Skip to main content
v2.0.1

Changelog

v2.0.1 is a small follow-up to v2.0.0 on the same OSS base. It adds a tenant-managed trusted-network allowlist so the generic SCIM provider can discover a self-hosted IdP on a private network without disabling SSRF protection, and it fixes a regression where the Vault secret store was never wired at boot on the v2 line.

✨ Features

  • Trusted Networks Allowlist for Private IdP Discovery - Admins can now allowlist private IP or CIDR ranges so the generic SCIM provider’s discover-endpoints and discover-claims flows can reach a self-hosted IdP on a private network. The list is managed through GET/POST/DELETE /api/network-trust and a “Trusted Networks” sheet in the SCIM wizard’s discovery step and on the post-setup dashboard, gated on the Settings/Update permission. Bare IPs are widened to single-host ranges, entries are normalized and deduplicated, invalid values return a 400, and both mutating calls are recorded as high-risk in the audit log. Loopback and metadata.google.internal stay blocked regardless of the allowlist, and every outbound hop in the discovery flow (issuer, token, userinfo, pinned TLS dial) checks the same list. The allowlist is a global client-level setting stored in the governance config, so no database migration is needed.

🐞 Fixed

  • Vault Secret Store Not Wired at Boot - The v2 file restructure dropped the step that installed the Vault resolve, prefix, store, and remove hooks on the bootstrap config store, so a configured Vault store never actually resolved or wrote secrets. The hooks are registered again during server bootstrap, and the store and remove hooks are installed only when Vault is both enabled and set to read-and-write.

📀 Base OSS version

transports/v2.0.0 (pinned as github.com/maximhq/bifrost/transports v1.6.12-0.20260826193051-e4a30d6041c0), unchanged from v2.0.0. No OSS features, fixes, or closed issues are included in this release.

🔌 If you are compiling plugin against this release - use following deps