ProAuth 3.0.4

This release strengthens identity administration and UserStore behavior with more reliable account-locking controls, safer TOTP registration content, and consistent scope and ownership validation across the v2 APIs. It also resolves timezone-sensitive Client App secret expiry handling and refreshes platform dependencies to incorporate current upstream security fixes.

ACTION REQUIRED

Existing integrations that send valid, matching identity and scope values remain compatible. Integrations that rely on conflicting route and payload identities, incomplete role and scope combinations, or values that were previously ignored may now receive a validation response and should update their requests. (#2936) (#2939)

Maintenance Release

Internal NuGet packages, the .NET SDK, and runtime and base images have been updated to current patch and minor versions to address security advisories. This maintenance refresh introduces no major version upgrades or intended functional changes, and no customer action is required. (#2938)

Core

Core

Reliable control over permanent UserStore account locking

Permanent UserStore account locking can now be disabled for an identity provider instance by setting AttemptsBeforeUserLocked to 0. Invalid or legacy values no longer interrupt sign-in, while temporary locking and throttling continue to operate independently. Configuration validation and documentation now reflect the same runtime behavior. (#2933)

Correct persistence and validation of Client App role scopes

Management API v2 update and patch operations for ClientAppRole now persist tenant and identity provider instance scopes correctly. ProAuth also rejects invalid or incomplete role and scope combinations, preventing inconsistent authorization configurations. (#2936)

Consistent scope and ownership handling across v2 APIs

Management API v2 and UserStore API v2 now process supported entity scope, ownership, and target fields consistently during update and patch operations. This release also corrects GroupMetadata filtering and partial updates, clears incompatible scopes during role transitions, and rejects conflicting route and payload identities instead of silently ignoring them. (#2939)

Security

Security

Safer, customizable authenticator links during TOTP setup

The TOTP registration page now presents accessible links to Microsoft Authenticator, Google Authenticator, and Apple Passwords instead of displaying raw anchor markup. The customizable mfaregistration-secret-app label supports plain text and safe HTTP(S) links while preventing scripts, event handlers, unsupported HTML, malformed links, and unsafe URL schemes from becoming active content. Existing customer label overrides remain effective above the updated system fallback labels. (#2935)

Security maintenance baseline refresh

ProAuth now uses current patch and minor versions of internal NuGet packages, the .NET SDK, and runtime and base images. These updates incorporate upstream security fixes and keep the platform current without major dependency upgrades or intended product behavior changes. (#2938)

AdminApp

AdminApp

Client App secret expiry supports local timezones

Administrators using PostgreSQL can now save Client App secrets with expiry dates from non-UTC timezones. Expiry values are converted to UTC while preserving the selected instant, ensuring consistent expiration behavior regardless of the administrator's local timezone. (#2934)

Platform Stability

More dependable identity administration and authentication

This release improves sign-in resilience when legacy account-locking values are present, corrects timezone-aware secret expiry persistence, safely renders TOTP authenticator resources, and strengthens role, scope, ownership, filtering, and partial-update behavior across the v2 APIs. Updated platform dependencies further reduce exposure to upstream security advisories. (#2933) (#2934) (#2935) (#2936) (#2938) (#2939)