Ory Network, Ory Kratos v26.2.15 released

Ory Network

You can now set a session lifespan per organization that overrides the project-level session.lifespan. The override applies to any session issued for the organization, on both initial sign-in and refresh.

Configure it through the organizations API by setting session_lifespan on the organization to a Go duration string such as "1h" or "24h". Send "" to clear the override and inherit the project default; omit the field to leave the existing value unchanged on PUT.

The minimum is 1 minute and the maximum is 1 year. Validation rejects invalid durations and values outside that range.

This is now available on Ory Network.

Ory Kratos

Block invisible-character duplicate accounts

Hidden characters in an email or username — zero-width spaces, joiners, soft hyphens, the byte-order mark, and similar invisibles — are now removed before the identifier is stored. This stops someone from registering a second account that looks identical to an existing one but is treated as different. Identifiers are also case- and width-normalized, so ＡＬＩＣＥ@example.com and [email protected] are the same account.

International identifiers keep working: Hebrew, Arabic, and emoji are all accepted. Characters that merely look alike across scripts — such as the Cyrillic “а” and the Latin “a” — are kept distinct and do not collide.

Fix SCIM Group attribute filtering returning HTTP 500

GET /scim/{client}/v2/Groups/{id}?attributes=... and GET /scim/{client}/v2/Groups?attributes=... now return the requested attributes correctly. Previously, any attributes= value on a Group endpoint caused a server-side panic that surfaced as HTTP 500 with an internal stack trace in the response body.

The excludedAttributes= form on Group endpoints, and all attribute filtering on User endpoints, were unaffected and continue to work as before.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Hydra, Ory Keto, Ory Oathkeeper, Ory Polis, Ory Elements, and Ory Terraform

No significant changes in this release.