📦 About this release
Configure exactly how users authenticate with multi-step MFA, including FIDO2 security keys. Administrators have full control over MFA flows for each location, with stronger authentication options for high-security environments.
Users can now configure their Multi-Factor Authentication (MFA) factors directly in the desktop application at any time, even after enrolment. Admins can enforce stronger security without disrupting access, while users manage their authentication seamlessly.
The Mobile Client has also been redesigned, joining the rest of the refreshed Defguard family.
Read more about this release on our blog.
✨ What's new
- Multi-step configurable MFA methods - build MFA flows from ordered steps, each with the factors allowed to pass it, enforce them per location and assign different flows to selected groups.
- Use FIDO2 hardware key as MFA factor - add it using the Desktop Client, configure an MFA Flow with FIDO2 Security Key factor, assign it to your location and connect using the latest Desktop and Mobile Client (NFC).
- Configuring MFA factors in the Desktop Client - when a location requires an MFA method a user hasn't set up, the desktop client shows Configure MFA and guides them through the setup, without re-enrolling the instance. Users can also add more methods at any time.
- Bulk actions for Firewall module - select several rules to enable, disable, deploy or delete them at once.
- Split-DNS for Defguard clients - only your internal domains are resolved by the location's DNS servers through the VPN, while all other names use the device's normal DNS (check this issue for context).
- Handling multiple locations with DNS configuration connected simultaneously - each connected location's domains are resolved by that location's DNS servers, so users can stay connected to several locations at the same time.
- Ability to apply custom MTU to the client apps - set the MTU sent to the client apps per location, with group-level overrides for selected groups.
- Automatic WireGuard interface metric on Windows - in all traffic mode, the tunnel interface gets the highest priority to prevent traffic and DNS leaks outside the VPN.
- Bulk action to put enrolment token in Active Directory for the auto-provisioning process - select users and store their enrollment tokens in an Active Directory attribute in one step, ready for client auto-provisioning.
- Completely redesigned Mobile Client - update from Google Play, the App Store, or use the assets from the mobile release.
|
|
🧪 How to test
- MacOS - install from the App Store or from a package in the release assets.
- Other OSes - use the appropriate package from the release assets.
- 🚀 Quickly run the latest server components using one-line-script. For production deployments check this guide.
🔄 Worried that your users have to upgrade the client applications? Here you can check the client vs server feature compatibility matrix.
🙋 Feedback
We want to get as much feedback as possible, so we encourage you to: 💬 open a GitHub discussion 🪲 report any missing features or bugs as issues
Full changelog
- Multi-step MFA location support by @jakub-tldr in https://github.com/DefGuard/client/pull/1117
- Stable to dev by @moubctez in https://github.com/DefGuard/client/pull/1140
- Switch to latest wireguard-rs for split-DNS by @moubctez in https://github.com/DefGuard/client/pull/1141
- Multi MFA flow with FIDO2 by @moubctez in https://github.com/DefGuard/client/pull/1151
- fix: persist provider display name on instance save by @wojcik91 in https://github.com/DefGuard/client/pull/1158
- handle remote-auth methods in multi-step MFA flows by @wojcik91 in https://github.com/DefGuard/client/pull/1154
- Handle MTU from Core by @moubctez in https://github.com/DefGuard/client/pull/1162
- Allow Windows to sleep by @moubctez in https://github.com/DefGuard/client/pull/1166
- fix mobile auth switch for legacy flows by @wojcik91 in https://github.com/DefGuard/client/pull/1165
- Cleanup dependencies by @moubctez in https://github.com/DefGuard/client/pull/1170
- post enrollment configure factors by @filipslezaklab in https://github.com/DefGuard/client/pull/1169
- Multistep MFA support for CLI by @t-aleksander in https://github.com/DefGuard/client/pull/1156
- trigger factor config flow from locations list by @filipslezaklab in https://github.com/DefGuard/client/pull/1176
- Unstuck macos by @moubctez in https://github.com/DefGuard/client/pull/1178
- Handle log rotation in log watcher by @moubctez in https://github.com/DefGuard/client/pull/1180
- Fix CTRL-C handling by @moubctez in https://github.com/DefGuard/client/pull/1183
- pick verification method by @filipslezaklab in https://github.com/DefGuard/client/pull/1186
- build macos dmg for dev branch by @filipslezaklab in https://github.com/DefGuard/client/pull/1190
- Add possible options to CLI help, change wording of MFA flow texts by @t-aleksander in https://github.com/DefGuard/client/pull/1189
- persist parts of ui shared session information. by @filipslezaklab in https://github.com/DefGuard/client/pull/1194
- fix dmg signing by @filipslezaklab in https://github.com/DefGuard/client/pull/1193
- missing ui elements for mfa configurator by @filipslezaklab in https://github.com/DefGuard/client/pull/1196
- Auto focus code by @filipslezaklab in https://github.com/DefGuard/client/pull/1198
- fix e2e mfa tests by @filipslezaklab in https://github.com/DefGuard/client/pull/1199
- Show provider name on when authenticating via OIDC by @jakub-tldr in https://github.com/DefGuard/client/pull/1204
- Verify factor setup flow with fido2 and oidc by @filipslezaklab in https://github.com/DefGuard/client/pull/1205
- impl explicit session end for mfa config by @filipslezaklab in https://github.com/DefGuard/client/pull/1206
- handle mfa capabilities list from instance info by @filipslezaklab in https://github.com/DefGuard/client/pull/1208
- handle multiple fido2 devices by @filipslezaklab in https://github.com/DefGuard/client/pull/1209
- Don't silently override totp secret during reenrollment by @j-chmielewski in https://github.com/DefGuard/client/pull/1210
- OpenID icons based on polling by @jakub-tldr in https://github.com/DefGuard/client/pull/1212
- Fix Windows signing by @moubctez in https://github.com/DefGuard/client/pull/1218
- Workaround HidApi::new panics by @moubctez in https://github.com/DefGuard/client/pull/1219
- fix session state missing fido2 by @filipslezaklab in https://github.com/DefGuard/client/pull/1224
- log compatibility decisions on add page by @filipslezaklab in https://github.com/DefGuard/client/pull/1225
- split legacy and multi-step MFA flows by @wojcik91 in https://github.com/DefGuard/client/pull/1211
- Autostart and start minimized settings by @j-chmielewski in https://github.com/DefGuard/client/pull/1222
- Detect conflicting locations on connect by @t-aleksander in https://github.com/DefGuard/client/pull/1223
- update location factor guards based on new proto by @filipslezaklab in https://github.com/DefGuard/client/pull/1214
- Autostart for Macs by @moubctez in https://github.com/DefGuard/client/pull/1233
- loading state for connection button by @filipslezaklab in https://github.com/DefGuard/client/pull/1243
- Fix allow prerelease by @j-chmielewski in https://github.com/DefGuard/client/pull/1236
- update instance selection step by @filipslezaklab in https://github.com/DefGuard/client/pull/1246
- styles update 2 by @filipslezaklab in https://github.com/DefGuard/client/pull/1249
- Properly surface listening port and keepalive on MacOS by @t-aleksander in https://github.com/DefGuard/client/pull/1250
- Bump wireguard-rs to 0.12.3 by @t-aleksander in https://github.com/DefGuard/client/pull/1248
- fix tray init after first instance added by @filipslezaklab in https://github.com/DefGuard/client/pull/1252
- Conflicting location detection fixes by @t-aleksander in https://github.com/DefGuard/client/pull/1253
- Allow only hardware keys in fido2 mfa flows by @filipslezaklab in https://github.com/DefGuard/client/pull/1255
- Adjust verify with oidc button by @jakub-tldr in https://github.com/DefGuard/client/pull/1257
- fix auto provisioning support by @wojcik91 in https://github.com/DefGuard/client/pull/1245
- dont recommend fido2 key name during registration by @filipslezaklab in https://github.com/DefGuard/client/pull/1260
- fix lack of window focus on deep link open by @filipslezaklab in https://github.com/DefGuard/client/pull/1261
- Update mfa config design by @filipslezaklab in https://github.com/DefGuard/client/pull/1262
- Fido2 UI tweaks by @filipslezaklab in https://github.com/DefGuard/client/pull/1264
- Change labels in MFA wizard by @jakub-tldr in https://github.com/DefGuard/client/pull/1268
- Move fido code on dev by @t-aleksander in https://github.com/DefGuard/client/pull/1263
- Input autofocus by @t-aleksander in https://github.com/DefGuard/client/pull/1280
- Change input on verify with security key by @jakub-tldr in https://github.com/DefGuard/client/pull/1283
- fix already registered key error message by @filipslezaklab in https://github.com/DefGuard/client/pull/1279
- Display clear message when mobile is outdated during remote approve by @j-chmielewski in https://github.com/DefGuard/client/pull/1287
- ui fixes by @filipslezaklab in https://github.com/DefGuard/client/pull/1289
- Error text fix by @filipslezaklab in https://github.com/DefGuard/client/pull/1290
- Pin dependencies (dev) by @renovate[bot] in https://github.com/DefGuard/client/pull/1281
- Fix connected location card missing MFA tile in certain scenarios by @filipslezaklab in https://github.com/DefGuard/client/pull/1291
- Adjust E2E tests by @jakub-tldr in https://github.com/DefGuard/client/pull/1296
- use proper error component by @j-chmielewski in https://github.com/DefGuard/client/pull/1294
- Linux service cleanup by @j-chmielewski in https://github.com/DefGuard/client/pull/1288
- client ui adjustments by @filipslezaklab in https://github.com/DefGuard/client/pull/1297
- Allow spaces in enrollment password by @jakub-tldr in https://github.com/DefGuard/client/pull/1298
- update settings general tab by @filipslezaklab in https://github.com/DefGuard/client/pull/1303
- Show specific error when MFA setup fails by @j-chmielewski in https://github.com/DefGuard/client/pull/1301
- Properly handle no MFA factors available on a given location by @t-aleksander in https://github.com/DefGuard/client/pull/1305
- update labels by @filipslezaklab in https://github.com/DefGuard/client/pull/1312
- tray locationcard error view unified by @filipslezaklab in https://github.com/DefGuard/client/pull/1313
- update configure mfa selection step design by @filipslezaklab in https://github.com/DefGuard/client/pull/1317
- Add other methods to OIDC MFA by @moubctez in https://github.com/DefGuard/client/pull/1316
- show checkbox on mfa selector when not configured by @filipslezaklab in https://github.com/DefGuard/client/pull/1318
- better start enrollment error detection and presentation by @filipslezaklab in https://github.com/DefGuard/client/pull/1319
- refactor mfa configuration flow by @filipslezaklab in https://github.com/DefGuard/client/pull/1321
- welcome for 2.2 by @filipslezaklab in https://github.com/DefGuard/client/pull/1322
- fix openid connect factor step layout by @filipslezaklab in https://github.com/DefGuard/client/pull/1323
- log ui related crashes,errors by @filipslezaklab in https://github.com/DefGuard/client/pull/1324
Full Changelog: https://github.com/DefGuard/client/compare/v2.1.0...v2.2.0
