Skip to main content

Release notes: SecureAuth CIAM 2.29.0

Summary of new features and changes in SecureAuth CIAM platform (formerly known as Cloudentity) version 2.29.0.

For platform component version details, see SecureAuth platform dependencies version reference.

Release Date: September 30, 2026

Breaking changes​

  • Phone providers replace the global SMS and voice configuration – Phone (SMS and voice) provider configuration is now managed per workspace instead of globally. The AdvancedPhone feature flag, the global Twilio sms: and voice: configuration blocks and the --disable-embedded-sms-provider and --disable-embedded-voice-provider CLI flags have been removed; existing workspace SMS and voice MFA methods are migrated automatically. Before upgrading, move a custom SMS sender ID from sms.from to messaging.smses.default_source (otherwise the sender defaults to SecureAuth), and add a phone provider (Workspace > MFA > Phone providers) to every workspace that relied only on the global gateway, or its SMS and voice delivery stops. The settings.sms.provider and settings.voice.provider fields on an MFA method, and the auth.sms and auth.voice credential blocks, are deprecated and no longer select a provider. [AUT-13620, AUT-13969]

  • Open Banking UK, Brazil and Saudi Arabia profiles removed – The deprecated obuk and ksa server profiles and the Brazil open banking and open insurance implementation, API references and clients were removed. Workspaces on a retired Brazil profile fall back to fapi_advanced. [AUT-14076, AUT-14077, AUT-14023, AUT-14027, AUT-14028]

  • Default reCAPTCHA v2 keys removed – The default configuration no longer ships a placeholder reCAPTCHA v2 key pair; configure your own keys under captcha. [AUT-14060]

New features​

  • Dark mode – The administrator, developer and organization (B2B) portals, including the Risk Engine views, now support a dark color scheme that follows the user's preference. [AUT-13726, AUT-13764, AUT-13772]

  • Groups management in the B2B portal – Organization administrators can now create, edit and delete identity-pool groups, manage their members and nest groups directly in the B2B self-service portal. [AUT-13828]

  • reCAPTCHA protection for activation and recovery links – Activation links, password, authenticator and passkey reset, and device pairing can now be protected with reCAPTCHA. An activation link first serves a challenge page and only then consumes the one-time code, so email security scanners can no longer use up the link. The protection is controlled entirely by the deployment captcha configuration (captcha.enabled plus the configured key pairs); no tenant feature flag is involved. [AUT-13529, AUT-14036, AUT-14133]

  • Per-tenant captcha allowlist – Captcha can now be waived for selected accounts or email domains of a single tenant, stored in the tenant's internal settings, instead of only across a whole environment. [AUT-14040]

  • Identity provider as a mappable claim – The ID and the method of the identity provider used at login can now be mapped as a claim in OpenID Connect tokens and as an attribute in SAML assertions. Select the Login session source and pick IDP Method or IDP ID when configuring the claim. [AUT-13732]

  • Service audience mode – Services now have an audience mode setting (spiffe, custom, none) that controls how the service audience is added to issued access tokens. none skips audience injection for that service, so tokens can satisfy strict OIDC validators that require a single aud value. [AUT-13599]

  • Forwarding authorize parameters to external OIDC IDPs – External OIDC identity provider connections can now forward the incoming prompt, max_age and id_token_hint parameters to the upstream IDP. Enable each parameter under the IDP's Advanced settings; existing connections are unaffected. [AUT-13797]

  • Dynamic client registration with an optional software statement – A workspace can now accept dynamic client registrations both with and without a software statement (dynamic_client_registration.software_statement.optional, also available as a toggle under Protected by software statement). Clients that present a statement are still validated and enriched from it, and DCR policies can tell the two kinds of client apart by the stored statement payload. Not available on the FDX profile.

  • Skip device fingerprint collection per client – A new Skip device fingerprint collection (skip_dbfp) application setting lets non-interactive clients that cannot run the collection script complete the authorization flow; risk inference is unaffected. The fingerprint page now also degrades gracefully when JavaScript is disabled. [AUT-13949]

  • Authentication analytics per identity pool – The Top incomplete authentications and Top password reset activity charts on the Authentication Summary page can now be narrowed to a single identity pool by selecting the pool in the identity provider picker. The identity provider search is labeled, the pool view is wider and legend values are formatted. Action required for on-premise deployments: these charts are served from new summary tables that are kept up to date from the upgrade onwards, but the automatic refresh only reaches back about a week. After upgrading, connect to the TimescaleDB analytics database and run the following statements, in this order, to recalculate the last two months of history (they cannot run inside a transaction block, so do not use psql --single-transaction):

    CALL refresh_continuous_aggregate('top_users_with_password_resets_1m_v2',  now() - interval '2 months', NULL);
    CALL refresh_continuous_aggregate('top_users_with_password_resets_1h_v2',  now() - interval '2 months', NULL);
    CALL refresh_continuous_aggregate('top_users_with_password_resets_12h_v2', now() - interval '2 months', NULL);

    CALL refresh_continuous_aggregate('top_users_with_authentication_failures_1m_v2',  now() - interval '2 months', NULL);
    CALL refresh_continuous_aggregate('top_users_with_authentication_failures_1h_v2',  now() - interval '2 months', NULL);
    CALL refresh_continuous_aggregate('top_users_with_authentication_failures_12h_v2', now() - interval '2 months', NULL);

    The operation is safe to repeat and can take from minutes to hours depending on the volume of audit data. [AUT-13658, AUT-14054, AUT-14072]

  • Configurable TimescaleDB retention – On-premise deployments can now configure how long analytics and audit data is kept via timescale.retention. Configured values are preserved across upgrades, and the new acp sql retention command applies them, with --dry-run to preview the changes. [AUT-13608]

  • Organization details in activation templates – When the identity pool belongs to an organization, its details (id, name, description, color and the organization metadata) are available in the Activate Account With Code and Activate Account With Link email and SMS templates as .Data.Organization. [AUT-14031]

  • Bulk methods on the SpiceDB-compatible gRPC endpoint – CheckBulkPermissions, ImportBulkRelationships and ExportBulkRelationships are now supported. Every object type must carry the caller's permission system prefix, and ExportBulkRelationships requires a relationship filter scoped to the caller's permission system, exporting one object type per call. Client-fault errors from SpiceDB are now returned with their original gRPC code and message. [AUT-13954]

  • Multi-architecture container images – The distroless runtime images and the FaaS environment images (node-env, rego-env) are now published as multi-arch manifests for linux/amd64 and linux/arm64. [AUT-13733]

Improvements​

  • Voice OTP generally available – Voice one-time passcodes for sign-in and MFA no longer require a feature flag. Users can receive a passcode through an automated phone call as an alternative to SMS or email OTP, and Voice OTP now appears by default across a workspace's authentication methods, MFA settings and voice message templates. Configure a phone provider (built-in, or a custom Twilio, Vonage or TeleSign provider) and enable Voice OTP for the identity pool. [AUT-13302, AUT-13465]

  • Application Launch Dashboard generally available – The Applications tab in the user portal, listing the applications available to a signed-in user with a direct link to each, no longer requires the application_launch_dashboard feature flag. [AUT-13838]

  • Refreshed admin navigation – The admin portal navigation has a cleaner design with a persistent, collapsible desktop sidebar (icon-only rail with tooltips, remembered across reloads), refined active and hover states, and a consistent Show all / Show less control across workspace types. Automatic collapsing on some views was removed, so users control the sidebar state; clicking a section header while collapsed temporarily opens the menu. [AUT-13527, AUT-13717, AUT-13718, AUT-13752, AUT-13843]

  • Application Quickstart redesign – The path selector now uses cards, the framework and scenario pickers use segmented controls, and the application configuration panel has a cleaner layout. [AUT-13725]

  • Self-service portal refresh – The user portal has an account header with the profile and last sign-in summary, clearer sign-in method management with plain-language status chips, a simplified sessions view with a Sign out all others action, and modernized application tiles. [AUT-13830]

  • Consistent dialogs – Dialogs across the admin panel now share the same look and widths. [AUT-13816]

  • Analytics dashboards tailored to CIAM tenants – The redundant Risk Insights Summary page was removed, the Authentication Breakdown shows identity provider names instead of raw IDs, and CIAM tenants now see a Risk Intelligence dashboard without the sections that only apply to SecureAuth Identity Platform tenants. [AUT-13657]

  • Tenant ID in email footers – Emails sent by the platform now show the issuing tenant's ID in the footer, so recipients can tell which tenant a message (for example a verification code) belongs to. [AUT-13806]

  • Structured certificate DN by default – The structured distinguished name format for signing-key certificates (organization, organizational unit, locality and so on) is now the default for all tenants; the use_new_dn_format feature flag was removed. [AUT-13209]

  • Code metadata returned on consumption – generateCodeForUser now persists the metadata supplied at code creation for all code types, and the system endpoints that consume a code (verifyAuthenticationCode, verifyOTP, inspectOTP) return it, so integrators can read the context set when the code was issued. [AUT-13738]

  • Timestamps on workspaces and organizations – Workspaces and organizations now return created_at and updated_at. Both are absent for workspaces and organizations that existed before the upgrade. [AUT-13994]

  • Authentication methods recorded from external identity providers – Logins completed through an external identity provider now record the authentication methods the provider reported in amr (built-in OIDC, SAML and Active Directory connectors, and custom identity providers), so they reach the authentication_mechanisms audit field, the acr-aal1 and acr-aal2 policies and the authentication context available to policies. MFA completed on the tenant-level OTP page is recorded the same way. [AUT-13984]

  • Client IP in post_authn_ctx scripts – The post_authn_ctx extension script input now exposes device.ip. Client IP resolution was also fixed for requests that supply a bare address without a port, such as RADIUS logins, which affected extension scripts, risk inference, IP intelligence lookups, audit events and brute-force protection. [AUT-13904]

  • Device fingerprinting – The fingerprint step uses a faster collection profile, and the browser no longer calls the fingerprinting service itself: it hands the fingerprint to the authorization server, which relays it and keeps the result on the login session (no fingerprint cookie is written any more). Logins without a fingerprint (JavaScript disabled, script blocked or collection timed out) are now scored on the remaining analyzers instead of defaulting to LOA 0, and a risk engine 4xx response is reported as an error instead of being recorded as an LOA 0 score. risk_engine.dbfp_timeout now bounds both the browser-side collection and the server-side relay. [AUT-13864, AUT-14081, AUT-14103]

  • Readable user identifier in risk analytics – Sign-in events sent to the risk engine now include the user's email address (falling back to username or name), so user search and per-user activity views in risk analytics work for all tenants. [AUT-13950]

  • is_first_time_login in risk audit events – Risk-related audit events now include is_first_time_login, reported by the risk engine when the user has no approved sign-in history in the last 180 days. It appears inside risk_engine_context on the risk_calculated event and as metadata.is_first_time_login on login-time events. [AUT-14148]

  • Webhook delivery retries – Webhook events are no longer discarded while deliveries to a repeatedly failing endpoint are suspended; they stay queued and are delivered once the endpoint responds again. Failed deliveries are retried on an increasing backoff (5s, 30s, 1m, then 5m intervals) for about 80 minutes, up to 20 attempts, after which the event is dropped and logged with its webhook and event ID. Events dropped during a suspension are now reported as failures instead of successes. [AUT-14070]

  • Cross-organization role grants confined to the home workspace tree – Workspace role grants must now stay within the user's home workspace tree; assigning a role on an organization in a different top-level workspace is rejected, both through the API and through tenant configuration import, and the cross-organization role picker only offers organizations from the user's own tree. [AUT-13781, AUT-13889]

  • Permission check tracing off by default – Debug traces on permission checks (with_tracing) are now disabled by default; single-tenant deployments can re-enable them with the new spicedb.allow_tracing setting. [AUT-13987]

  • Faster listing of organizations and workspaces – Organization and workspace listing endpoints now resolve a whole page in a fixed number of database queries instead of one per item, and GET /user/organizations and GET /user/workspaces return results in a stable order, so cursor paging no longer repeats or skips entries. [AUT-14041]

  • Faster role grant and revoke – Admin role grant and revoke requests on tenants with many identity providers or organizations now complete in milliseconds instead of seconds. [AUT-13839, AUT-13948]

  • Faster identity provider selection scripts – Improved the reliability and performance of IDP selection extension scripts in workspaces with a large number of identity providers. [AUT-13945]

  • Faster API Gateways list – The gateways list now reads API group and service counts from the list endpoint itself (number_of_apis_with_connected_services, number_of_apis_without_connected_services, number_of_services_with_connected_gateway) instead of issuing one request per gateway. [AUT-13510, AUT-13890]

  • No-op user updates are ignored – An update to an identity pool user that changes nothing no longer rewrites the record, bumps updated_at or emits a user-updated event; only real changes are persisted, audited, sent to webhooks and synchronized to a connected authenticator. [AUT-14146]

  • Workforce integration settings are read-only – The eGuardian workforce integration settings of a workspace can no longer be changed through the admin API; they are managed by the system and the client secret is no longer returned. [AUT-14101]

  • One identity pool per workspace with push enabled – When the push feature flag is enabled, creating a second identity pool in a workspace is rejected with 409 Conflict instead of being accepted and silently left out of the authenticator sync; the admin portal hides the create-pool buttons in that case. [AUT-14139]

  • Fewer token requests from device wait screens – Device pairing and login wait screens no longer request a fresh access token from SecureAuth Authenticate on every status check; a waiting user now costs one token request instead of one every fifteen seconds. [AUT-14183]

Bug fixes​

  • Malformed text in identity forms – Identity self-service forms (set and reset password, register, activate, MFA, TOTP and passkey setup, address verification, challenge confirmation and credentials setup) now return a normal validation error instead of an internal server error when a request contains invalid UTF-8 or an embedded NUL byte. [AUT-13630]

  • Malformed set-password link – A malformed or corrupted set-password link now shows an "invalid link" page instead of an internal server error. [AUT-13743]

  • Pools dropped on export and clone – Fixed identity export and workspace clone silently dropping pools when a tenant had more pools than the listing cap. [AUT-13720]

  • SAML applications and id_token_signed_response_alg – Fixed SAML applications failing validation on id_token_signed_response_alg after the authorization server signing algorithm was changed, which also broke tenant configuration import through the hub patch API. This OIDC-only attribute is no longer set or validated for SAML clients. [AUT-13562]

  • Organization metadata claims after refresh and SSO – Fixed custom claims sourced from organization.metadata.* disappearing from the access token after a refresh-token grant and after an SSO-based re-login. [AUT-13786]

  • idp_hint and SSO session reuse – Fixed an authorization request with an idp_hint pointing at a different IDP than the one that established the current SSO session silently reusing that session; in B2B setups with organization IDPs on a shared authorization server this could log in the wrong user. A mismatching idp_hint now always forces fresh authentication, and a matching one allows session reuse (previously it forced re-authentication; use prompt=login to force a re-login). [AUT-13813]

  • Truncated query results – Fixed multi-row database queries silently returning truncated results when a database error occurred mid-iteration; such errors are now surfaced to the caller. [AUT-13763]

  • Social login cancellation – Cancelling a social login with Apple or LinkedIn now returns the user to the calling application instead of showing the generic "Unable to login with identity provider" error page. [AUT-13824]

  • Webhook URL validation – Webhook URLs with a doubled scheme (for example https://https://host/path) are now rejected at create and update time instead of being stored as active and failing on every delivery. [AUT-13833]

  • Group listing order – The sort attribute the groups API validates is now the one the database orders by, and SCIM GET /Groups returns groups in ascending ID order as documented. [AUT-13836]

  • Nested group deletion – Deleting an identity-pool group now removes all of its nested groups; previously trees with more than 1000 descendants were only partially deleted. [AUT-13837]

  • Static number attribute mappings – Fixed a static provider mapping to a number-typed attribute being saved as a string by the admin UI, which caused authentication to fail with "Could not parse attributes". Values are saved with the correct type, and mismatched static mappings are rejected at save time. [AUT-13848]

  • Okta private key format – Fixed application provisioning in Okta failing silently when the integration's private key was supplied in PKCS#8 format. Existing configurations recover automatically. [AUT-13893]

  • Identity pool cards in dark mode – Fixed identity pool card icons and user counts not being visible in dark mode. [AUT-13914]

  • Phone provider rollback – The Twilio-to-phone-providers migration no longer rewrites the MFA method's provider value, so rolling back to a previous release after the migration leaves SMS and voice delivery working. [AUT-13928]

  • Built-in phone provider webhooks – Fixed TeleSign voice OTP calls hanging up without speaking the code when TeleSign is configured as a built-in provider, and delivery receipts for built-in providers being rejected. The webhook secret is now resolved according to the tenant's provider mode. [AUT-13762]

  • Re-creating a deleted user – Fixed re-creating a user with the identifier of a just-deleted user failing with an incorrect "identifier already taken" error for several minutes. [AUT-13952]

  • Tenant configuration import – Fixed tenant configuration import and patch silently discarding roles, claim grants and brute-force limits. Export now emits brute-force limits, and roles when exporting with data; import rejects out-of-range brute-force limits instead of silently accepting them. [AUT-13964]

  • WebAuthn Relying Party ID validation – An identity pool with a WebAuthn rp_id that is not a valid domain no longer makes passkey requests fail with a 500; the value is rejected when the pool is saved, and an already-saved one returns 422. [AUT-13966]

  • Login discovery with many organizations – Fixed a sign-in failure for users whose email address is registered across a large number of organizations, where the identity provider lookup could exceed its time limit. [AUT-13967]

  • Tenant configuration push and phone providers – Fixed importing or patching a tenant's configuration disabling that tenant's advanced phone provider setup, which stopped SMS and voice OTP delivery. [AUT-13968]

  • Audit events dropped after retries – Audit events are no longer dropped after 10 delivery retries on the SQL storage backend, and deleting an identity pool no longer publishes one membership audit event per grant. [AUT-13990, AUT-13996]

  • Recovery identifier on Smart Passkey login – Fixed the identity pool login page not pre-filling the email or mobile field on the "No access to passkey?" recovery screen after intelligent IDP discovery. [AUT-13974]

  • Passkey prompt on activation and self-registration – The identity pool setting Require user interaction before passkey prompt is now honored on the hosted activation and self-registration pages. [AUT-14003]

  • Stricter email validation on existing users – Adding a verifiable address, or any other write, no longer fails with a 500 for users whose stored identifiers predate a stricter email validation rule. [AUT-13741]

  • SCIM group read-after-write – Fixed a race where a SCIMv2 group read issued immediately after a create, update, PATCH or delete could return stale data. [AUT-13997]

  • Cloned client creation date – An organization created from a template now reports its own creation date on its User Portal client instead of inheriting the template's. [AUT-13993]

  • Registration with reCAPTCHA v3 – Fixed the Continue button on the registration form staying disabled when reCAPTCHA v3 is configured, and hosted self-registration failing with "Missing captcha verification" on passkey steps. [AUT-14013, AUT-14037]

  • reCAPTCHA browser assessment failures – Fixed a server error on the activation and reset-password forms when reCAPTCHA declined to assess the browser; the form now re-serves the challenge. [AUT-14272]

  • Double submit on OTP screens – Fixed the authenticator (TOTP), one-time-code and registration screens accepting repeated submits while the first request was in flight, which showed an "invalid login state" error after a successful login and sent duplicate activation codes on registration. [AUT-14039]

  • Paired device as second factor – Fixed a user whose second factor was a paired mobile device being able to skip two-factor authentication on pools that allow skipping it. [AUT-14061]

  • Custom theme on the fingerprinting page – Custom theme templates are now applied to the device fingerprinting page in the OIDC authorization flow. [AUT-14063]

  • Fingerprinting timeout race – Fixed a timing issue on the device fingerprinting page that could fail a login with "We've run into an unexpected error" when collection finished just after the configured timeout. [AUT-13814]

  • SAML SSO with device fingerprinting – Fixed SAML single sign-on failing with an invalid destination error for applications using a custom IDP SSO URL when device browser fingerprinting is enabled. [AUT-14120]

  • Authentication method reported to the risk engine – Multi-factor logins previously reported the weaker factor to the risk engine, and several authentication methods were not reported at all. [AUT-14078]

  • Duplicate login reports to the risk engine – Fixed reporting a completed login to the risk engine failing with an internal error, and being retried, when the login had already been reported, for example on a token refresh. [AUT-14127]

  • Granted applications list – Fixed the list of applications a user has granted access to failing to load for users with a large number of granted applications. [AUT-14095]

  • Identifier casing – Fixed a conflict error that stopped an identity pool user from being linked to their authenticator when a connected system sent their email or phone number with different letter casing than stored. Creating or updating a user with two identifiers that differ only by case on a case-insensitive pool now stores a single identifier, and the same value under two types is rejected with a validation error. [AUT-14123, AUT-14142]

  • sid claim without an SSO session – ID tokens and userinfo responses no longer contain a sid claim when the workspace has no single sign-on session; previously a placeholder value identical for every user of an application was returned. [AUT-14130]

  • Self-service tab switching – Fixed the self-service view returning to the Applications tab on its own, which prevented users from completing changes on another tab. [AUT-14182]

  • Navigation "Show all" toggle – Fixed the Show all / Show less navigation toggle being covered by the browser's link preview. [AUT-14038]

  • Identity pools after tenant import – Identity pools referenced by role bindings are readable immediately after a tenant import. [AUT-14255]

  • Deleted users and background queues – Deleting an identity pool user no longer leaves messages retrying in the background; an update processed after the user was deleted is discarded instead of being retried for up to an hour and a half on the persistence queue or seven days on the workforce sync queue. [AUT-14193]

  • Organizations provisioned for push – Fixed organizations created after enabling push never being provisioned in eGuardian, so their users could not pair the SecureAuth Authenticate app. [AUT-14092]

  • Device challenge for organization users – Fixed the second factor failing with a server error for an organization user signing in through the parent workspace, because the device challenge was issued in the wrong workforce tenant. [AUT-14094]

  • Inline device pairing during login – After pairing a device as a required second factor during login, Sign in now continues into the push or symbol challenge instead of failing with "invalid login state". [AUT-14093]

  • User ID on failed authentication events – Failed login audit events (user_authenticated and user_authn_challenged with result=failure) now include metadata.user_id for device-challenge and second-factor failures where the user was already known to the flow. [AUT-14106]

  • Authenticator write-back loop – Fixed a synchronization loop between the identity pool and the connected authenticator, where an update written back by the authenticator was pushed to it again and could cause oscillating updates and lost attribute changes under concurrent edits. [AUT-14145]

  • Device approval screens on mobile – Fixed the device approval and pairing screens not advancing after switching to the authenticator app on a mobile browser, and not completing when the real-time connection is unavailable. [AUT-14147, AUT-14129]

  • Devices tab on push-only tenants – Fixed the Devices tab not being shown in the user portal on tenants where only push is enabled. [AUT-14144]

  • Security updates – This release includes security updates to platform dependencies and base images.