Skip to main content

TideCloak 0.14.17

Summary​

TideCloak 0.14.17 focuses on the mobile approval story. The Tide Authenticator app has been rebuilt as a Progressive Web App with native DPoP support, and the Home ORK now tunnels session-key approval to mobile — together enabling DPoP-bound QR sign-in end-to-end. It also lands a runtime TideCloak URL resolution fix for the embedded Admin UI Console, an IGA governance completeness fix on CREATE_ROLE and CREATE_CLIENT_SCOPE, and a Ragnarök vulnerability patch.

Key Features​

DPoP-Bound QR Sign-In (End-to-End) : Sign-in with a DPoP-bound token now works across desktop and mobile via QR. The Vendor's nominated Home ORK tunnels session-key approval to the mobile device, and the Authenticator PWA presents the DPoP approval card with the current page hidden behind it. Requires the new Authenticator PWA on 0.14.17+.

Tide Authenticator: PWA Rebuild + DPoP : The Authenticator app has been rewritten as a Progressive Web App: Capacitor removed, DPoP support added, push-notifications added. Installation is now mandatory, with a simplified iOS path via Safari, install prompts for iPhone and Android, and clear guidance when running on insecure origins.

Runtime TideCloak URL Resolution : The IdP now resolves the TideCloak base URL at runtime instead of baking it into the bundle at build time.

IGA Governance Completeness : iga-core now threshold-signs role_composite_children_set and the client-scope mapper set on CREATE_ROLE and CREATE_CLIENT_SCOPE. Closes the multiAdmin tide-dummy fail-closed family.

Documentation : Midgard documentation updated with the Tide key-generation commands.

Enclave SRI : sha256-qXnIKm4sJiuDcBXZNKdRmmLr76cTDeAovHAFbSAvfTo=

Upgrade Notes​

  • DPoP QR sign-in requires the new Authenticator PWA. Users on older Authenticator builds can still sign in as before, but need the 0.14.17+ PWA to complete DPoP-bound QR flows.
  • Existing Authenticator installs may need to reinstall. The move off Capacitor to a PWA is a platform change — existing users should install from the new install prompts.
  • No IdP rebuild needed to change environments now that TideCloak URL resolves at runtime.

Detailed changelog​

For a granular per-repository breakdown of changes, see the detailed changelog.