<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="21">
<package pkgid="ab89eed3f99f9bd9523ddd3530b37cffd8ac66fe423e75a569a247ac2c753bbb" name="kanidm" arch="aarch64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="33b4c830aea24c89c0471cd83267a513d17681924e7615859973469a4d460bd2" name="kanidm" arch="src">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="52a66f44af368a5d7a98ce47c78b83142ccde4bc0a1762809d053e2e4da1917c" name="kanidm" arch="x86_64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="75cfdca0bee8ec2035b02a5c0e255862e39598d8e8b1b73d854070d388e9494f" name="kanidm-clients" arch="aarch64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="c64c7b3bd996254a2e29f51e4eb2f14584b400a698d6112af2b9ffbebd314fa9" name="kanidm-clients" arch="x86_64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="c12d2e0b915e143a6469398b8da373c27125c5d1a0c65842aecd6245e2ce1964" name="kanidm-clients-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="354a4aaaa07762dcc80a6c8a3e26a1be0ebdf8d05d198da55ccf122364114aa5" name="kanidm-clients-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="3f68f5e0777a15b50b359f5a18aa1b21b744969aef9e6adeb0b20875302845ea" name="kanidm-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="e8cb9a82d284faca1009ebfcba39a97583ffa2ecd3c4e2936b978f7527985b0e" name="kanidm-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="c01116d1784fdc568bb8511d218e0b9205891a55ddb091858f2a63ead95529f6" name="kanidm-debugsource" arch="aarch64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="cae68300a97f10996a96a49054cd2d4bd3f79b0f3589b3e36a0a0e9c68ae3bc6" name="kanidm-debugsource" arch="x86_64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="298d170699ff00b7d5c1b06620c7605a8ebae7eec45cb19410687162e8942a2e" name="kanidm-docs" arch="aarch64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="40b12345bdc9493ab06ad00bc27b0adbee54a2ebc8c12a3b8f77a028d8ceed60" name="kanidm-docs" arch="x86_64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="42c2d32b3ab40b6f361a3c442692ca94e62e1aa910f542436ebad7ab969e67de" name="kanidm-server" arch="aarch64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="96ad766c3e28ea438d79c37bfd9bcf766e71c8c2a86b54c931ab9985276264fa" name="kanidm-server" arch="x86_64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="a88fd8b2fa42b035dc3feccb932c3a19924bbdfaa960c0d6bf6887ede5118307" name="kanidm-server-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="176a3a7ea81dbb8732cb052fbbfa02fe8ff61e2a1848c74b9fdb58c09537f692" name="kanidm-server-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="0f3eee55ddb631f1084bdddb83811457ef3a35d691f6bf650c3a24a907d72062" name="kanidm-unixd-clients" arch="aarch64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="c8243f218ac4b3e7717da35404e31280a148efab67e63d6e9a63d8a94513765b" name="kanidm-unixd-clients" arch="x86_64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="1b7f52ca33c8187410c23b07e0f329207951e2786b450fd460d97206e69c5796" name="kanidm-unixd-clients-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
<package pkgid="1162c158a75cac850ecc692be87294253eb39a5c9ce979953bd1b5826ef52708" name="kanidm-unixd-clients-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.6.4~git2.a4b3b0f7b" rel="bp157.2.3.1"/>
  <changelog author="william.brown@suse.com" date="1730635200">- Update to version 1.4.0~git2.770efa8:
  * Resolve incorrect handling of rhost in pam (#3171)</changelog>
  <changelog author="william.brown@suse.com" date="1730808000">- Update to version 1.4.1~git0.ad93202:
  * Release 1.4.1
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)</changelog>
  <changelog author="william.brown@suse.com" date="1732276800">- Update to version 1.4.3~git0.fb00176:
  * Release 1.4.3
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Release 1.4.2
  * Re-migrate all acps to force updating (#3184)
  * security - low - fault in migrations (#3182)</changelog>
  <changelog author="william.brown@suse.com" date="1732276801">- Update to version 1.4.3~git1.078625c:
  * Update to latest fido-mds-tool (#3230)</changelog>
  <changelog author="william.brown@suse.com" date="1733227200">- Update to version 1.4.4~git0.c3dbf83:
  * Release 1.4.4
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * Clear invalid tokens from unix resolver (#3256)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Yaleman/issue3229 (#3239)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1733918400">- Require system-user-nobody to prevent install ordering issue with
  invalid rpc/statd users</changelog>
  <changelog author="william.brown@suse.com" date="1734782400">- Update to version 1.4.5~git0.a7fabde:
  * Release 1.4.5
  * nss/pam resolver should reauth faster (#3309)
  * Further SCIM sync testing, minor fixes (#3305)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Add CORS headers to jwks and userinfo (#3283)</changelog>
  <changelog author="william.brown@suse.com" date="1737633600">- Update to version 1.4.6~git0.3ce4e0f:
  * Release 1.4.6
  * Small UI updates. (#3361)
  * Allow modification of password minimum length (#3345)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * cookies don't clear unless you set domain (#3332)</changelog>
  <changelog author="william.brown@suse.com" date="1739275200">- Update to version 1.4.6~git1.3f47d7f:
  * fix: PAM on Debian, enable use_first_pass by default (#3326)</changelog>
  <changelog author="william.brown@suse.com" date="1739275201">- Update to version 1.5.0~git1.0fa57fc:
  * Update makefile for docker
  * Release 1.5.0
  * 20250209 pre release (#3409)
  * 20250206 freebsd ports (#3404)
  * Resolve kanidm-unix auth-test bug (#3405)
  * chore: Remove empty scopemaps (#3170)
  * Feat: Allowing spn query with non-spn structured data in LDAP (#3400)
  * SSH Keys in Credentials Update (#3027)
  * 20250205 3369 firefox pin (#3403)
  * Correctly return that uuid2spn changed on domain rename (#3402)
  * Fix the password reset form and possible resolver issue (#3398)
  * Add handle_group_error to cli client (#3399)
  * Improve spans in unixd (#3397)
  * Allow OAuth2 with empty state parameter (#3396)
  * #3387 - RADIUS Startup fixin's (#3388)
  * Allow POST on oauth userinfo (#3395)
  * OpenBSD support (#3381)
  * Bump openssl from 0.10.69 to 0.10.70 in the cargo group (#3391)
  * Add /.well-known/change-password endpoint (#3382)
  * Bump the all group across 1 directory with 7 updates (#3385)
  * extend oauth2 examples with gitea (#3351)
  * Bump the all group with 22 updates (#3376)
  * Book: Added small section on primary cred fallback (#3365)
  * Added shell.nix to create dev environment (#3362)
  * fix(ci): Add setup-oras step to include ORAS CLI for container builds on ubuntu-24.04. (#3368)
  * 20250114 3325 SCIM access control (#3359)
  * Small UI updates. (#3361)
  * Bump the all group in /pykanidm with 2 updates (#3366)
  * Repair systemd reload notifications (#3355)
  * fix: unrecoverable error page doesn't include logo or domain name (#3352)
  * Bump jinja2 from 3.1.4 to 3.1.5 in /pykanidm in the pip group (#3358)
  * Bump the all group in /pykanidm with 4 updates (#3356)
  * 20250110 eo fixes (#3353)
  * fix(server/config): reduce string allocations (#3350)
  * Add ssh_publickeys as a claim for oauth2 (#3346)
  * Allow modification of password minimum length (#3345)
  * Add OAuth2 `response_mode=fragment` (#3335)
  * Resolve passkey regression (#3343)
  * Renaming "TOTP" in the login flow (#3338)
  * Bump the all group in /pykanidm with 3 updates (#3339)
  * Bump actions/checkout from 2 to 4 in the all group (#3341)
  * Add support for prefers-color-scheme using Bootstrap classes. (#3327)
  * Fix /var/run/kanidm-unixd permission (#3342)
  * Javascript linting (#3329)
  * Ignore anonymous in oauth2 read allow access (#3336)
  * cookies don't clear unless you set domain (#3332)
  * 20250102 freebsd client (#3333)
  * fix: PAM on Debian, enable use_first_pass by default (#3326)
  * Bump the all group with 6 updates (#3324)
  * Bump the all group in /pykanidm with 2 updates (#3323)
  * Bump the all group with 3 updates (#3317)
  * Bump the all group in /pykanidm with 7 updates (#3316)
  * nss/pam resolver should reauth faster (#3309)
  * Update to latest webauthn-rs/time (#3315)
  * kanidm-unixd example config enfixening (#3314)
  * Further SCIM sync testing, minor fixes (#3305)
  * book: explain how to use fido-mds-tool (#3231)
  * client: read attestation CA list JSON from file (#3232)
  * Automatically trigger passkeys on login view (#3307)
  * Re-add enrol another device flow
  * Improved Cookie Removal
  * Allow opt-in of easter eggs (#3308)
  * Allow reseting account policy values to defaults (#3306)
  * Incorrect member name in groups (#3302)
  * SCIM Sync Missing Annotation (#3300)
  * Ignore system users for UPG synthesiseation (#3297)
  * Limit OAuth2 resumption to session (#3296)
  * Use specific errors for intent token revoked (#3291)
  * Autocomplete password during reauth with TOTP (#3290)
  * Bump the all group with 6 updates (#3294)
  * Bump mozilla-actions/sccache-action from 0.0.6 to 0.0.7 in the all group (#3295)
  * Bump the all group in /pykanidm with 2 updates (#3293)
  * remove unused webauthn features. (#3286)
  * Add CORS headers to jwks and userinfo (#3283)
  * Cleanup webauthn features (#3285)
  * Minor tweaks to cred reset ui (#3284)
  * Bump the all group across 1 directory with 6 updates (#3280)
  * Allow group managers to modify entry-managed-by (#3272)
  * pykanidm: Make a little dry. (#3281)
  * Bump the all group with 5 updates (#3278)
  * pykanidm: Add retrieving credential reset token for a person. (#3279)
  * Cleanup of println and other outputs (#3266)
  * Canonicalize path for user shell check (#3265)
  * Check DNS on replication loop start not at task start (#3243)
  * Work around systemd race condition (#3262)
  * fix(docstrings): minor lack of formatting breaking things (#3260)
  * Devcontainertainertainer (#3251)
  * grafana: update example to work with strict redirect uri checking (#3259)
  * Bump the all group in /pykanidm with 5 updates (#3257)
  * Bump the all group with 6 updates (#3258)
  * 20240927 SCIM put (#3151)
  * Clear invalid tokens from unix resolver (#3256)
  * Clippy Lints (#3255)
  * Allow OAuth2 loopback redirects if the path matches (#3252)
  * Correctly display domain name on login (#3254)
  * Display account_id during success/deny paths in unixd (#3253)
  * s/idm_people_self_write_mail/idm_people_self_mail_write/g (#3250)
  * handle missing map_group setting in config (#3242)
  * owncloud: Add SameSite=Lax config for cross-domain auth (#3245)
  * Bump the all group across 1 directory with 7 updates (#3238)
  * Yaleman/issue3229 (#3239)
  * Bump the all group across 1 directory with 12 updates (#3235)
  * Update to latest fido-mds-tool (#3230)
  * Warn when v2 options are used in v1 unixd config (#3228)
  * Bump aiohttp from 3.10.10 to 3.10.11 in /pykanidm in the pip group (#3223)
  * Resolve UI Auth Loop with OAuth2 (#3226)
  * Harden transport in pam unixd (#3227)
  * Improve warning around invalid JWT deserialisation (#3224)
  * Update and fix server config files in examples. (#3225)
  * Change CLI oauth2 command from set-display-name to set-displayname for consistency. (#3212)
  * Add docs on customising Kanidm. (#3209)
  * Correct spelling of occurred (#3222)
  * Bump the all group across 1 directory with 13 updates (#3202)
  * UI/Feature polish (#3191)
  * Prevent Invalid MFA Reg States (#3194)
  * Change CSS for applications so SVG scales nicely in Firefox. (#3200)
  * 20241109 3185 max age (#3196)
  * Hoist max_age to prevent incorrect deserialisation (#3190)
  * Use correct oauth2 manage acp (#3186)
  * Re-migrate all acps to force updating (#3184)
  * Bump the all group across 1 directory with 2 updates (#3180)
  * security - low - fault in migrations (#3182)
  * fix(kanidmd): Print replication cert to stdout (#3179)
  * Correct missing CSP header (#3177)
  * Resolve pam services not always having a tty (#3176)
  * Resolve incorrect handling of rhost in pam (#3171)
  * chore: Made oauth2 scopes required in CLI (#3165)
  * More "choosing a domain" revision (#3161)
  * Bump jsonschema from 0.21.0 to 0.26.0 in the all group (#3157)
  * Update missing inputmode numeric when adding a new TOTP. (#3160)
  * Improve OAuth2 authorisation ux (#3158)
  * Fix attribute scim sync attribute naming (#3159)
  * Change to text input and use numeric mode for TOTP prompts. (#3154)
  * Bump the all group in /pykanidm with 3 updates (#3156)
  * Fix release note date and typos (#3153)
  * Begin 1.5.0 Development Cycle (#3150)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1739620800">- Fix building on CentOS_9</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1740139200">- Enable aarch64 for Fedora/Centos</changelog>
  <changelog author="william.brown@suse.com" date="1746619200">- Update to version 1.5.0~git2.21c2a1bd0:
  * fix: documentation fail (#3555)</changelog>
  <changelog author="william.brown@suse.com" date="1746619201">- Update to version 1.6.0~git0.d7ae0f336:
  * Release 1.6.0
  * Avoid openssl for md4
  * Fixes #3586, inverts the navbar button color (#3593)
  * Release 1.6.0-pre
  * chore: Release Notes (#3588)
  * Do not require instances to exist during optional config load (#3591)
  * Fix std::fmt::Display for some objects (#3587)
  * Drop fernet in favour of JWE (#3577)
  * docs: document how to configure oauth2 for opkssh (#3566)
  * Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  * Bump the all group in /pykanidm with 2 updates (#3581)
  * Update dependencies, fix a bunch of clippy lints (#3576)
  * Support spaces in ssh key comments (#3575)
  * 20250402 3423 proxy protocol (#3542)
  * fix(web): Preserve SSH key content on form validation error (#3574)
  * Bump the all group in /pykanidm with 3 updates (#3572)
  * Bump the all group in /pykanidm with 2 updates (#3564)
  * Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  * Improve token handling (#3553)
  * Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  * Update fs4 and improve klock handling (#3551)
  * Less footguns (#3552)
  * Unify unix config parser (#3533)
  * Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  * Bump the all group in /pykanidm with 8 updates (#3547)
  * implement notify-reload protocol (#3540)
  * Allow versioning of server configs (#3515)
  * 20250314 remove protected plugin (#3504)
  * Bump the all group with 10 updates (#3539)
  * Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  * Bump the all group in /pykanidm with 4 updates (#3537)
  * Add max_ber_size to freeipa sync (#3530)
  * Bump the all group in /pykanidm with 5 updates (#3524)
  * Update Concread
  * Update developer_ethics.md (#3520)
  * Update examples.md (#3519)
  * Make schema indexing a boolean instead of index types (#3517)
  * Add missing lld dependency and fix syntax typo (#3490)
  * Update shell.nix to work with stable nixpkgs (#3514)
  * Improve unixd tasks channel comments (#3510)
  * Update kanidm_ppa_automation reference to latest (#3512)
  * Add set-description to group tooling (#3511)
  * packaging: Add kanidmd deb package, update documentation (#3506)
  * Bump the all group in /pykanidm with 5 updates (#3508)
  * 20250313 unixd system cache (#3501)
  * Support rfc2307 memberUid in sync operations. (#3466)
  * Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  * Update Traefik config example to remove invalid label (#3500)
  * Add uid/gid allocation table (#3498)
  * 20250225 ldap testing in testkit (#3460)
  * Bump the all group in /pykanidm with 5 updates (#3494)
  * Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  * Handle form-post as a response mode (#3467)
  * book: fix english (#3487)
  * Correct paths with Kanidm Tools Container (#3486)
  * 20250225 improve test performance (#3459)
  * Bump the all group in /pykanidm with 8 updates (#3484)
  * Use lld by default on linux (#3477)
  * 20250213 patch used wrong acp (#3432)
  * Android support (#3475)
  * Changed all CI/CD builds to locked (#3471)
  * Make it a bit clearer that providers are needed (#3468)
  * Fix incorrect credential generation in radius docs (#3465)
  * Add crypt formats for password import (#3458)
  * build: Create daemon image from scratch (#3452)
  * address webfinger doc feedbacks (#3446)
  * Bump the all group across 1 directory with 5 updates (#3453)
  * [htmx] Admin ui for groups and users management (#3019)
  * Fixes #3406: add configurable maximum queryable attributes for LDAP (#3431)
  * Accept invalid certs and fix token_cache_path (#3439)
  * Accept lowercase ldap pwd hashes (#3444)
  * TOTP label verification (#3419)
  * Rewrite WebFinger docs (#3443)
  * doc: fix formatting of URL table, remove Caddyfile instructions (#3442)
  * book: add OAuth2 Proxy example (#3434)
  * Exempt idm_admin and admin from denied names. (#3429)
  * Book fixes (#3433)
  * ci: uniform Docker builds (#3430)
  * 20240213 3413 domain displayname (#3425)
  * Correct path to kanidm config example in documentation. (#3424)
  * Support redirect uris with query parameters (#3422)
  * Update to 1.6.0-dev (#3418)
  * Remove white background from square logo. (#3417)
  * feat: Added webfinger implementation (#3410)
  * Bump the all group in /pykanidm with 7 updates (#3412)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1746619202">- bsc#1242642 - CVE-2025-3416 - openssl use after free</changelog>
  <changelog author="william.brown@suse.com" date="1746705600">- Update to version 1.6.1~git0.2e4429eca:
  * Release 1.6.1
  * Resolve reload of oauth2 on startup (#3604)</changelog>
  <changelog author="william.brown@suse.com" date="1746792000">- Update to version 1.6.2~git0.a20663ea8:
  * Release 1.6.2
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings</changelog>
  <changelog author="william.brown@suse.com" date="1747224000">- Update to version 1.6.3~git0.389493eb1:
  * Release 1.6.3
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * cargo publish (#3613)</changelog>
  <changelog author="william.brown@suse.com" date="1749643200">- Update to version 1.6.4~git0.e1d26ed10:
  * Release 1.6.4
  * Allow deferring spans in unixd
  * Dark mode improvements (#3660)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Fix healthcheck to use ENV for config path (#3656)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)</changelog>
  <changelog author="william.brown@suse.com" date="1749729600">- Update to version 1.6.4~git2.a4b3b0f7b:
  * Remove dead code
  * OpenSUSE build fix</changelog>
</package>
</otherdata>