SqlOS 9.0.0: Authorized lists are a SQL predicate
BuildFilterAsync composes into the EF query again. SqlOS 9.0.0 withdraws the 8.0 page executor and returns list filtering to the authorization TVF.
FGAEF CoreSqlOS
Read the postBlog
Blog
Auth, hierarchical authorization, EF Core, and practical .NET application security — release by release.
SqlOS 8.0.0: Authorized pages on .NET 10
SqlOS now runs authorized list pages without first loading the caller's grants, targets .NET 10 and EF Core 10, and fixes sign-up code limits, headless organization selection, and SCIM behind the dashboard.
FGAEF CoreAuthServerSCIMSecuritySqlOS
Read the postSqlOS 7.2.1: Tenant and email-ownership boundaries hold
SSO connections stay inside their organization, direct login is first-party only, SCIM grants stay inside a boundary, and unverified email addresses can no longer be used to take over accounts.
AuthServerSAMLSCIMOAuthFGASecuritySqlOS
Read the postSqlOS 7.2.0: Sessions and stored credentials stop when they should
Confidential refresh requires the client secret, operator and portal cookies die on rotation and sign-out, and calendar tokens are revoked on offboarding.
AuthServerOAuthSecurityDashboardCalendarSqlOS
Read the postSqlOS 7.1.1: A tenant IdP cannot steal a global user by email
SAML first-link of an existing SqlOS user now requires the organization to own that exact email domain.
AuthServerSAMLSecuritySqlOS
Read the post