Ory Network, Ory Hydra, Ory Kratos, Ory Keto v26.4.5 released

Ory Hydra

Events show who made an admin API request

Events that Ory Identities, Ory OAuth2, and Ory Permissions emit while handling an authenticated admin API request now say who made the request. Three new event attributes carry this:

• InitiatorType: api_key, console_user, or scim_client.

• InitiatorID: the ID of the API key, the Ory Console user, or the SCIM client.

• InitiatorName: the name of the API key. Only present for api_key.

The attributes appear in event streams, and you can filter events by them in the Ory Console. They are absent on events from self-service flows and from work that Ory starts itself, so treat them as optional.

This is now available on Ory Network.

Ory Kratos

De-activating an identity through SCIM revokes its sessions

When SCIM sets an identity's state to inactive, Ory now revokes all of the identity's sessions. This applies to user updates and to group changes that de-activate a member. Before, a group change could de-activate an identity while its sessions stayed active. An identity that is activated again must sign in again.

Events show who made an admin API request

Events that Ory Identities, Ory OAuth2, and Ory Permissions emit while handling an authenticated admin API request now say who made the request. Three new event attributes carry this:

• InitiatorType: api_key, console_user, or scim_client.

• InitiatorID: the ID of the API key, the Ory Console user, or the SCIM client.

• InitiatorName: the name of the API key. Only present for api_key.

The attributes appear in event streams, and you can filter events by them in the Ory Console. They are absent on events from self-service flows and from work that Ory starts itself, so treat them as optional.

This is now available on Ory Network and for the Ory Enterprise License.

Ory Keto

OPL namespace, relation, and permit names are limited to 1,024 bytes

Namespace, relation, and permit names in Ory Permission Language schemas must be at most 1,024 bytes long in UTF-8. Longer names now return a parse error at the declaration or reference.

Breaking changes

Schemas with longer names are no longer accepted. Shorten those names and update schema and relationship tuple references before loading the schema.

Events show who made an admin API request

Events that Ory Identities, Ory OAuth2, and Ory Permissions emit while handling an authenticated admin API request now say who made the request. Three new event attributes carry this:

• InitiatorType: api_key, console_user, or scim_client.

• InitiatorID: the ID of the API key, the Ory Console user, or the SCIM client.

• InitiatorName: the name of the API key. Only present for api_key.

The attributes appear in event streams, and you can filter events by them in the Ory Console. They are absent on events from self-service flows and from work that Ory starts itself, so treat them as optional.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Oathkeeper, Ory Polis, Ory Elements, and Ory Terraform

No significant changes in this release.