From af3b5ce51812a7cba85f4da4f5f9edc7204d8932 Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Tue, 4 Aug 2026 14:57:09 +0530 Subject: [PATCH 1/2] feat(copy): cover 2.4.0 features on the landing page Landing copy stopped at RBAC/FGA and still described MFA as email-OTP only, omitting the enterprise surface shipped since: passkeys, SAML/OIDC SSO, organizations, SCIM, M2M and RFC 8693 delegation. - add six feature cards for the above - correct the MFA card and the SDK list (Vue and Svelte ship; drop the Flutter "coming soon", the repo has no code) - widen the meta/OG descriptions to the same set --- .gitignore | 1 + components/Features.tsx | 52 +++++++++++++++++++++++++++++++++++++++-- constants/site.ts | 4 ++-- 3 files changed, 53 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 96c99d0..a53370c 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,4 @@ yarn-error.log* # vercel .vercel +tsconfig.tsbuildinfo diff --git a/components/Features.tsx b/components/Features.tsx index 9dd244c..baacfcc 100644 --- a/components/Features.tsx +++ b/components/Features.tsx @@ -1,15 +1,21 @@ import { + FaBuilding, FaCloud, FaCode, FaConnectdevelop, FaDatabase, + FaExchangeAlt, + FaFingerprint, FaLock, FaMailBulk, FaNetworkWired, FaPlug, FaProjectDiagram, FaRobot, + FaServer, FaShieldAlt, + FaSitemap, + FaSyncAlt, FaUserAstronaut, FaUsers, } from 'react-icons/fa'; @@ -68,7 +74,7 @@ const features = [ label: 'GraphQL, REST & gRPC APIs', icon: , description: - 'Integrate over three protocols on standard OAuth2 and OpenID Connect, with official SDKs for Go, Python, JavaScript, and React (Vue, Svelte, and Flutter coming soon).', + 'Full parity across three protocols on standard OAuth2 and OpenID Connect—every operation available over GraphQL, REST, and gRPC. Official SDKs for Go, Python, JavaScript, React, Vue, and Svelte.', position: 12, }, { @@ -107,9 +113,51 @@ const features = [ icon: , description: - 'Added layer of security with email based OTP for your basic authentication recipe', + 'TOTP authenticator apps, email and SMS one-time codes, and passkeys as a second factor—on by default, optional per user, with brute-force lockout and admin recovery.', position: 9, }, + { + label: 'PASSKEYS & WEBAUTHN', + icon: , + description: + 'Phishing-resistant passwordless login with WebAuthn passkeys—Touch ID, Face ID, Windows Hello, and hardware keys. Use them to sign in, or as a second factor.', + position: 14, + }, + { + label: 'ENTERPRISE SSO (SAML & OIDC)', + icon: , + description: + 'Per-organization SAML 2.0 and OIDC single sign-on to Okta, Entra ID, Google Workspace, and any compliant IdP. Authorizer also runs as a SAML 2.0 Identity Provider for your own downstream apps.', + position: 15, + }, + { + label: 'ORGANIZATIONS & MULTI-TENANCY', + icon: , + description: + 'First-class organizations with memberships, org-scoped admins, verified email domains, and home-realm discovery that routes users to their own identity provider.', + position: 16, + }, + { + label: 'SCIM 2.0 PROVISIONING', + icon: , + description: + 'Inbound SCIM 2.0 keeps users and groups in sync from your customers’ directories—automatic joiner, mover, and leaver handling, with SCIM groups mapped to roles.', + position: 17, + }, + { + label: 'MACHINE-TO-MACHINE AUTH', + icon: , + description: + 'Service accounts with the client_credentials grant, plus workload identity that needs no shared secret—private-key JWT (RFC 7523), SPIFFE JWT-SVIDs, and Kubernetes TokenReview.', + position: 18, + }, + { + label: 'DELEGATION FOR AI AGENTS', + icon: , + description: + 'RFC 8693 token exchange lets an agent act on a user’s behalf with a verifiable actor chain—delegation only, never silent impersonation, with the full chain visible in the token.', + position: 19, + }, ]; const pillars = [ diff --git a/constants/site.ts b/constants/site.ts index 2c03481..faa1521 100644 --- a/constants/site.ts +++ b/constants/site.ts @@ -36,7 +36,7 @@ export const TWITTER_CARD_IMAGE_HEIGHT = 600; /** ~155 chars for meta description snippets */ export const META_DESCRIPTION = - "Own your identity layer. Self-host open-source auth & fine-grained authorization—OAuth2, OIDC, RBAC, MFA, OpenFGA—with permission-aware AI on your data."; + "Own your identity layer. Self-host open-source auth—OAuth2, OIDC, SAML SSO, SCIM, passkeys, MFA, OpenFGA—with permission-aware AI on your own data."; export const DEFAULT_DESCRIPTION = - "Own your identity layer with open-source authentication and authorization you self-host. OAuth2, OpenID Connect, social login, magic links, RBAC, MFA, and fine-grained authorization (OpenFGA) for permission-aware AI and RAG. GraphQL, REST, and gRPC APIs with Go, Python, and JS SDKs—your users stay in your own database, not someone else's dashboard. No per-seat auth tax."; + "Own your identity layer with open-source authentication and authorization you self-host. OAuth2, OpenID Connect, SAML 2.0 enterprise SSO, SCIM 2.0 provisioning, passkeys, MFA, organizations, machine-to-machine auth, and fine-grained authorization (OpenFGA) for permission-aware AI and RAG. GraphQL, REST, and gRPC APIs with Go, Python, JS, React, Vue, and Svelte SDKs—your users stay in your own database, not someone else's dashboard. No per-seat auth tax."; From 4b428535775289dd555f721639503e9ef89e535a Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Wed, 5 Aug 2026 19:25:49 +0530 Subject: [PATCH 2/2] fix(copy): agent delegation is an intersection, not the user's reach MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The prompt-injection card described the pre-2.4.0 behaviour as the safety property — "it asks as the user, and gets the user's answer" is the Confused Deputy, not protection from it. An agent now gets what it AND the user are allowed. The delegation feature card stopped at the actor chain, which every RFC 8693 implementation has. Per-agent permissions are the differentiator. --- components/AiUseCase.tsx | 4 ++-- components/Features.tsx | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/components/AiUseCase.tsx b/components/AiUseCase.tsx index 6689950..51bb76d 100644 --- a/components/AiUseCase.tsx +++ b/components/AiUseCase.tsx @@ -27,8 +27,8 @@ const guarantees = [ }, { icon: , - title: "Prompt-injection safe", - body: "The agent calls Authorizer with the end user’s JWT and the subject is pinned server-side. A hijacked agent holds no privileged credential—it asks as the user, and gets the user’s answer.", + title: "A hijacked agent can’t reach further than it was trusted with", + body: "The subject is pinned server-side—an agent can never ask on someone else’s behalf. And an agent acting for a user gets the intersection of what the agent is trusted with and what that user can see, never the user’s full reach. Prompt-inject it all you like: it cannot open a door it was not given.", }, ]; diff --git a/components/Features.tsx b/components/Features.tsx index baacfcc..c7370e3 100644 --- a/components/Features.tsx +++ b/components/Features.tsx @@ -155,7 +155,7 @@ const features = [ label: 'DELEGATION FOR AI AGENTS', icon: , description: - 'RFC 8693 token exchange lets an agent act on a user’s behalf with a verifiable actor chain—delegation only, never silent impersonation, with the full chain visible in the token.', + 'RFC 8693 token exchange lets an agent act on a user’s behalf with a verifiable actor chain—delegation only, never silent impersonation. Give each agent its own permissions: it gets what it AND the user are allowed, never the user’s full reach.', position: 19, }, ];