Kurahi 2.5.0

Also available in Japanese.

Kurahi 2.5.0 brings Super SSO: one company sign-in for every surface, passkeys built in, and a fresh authentication for every important decision, recorded in the signed evidence. Kurahi is built by the KODA SōKEN team. The complete list of changes is in the changelog.

With 2.5.0 you can:

• Sign in with passkeys, with or without an identity provider. Face ID, Touch ID, Windows Hello or a security key; an authenticator app as an alternative. Free in every plan.
• Sign every important decision with a fresh authentication. Approvals, raising autopilot levels, lifting the emergency stop, identity administration and data governance actions ask the person to confirm it is them; the evidence records when and how they authenticated.
• Use the same company sign-in on the command line and in Kurahi Desktop. kurahi login shows a code the person confirms in the browser; Desktop signs in through the system browser. Each device has its own session that can be revoked on its own.

See Enterprise identity for configuration and details.

What is new

• Passkeys and one-time codes (gateway.identity.passkeys): WebAuthn (ES256, RS256, EdDSA; user verification required by default) and TOTP (encrypted at rest). An identity admin’s one-time link enrols a person’s first authenticator; people add further devices themselves after a step-up.
• Step-up for decisions (gateway.identity.stepUp): on by default when identity is configured, with maxAgeSeconds 300. Re-authentication at the identity provider (OIDC max_age=0 and prompt=login, SAML ForceAuthn) or with a passkey or one-time code; it never switches persons. Stopping, demoting, revoking, sending back and cancelling stay immediate.
• Authentication in the evidence: sessions record OIDC auth_time, amr and acr or SAML AuthnInstant and AuthnContextClassRef; each covered decision records them as authn.
• Command line and desktop sign-in: kurahi login, logout and whoami (device authorization grant, RFC 8628) and native apps with loopback redirects and PKCE (RFC 8252).

Upgrade from 2.4.0

kurahi update (or install.sh / install.ps1 with --version 2.5.0) installs 2.5.0 as usual; see Updating.

If you use SSO, step-up is on after the upgrade. People who approve, raise autopilot levels, lift the emergency stop or administer identity are asked to authenticate again when their last authentication is older than 5 minutes. Sessions from 2.4.0 have no recorded authentication and are asked at the first covered decision. To adjust:

• raise gateway.identity.stepUp.maxAgeSeconds (up to 3600);
• limit approvals to larger amounts with actions.approvals: { amountAtLeast: … };
• or set gateway.identity.stepUp.enabled: false.

For OIDC step-up, your identity provider must return auth_time when Kurahi sends max_age (Microsoft Entra ID, Okta, Google and Keycloak do).

Passkeys need an https origin (gateway.identity.publicUrl or passkeys.allowedOrigins; http only for localhost) and a domain name, not an IP address. Everything else is off until you configure it.

Roll back

install.sh --version 2.4.0 (Windows: install.ps1 -Version 2.4.0) installs 2.4.0 again; see Updating. Before you start 2.4.0:

• Remove gateway.identity.passkeys, stepUp, nativeClients and deviceSignIn from the configuration: 2.4.0 does not accept keys it does not know.
• People who signed in only with passkeys or one-time codes cannot sign in on 2.4.0; use an identity provider or break-glass until you upgrade again. Their enrolled authenticators stay on disk and work again after the upgrade.
• Sign in again with kurahi login after you upgrade again; 2.4.0 has no command-line sign-in.

Notes

• Kurahi Desktop 0.5.0 is unchanged and works with 2.5.0; native sign-in for Desktop follows in a Desktop update.
• Kurahi is self-hosted: your servers and any identity or model provider you choose are separate from Kurahi.
• Checksums for every asset are in SHA256SUMS.txt and SHA256SUMS-desktop.txt.