📦 About this release
Configure exactly how users authenticate with multi-step MFA, including FIDO2 security keys. Administrators have full control over MFA flows for each location, with stronger authentication options for high-security environments.
Users can now configure their Multi-Factor Authentication (MFA) factors directly in the desktop application at any time, even after enrolment. Admins can enforce stronger security without disrupting access, while users manage their authentication seamlessly.
The Mobile Client has also been redesigned, joining the rest of the refreshed Defguard family.
✨ What's new
- Multi-step configurable MFA methods - build MFA flows from ordered steps, each with the factors allowed to pass it, enforce them per location and assign different flows to selected groups.
- Use FIDO2 hardware key as MFA factor - add it using the Desktop Client, configure an MFA Flow with FIDO2 Security Key factor, assign it to your location and connect using the latest Desktop Client.
- Configuring MFA factors in the Desktop Client - when a location requires an MFA method a user hasn't set up, the desktop client shows Configure MFA and guides them through the setup, without re-enrolling the instance. Users can also add more methods at any time.
- Bulk actions for Firewall module - select several rules to enable, disable, deploy or delete them at once.
- Handling multiple locations with DNS configuration connected simultaneously - each connected location's domains are resolved by that location's DNS servers, so users can stay connected to several locations at the same time.
- Ability to apply custom MTU to the client apps - set the MTU sent to the client apps per location, with group-level overrides for selected groups.
- Automatic WireGuard interface metric on Windows - in all traffic mode, the tunnel interface gets the highest priority to prevent traffic and DNS leaks outside the VPN.
- Bulk action to put enrolment token in Active Directory for the auto-provisioning process - select users and store their enrollment tokens in an Active Directory attribute in one step, ready for client auto-provisioning.
- Completely redesigned Mobile Client - update from Google Play, the App Store, or use the assets from the mobile release.
|
🧪 How to test
🚀 Quickly run the latest server components using one-line-script. For production deployments check this guide.
🔄 Worried that your users have to upgrade the client applications? Here you can check the client vs server feature compatibility matrix.
🙋 Feedback
We want to get as much feedback as possible, so we encourage you to:
💬 open a GitHub discussion
🪲 report any missing features or bugs as issues
Full changelog
- add multi-step MFA flow management API by @wojcik91 in #3535
- update proto submodule by @wojcik91 in #3538
- Update model_derive by @moubctez in #3548
- implement client version gate for multi-step MFA locations by @wojcik91 in #3554
- Mfa flow editor by @j-chmielewski in #3551
- implement MFA session DB store by @wojcik91 in #3577
- Mfa flow fixes by @j-chmielewski in #3584
- multi-step MFA engine MVP by @wojcik91 in #3591
- Atomic postures and mfa-flows assignments by @j-chmielewski in #3590
- fix mfa editor spacing issue by @j-chmielewski in #3602
- Stable to dev by @moubctez in #3642
- Assign MFA flows to locations by @t-aleksander in #3609
- ACL bulk actions by @t-aleksander in #3644
- Show in the location settings when a configured MFA flow becomes unusuable by @t-aleksander in #3647
- Fido2 by @moubctez in #3593
- utoipa is an option by @moubctez in #3650
- Optimise by @moubctez in #3652
- handle remote-auth methods in multi-step MFA flows by @wojcik91 in #3657
- Fix ghost rows being left behind in MFA flow assignment by @t-aleksander in #3659
- Attempt at fixing e2e tests by @t-aleksander in #3667
- Settings details in activity log by @moubctez in #3653
- Configure MFA methods on demand via client by @t-aleksander in #3656
- Switch to PNPM 12 and fix LogDetailDrawer by @moubctez in #3675
- Re-order activity log columns by @moubctez in #3679
- Update sqlx to 0.9 by @moubctez in #3681
- fix: don't emit failure event for each OIDC finish poll by @wojcik91 in #3684
- Client MTU by @moubctez in #3686
- Clean before alpha release by @moubctez in #3690
- chore: port LDAP firewall update fix from stable by @wojcik91 in #3692
- register fido2 factor via desktop client by @filipslezaklab in #3689
- Load-testing-related performance improvements by @j-chmielewski in #3697
- Disallow CIDR of /31 and fix address range handling by @moubctez in #3708
- Load generator by @j-chmielewski in #3702
- MFA flow minor fixes by @t-aleksander in #3711
- Add RPC to end an mfa configuration session by @t-aleksander in #3680
- logout all web sessions on password reset via Edge by @wojcik91 in #3757
- Duplicate Firewall rules (Aliases/Destinations/Rules) by @jakub-tldr in #3760
- LDAP enrolment token by @moubctez in #3759
- Change Location "Allowed IPs" from a single line text entry field to a managed table by @jakub-tldr in #3764
- Commit Gateway commands after database transaction by @moubctez in #3767
- fix(LDAP): sync users in "Pending" state by @wojcik91 in #3775
- Authorize configure mfa flow with fido2, oidc by @filipslezaklab in #3765
- Fix duplicated display of ACL rule names, fix autofill input color on safari by @t-aleksander in #3766
- Attemp to automate the release process where possible by @t-aleksander in #3726
- MFA flow assignment in location wizard by @j-chmielewski in #3769
- Warn before removing SMTP config when MFA flows use email codes by @j-chmielewski in #3778
- Forward OIDC provider kind to proxy by @jakub-tldr in #3784
- fix: improve UX when removing SMTP is blocked by @wojcik91 in #3776
- fix gateway trim logic on license expiry by @wojcik91 in #3793
- send mfa capabilties to client by @filipslezaklab in #3792
- MFA flow load testing by @j-chmielewski in #3791
- Block duplicated MFA Flow name by @jakub-tldr in #3795
- Add OpenID kind to InstanceInfo by @jakub-tldr in #3799
- Rate limit for MFA flow endpoints, refactor throttling by @t-aleksander in #3737
- Group MTU by @moubctez in #3789
- Add an information when flows for location are blocked by instance config by @filipslezaklab in #3801
- E2E tests for rate limits by @t-aleksander in #3805
- Group MTU take 2 by @moubctez in #3806
- Store JSON in LDAP by @moubctez in #3809
- Port recent LDAP fixes from stable to dev by @t-aleksander in #3813
- split MFA flows from legacy MFA at contract level by @wojcik91 in #3797
- send openid and smtp configured flag via instance-info by @filipslezaklab in #3804
- Remove secret values from API responses by @jakub-tldr in #3816
- Fix flow cards by @filipslezaklab in #3812
- Fix tests on the dev branch by @t-aleksander in #3819
- Adjust e2e tests to new mfa flows by @t-aleksander in #3821
- port ignore for release from the dev branch by @t-aleksander in #3824
- Add new user active statuses for Okta (#3817) by @t-aleksander in #3830
- fix legacy mobile approve gate for multi-step sessions by @wojcik91 in #3834
- remove defguard_common dependency from defguard_grpc_tls crate by @wojcik91 in #3833
- Gateway events by @moubctez in #3848
- fix mfa tooltip by @j-chmielewski in #3857
- Support page fixes by @jakub-tldr in #3864
- redact WireGuard peer PSK in Debug output by @wojcik91 in #3854
- MFA tooltip tweaks by @j-chmielewski in #3863
- Ci load tests by @j-chmielewski in #3853
- Fix MFA Flow button phasing by @jakub-tldr in #3866
- Fix permissions to allow load-test workflow alerts by @j-chmielewski in #3865
- allow default MFA flow delete if related locations have MFA disabled by @wojcik91 in #3861
- Copy fixes by @j-chmielewski in #3867
- Always load the license into the memory by @t-aleksander in #3860
- Ensure Defguard and Public urls differ by @j-chmielewski in #3871
- Show error message if OIDC login fails by @t-aleksander in #3873
- Add desktop and mobile v2.2 as posture-check option by @j-chmielewski in #3875
- Server check clients use only hardware keys for fido2 factor by @filipslezaklab in #3878
- Display OpenID provider icon on login page by @jakub-tldr in #3893
- cleanups by @moubctez in #3859
- Fix distinct urls by @j-chmielewski in #3898
- MFA flow additional details in table by @t-aleksander in #3889
- Edge error codes during OIDC flow by @t-aleksander in #3879
- group MTU UI fixes by @wojcik91 in #3899
- Profile auth update by @filipslezaklab in #3904
- review fixes for fido2 tool by @filipslezaklab in #3909
- Ldap migration wizard by @j-chmielewski in #3887
- responsive login layout by @filipslezaklab in #3908
- Improve wizard tests by @jakub-tldr in #3921
- Add posture check explanations by @j-chmielewski in #3922
- update profile menu items style by @filipslezaklab in #3923
- Fix posture checks UI by @jakub-tldr in #3928
- Move fido code on dev by @t-aleksander in #3926
- Fix wrong font size on mfa flow deletion warning modal by @t-aleksander in #3931
- fix gitignore by @filipslezaklab in #3934
- Pin dependencies (dev) by @renovate[bot] in #3942
- Security patches (dev) by @renovate[bot] in #3936
- Bump ctutils by @t-aleksander in #3947
- port graceful shutdown fix from stable by @wojcik91 in #3930
- fix ui for selection of mfa flow for location by @filipslezaklab in #3944
- Tie registered attested passkey to cert by @filipslezaklab in #3927
- Fix single step MFA locations without license by @t-aleksander in #3945
- Show details for LDAP test connection failure by @t-aleksander in #3943
- ui profile fixes by @filipslezaklab in #3952
- Mark email mfa as unavailable when SMTP becomes disabled by @t-aleksander in #3946
- Handle outdated mobile app during remote approve by @j-chmielewski in #3951
- Fix 403 error after user switch by @j-chmielewski in #3953
- DG220-4: [core] Unauthenticated SSH Key Exposure for Deactivated Accounts by @wojcik91 in #3961
- Treat spaces in password as special character by @jakub-tldr in #3966
- DG220-3: [core] Settings Update Silently Clears JWT and OIDC Signing Keys by @wojcik91 in #3967
- profile empty states by @filipslezaklab in #3970
- fix cargo deny by @filipslezaklab in #3971
- Show correct firewall state with inactive license by @jakub-tldr in #3973
- Use unified component in modals by @jakub-tldr in #3975
- Fido2 feature flags by @t-aleksander in #3977
- Show specific error when MFA setup fails by @j-chmielewski in #3974
- Add multiselect to ACL components by @jakub-tldr in #3978
- update labels by @filipslezaklab in #3981
- add MFA flows e2e tests by @wojcik91 in #3982
- update trusted authenticators db by @filipslezaklab in #3996
Full Changelog: v2.1.0...v2.2.0