v1.1.0

kratos

Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.

Ory Kratos v1.1 is the most complete, most scalable, and most secure open-source identity server on the planet, and we are thrilled to announce its release! This release comes with over 270 commits and an incredible amount of new features and capabilities!

Don't forget to leave a GitHub star and check out our other open source projects while you're here :)

Phone Verification & 2FA with SMS: Enhance convenient security with phone verification and two-factor authentication (2FA) via SMS, integrating easily with SMS gateways like Twilio. This feature not only adds a convenient layer of security but also offers a straightforward method for user verification, increasing your trust in user accounts.
Translations & Internationalization: Ory Kratos now supports multiple languages, making it accessible to a global audience. This improvement enhances the user experience by providing a localized interface, ensuring users interact with the system in their preferred language.
Native Support for Sign in with Google and Apple on Android/iOS: Get more sign-ups with native support for "Sign in with Google" and "Sign in with Apple" on mobile platforms. Great user experience matters!
Account Linking: Simplify user management with new features that facilitate account linking. If a user registers with a password and later signs in with a social account sharing the same email, new screens make account linking straightforward, enhancing user convenience and reducing support inquiries.
Passwordless "Magic Code": Introduce a passwordless login method with "Magic Code," which sends a one-time code to the user's email for sign-up and login. This method can also serve as a fallback when users forget their password or their social login is unavailable, streamlining the login process and improving user accessibility.
Session to JWT Conversion: Convert an Ory Session Cookie or Ory Session Token into a JSON Web Token (JWT), providing more flexibility in handling sessions and integrating with other systems. This feature allows for seamless authentication and authorization processes across different platforms and services.

Note: To ensure a seamless upgrade experience with minimal impact, some of these features are gated behind the feature_flags config parameter, allowing controlled deployment and testing.

Better reliability when sending out emails across different providers.
Streamlining the HTTP API and improving related SDK methods.
Better performance when calling the whoami API endpoint, updating identities, and listing identities.
The performance of listing identities has significantly improved with the introduction of keyset pagination. Page pagination is still available but will be fully deprecated soon.
Ability to list multiple identities in a batch call.
Passkeys and WebAuthn now support multiple origins, useful when working with subdomains.
The logout flow now redirects the user back to the return_to parameter set in the API call.
When updating their settings, the user was sometimes incorrectly asked to confirm the changes by providing their password. This issue has now been fixed.
When signing up with an account that already exists, the user will be shown a hint helping them sign in to their existing account.
CORS configuration can now be hot-reloaded.
The integration with Ory OAuth2 / Ory Hydra has improved for logout, login session management, verification, and recovery flows.
A new passwordless method has been added: "Magic code". It sends a one-time code to the user's email during sign-up and log-in. This method can additionally be used as a fallback login method when the user forgets their password.
Integration with social sign-in has improved, and it is now possible to use the email verified status from the social sign-in provider.
Ory Elements and the default Ory Account Experience are now internationalized with translations.
It is now possible to convert an Ory Session Cookie or Ory Session Token into a JSON Web Token.
Recovery on native apps has improved significantly and no longer requires the user to switch to a browser for the recovery step.
Administrators can now find users by their identifiers with fuzzy search - this feature is still in preview.
Importing HMAC-hashed passwords is now possible.
Webhooks can now update identity admin metadata.
New screens have been added to make account linking possible when a user has registered with a password and later tries signing in with a social account sharing the same email.
Ability to revoke all sessions of a user when they change their password.
Webhooks are now available for all login, registration, and login methods, including Passkeys, TOTP, and others.
The login screen now longer shows “ID” for the primary identifier, but instead extracts the correct label - for example, “Email” or “Username” from the Identity Schema.
Login hints help users with guidance when they are unable to sign in (wrong social sign-in provider) but have an active account.

The following features have been shipped exclusively to Ory Network for this version:

B2B SSO allows your customers to connect their LDAP / Okta / AD / … to your login. Ory selects the correct login provider based on the user’s email domain.
Significantly better API performance for expensive API operations by specifying the desired consistency (strong, eventual).
Finding users effortlessly with our new fuzzy search for credential identifiers available for the Identity List API.

Ory Kratos 1.1 is a major release that marks a significant milestone in our journey.

We sincerely hope that you find these new features and improvements in Ory Kratos 1.1 valuable for your projects. To experience the power of the latest release, we encourage you to get the latest version of Ory Kratos here or leverage Ory Kratos in Ory Network — the easiest, simplest, and most cost-effective way to run Ory.

For organizations seeking to upgrade their self-hosted solution, Ory offers enterprise support services to ensure a smooth transition. Our team is ready to assist you throughout the migration process, ensuring uninterrupted access to the latest features and improvements. Additionally, we provide various support plans specifically tailored for self-hosting organizations. These plans offer comprehensive assistance and guidance to optimize your Ory deployments and meet your unique requirements. We extend our heartfelt gratitude to the vibrant and supportive Ory Community. Without your constant support, feedback, and contributions, reaching this significant milestone would not have been possible. As we continue on this journey, your feedback and suggestions are invaluable to us. Together, we are shaping the future of identity management and authentication in the digital landscape.

Contributors to this release in no particular order: moose115, K3das, sidartha, efesler, BrandonNoad ,Saancreed, jpogorzelski, dreksx, martinloesethjensen, cpoyatos1, , , ,

Are you passionate about security and want to make a meaningful impact in one of the biggest open-source communities? Join the Ory community and become a part of the new ID stack. Together, we are building the next generation of IAM solutions that empower organizations and individuals to secure their identities effectively. Want to check out Ory Kratos yourself? Use these commands to get your Ory Kratos project running on the Ory Network:

brew install ory/tap/cli

scoop bucket add ory <https://github.com/ory/scoop.git>
scoop install ory

bash <(curl <https://raw.githubusercontent.com/ory/meta/master/install.sh>) -b . ory
sudo mv ./ory /usr/local/bin/

ory auth login

ory create project --name "My first Kratos project"

ory open account-experience registration

ory patch identity-config \
  --replace '/identity/default_schema_id="preset://username"' \
  --replace '/identity/schemas=[{"id":"preset://username","url":"preset://username"}]' \
  --format yaml

ory open account-experience registration

Breaking Changes

Pagination parameters for the list identities CLI command have changed from arguments to flags --page-token and page-size:

- kratos list identities 1 100
+ kratos list identities --page-size 100 --page-token ...

Furthermore, the JSON / JSON pretty output of list identities has changed:

-[
-  { "id": "..." },
-  { /* ... */ },
-  // ...
-]
+{
+  "identities": [
+    {"id": "..."},
+    { /* ... */ },
+    // ...
+  ],
+  "next_page_token": "..."
+}

Closes https://github.com/ory/sdk/issues/284 Closes https://github.com/ory/kratos/pull/3480

Bug Fixes

oidc does not require a method in the payload (#3564) (b299abc):
- fix: oidc does not require a method in the payload
- refactor: only update strategies order in test
- chore: update audit messages and comments
Accept all 200 responses as OK in courier (#3401) (88237e2), closes #3399:
- fix: accept all 200 responses as OK in courier
Accept login_challenge after verification (#3427) (6b02350):

Part of https://github.com/ory/network/issues/320
Add caching to Jsonnet snippet during session JWT tokenization () ()

Code Generation

Pin v1.1.0 release commit (f47675b)

Documentation

Add example for allowed_return_urls to include wildcard url (#3533) (39b0c3c), closes #1528
Improve enum handling and completeness (#3714) (4b881ca)
Remove experimental warnings (#3406) (d4d26e6):

See https://github.com/ory/kratos/discussions/3388
Update link to hashed password formats (#3484) (8ca3adc)

Features

Add ability to convert session to JWT when calling whoami (#3472) (57b7bb8), closes #2487:

This patch adds a query parameter tokenize_as to /session/whoami which encodes the session to a JWT. It is possible to customize the JWT claims by using a JsonNet template, and furthermore change the expiry of the token.

The tokenize feature supports multiple templates, which makes it easy to use the resulting JWT in a variety of use cases.
Add event (#3524) (75031e6)
Add GetID member functions to RecoveryAddress and Credentials (#3474) (085d500)
Add ID Token sign in with Google Android/iOS SDK (#3515) ()

Reverts

Revert "chore: simplify courier code (#3603)" (7c54c9f), closes #3603:

This reverts commit 316cd4aacfe31efafa7d737a7c476e2c794e9c9b.

Tests

Add test for link + oidc challenge (#3720) (67360cf)
e2e: Logout return_to (#3418) (c348c12)
Fix cypress setup (#3527) (70c8ddd)
Fix e2e failures and speed up e2e tests (#3483) (70a6171)
Fix hydra tests on master (#3737) ()

Unclassified

Revert "feat: extend Microsoft Graph API capabilities (#3609)" (#3717) (549308d), closes #3609 #3717:

This reverts commit 4a7bcc9322be37e6fd141e411bd65e3977eeb692.

Changelog

7c54c9f36 Revert "chore: simplify courier code (#3603)"
549308db1 Revert "feat: extend Microsoft Graph API capabilities (#3609)" (#3717)
8cc83bc75 Revert "fix: re-add exported symbols (#3611)"
e0327b00a autogen(docs): generate and bump docs
7c0e02efd autogen(docs): regenerate and update changelog
32299d5eb autogen(docs): regenerate and update changelog
046aa9bd2 autogen(docs): regenerate and update changelog
8a0e4969a autogen(docs): regenerate and update changelog
dbb3a7ed3 autogen(docs): regenerate and update changelog
043114bb7 autogen(docs): regenerate and update changelog
0d37eb356 autogen(docs): regenerate and update changelog
af5583456 autogen(docs): regenerate and update changelog
e9ed14fdb autogen(docs): regenerate and update changelog
34751a1a3 autogen(docs): regenerate and update changelog
3d6927ced autogen(docs): regenerate and update changelog
6b91dc14c autogen(docs): regenerate and update changelog
5fc88baef autogen(docs): regenerate and update changelog
35a820bdf autogen(docs): regenerate and update changelog
461ad5297 autogen(docs): regenerate and update changelog
4be520532 autogen(docs): regenerate and update changelog
32d8306e8 autogen(docs): regenerate and update changelog
fc057a8be autogen(docs): regenerate and update changelog
04bca63dc autogen(docs): regenerate and update changelog
13de64daf autogen(docs): regenerate and update changelog
8384f1033 autogen(docs): regenerate and update changelog
566d1ca0e autogen(docs): regenerate and update changelog
988be61f8 autogen(docs): regenerate and update changelog
048af1d0e autogen(docs): regenerate and update changelog
53080b0bd autogen(docs): regenerate and update changelog
89928c810 autogen(docs): regenerate and update changelog
4f8ea02ce autogen(docs): regenerate and update changelog
0e45e8763 autogen(docs): regenerate and update changelog
4b7fd0d68 autogen(docs): regenerate and update changelog
f1493c8c0 autogen(docs): regenerate and update changelog
dd5a9f38c autogen(docs): regenerate and update changelog
ce6b11abe autogen(docs): regenerate and update changelog
4eaf6c8d7 autogen(docs): regenerate and update changelog
60e9a363c autogen(docs): regenerate and update changelog
7b633794a autogen(docs): regenerate and update changelog
96dba50d0 autogen(docs): regenerate and update changelog

Artifacts can be verified with cosign using this public key.