Changelog

Your WorkOS Environment configuration has a new look! We’ve made it easy to see which OAuth providers you have configured at a glance.

We've also made updating your configuration a bit more secure from unwanted changes. The screen loads in a reader view while updates are made in modals. This way you're focused on a single configuration change.

Previously when setting up a directory with custom attributes in the Admin Portal, a mapping value was required to be entered for each custom attribute. Now you can remove this restriction by visiting the configuration page in the dashboard and unchecking the required field for each custom attribute you would like to make optional.

We recently shipped UX improvements to the demo credential experience for Okta, the most popular identity provider, so that it’s easier and faster for developers to confirm that their SSO flow works properly. Previously, the steps were shown on different pages, which made following the process difficult.  You can now provision Okta demo credentials within the Configuration section of the dashboard in a few clicks. 

Directory user and group webhook update events now include a previous_attributes property that show changes since the last snapshot of the user or group. The value in `previous_attributes` is an object that contains names and values of attributes that have changed.

We are sending along shallow changes in root properties, raw attributes, and custom attributes. If a new attribute is added in the current snapshot that did not exist previously, then the previous_attributes object will contain the attribute name with a`null` value.

We’re excited to announce the official release of the WorkOS Java SDK. The SDK source is written in Kotlin and can be found here. We’ve also created example Java applications to help with integration and troubleshooting.

The SDK can be installed from the Maven Central repository. Installation instructions for all supported package managers can be found on the Maven Central package.

Developers can now define Custom Attributes for Directory Sync that will be available on user Profile objects from WorkOS. Previously, if developers needed to make use of more specialized attributes from user profiles in Directory Sync, they needed to delve into “raw_attributes”, which varied by each directory provider. 
‍

Mappings from raw attributes to these Custom Attributes can be defined in the dashboard by the developer, or by the Enterprise Admin in Admin Portal when they are configuring their directory.

We’ve updated the Directory summary view to include information about the last sync for non-SCIM based directories like BambooHR or Workday. You can now see when the most recent sync for the Directory was run and what the status of the run was.

Today we're announcing email notifications for webhook delivery failures. This notification will be sent if all retry attempts have been exhausted for a specific event.

The email link will take you directly to the Dashboard settings page for the webhook in question. There, users can further review details around the webhook failure, including the event payload and webhook response.

When creating an Organization in WorkOS, you will now be prompted with an option checkbox which says “Allow authentication for users that do not match Organization email domains.” When left unselected (default), WorkOS will check that a user’s email domain matches one of the listed domains on the Organization object. If the domain is not included, user authentication will fail. 

In the rare case that you are unable to maintain a list of domains that are valid for that organization, you may check this box to disable the additional security check. 

This enhanced security feature is backwards compatible with existing connections, and we’ve migrated the majority of connections already. This change does not affect Google or Microsoft OAuth authentication, as these integrations have no domain restriction.

If you have questions about this new functionality and the implications for your app, feel free to check the documentation or reach out to WorkOS Support.

Today we’re announcing the ability to customize email notification preferences in the WorkOS Dashboard.

Historically, email notifications have been sent to all team Admin's which can result in unneeded noise in your inbox. Admin’s can now configure email notification preferences in a new Profile page, available from the user dropdown menu.

In the near future, the WorkOS team will be adding additional email notifications and categories that will help teams stay in tune with their WorkOS integrations.

Today we're introducing Dark Mode to the WorkOS Dashboard.

By default, we apply a theme that matches your system preferences. Still, you have the freedom to manually switch to light or dark mode by going to the user dropdown on the top right corner and changing to your preferred setting.

Whether you prefer your screen bright or if you want to feel like a hacker using dark mode, it’s up to you how you experience WorkOS.

Today we're introducing a new input file field for X.509 certificates. This will allow users to view the content of the file at any point, making it easier to debug certificate issues.

You can also remove and re-upload a different cert, in case there's any problem.

Similar to how we show a list of users for a Directory, you can now see a new tab containing a paginated list of groups in a Directory Sync connection.

Additional changes

- Fixed geolocation data caching

- Optimized image caching and serving

Admin Portal users can now restart their entire configuration by using the "Reset Connection" button located at the bottom of the post-setup page. This will completely delete the connection and land the user back on the initial setup screen.

Now you have the ability to search for specific Directory Sync users. To provide more control and visibility, we allow you to filter by the following parameters:

• First name
• Last name
• Email
• Group name
• Group ID

Navigate to one of your synced Directories to try it out.

You can now visualize the total number of users and groups when using Directory Sync. This will allow developers to check if a directory has the expected number of users and groups at a glance.

Additional changes

- Added OpenID Connect Sessions to the Admin Portal

- Removed return of state param in the SSO flow when it's undefined

You now have the ability to generate additional API keys for use in staging or production, revoke or expire API keys to no longer be able to make requests to the WorkOS API. Keys are not visible to anyone in the Dashboard after creation. Because of this, you will need to store these API Keys somewhere securely.

Check out the documentation.

Additional changes

- Fixed an issue where directory validation errors would crash Admin Portal sessions

- Filtered out Magic Link connections from Admin Portal

- Remove environment Pill on API keys page

We redesigned the sidebar and environment switcher so you can easily navigate between your staging and production environments. We also updated our URL routing to include absolute links for specific pages within the Dashboard.

Additional changes

- Fixed toast notifications to work properly on route changes

- Make Admin Portal generation error message clearer

You can now synchronize HiBob HRIS data with WorkOS Directory Sync.

On top of that, we also added Microsoft OAuth as a new SSO Identity Provider. This will enable users to sign in to your app with their Microsoft accounts.

Check out the HiBob documentation and Microsoft OAuth documentation.

We released v1.0 of all our SDKs. As a result, we’re now following standard semantic versioning with our releases. We recommend upgrading and pinning the latest version of our SDK in your project.

You can view release notes for SDKs in the following languages:
‍Node, Ruby, Go, Python, PHP, .NET.

Additional changes

- Added GET /sso/profile endpoint for fetching SSO user profiles

- Added GET /organizations/:id endpoint

- Added DELETE /organizations/:id endpoint

- Added connection.deleted webhook. This fires when a SSO Connection is deleted

- Added dsync.deleted webhook. This fires when a Directory Sync Connection is deleted