PatchMon Files

A small release that fixes single sign-on for Microsoft Entra ID, and adds a documented way out for any provider that cannot confirm email addresses.

Upgrading

:::bash
docker compose pull
docker compose up -d

No compose changes and no new settings you have to touch. One new database column is added automatically on start.

If your SSO broke on v2.1.0 or v2.1.1

From v2.1.0, when PatchMon has to work out who you are from your email address rather than from an identity it has already stored, it requires your provider to confirm that address is verified. Otherwise anyone able to set their own email address at your provider could sign in as an existing PatchMon user. This applies when linking to an existing account and when creating one on first login, and stops applying once an account is linked.

Two widely used providers could not satisfy that. Here is where each now stands.

Microsoft Entra ID. Entra never sends the standard email_verified claim and there is no way to make it, so there was no fix short of turning off auto-creation. PatchMon now reads xms_edov instead, which is Microsoft's own "Email Domain Owner Verified" signal, added by Microsoft in response to nOAuth, the same account-takeover attack this check exists to prevent. Add it as an ID token optional claim on your app registration and sign in again. The verified email requirement has the steps, including the manifest route for when the portal marks the claim unrecognised. Nothing has to be relaxed.

Because the claim is Microsoft-proprietary, it is only accepted from a Microsoft issuer and only from the ID token, which is signature verified. Azure AD B2C and Entra External ID are not currently on that list. If a sign-in is still refused, the server log now says which check failed and why, rather than only reporting the outcome.

Authentik. Unchanged, and the answer is still to replace the default email scope mapping with one that reports the address as verified. Full steps are in The verified email requirement.

Keycloak, Okta and Google Workspace were never affected and need no action.

If your provider cannot confirm addresses at all

Some directories have no notion of a verified email address. There is now an explicit opt-in for those: Trust unverified email in Settings > OIDC, or OIDC_TRUST_UNVERIFIED_EMAIL=true. It is off by default.

Be clear about what it does. With it on, anyone who can set their own email address at your identity provider can sign in as an existing PatchMon user with that address. It is only a reasonable choice when you control who can change addresses in your directory. Every login it allows through is written to the log, so you can see whether it is being used.

If a real fix exists for your provider, use that instead. This is the fallback. Full detail in If your provider cannot assert verification at all.

Also in this release

• A provider that simply omitted the verified-email claim was treated the same as one that actively denied it. Those are now told apart, which is what makes the Entra fix possible.
• The rejection in the log now names the claims PatchMon looked for and points at the relevant guide section, rather than just stating the outcome.

Every change in this release

What is coming next

Bug fixes are tracked in GitHub milestones. Each milestone lists the issues targeted at that release, so you can follow anything you have reported through to the version it lands in.

Feature requests live on feedback.patchmon.net, where you can propose an idea, vote on existing ones, and see what has been accepted onto the roadmap.

Questions about this release

This release has its own discussion thread, filed under New Release Discussions. If something is unclear or an upgrade step has not gone to plan, check there first. Open a new issue for a reproducible bug not already covered.