Ronne AI Marketplace 0.5.0
Ronne now works with a company's identity provider: single sign-in over OpenID Connect, two-factor sign-in, and accounts and groups kept in step by SCIM. It also keeps personal data for a time root sets, erases a person on request, and gives each person a file of what it holds about them.
What it added
- Admin › Settings is split into tabs: Usage, Plugin feeds, a new Authentication tab where root decides how people sign in, and a new Privacy tab.
- Root connects the company's identity provider from the browser, with step-by-step instructions for each: Google Workspace, Microsoft Entra ID, Okta, Keycloak, authentik, Auth0, or any other OpenID Connect provider. An account is linked by its verified email, or created on first sign-in for the domains root chooses, with the role
user. A Test sign-in shows what the provider sends back and changes nothing. - The provider's groups can be mapped to workspace roles, so membership follows the company's directory. A password policy and
rmk-server disable-ssomake sure a broken provider can't lock everyone out. - People can add a second step to their password sign-in: a code from an authenticator app, with backup codes for a lost phone. Root decides whether it is optional, required for everyone, or required for roots and moderators.
rmk login --webis for people who sign in with a provider or a second step:rmkshows a short code and an address, you approve it in the browser where you are signed in, and it gets a personal access token. The MCP setup uses it too.- The identity provider can create, update and remove accounts itself through SCIM, with a token for each provider, and keep workspace membership in step with its groups. When someone is removed, their account is disabled and their sessions and tokens are revoked.
- Root sets how long IP addresses are kept in the audit log, sessions and device grants, 90 days by default. The server purges what is older on a schedule, and
rmk-server purgedoes it from cron. - Root can erase a person. Their email, name and credentials go, and what they did stays under the pseudonym
deleted-user-<id>, so an item's history and the audit log still make sense. It can't be undone. - Root opens a page for each person from Admin › Users, with their role, status and last sign-in, and the actions: change the role, disable or enable, reset their password or two-factor step, download their data and erase them. The list shows the last sign-in and a button to copy each email.
- From their Account page, a person downloads one JSON file of what the instance holds about them: their account, the names of their tokens, submissions, comments and audit events. Root can make it for someone who asked.