, then there is no way for the code to know it needs to redirect the user to the 2FA page. Instead of responding with the Session in this scenario, this PR changes the behaviour to respond with a browser_location_change_required error (status 422) to indicate that the browser needs to open a specific URL, /self-service/login/browser?aal=aal2.

• Return 400 bad request for invalid login challenge (#3404) (ca34e9b)

• Return HTTP 400 if key unmarshal fails (#3594) (fdf4956):

  • fix: return HTTP 400 if key unmarshal fails

  • fix: apply reviewer's suggestion, prepare for bump

  • fix: follow up reviewer suggestion from ory/x

  • chore: bump ory/x

• Schema test errors (#3528) (bee0341)

• Set iss from userinfo claims if missing (#3744) (241a911)

• Specify correct minimum versions in migratest (18b89ea)

• Tracing context passing in /sessions/whoami (1254bf5)

• Tracing improvements (c804cb2)

• Type-assert all interfaces that WebHook implements (ffda1a0)

• Ui node input attributes key added (#3561) (9eff0f3):

  • fix: ui node InputAttributes.Key added

  • fix: selfservice recovery flow add React unique key and numeric pattern

  • fix: remove React related key addition

  • test: update snapshot

• Use ID label on login with multiple identifiers (#3657) (be907db)

• Use org ID from session if available in login flow (#3545) (1b3647c)

• Use provider label in link message (#3661) (fa5ec93)

• Use registry client for schema loading (#3471) (3a57726)

• Using first name as last name (#3556) (df80377)

• Wrong continue_with enum declaration (#3522) (4c34c24)

Code Generation

• Pin v1.1.0 release commit (f47675b)

Documentation

• Add example for allowed_return_urls to include wildcard url (#3533) (39b0c3c), closes #1528

• Improve enum handling and completeness (#3714) (4b881ca)

• Remove experimental warnings (#3406) (d4d26e6):

  See #3388

• Update link to hashed password formats (#3484) (8ca3adc)

Features

• Add ability to convert session to JWT when calling whoami (#3472) (57b7bb8), closes #2487:

  This patch adds a query parameter tokenize_as to /session/whoami which encodes the session to a JWT. It is possible to customize the JWT claims by using a JsonNet template, and furthermore change the expiry of the token.

  The tokenize feature supports multiple templates, which makes it easy to use the resulting JWT in a variety of use cases.

• Add event (#3524) (75031e6)

• Add GetID member functions to RecoveryAddress and Credentials (#3474) (085d500)

• Add ID Token sign in with Google Android/iOS SDK (#3515) (055ed92)

• Add OpenTelemetry span for password hash comparison (#3383) (e3fcf0c)

• Add request URL to email and SMS templates (bf5f8c3)

• Add sms verification for phone numbers (#3649) (e3a3c4f)

• Add support for recovery on native flows (#3273) (e363889)

• Add WebhookSucceeded event (aa8c936)

• Added various new text messages (ea91483):

  To improve i18n and message customization, we added a bunch of new messages. Integrations that do message customization should probably handle those new message codes:

  • 1010014
  • 1010015
  • 1040005
  • 1040006
  • 1070012
  • 1070013
  • 4000028
  • 4000029
  • 4000030
  • 4000031
  • 4000032
  • 4000033
  • 4000034
  • 4000035
  • 4000036
  • 4010007
  • 4010008
  • 4040002
  • 4040003

  Additionally, these messages got more context:

  • 1050014
  • 1050018
  • 1070002
  • 4000001
  • 4000003
  • 4000004
  • 4000017
  • 4000018
  • 4000019
  • 4000020
  • 4000021
  • 4000022
  • 4000023
  • 4000024
  • 4000025
  • 4000026
  • 4010001
  • 4040001
  • 4050001
  • 4060005
  • 4070005
  • 5000001

• Allow additional id token audiences (#3616) (0fa648d)

• Allow extra migrations in NewPersister (96c1ff7)

• Allow fuzzy-search on credential identifiers (#3526) (2cb3ea2):

  This PR adds the ability to search for sub-strings and similar strings in credential identifiers.

  Note that the postgres and CRDB migrations create special indexes useful for this feature. To use online schema changes with cockroach, we recommend to manually copy the index definition and run it before applying migrations. The migration will then be a no-op.

  If you run on mysql (or sqlite), no special index is created. If desired, you can create such an index manually, and it would be highly appreciated if you could contribute its definition.

  This feature is a preview and will change in behavior! Similarity search is not expected to return deterministic results but are useful for humans.

• Allow importing hmac hashed passwords (#3544) (0a0e1f7), closes #2422:

  The basic format is $hmac-<hashfunction>$<base64 encoded hash>$<base64 encoded key>:

  # password = test; key=key; hash function=sha
  $hmac-sha1$NjcxZjU0Y2UwYzU0MGY3OGZmZTFlMjZkY2Y5YzJhMDQ3YWVhNGZkYQ==$a2V5
  

• Allow marking OIDC provider-verified addresses as verified during registration (#3448) (e7b33a1), closes #3445 #3424 #1057:

  This feature allows marking emails provided by social sign in providers as verified.

• Batch list identities (#3598) (8ad54f1), closes #2448:

  This change allows to filter GET /admin/identities by ID with the following syntax:

  /admin/identities?ids=id1&ids=id2&ids=id3
  

• changelog: Add support for native recovery (#3624) (492808c):

  Adds the ability to complete the recovery flow properly on API flows. This PR also streamlines the behavior for SPA flows to not return 422 errors anymore. To enable this new behavior, set the features.use_continue_with_transitions flag in the config to true.

  See also #3273

• Claims from userinfo endpoint (#3718) (90bdc61):

  • feat: claims from userinfo endpoint

  • chore: update libraries

  • test: improve coverage

• Emit error details when we find stray cookies in an API flow (#3496) (df74339)

• Eventually consistency API controls (#3558) (00cf11c):

  Adds a feature used in Ory Network which enables trading faster reads for slightly stale data.

  This feature depends on Cockroach functionality and configuration, and is not possible for MySQL or PostgreSQL.

• Extend Microsoft Graph API capabilities (#3609) (4a7bcc9):

  This change queries for all user information available with the User.Read scope
  during OIDC, and populates the RawClaims field.

• Extract identifier label for login from default identity schema (#3645) (180828e)

• Fine-grained hooks for all available flow methods (#3519) (a37f6bd):

  Adds fine-grained hook configurations to the post-settings flow for methods totp, webauthn, lookup_secret and the post-login flow for totp, lookup_secret, and code.

• Hook to revoke sessions after password changed (#3514) (e6af6db), closes #3513:

  Currently, the Kratos system does not automatically log out or invalidate other active sessions when a user changes their password. This poses a significant security risk as it allows potentially unauthorized individuals to maintain access to the account even after the password has been updated.

  This PR provides the option to add the revoke_active_sessions hook to the actions sections of the selfservice settings.

• Hot-reload CORS origins (#3423) (157d934)

• Improve messages for easier i18n (#3457) (37f1657)

• Improve performance by computing password hashes while validating (#3508) (a9786c5)

• Improved webhook tracing (#3746) (9d7021d)

• Jsonnet caching for OIDC claims mapper, webhooks, JWT session tokenizer (#3701) (1d26e09)

• Link oidc credentials when login (#3563) (b784949), closes #2727 #3222:

  When user tries to login with OIDC for the first time but has already registered before with email/password a credentials identifier conflict may be detected by Kratos. In this case user needs to login with email/password first and then link OIDC credentials on a settings screen.
  This PR simplifies UX and allows user to link OIDC credentials to existing account right in the login flow, without
  switching to settings flow.

• List by OIDC cred (#3721) (bff9c61)

• Login with code on any credential type (#3549) (ceed7d5):

  Should be able to login with the code credential even if the user did not register on the code credential.
  Only identifier matching is done and validation based on the identity schema.

• One-time code native flows (#3516) (9b0fee3)

• Order sessions by created_at (#3696) (688111c)

• Parametrize courier worker (#3601) (0e4be57):

  Allows one to parametrize how many messages the courier will fetch and how often it will fetch messages.

• Passwordless browser login and registration via code to email (#3378) (eaaf375), closes #2029 ory-corp/cloud#3573:

  This feature adds passwordless email code login. When a user signs up, or signs in, a code is sent to their email address which they can use to complete the authentication process.

  This feature is currently only working for browser facing APIs.

• Pooled process-isolated Jsonnet VM (9a52ddf)

• Provide login hints when registration fails due to duplicate credentials/addresses (#3430) (8b28469):

  • feat: provide login hints when registration fails due to duplicate credentials or identifiers

  • feat: identify edge cases and write tests

  • chore: synchronize workspaces

  • feat: make login hints configurable

  • chore: synchronize workspaces

  • chore: synchronize workspaces

  • chore: synchronize workspaces

  • chore: synchronize workspaces

• Support auth_type parameter (#3487) (fc30304):

  The Facebook OIDC provider supports an auth_type parameter that
  when set to "reauthenticate" will force the user to
  reauthenticate (similar to prompt=login for other Providers).

• Support for B2B SSO (#3489) (0ec037a)

• Support MFA via SMS (#3682) (1516cf6)

• Support multiple origins for WebAuthN (#3380) (013f335):

  Users can now supply a list of origins for webauthn in the configuration.

• Support native social sign using apple sdk (#3476) (f561013)

• Transmit current session ID to Hydra when accepting the login (#3426) (610c76d):

  • chore: change react-native port to 19006

  • feat: transmit current session ID when accepting login

  • fix: upgrade hydra in tests

• Webhook analytic events (9c8a25e)

Reverts

• Revert "chore: simplify courier code (#3603)" (7c54c9f), closes #3603:

  This reverts commit 316cd4a.

Tests

• Add test for link + oidc challenge (#3720) (67360cf)
• e2e: Logout return_to (#3418) (c348c12)
• Fix cypress setup (#3527) (70c8ddd)
• Fix e2e failures and speed up e2e tests (#3483) (70a6171)
• Fix hydra tests on master (#3737) (12166b4)
• Reduce logging in go tests (#3562) (05de3a2)
• Resolve cypress issues (#3531) (4206d26)

Unclassified

• Revert "feat: extend Microsoft Graph API capabilities (#3609)" (#3717) (549308d), closes #3609 #3717:

  This reverts commit 4a7bcc9.

Changelog

• 7c54c9f Revert "chore: simplify courier code (#3603)"
• 549308d Revert "feat: extend Microsoft Graph API capabilities (#3609)" (#3717)
• 8cc83bc Revert "fix: re-add exported symbols (#3611)"
• e0327b0 autogen(docs): generate and bump docs
• 7c0e02e autogen(docs): regenerate and update changelog
• 32299d5 autogen(docs): regenerate and update changelog
• 046aa9b autogen(docs): regenerate and update changelog
• 8a0e496 autogen(docs): regenerate and update changelog
• dbb3a7e autogen(docs): regenerate and update changelog
• 043114b autogen(docs): regenerate and update changelog
• 0d37eb3 autogen(docs): regenerate and update changelog
• af55834 autogen(docs): regenerate and update changelog
• e9ed14f autogen(docs): regenerate and update changelog
• 34751a1 autogen(docs): regenerate and update changelog
• 3d6927c autogen(docs): regenerate and update changelog
• 6b91dc1 autogen(docs): regenerate and update changelog
• 5fc88ba autogen(docs): regenerate and update changelog

Note truncated.