> ## Documentation Index > Fetch the complete documentation index at: https://docs.strata.io/llms.txt > Use this file to discover all available pages before exploring further. # 2026 **October 19 2026** * OIDC and OIDC CIMD apps now support an **Auto Grant** toggle that issues a refresh token even when the client doesn't request the `offline_access` scope. Enable it for MCP clients such as Claude or ChatGPT so users aren't asked to sign in again when their access token expires. Requires **Allow Offline Access** to be enabled. **September 30 2026** * FIPS 140-3 compliant Orchestrator builds are now available to download in the Maverics Console. Open any Deployment, select **Download Orchestrator Software**, and find the **FIPS 140-3 Compliant Build** section below the standard platform installers. **September 9 2026** * Fixed an issue where port 10443 was not included in admin OAuth redirect URLs **August 28 2026** * Added a warning in the publish drawer when a configuration override is active for a deployment * Proxy app access policy editor now exposes the option to match on query parameters **August 27 2026** * OIDC Identity Fabric providers now support CIMD (Client Initiated Metadata Document) and DCR (Dynamic Client Registration) configuration * Fixed an issue where namespaces were not consistently applied to service extension claims **August 7 2026** * OIDC apps now support access token claims mapping, letting you configure which claims are included in issued access tokens * Fixed an issue in the configuration inspector where OIDC CIMD app types and token broker authentication were not handled correctly **July 29 2026** * **OIDC CIMD App Type:** Administrators can now create and configure CIMD-type OIDC applications directly in the Console. The Orchestrator fetches and validates the client's published metadata document at runtime, completing the full authorization-code + PKCE flow with no prior client registration. * Service extension claims are now available as options in the Username Mapping dropdown * Username Mapping now accepts free text input in addition to selector options * Dropdown fields can now be cleared to unselect the current value **July 22 2026** * MCP Proxy apps now support tool filtering to control which tools are accessible per app configuration * You can now configure an Authenticate SE as the username mapping source for an attribute provider resource **July 16 2026** * The Maverics Storage used for evaluation purposes has been removed. Instead, use one of the supported configuration storage providers. See [Config Publishing](/reference/console/config-publishing) for more details. * SAML Provider private and key configuration now accepts a single key; key reordering has been removed from the key management drawer. **July 14 2026** ### Improvements * OIDC provider private keys now respect configured ordering, enabling key rotation. ### New * Now that Strata Identity has joined Rubrik, there is a prompt to accept the Rubrik Terms of Service and Privacy Policy. **July 6 2026** * Claim and attribute mapping fields now accept free text input in addition to selector options * Removed "Log in with Microsoft" as a social sign-in option from the Maverics Console **June 24 2026** * Fixed an issue where Generic OAuth could not be used as an authentication provider **June 22 2026** ## Filter MCP tools by access token MCP Proxy apps can now apply an OPA connection authorization policy that decides, per upstream MCP server, whether the gateway connects to it and lists its tools — evaluated against the caller's access token. Instead of surfacing every upstream's tools to every client, you can scope which tools each session sees based on identity. See the [MCP Proxy reference](/reference/orchestrator/applications/mcp-proxy) for full configuration details. **June 16 2026** ### Proxy app type editing improvements * User flows have been completely phased out and will no longer appear in list views. * All configuration for a Proxy app — upstream, route patterns, location access policies, and global request headers — now live in the app editor. * Resources (formerly Dependencies) define the identity fabric and service extensions you reference in access policies and claims. Define your Resources first, and they'll be available in the relevant drop-downs throughout the Proxy app editor. ### Fixes * Added a warning in the configuration inspector when `http.writeTimeoutSeconds` is set for deployments using an MCP provider * Resolved an issue where SAML and OIDC claims mappings were omitted during a deployment **June 5 2026** * Added WSO2 to the supported identity provider filters for the OIDC protocol * Attribute providers can no longer be selected as authentication sources for OIDC and SAML apps * Fixed an issue where long policy metadata values were not properly truncated **June 3 2026** * Added support for multiple identity providers in authentication policies for OIDC and SAML apps * Added a scopes field to the OAuth connector in the Identity Fabric * Fixed the OIDC offline access toggle always showing as disabled in the edit form * Fixed uploaded service extension assets not being included in deployment bundles for OIDC and SAML apps * Fixed namespace handling for service extension claims in OIDC and SAML claims mapping **May 28 2026** ## Token brokering for OIDC apps OIDC apps can now broker tokens from an upstream provider. Configure token brokering directly in the OIDC app editor. > [!NOTE] > > Token brokering is experimental and may change in a future release. ## Generic OAuth connector A new **Generic OAuth** connector is available from the Identity Fabric. Use it to broker tokens against SaaS upstreams that expose OAuth but no OIDC discovery — for example, Databricks account-wide federation or GCP Workload Identity Federation. ## RFC 7638 key IDs for OIDC Provider JWKs The OIDC Provider JWK editor now includes a toggle for RFC 7638-compliant key ID (KID) generation. Existing keys keep their current KID; new keys use the spec-compliant algorithm. ## Fixes * Removing a Resource from a SAML or OIDC app no longer fails to save when an attribute provider still references it. Stale references now clear automatically, and the editor flags any that still need attention before you save. * Fixed SAML v2 request verification certificate handling. * Added URL validation to the Generic OAuth connector in the Identity Fabric. **May 27 2026** ### SAML app type editing improvements * User flows are being phased out and will no longer appear in list views. * All configuration for a SAML app — service provider configuration, protocol & assertion settings, access policies, and attribute mappings — now live in the app editor. * Resources (formerly Dependencies) define the identity fabric and service extensions you reference in access policies and claims. Define your Resources first, and they'll be available in the relevant drop-downs throughout the SAML app editor. **May 14 2026** ## OIDC app type editing improvements * **User flows are being phased out.** All configuration for an OIDC app — client details, access policies, claims, and OAuth 2.0 scopes — now lives in a single view. * **Resources** (formerly Dependencies) define the identity fabric and service extensions you reference in access policies and claims. Define your Resources first, and they'll be available in the relevant drop-downs throughout the OIDC app editor. ## Custom Telemetry Exporters for Metrics Ship Orchestrator metrics to any OTLP-compatible backend directly from the Observability settings page — no external collector required. The **Custom Telemetry Exporters** section lets you add one or more metrics destinations alongside Maverics Cloud Telemetry. Each exporter is configured with a name, protocol (OTLP over HTTP or gRPC), endpoint, optional auth headers, and advanced tuning for compression, temporality, histogram aggregation, and export interval/timeout. See the [metrics telemetry reference](https://docs.strata.io/reference/orchestrator/telemetry/metrics#metrics) for the full field list. **Exporter types** * **New Relic** — preset tuned for New Relic's OTLP ingest (`otlp.nr-data.net`, delta temporality, base2 exponential histograms, gzip). * **Generic OTel** — works with any OTLP receiver. Point it at your own OpenTelemetry Collector or directly at a SaaS backend that accepts OTLP, including Datadog, Grafana Cloud, Honeycomb, Splunk Observability Cloud, Dynatrace, AWS CloudWatch (via ADOT), Microsoft Azure Monitor, Google Cloud Observability, and Chronosphere. **Why it matters** Previously, fanning metrics out to a vendor meant standing up an OpenTelemetry Collector in front of the Orchestrator and managing exporter config in YAML. Now operators can wire up multi-destination metrics from the admin UI in under a minute, with per-exporter tuning of headers, interval, temporality, and histogram shape. **Notes** * Observability settings are now grouped under **Orchestrator Settings**. * Each exporter runs independently — a slow or unreachable destination won't block the others. * Maverics Cloud Telemetry remains available and is unaffected by custom exporter configuration. **April 21 2026** * Resolved an issue where SSO configuration changes were not applied * Fixed sidebar navigation active state on Identity Fabric and Service Extension detail pages **April 14 2026** * Dropdowns with 10+ items now include a search filter so you can quickly find what you need * Fixed an issue where dropdown selections couldn't be changed **April 9 2026** * Added search and filter support to dropdown selectors * Resolved issues preventing successful signup and user invitation flows **March 30 2026** * The code editor for service extensions, OPA policies, and OpenAPI code has been upgraded to Monaco Editor for an improved editing experience * Configure JSON output logging for deployments **March 26 2026** * SAML apps now support configuring NameID element qualifiers * The Console now validates Rego policy scripts for compilation errors when saving OPA policies * The OIDC Identity Fabric connector now shows a detailed error view and validates that the connected Orchestrator meets the required minimum version * Resolved an issue where account re-registration was blocked after deleting an account **March 13 2026** * **API App Type Moves to Service Extensions:** API App Types have been relocated from the Applications area to the Service Extensions area in the Maverics Console, unifying the experience for managing APIs and service extensions under a single interface. * All existing API App Types automatically appear in the Service Extensions area alongside your other extensions. * Creating a new API is straightforward — select "API" from the Service Extensions area and provide your configuration details. * API App Types can now be attached to deployments directly. * Existing deployments that already have APIs associated with them will find those APIs in a new dedicated APIs section within the deployment configuration. No migration or reconfiguration is required. * Added OIDC callback error handling configuration for the [Entra ID](/reference/orchestrator/identity-fabric/azure-ad#callback-error-handling) and [Generic OIDC](/reference/orchestrator/identity-fabric/custom-oidc) Identity Fabric connectors. Requires Orchestrator v2026.03.3 or higher. * Service extension asset uploads now support files up to 5 MB * Fixed an issue where dependencies and library settings were not deployed with API service extensions **March 5 2026** * The Console will now validate the SAML certificate and key pair when uploading to a deployment. We recommend doing this only for testing purposes; for production, always use a secrets provider. * LDAP configuration no longer shows a custom login file path option * HTTP Server TLS configuration now supports `None` as a client authentication type * Resolved issues when attaching service extensions to a deployment * Resolved issues when typing spaces or enter the Rego policy editor * Service Extensions list header is now properly titled **February 26 2026** * Fixed an issue where service extensions were not working as a Name ID source in SAML user flows * Authentication service extensions are no longer listed in the user flow dependency list **February 25 2026** * Audit Log (Beta) is now available * Resolved email case sensitivity issues when signing in and accepting user invitations **February 24 2026** * Maverics Console no longer applies an automatic namespace prefix when a Service Extension is the source for a NameID attribute value. This resolves Orchestrator runtime errors that produced "connector does not exist" and "missing claim mapping" messages, which prevented SAML authentication from completing. * **Action Needed:** SAML user flows that use a Service Extension to populate the NameID value may require a manual update to the NameID mapping field. * You can now remove members who declined a team invitation * Resolved an issue whereby screens refresh unexpectedly causing a loss of edits **February 23 2026** * Audit logs now capture login and logout events * Audit log events now include event type, category, and target metadata in the admin API * Audit logs table now shows the target type alongside the target name * Service extensions listed in user flow dependencies now show available metadata * Audit Logs navigation item is pinned to the bottom of the sidebar * Fixed sorting issues across listing views for consistent ordering * Fixed an issue where dependency metadata was not preserved when updating a user flow * Fixed the Service Extension editor shuffling metadata fields * Audit log timestamps are now formatted for readability * Session creation audit log events no longer include query parameters **February 18 2026** * Configure the maximum TLS version for deployment TLS settings (requires Orchestrator v2026.02.3 or higher) * Resolved an issue preventing login with Email OTP * Added a Target Name column to the audit logs table for easier identification of affected resources * User details are now included in membership audit log events **February 17 2026** * Configure HTTP Server timeouts and access logging in Deployments * Configure outbound authorization for MCP protocol operations (`initialize` and `tools/list`) for MCP Proxy apps (requires Orchestrator v2026.02.2 or higher) * Improved UX when deploying HTTP Server settings, including default placeholders and endpoint timeout validation * Resolved TLS configuration issues with client CA files, Windows certificate store persistence, and cipher suite persistence **February 10 2026** * Your Console account is now linked to one sign-in method (the last one you used) -- use that same method every time you log in * Sign-in options: Maverics Account passwordless (Email OTP or HYPR), social sign-in (Google or Microsoft Account), or Enterprise SSO (bring your own IdP) * GitHub sign-in has been removed as a login option * If you try a different sign-in option, you'll see a message that the email is already associated with another identity provider **February 5 2026** * Redis Cache now supports enabling TLS configuration in the Console without having to set a CA file path * A new toggle lets you enable or disable TLS for the Redis cache connection * Set the minimum TLS version (1.2 or 1.3) **February 3 2026** * Resolved an issue preventing SSO users from reliably signing into Maverics Console **January 28 2026** * Resolved a critical issue where CA (Certificate Authority) and mutual TLS configuration was not persisting in proxy applications * The system now properly saves and deploys the configuration * Fixed an issue where the proxy outbound TLS CA file path was not being properly saved or deployed **January 22 2026** * The sign up and sign in flows have been redesigned for a cleaner, more efficient user experience * The Orchestrators Main Menu has been removed -- all orchestrator settings are now accessible from the Deployment Manager **January 16 2026** * You can now configure JWT client authentication for OIDC apps * Requires Orchestrator v2026.01.3 or higher **January 15 2026** * JWT Client Authentication Configuration for the Generic OIDC Connector * Requires Orchestrator release v2026.01.3 or higher **January 14 2026** * Resolved issues preventing the attachment of service extensions to OIDC, SAML, or Proxy app type user flows * Resolved issues preventing deletion of applications or user flows that were not attached to a deployment **January 8 2026** * MCP Proxy App Type is now available * You can now create and configure MCP Proxy apps directly from the Maverics Console