Ory Hydra, Ory Polis v26.4.8 released

Ory Hydra

Reject JWT bearer assertions issued in the future

The JWT bearer grant (urn:ietf:params:oauth:grant-type:jwt-bearer) now rejects an assertion with an invalid_grant error if its iat (issued at) claim is more than five minutes in the future.

If a client's clock runs ahead, synchronize it, or set iat to the current time when signing the assertion.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Polis

Polis FIPS image no longer trusts the roots of the compromised eMudhra CAs

Eight eMudhra intermediate certificate authority keys are compromised. The Polis FIPS image now distrusts the two root certificates those intermediates chain to, AAA Certificate Services and emSign ECC Root CA - G3, so Polis rejects certificates issued through them on every outgoing TLS connection.

If an identity provider, metadata URL, webhook endpoint, or database that Polis connects to presents a certificate that only chains to one of these roots, the connection now fails. Ask its operator to replace the certificate. Upgrade to this image and roll out new pods to apply the change.

The FIPS image now trusts the Red Hat system trust store instead of the root list built into Node.js. To trust a private certificate authority, add it with update-ca-trust in an image built on this one, or keep using NODE_EXTRA_CA_CERTS. If you set NODE_OPTIONS yourself, include --use-openssl-ca, or Polis falls back to the built-in list.

This is now available for the Ory Enterprise License.

Ory Network, Ory Kratos, Ory Keto, Ory Oathkeeper, Ory Elements, and Ory Terraform

No significant changes in this release.