Ory Network, Ory Kratos, Ory Polis v26.4.11 released

Ory Network

Accept a SAML assertion only from the IdP of its connection

Ory Polis now requires the Issuer of a signed SAML assertion to be the entity ID of the connection's IdP, and rejects the response otherwise. An IdP whose assertions name an Issuer other than the entity ID in its metadata is rejected with an error that names both values in the SSO trace; update the connection's metadata to match.

Event streams can include the request security context

An event stream can now include the security context of the request behind each event: the client IP address, user agent, HTTP method, host, and path. Use it to feed a security information and event management (SIEM) system.

The option is off by default, so existing streams are unchanged. Turn it on with Include security context in the Ory Console, or set include_security_context to true when you create or update a stream. An update that omits the field keeps the current setting.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Kratos

Check each login submission with a web hook

The new selfservice.flows.login.submit.hooks trigger calls a web hook on every login submission, before Ory Kratos Identities looks up the identifier, checks a credential, sends a code, or redirects to an identity provider. Use it to ask a fraud detection service about each attempt, including the identifier step of identifier-first login. The web hook gets ctx.submission with the authentication method, the step, and, where the method has one, the submitted identifier or the chosen provider, together with the request's transient_payload. With can_interrupt: true, it can block the submission by answering with status 400 or 403 and validation messages.

This is now available on Ory Network and for the Ory Enterprise License.

Ory Polis

Accept a SAML assertion only from the IdP of its connection

Ory Polis now requires the Issuer of a signed SAML assertion to be the entity ID of the connection's IdP, and rejects the response otherwise. An IdP whose assertions name an Issuer other than the entity ID in its metadata is rejected with an error that names both values in the SSO trace; update the connection's metadata to match.

Browser clients can send JSON or an Authorization header to the token endpoint

The token endpoint (/api/oauth/token) now answers a CORS preflight request for POST, and the OpenID discovery document (/.well-known/openid-configuration) answers one for GET. Before, the preflight for the token endpoint only advertised GET and HEAD, so a browser application that sent the code exchange as JSON, or with client credentials in an Authorization header, was blocked by the browser before the request was sent. Form-encoded requests were never affected and keep working unchanged.

Both endpoints already allowed any origin to read their responses; nothing changes for server-side clients or in how requests are authenticated.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Hydra, Ory Keto, Ory Oathkeeper, Ory Elements, and Ory Terraform

No significant changes in this release.