TideCloak 0.14.0
Summary
TideCloak 0.14.0 is a major feature release spanning nearly every component of the stack. It introduces the embedded Tide Admin Console, VRK-signed self-registration and invitation flows, mTLS-bound delegation tokens, and Tide Vault encryption endpoints. It also lands end-to-end W3C distributed tracing, RFC 9457 Problem Details errors with stable codes, comprehensive metrics instrumentation, expanded IGA governance, restored Ragnarök offboarding, a new ORK TokenValidationEngine, and Keycloak 26.7.0 compatibility across the stack.
Key Features
Embedded Tide Admin Console : The IdP now ships with a first-class embedded Tide Admin Console, integrated directly into the repository instead of a submodule. Includes automated client provisioning, bootstrap support, approval flows, configurable realm branding with validated image uploads and versioned asset URLs, and policy management tooling.
Self-Registration & Invitation Flows : New VRK-signed user-identity attestation supports both self-registration and invite-based enrolment. Signed RegOn settings ship with freshness validation, default-role enforcement, and restricted-attribute controls, plus reusable invitation links and correct routing between invite and self-registration ceremonies.
mTLS-bound Delegation Tokens : Added secure, mTLS-bound delegation token exchange with scoped role filtering and support for common reverse-proxy certificate headers, so delegation works cleanly behind Nginx, Envoy, and similar. ORK now signs a full family of token types — access, ID, DPoP-bound, delegation, service-account, transient, and refresh.
Tide Vault Endpoints : Midgard exposes new Tide Vault encryption and decryption endpoints, opening a new integration surface for vault-style data protection.
W3C Distributed Tracing : End-to-end traceparent propagation across HTTP clients, JNI exports, Midgard Java wrappers, ORK inbound and outbound requests, remote exceptions, logs, and error envelopes. Trace context is preserved through --FAILED-- failure envelopes for full request lineage, with values sanitised before header injection.
Structured Problem Details Errors : RFC 9457 Problem Details responses across the stack, with stable TIDE-ORK-* error codes and message-key support. Case-tolerant parsing and application/problem+json pass-through in tide-js. New client-side enclave error interface with diagnostic reporting, plus secure unanimous error-code promotion for concurrent PromiseRace failures.
Metrics Instrumentation : Micrometer per-operation timers in the Midgard Java facade; login/voucher/VRK scheduled-task metrics in the IdP; a comprehensive .NET metrics suite in ORK covering cryptographic, protocol, network, master-node, Forseti, HTTP, and runtime operations; and new Tide.Master metrics for SubmitUser lock contention in master-libs. ORK also standardised on structured ECS logging with configurable ECS-or-text console output.
Approval Enclave UX Overhaul : Plain-language approval cards for ServerCert:1, vrkEnc:1, vrkDec:1, and AttestationUnit:1, with human-readable titles, role and user names, and action-neutral summaries. Approval actions are now rendered from signed canonical request bytes to prevent misleading grant descriptions.
Expanded IGA Governance : IGA functionality consolidated into a single iga-core module. Added DELETE_REALM change requests for governed realm deletion using the standard admin quorum. New governance for client creation, deletion, settings, and origin URL changes, with multi-field updates coalesced into single change requests to prevent self-conflicting 409 loops. Automatic IdP settings re-signing after governed client changes. CREATE_CLIENT now covers the complete owned attestation-unit family.
Ragnarök Restored : Governed realm offboarding is functional again — backup enablement, minimum three-admin quorum, admin-quorum doken support, commit-time execution, and best-effort password-reset emails for all users after offboarding (with required-action fallback when email delivery is unavailable).
TokenValidationEngine : New ORK engine for validating and reproducing Keycloak token claims, roles, scopes, audiences, organisations, protocol mappers, and token surfaces. Includes batch attestation verification with CBOR-based signing envelopes.
Keycloak 26.7.0 Compatibility : IGA extensions, IdP extensions, and Ragnarök updated for Keycloak 26.7.0 and Quarkus 3.33.2.1, including dependency alignment, built-in client and scope updates, and token API compatibility. Boot-safe capture of new organisation-admin migration roles as pending change requests.
Enclave SRI : sha256-NqcP6DQfDgcpp8RaKGLoMIXLXDZo2LmKOvhYKvNsHD0=
Behaviour Changes
DPoP is now strictly opt-in : DPoP was enabled by default on the SDK in 0.13.31. In 0.14.0, tokens are DPoP-bound only when explicitly requested. If your app relied on the previous default binding, update your init options to opt in explicitly.
Silent Re-Authentication After Logout : The SDK no longer opens a dokenless approval enclave during silent re-auth after logout. Post-logout re-auth is now deterministic — silent check-sso handles terminal states reliably, interactive login is forced when required, and the authenticated-but-tokenless window that caused temporary 401 responses on admin API calls is closed.
Detailed changelog
For a granular per-repository breakdown of changes (Midgard, Heimdall, ORK, Ragnarök, TideJS, TideCloakJS, Asgard, master-libs, tidecloak-idp-extensions, tidecloak-iga-extensions, tidecloak-override, and upstream Keycloak), see the detailed changelog.