NeySlim/ultimate-ca-manager v2.174

on GitHub

[2.173] - 2026-06-17

Changed

• SSO identity is now the directory's stable identifier, never the email — OIDC sub, SAML persistent NameID, or LDAP entryUUID/objectGUID (configurable per provider, auto-detected by default). Accounts are recognised across username/email changes, and the email is never an authentication key (removes account-takeover risk). An SSO login whose email matches a local account now provisions a separate SSO account instead of erroring; an administrator can still merge them via Link to SSO, which no longer renames the local username (#136, #138).
• Backups — the backup list is paginated, searchable and sortable, with multi-select bulk delete, a usage summary (count, total size, free disk) and a Clean up now action. Retention is always visible (no longer hidden behind the automatic-backup toggle) and is enforced daily even when automatic backups are off.

Fixed

• Backups could fill the disk — pre-migration database snapshots are now capped to the most recent few, and backup retention runs as its own scheduled task (previously it only ran after a scheduled backup, so manual backups accumulated indefinitely).

[2.172] - 2026-06-16

Fixed

• SSO login with an email that already exists — an SSO (LDAP/OAuth2/SAML) login whose email matches an existing account no longer returns an Internal Server Error. Instead of silently merging on email (an account-takeover risk) or creating a duplicate, the login is refused with a clear message, and an administrator can deliberately link the two from Users › Link to SSO (new link-sso/unlink-sso actions). One account per email is preserved (#136).
• Key-recovery dual control is now configurable — a Settings › Security toggle enables/disables four-eyes control for private-key recovery, and KEY_RECOVERY_DUAL_CONTROL in the service environment overrides it (an explicit false/0/no disables it, and the toggle is shown read-only). Previously the setting could not be changed from the UI and the environment value was ignored (#137).

Full history: CHANGELOG.md