Releases

0.4.4 · 28.08.2026

Behoben

• Production logs no longer print the source file and line of each entry

0.4.3 · 28.08.2026

Behoben

• Report the stamped control-plane endpoints in --version, so an image can be checked without running it
• Stamp the production control-plane endpoints into the published on-prem image; a build without them shipped with no control plane
• Name the licence fetch, telemetry and local reload cadences on the startup splash

0.4.2 · 28.08.2026

Neu

• Disclose the resolved control-plane endpoints, the applied enforcement mode, and the install/licence identifiers on the startup splash
• Log every license fetch and telemetry send at INFO, including the endpoint contacted
• Replace the dashboard's placeholder System Health tiles with a live master-realm-only view of database reachability, schema state, build identity and uptime, and licence validity.
• Show an update notice on the master-realm dashboard when a newer release has been published. A connected install learns of it on its regular licence check, without a second outbound connection. It is advisory only: an install a version behind is not degraded for it, and an air-gapped install is never told and correctly shows nothing.

Behoben

• The admin UI now verifies the realm in the URL before mounting the console. A realm the server does not host used to leave the OIDC provider and the login redirect hammering the discovery endpoint; the console now asks which realm to administer, with the wrong name prefilled. A login that cannot start is attempted once per mount instead of retried in a loop.
• Bring the published privacy policy, terms and data processing agreement in line with what the service actually does, including a full description of the telemetry an install reports
• Terms: the data processing agreement and its annexes are now an integral part, defect claims expire after one year, the backup clause states what the backups are for, and an amendment notice must say that silence counts as consent
• Let a browser read the realm-not-found error. The 404 for a realm the server does not host carried no Access-Control-Allow-Origin, because the CORS middleware reflects an origin registered in the request's realm and runs after the realm is resolved. A page that asked cross-origin saw a network error instead of the 404, so the admin console could not tell a mistyped realm from an unreachable server and sat on a spinner that never resolved.

0.4.0 · 25.08.2026

Inkompatible Änderungen

• A connected install takes its licence-fetch and telemetry endpoints from the signed licence itself, falling back to the endpoints stamped into the build; they are no longer configured on the install. Route the outbound connection with HTTPS_PROXY. An air-gapped install is exempted from reporting by its licence, and both intervals are capped at 48h.
• Rename the product to KlardoIdent and move every public hostname to klardo-ident.com. The shipped binaries become kident and kidentctl, the public images become ident and ident-admin-ui, and a migration rewrites the old domain in stored client redirect URIs, web origins, realm settings and branding overrides.
• LICENSE_FILE now defaults to /etc/kident/license.lic. An install relying on the old default must set LICENSE_FILE=/etc/identcontrol/license.lic or move the file; there is no automatic fallback.

Sicherheit

• Authorize the admin API at its boundary: an access token now reaches it only when it was issued to the realm's admin client and its subject holds the realm-admin role.
• Store the dynamic-client-registration initial access token as a one-way hash, mint it at realm creation and return the plaintext only in that response; registration no longer accepts an empty bearer token.
• Reject POST /admin/api/v1/realms outside the master realm: CreateRealm now guards its current realm like its sibling realm-management endpoints, closing a tenant-isolation gap.
• Add an optional network allowlist in front of the admin API (ADMIN_IP_ALLOWLIST), applied before authentication. A forwarded client address is honored only when the peer that sent it is a configured TRUSTED_PROXIES load balancer, so the header cannot be used to walk in.
• Harden the kidentctl login callback page against script injection through the parameters a failed browser login returns to its loopback listener.
• Revoke the tokens issued from an authorization code as soon as that code is replayed

Neu

• Publish the admin UI as its own container image alongside the server, both available on Docker Hub.
• Add a route and kidentctl command to rotate a realm's DCR initial access token, invalidating the previous one.
• Add license administration to the master realm's admin API (PUT/GET/DELETE /admin/api/v1/license): an administrator can enter a signed snapshot without shell access to the server. It is verified against the embedded key and the installation's deployment binding before being stored, refused with 409 while LICENSE_FILE or LICENSE_KEY is set, and read at boot behind both.
• Apply a stored on-prem license immediately: the deployment re-resolves its entitlements when a snapshot is stored or cleared through the master realm, and the periodic reloader re-reads the stored source.
• Add kidentctl license set/get/clear, so an air-gapped deployment can be licensed from a signed snapshot file without shell access to the server.
• Link the master realm's license view to the customer portal when a control plane is resolved for the install; the link carries the deployment and subscription identity and never a credential.
• Add a License page to the master realm's admin UI: enter or replace the signed snapshot, see what is stored, and reach the customer portal when the install is connected.
• Run schema migrations as their own step: kident migrate applies them (--check reports what is pending), and a cloud plane refuses to serve behind a schema the migration job has not caught up with. A single-binary on-prem install keeps migrating at boot; RUN_MIGRATIONS overrides either default.
• Separate liveness from readiness: /health on the serving port stays a dependency-free liveness check, while /health/live and /health/ready are served on an internal listener (INTERNAL_ADDR, default :9090) where readiness reports whether this instance can reach the database primary.
• Rate limit protocol traffic, the admin API and dynamic client registration in three independent per-IP buckets, so no traffic class can spend another's budget; the health and readiness probes are exempt from all three.
• Set HTTP connection timeouts per plane — tight where a request is a signature, generous where it generates key material — overridable with SERVER_READ_HEADER_TIMEOUT, SERVER_READ_TIMEOUT, SERVER_WRITE_TIMEOUT and SERVER_IDLE_TIMEOUT.
• Give the standalone admin UI a second base URL: an optional adminBaseUrl in window.__ADMIN_CONFIG__ (ADMIN_BASE_URL in the nginx image) for deployments where the admin API is its own host. It defaults to serverBaseUrl, so a single-binary on-prem install is unchanged.
• Report the running build over the admin API: GET /admin/api/v1/server-info answers with the version, stream, and release date, and kidentctl server-info get mirrors it. It needs no token, so a console can tell which version it is talking to before logging in.
• Restyle the login, registration and consent pages onto the built-in design system. The pages now load their stylesheets and icons from the server itself instead of two public CDNs, so they render correctly in an air-gapped install and no third party is contacted while a user authenticates. Per-realm branding is unchanged: upload a brand.css to re-skin every page.
• Restyle the remaining first-party pages — forgot password, reset password, email verification, email change confirmation and the error page — onto the same design system as the login page. They were left carrying class names from the removed CDN stylesheets and rendered unstyled; they now use the built-in theme and the embedded icon sprite, so a per-realm brand.css re-skins them with every other page.
• Restyle the account page onto the shared design system: sections, detail rows, sprite icons and a destructive-action button, with no Tailwind or Font Awesome left in any template

Behoben

• Remove the realm HTML admin endpoint (GET /admin/api/v1/realms/html), which rendered a template that no longer exists and answered 500 for every caller.
• Fix a data race on the global logger: Get installed a fallback logger when Init had not run, writing shared state from every caller instead of only reading it.
• Mint one audience convention in every access token. SessionService (login, registration, support login) stamped the client's database id as the aud claim while the /token exchange stamped its string client id; both now use the string client id, which is the value a client presents and the admin-API boundary compares against.
• Bring env.example in line with what the server actually reads: drop the settings it no longer has, document the ones that were missing, and hold both directions with a test.
• The admin UI can now declare that it has no default realm: DEFAULT_REALM set to the empty string makes a bare origin ask which realm to administer instead of opening one. The tenant-facing origin no longer points a visitor at the master realm, which advertised that it exists; unset still means master, so single-realm installs are unchanged.
• MongoDB replica-set check no longer requires clusterMonitor on admin, so least-privilege plane and migration users can start
• Let an administrator store a license through the admin console again. The built-in LICENSE_FILE default path counted as licensed by configuration, so every deployment that had not set LICENSE_FILE refused the snapshot with 409 license_configured; only an explicitly set LICENSE_FILE, or a snapshot actually present at the path, does now.

0.5.5 · 28.08.2026

Neu

• Replace the dashboard's placeholder System Health tiles with a live master-realm-only view of database reachability, schema state, build identity and uptime, and licence validity.
• Show an update notice on the master-realm dashboard when a newer release has been published. A connected install learns of it on its regular licence check, without a second outbound connection. It is advisory only: an install a version behind is not degraded for it, and an air-gapped install is never told and correctly shows nothing.

Behoben

• Show a way out when sign-in cannot start. A failed signinRedirect, which is what a realm that does not resolve produces, was swallowed and left the console on a spinner with no reason and no exit. It now renders a screen that says sign-in could not be started, names the realm, and offers a retry and a way back to the realm prompt.

0.5.4 · 26.08.2026

Behoben

• Keep the admin console out of search indexes. The image now serves a robots.txt that disallows the host, sends X-Robots-Tag: noindex on every response, and answers a real 404 outside the app's own URL space instead of returning index.html for any path. The blanket SPA fallback had made robots.txt itself resolve to the login screen.
• Serve the Inter webfont from the console's own origin. It was loaded from fonts.googleapis.com, which sent every console user's IP address to Google on page load and contradicted the privacy policy's same-origin claim. The bundle now ships the variable face itself, so the console requests no third-party host at all.

0.5.3 · 26.08.2026

Neu

• Ask before measuring: the admin console and the marketing site now load the Umami tracker only after an explicit consent, with refusing as easy as agreeing and a one-click withdrawal in the footer

0.5.2 · 25.08.2026

Behoben

• The realm check the admin console runs before mounting now asks both planes, the auth plane's discovery document and the admin API's server-info. A realm that exists on only one of them sends the visitor back to the realm prompt instead of mounting a console whose every admin call 404s. Only 404 counts: a 403 (a realm the admin host refuses by policy) is not treated as nonexistent.

0.5.1 · 25.08.2026

Neu

• Optionally report admin console page views to a self-hosted Umami instance, configured per environment via UMAMI_SCRIPT_URL and UMAMI_WEBSITE_ID. Off by default: with either unset no tracker script is loaded and no request is made, which is what a self-hosted install gets. Only the route pattern is reported, never the URL, which carries the realm and object ids.