franz/forseti
Watch
1
0
Fork
You've already forked forseti
 0
Code Issues 2 Pull requests Projects Releases 34 Packages Wiki Activity
34 releases 34 tags
  • v0.1.8 46912efde1

    v0.1.8 Stable

    franz released this 2026-06-24 16:37:46 +00:00 | 120 commits to master since this release

    Added

    • Linux host authentication (preview): provision Kratos identities into POSIX accounts; enrolled hosts resolve passwd/group/SSH keys
    • Interactive Linux login via the OAuth 2.0 Device Authorization Grant (RFC 8628), with force_mfa AAL2 enforcement
    • Offline Linux login with a dedicated passphrase when the server is unreachable
    • forseti-unix host client — daemon, NSS module, pam_forseti.so, Guix packaging
    • Per-host seat cap on provisioned accounts; resolution is never license-gated

    Security

    • PAM account stack fails closed on a daemon outage; local/root logins unaffected
    • Panic-guarded PAM entrypoints; daemon socket bounded before auth
    • Unique device user_code; id_token audience pinned to the PAM client; device-auth refuses an empty client secret
    • Org member removal now revokes the member from the org's POSIX group
    • A [security].cookie_secret under 32 bytes now hard-fails boot

    Fixed

    • Identity deletion purges POSIX rows at every path; hourly reconcile sweep catches out-of-band deletes
    • Expired commercial license re-evaluated hourly, not only at restart
    • Org-invite invalid-email redirect used the org id instead of its slug

    Builds, checksums and provenance: https://github.com/franzos/forseti/releases/tag/v0.1.8

    Downloads