Skip to content
IdentityScribe

All versions since v3.2.0 (2026-09-18)

All versions

v3.2.0 (2026-09-18) Latest

Added

  • Technical accounts can authenticate locally — Configure one or more local accounts with a DN, password, and optional short-name alias for LDAP, HTTP Basic, or browser login without a backend authentication round trip. Forwarded LDAP operations use the account’s explicit backend credentials or the root LDAP credentials as a complete pair, and disabled delegation fails before a backend connection is opened.
  • Thread dumps from a running service — Sending the quit signal (kill -3) now writes every thread’s state and code location to the service output and lets the process carry on serving. Operators can see what a stalled instance is waiting on without restarting it, and the dump holds no directory entries or credentials. Earlier versions shut down on that signal.

Changed

  • Authentication settings keep their method scope — LDAP and ROPC cache lifetimes, disabled caching, and token-expiry revalidation now apply to the selected authentication method. Concurrent checks for the same backend credentials share bounded work; local passwords are never cached, and bearer validation remains unchanged.

Fixed

  • LDAP sign-ins stop waiting indefinitely — Authentication and identity lookups now have a ten-second default timeout, with limited simultaneous upstream work. Configure auth.ldap.request-timeout from 1 millisecond to 1 minute. Brief bursts can wait up to two seconds at each capacity limit within the authentication deadline. The default pending limit is 256 callers, including those joining a check for the same credential. Size auth.ldap.max-pending for the client connections that may bind within one upstream authentication round-trip, such as a client pool reconnecting after a restart; adjust waiting with auth.ldap.capacity-wait. Capacity rejections return LDAP busy (51), and authentication timeouts return unavailable (52); HTTP Basic sign-ins return 503 for either. These temporary failures skip the credential-failure delay. Invalid credentials retain LDAP 49, HTTP 401, and their configured minimum response duration.