New Features
OIDC Authentication
- Support for Authelia, Authentik, and generic OIDC providers
- PKCE (Proof Key for Code Exchange) for enhanced security
- Multiple OIDC providers per user
- Seamless integration with existing authentication flow
WebAuthn Passkey Authentication
- Platform authenticators (Touch ID, Windows Hello, Face ID)
- Roaming authenticators (YubiKey, USB security keys)
- Multiple passkeys per user
- Passwordless authentication support
Authentication Flexibility
- Password removal capability when alternative auth methods exist
- Account cleanup for failed passkey setup
- Mixed authentication method support per user
Security Fixes
- P0: Authentication bypass prevention in registration endpoint
- P1: Race condition fixes in user creation and OIDC callback
- P1: Passkey deletion validation (requires alternative auth)
- P1: Permanent lockout prevention during initial setup
- P1: Passkey setup rollback capability
- Enhancement: YubiKey and roaming authenticator support
Documentation
- Comprehensive AUTHENTICATION.md guide
- Setup instructions for all authentication methods
- Security best practices
Breaking Changes
None - all changes are backwards compatible with existing password authentication.
Full Changelog: v2.1.1...v2.2.0