Skip to main content
Version: 1.11

3.1.0 Release Notes

This page summarizes the major changes introduced after v3.0.0. The stable release is listed first, followed by the release-candidate fixes and the principal beta milestones.

Nauthilus 3.1.0 makes native Go plugins a production-ready extension surface, adds privacy-aware GeoIP and reputation intelligence, hardens OIDC, SAML, MFA, cache, and plugin boundaries, and improves authentication-path observability and latency. It also completes mixed passkey/security-key support and reliable MFA self-service continuations.

3.1.0​

Released on August 3, 2026.

This stable release promotes v3.1.0-rc.11 without additional code changes after the final release candidate. Use it as the stable 3.1 upgrade target for deployments on the 3.0 line.

Added​

Native Go plugin platform​

  • A versioned pluginapi/v1 contract now covers plugin loading, registration, configuration, reload lifecycle, capabilities, request snapshots, policy facts, subject sources, backends, hooks, obligations, and detached post-actions.
  • Capability-oriented host services provide bounded access to configuration, logging, metrics, tracing, HTTP, Redis, LDAP, mail, connections, credentials, and supervised background work.
  • Native extensions can participate in the same policy and runtime exchange used by Lua integrations without receiving mutable server internals.
  • Bundled reference plugins cover GeoIP, Have I Been Pwned, and ClickHouse workflows, including signature verification and image-build integration.

Privacy and reputation intelligence​

  • GeoIP processing adds local country, city, ASN, organization, prefix, registry, allocation, and routability data without requiring a remote lookup for every request.
  • Redis-backed reputation and free network-intelligence feeds expose policy-safe subject facts for IP, ASN, country, and shared-egress decisions.
  • Shared-egress brute-force controls can combine request behavior with reputation evidence instead of penalizing every user behind the same address equally.
  • ClickHouse analytics include bounded GeoIP, reputation, policy-decision, failed-login, and latency context.

Observability​

  • HTTP and gRPC authentication response latency is measured at comparable outer transport boundaries with bounded protocol and outcome labels.
  • Authority RPC completion and response-boundary latency metrics separate client-visible work from detached post-actions.
  • Post-action latency, native plugin module selection, and trace ownership are observable without extending synchronous authentication timing.

Security​

Identity Provider and MFA​

  • OIDC client authentication, token audience/type handling, device authorization, introspection, and configured PKCE boundaries fail closed.
  • Public Authorization Code clients continue to require PKCE with S256; confidential clients can opt in with require_pkce: true.
  • SAML federation controls, request validation, attribute release, and sensitive assertion output were tightened.
  • MFA assurance is enforced at sensitive boundaries, while recovery-code, TOTP, and WebAuthn self-service operations preserve the account-bound step-up continuation.
  • WebAuthn ceremonies retain authenticator attachment, transport, and extension metadata so platform passkeys and roaming security keys can coexist under one RP policy.

Runtime and data boundaries​

  • Sensitive configuration, authentication, SAML, hook, trace, log, metric, and error output is filtered more consistently.
  • Lua SQL, LDAP, ClickHouse, decompressed HTTP body, async hook, client, and native plugin boundaries now apply explicit size, ownership, and failure controls.
  • Password-derived cache and plugin values use the canonical lowercase 64-character SHA-256 digest. Only integration-specific bounded exports, such as the established ClickHouse field, shorten a validated digest.
  • Authentication caches use collision-safe full hashes and re-evaluate request-local controls instead of reusing mutable response state.

Changed​

Compatibility and performance​

  • The Go module path is github.com/croessner/nauthilus/v3; native plugins must use the v3 pluginapi/v1 import path and be rebuilt for the exact Nauthilus release toolchain and dependency graph.
  • Declarative policy evaluation, snapshot exchange, password-history loading, post-action scheduling, and GeoIP processing avoid unnecessary clones and synchronous work.
  • Backend references used by gRPC deployments are opt-in, and copied IdP backend lookup contexts cannot mutate client responses.
  • LDAP health checks share the normal LDAPS/StartTLS CA, SNI, and client-certificate setup while remaining transport-only probes.

Upgrade Notes​

  1. Rebuild every native Go plugin against github.com/croessner/nauthilus/v3/pluginapi/v1 and the exact 3.1.0 toolchain and module graph. Do not reuse a .so built for another Nauthilus binary.
  2. Keep plugin signature verification fail closed in production and provision the configured verification keys before enabling modules.
  3. Review native plugin capabilities and module selectors; grant only the host services each module actually needs.
  4. If a confidential OIDC client must use PKCE, add require_pkce: true and verify S256 end to end. Public clients remain PKCE-mandatory.
  5. Re-test passkey and security-key registration/login policies after the upgrade, especially attachment, resident-key, user-verification, extension, and transport handling.
  6. Update consumers of password-derived plugin values to accept the canonical 64-character lowercase SHA-256 form. Validate before deriving an integration-specific short field.
  7. Revalidate LDAP health checks with the same CA, SNI, StartTLS/LDAPS, and mTLS settings used by normal backend connections.
  8. Compare authentication latency by transport and outcome after rollout; detached post-action time is intentionally reported separately from the client-visible boundary.

See Native Go Plugins, the Go Plugin Developer Guide, OIDC Configuration, and MFA Assurance Policy for the frozen 3.1 contracts.

3.1.0-rc.11​

Released on August 3, 2026.

Fixed​

  • Native Lua-context representations are preserved across plugin runtime bridges so brute-force and RBL controls cannot panic on normalized values.
  • Account-bound WebAuthn rename requests survive one-time MFA step-up and execute only after the fresh browser session is established.
  • Focused panic, continuation, and single-save browser regressions cover the final self-service path.

3.1.0-rc.10​

Released on August 2, 2026.

Fixed​

  • Expired MFA self-service sessions are distinguished from invalid IdP flows so users can recover safely.
  • Passkey rename submissions use browser-native form handling with localized redirects.
  • Step-up and rename persistence are covered by focused handler and browser tests.

3.1.0-rc.9​

Released on August 2, 2026.

Fixed​

  • Configured authenticator selection is applied consistently to WebAuthn registration and login ceremonies.
  • Browser attachment, extension, and transport metadata is preserved with stored credentials.
  • Regression coverage verifies mixed platform-passkey and roaming-security-key policies.

3.1.0-rc.8​

Released on July 27, 2026.

Security​

  • google.golang.org/grpc was updated to 1.82.1 and the vendored dependency set was refreshed and revalidated.

3.1.0-rc.7​

Released on July 26, 2026.

Security​

  • OIDC clients can set require_pkce: true; authorization requests for those clients are rejected unless they use PKCE with S256.
  • Mandatory PKCE for public clients remains unchanged.

3.1.0-rc.6​

Released on July 23, 2026.

Fixed​

  • LDAP health probes share CA, SNI, client-certificate, LDAPS, and StartTLS configuration with normal LDAP connections.
  • Health checks remain explicitly transport-only and preserve connection close semantics.

3.1.0-rc.5​

Released on July 20, 2026.

Fixed​

  • Copied IdP backend lookup contexts disable response mutations.
  • The shared plugin response boundary is guarded before any Gin writer access.

3.1.0-rc.4​

Released on July 17, 2026.

Added​

  • HTTP and gRPC authentication response latency uses comparable outer transport boundaries, bounded labels, and millisecond-focused histogram buckets.

3.1.0-rc.3​

Released on July 16, 2026.

Added​

  • Authority RPC completions and client-visible response latency are measured before detached post-actions are released.

3.1.0-rc.2​

Released on July 15, 2026.

Fixed​

  • Declarative policy allowlists preserve dotted usernames after Viper map-key expansion.
  • The RBL soft allowlist is exposed through the native configuration schema.

3.1.0-rc.1​

Released on July 15, 2026.

This release candidate consolidated the 3.1 beta line for stable validation and made gRPC backend references explicitly opt-in.

Beta Milestones​

The 3.1 beta line was intentionally iterative. The milestones below identify the compatibility and operational boundaries most relevant to upgrades; later candidates include all earlier beta work.

Native plugins and module compatibility​

  • v3.1.0-beta.1 introduced GeoIP reputation facts and ClickHouse enrichment.
  • v3.1.0-beta.5 required signed bundled GeoIP plugins in stable images.
  • v3.1.0-beta.8 moved the Go module path and generated contracts to github.com/croessner/nauthilus/v3.
  • v3.1.0-beta.20 through v3.1.0-beta.34 completed native policy producers, action/post-action parity, runtime exchange, dependency handling, subject-source cache behavior, debug selection, and detached trace continuity.
  • v3.1.0-beta.48 through v3.1.0-beta.51 completed prerequisite contracts, Lua parity, subject dependencies, and LDAP worker-pool routing.

Security and identity continuity​

  • v3.1.0-beta.12 closed security findings across sensitive output, OIDC/SAML, MFA, decompression, Lua, database, and plugin boundaries.
  • v3.1.0-beta.13 through v3.1.0-beta.19 repaired OIDC reentry, introspection, MFA step-up state, forced enrollment, localization, and WebAuthn registration continuations.

Performance, privacy, and analytics​

  • v3.1.0-beta.23 through v3.1.0-beta.44 reduced password-history, cache, policy, snapshot, and GeoIP overhead; separated detached post-action latency; and added privacy-aware network/reputation signals.
  • Native and Lua ClickHouse paths converge on the same validated analytics schema and derive the established eight-character password_hash field only from the canonical full digest.