Skip to content

ProAuth 3.3.0 is available

Explore ProAuth 3.3.0, including API step-up, token exchange, federation claim controls, repeatable YAML imports and image digest pinning by default in Helm.

Release note2 min readMarc Müller
Back to blog
On this page

We released ProAuth 3.3.0 on November 12. This version gives application teams more control over API access and the identity data each application receives. It also updates how administrators provision ProAuth, deploy it on Kubernetes and manage sign-out.

What’s new in 3.3.0

  • API security. A protected API can request stronger authentication for an individual operation. When one API calls another on a user’s behalf, a token exchange policy can limit which API the new token reaches, what it permits and how long it lasts.
  • Federation claims. Administrators in every edition can choose which raw claims from an external identity provider each client application may receive. They can specify the claim names directly without writing custom rules.
  • YAML provisioning. When you reimport a role assignment with the same settings, the CLI keeps its existing ID and permissions. The CLI also checks who owns an existing child resource before updating it and stops the operation if the manifest names a different parent.
  • Kubernetes deployments. By default, the Core and AdminApp Helm charts pin application and Job images by digest, so each deployment uses the exact images specified for that release. ProAuth signs its release images, and cluster operators can enforce signature verification. For TLS between an Ingress or Gateway and the ProAuth containers, teams can use an existing Kubernetes TLS Secret or a certificate managed by cert-manager. If an AdminApp view deployment fails, the logs identify the stage that needs attention.
  • Sign-out and account management. Users can sign out of AdminApp and keep working in other applications, or end browser single sign-on. The account pages also make passkey registration easier to find and give active session details more room on mobile.

Upgrading to 3.3.0

We found that some migrations from ProAuth 2.x to 3.x left role assignments behind. We fixed this in 3.3.0. If your installation was affected, you can use the CLI to preview the missing assignments and choose which to restore.

Before migrating the database, run the duplicate-option check for SQL Server or PostgreSQL. The full ProAuth 3.3.0 release notes include the scripts, client upgrade order, token exchange compatibility changes and Helm settings to review.

Image detail