Last month we introduced a loooot of new features and improvements. We also have big news about compliance to share.
We are SOC 2 Type I compliant, officially! 🎉 A Type II audit is on the horizon.
This feature allows users to automatically join the organization and be assigned roles upon their first sign-in through some authentication methods. You can set requirements to meet for Just-in-Time provisioning.
To use this feature, head to the organization settings and find the "Just-in-Time provisioning" section. Management APIs are also available to configure this feature via routes under /api/organizations/{id}/jit. To learn more, see Just-in-Time provisioning.
New users will automatically join organizations with Just-in-Time provisioning if they:
This applies to organizations that have the same email domain configured.
To enable this feature, you can add email domain via the Management API or the Logto Console:
GET /organizations/{organizationId}/jit/email-domainsPOST /organizations/{organizationId}/jit/email-domainsPUT /organizations/{organizationId}/jit/email-domainsDELETE /organizations/{organizationId}/jit/email-domains/{emailDomain}New or existing users signing in through enterprise SSO for the first time will automatically join organizations that have Just-in-Time provisioning configured for the SSO connector.
To enable this feature, you can add SSO connectors via the Management API or the Logto Console:
GET /organizations/{organizationId}/jit/sso-connectorsPOST /organizations/{organizationId}/jit/sso-connectorsPUT /organizations/{organizationId}/jit/sso-connectorsDELETE /organizations/{organizationId}/jit/sso-connectors/{ssoConnectorId}You can also configure the default roles for users provisioned via this feature. The default roles will be assigned to the user when they are provisioned.
To enable this feature, you can set the default roles via the Management API or the Logto Console:
GET /organizations/{organizationId}/jit/rolesPOST /organizations/{organizationId}/jit/rolesPUT /organizations/{organizationId}/jit/rolesDELETE /organizations/{organizationId}/jit/roles/{organizationRoleId}This feature allows machine-to-machine apps to be associated with organizations, and be assigned with organization roles.
OpenID Connect grant
The client_credentials grant type is now supported for organizations. You can use this grant type to obtain an access token for an organization.
A set of new endpoints are added to the Management API:
/api/organizations/{id}/applications to manage machine-to-machine apps./api/organizations/{id}/applications/{applicationId} to manage a specific machine-to-machine app in an organization./api/applications/{id}/organizations to view the associated organizations of a machine-to-machine app.Build operationId for Management API in OpenAPI response
As per the specification:
operationIdis an optional unique string used to identify an operation. If provided, these IDs must be unique among all operations described in your API.
This greatly simplifies the creation of client SDKs in different languages, because it generates more meaningful function names instead of auto-generated ones, like the following examples:
Fixed OpenAPI schema returned by the GET /api/swagger.json endpoint
: character is invalid in parameter names, such as organizationId:root. These characters have been replaced with -.tenantId parameter of the /api/.well-known/endpoints/{tenantId} route was missing from the generated OpenAPI spec document, resulting in validation errors. This has been fixed.We've enabled the support of OpenID Connect Back-Channel Logout 1.0.
To register for backchannel logout, navigate to the application details page in the Logto Console and locate the "Backchannel logout" section. Enter the backchannel logout URL of your RP and click "Save".
You can also enable session requirements for backchannel logout. When enabled, Logto will include the sid claim in the logout token.
For programmatic registration, you can set the backchannelLogoutUri and backchannelLogoutSessionRequired properties in the application oidcClientMetadata object.
When you added Google as a social connector, you can now enable Google One Tap to provide a smoother sign-in experience for your users with Google accounts.
Head to the Google connector settings in the Logto Console and switch on the "Google One Tap" option.
To learn more about Google One Tap, see Enable Google One Tap.
You can find this configuration in Console -> Sign-in experience -> Sign-up and sign-in -> Social sign-in -> Automatic account linking.
When switched on, if a user signs in with a social identity that is new to the system, and there is exactly one existing account with the same identifier (e.g., email), Logto will automatically link the account with the social identity instead of prompting the user for account linking.
We've added a new configuration to allow you to set the terms of service agreement policy for sign-in experience:
profile property in the user settings page.hasPassword to custom JWT user context.prompt.GET /api/organizations/{id}/users/{userId}/roles. If you don't provide page and limit query parameters, the API will return all roles.User.Deleted webhook event.