ZITADEL v4.17.0
This release adds support for Zitadel as an identity provider with full CRUD operations, dynamic OIDC client registration and management per RFC 7591/7592, native passkey app links, and numerous bug fixes including improvements to login flows, metadata handling, and database operations.
Bug Fixes
- actions: allow adding raw metadata values via appendMetadataRaw (#12567) (c1b9885), closes #10666 #5526 #10470 #5526
- allow invite codes for users whose auth methods were all removed (#12453) (eb7af25)
- api: accept SetSecuritySettings on /v2/settings/security (#12518) (6e07fb7), closes #12313
- console: change username abort dialog and set email as verified #10803 #12146 (#12155) (8e2dc18)
- database: skip CREATE USER when role exists to avoid password in Postgres logs (#12538) (207f14a), closes #12178
- login: honour login_hint and skip the auto-submit loop in OIDC flow (#12431) (3bb23d2), closes #12346
- login: provide hidden username on password set/change forms (#12490) (e82b845)
- login: resolve unknownContext error on password page caused by inconsistent ignoreUnknownUsernames handling (#12512) (65e50fc)
- login: treat user-verified passkey as fulfilling MFA in session validity check (#12575) (4f3a1dd)
Features
- add api definition to update Zitadel IdP (#12371) (8106304)
- API definition to add new Zitadel providers (#12018) (9996463)
- command layer implementation for AddZitadelProvider (#12020) (a45ac66)
- eventstore: autovacuum tuning for events2 table (#12449) (0011448), closes #12448 #10754 #10260 #8585 #9239
- extend DeleteProvider to include Zitadel IdP (#12396) (29ec5b0)
- extend start/retrieve idp intent for Zitadel provider (#12424) (df97d7d)
- get/list Zitadel IdP (#12394) (825dbf5)
- handle Zitadel provider IdP login via login v1 (#12469) (9173927)
- implement AddZitadelProvider in ManagementService (#12056) (29196dc)
- implement instance-level UpdateZitadelProvider (#12378) (deaa1a3)
- implement UpdateZitadelProvider in ManagementService (#12384) (de87ee0)
- login: hu translations + I18n consistency v2 (#12447) (f60a4d2)
- login: idp userAction oneof (#12433) (b33f2d5), closes #11369
- login: Sign in with Zitadel (#12530) (e1a924b), closes #11824 #5127
- login: synchronize instance roles for Zitadel identity provider (#12568) (929cfc1), closes #5127
- native app links for passkeys (#12580) (da16af1), closes #12497 #12531 #12532 #12536 #12537 #12547
- oidc: add RFC 7591 dynamic client registration (#12313) (6a02b7e), closes #9810 #12315 #12316 /github.com/zitadel/zitadel/issues/9810#issuecomment-4891176997
- oidc: add RFC 7592 dynamic client management (#12315) (443783a), closes #12313 #12313 #9810 #12313 #12313
- oidc: provide actor information in userinfo actions (#12566) (c2a55d2)
- projection layer implementation to add Zitadel provider (#12055) (7a2f331)
- update GetActiveIdentityProviders to return Zitadel in the IdP list (#12422) (8898e08)
Source: original entry ↗
More from ZITADEL
Follow ZITADEL to get its new changes in your feed and email digest.
v4.19.4 Bug Fixes
This release includes bug fixes for the async execution worker context not having the instance ID set, corrects the ID order in the invite code notification handler, and improves handling of finalized unique-constraint backfill and exclusive owner deletes.
Performance improvements for user queries
Improved performance of user listing queries by indexing users by instance and organization, and stopped expanding login names for every ListUsers row to reduce database load.
v4.19.2 – Security fixes for SAML, session cookies, and impersonation
This release fixes three security vulnerabilities including SAML identity-provider confusion leading to account takeover, unsigned Login V2 session cookie vulnerability, and unauthorized administrator impersonation. All 4.x deployments should upgrade and configure the new ZITADEL_SESSION_COOKIE_SECRET for Login V2.