Release 2.1.10

Release Dates

InstanceRelease Date
LE0To be announced
LE1To be announced
note

All Playground instances will be upgraded automatically to this release as per the above release dates.

Release Highlights

Single Sign-On with SAML 2.0 and OpenID Connect

Let your people sign in with your company identity provider, such as Okta, Microsoft Entra ID, OneLogin or any SAML 2.0 / OpenID Connect provider. Setup is guided from the Control Panel: copy two values into your identity provider, import its metadata with a single URL (or use Discover for OpenID Connect), test it, and turn it on.

People can have an account created automatically the first time they sign in (just-in-time provisioning, within your domain and license rules), or you can limit single sign-on to people who already have an account. Read the guides for SAML 2.0 and OpenID Connect.

Require Single Sign-On

Companies that want their identity provider to be the only way in can now set the sign-in policy to Require single sign-on (SSO). Google and Salesforce sign-in stop working for people, and the Sign up link is hidden.

You cannot lock yourself out: administrators can always sign in, you can name extra break-glass accounts, and the policy can only be switched on after you have signed in with single sign-on yourself. Details are in Sign-in Methods & Policy.

Branded Login Buttons

Show Sign in with Okta, Sign in with Microsoft or your own company name on the login page. Pick a built-in logo or upload your own image, and see a preview before saving.

A New Connections Page

Everything your Playground connects to is now in one place under Control Panel → Advanced → Connections. Each connection is a card with a clear status, settings open in a pop-up, and every card has a link to its guide. The Google and Salesforce switches have moved here from General, next to single sign-on.

Bitbucket Scoped API Tokens

The Bitbucket connection now uses a scoped API token instead of an app password, and asks for the token's expiry date. Playground shows how long the token has left and flags it when it is close to expiring or expired. A new Test connection button checks your saved credentials and tells you exactly what to fix.

Allowed Email Domains

Private Playgrounds can now list the exact email domains that may sign in or sign up, under General → Allowed Email Domains. company.com no longer lets in company.app or look-alike domains. The list applies to every sign-in method, including Google, Salesforce, SAML 2.0 and OpenID Connect.

Stable Single Sign-On Identity

People can be matched by a Unique ID stored on their account instead of their email, so a changed or aliased email no longer creates a second account or locks the person out. Choose a Unique identifier attribute (SAML) or Unique identifier claim (OpenID Connect), and set Unique IDs on Control Panel → People, one by one or with a CSV import. The email and names are still detected automatically from common attribute and claim names; only the Unique ID is never guessed. The SAML and OpenID Connect forms now also show a Sign-in (start) URL you can paste into your identity provider so the app tile signs people in with one click.

Failed Sign-ins in Login History

Failed sign-in attempts are now recorded in the login history with a short, clear reason, such as "No Playground account exists and automatic account creation is off" or "This domain requires single sign-on", so you can report on them.

Improvements and Fixes

  • Saved passwords and tokens are no longer sent back to the browser. To replace one, enter a new value; leave the field empty to keep the saved one.
  • Connection settings are strengthened so that a change always applies to your own Playground only, and each Playground has a single active connection per type.
  • Tooltips on settings screens now stay inside the pop-up they belong to.
  • Sign-in messages are clearer when a method is turned off, or when single sign-on is required.
  • Platform staff addresses are now matched exactly (@playg.app).

Upgrading

  • Allowed email domains are empty by default. Until an admin lists domains, the earlier rule still applies. List your domains under General → Allowed Email Domains to switch to the strict rule, then check that contractors and alias domains are included.
  • Single sign-on is off by default. Nothing changes for existing logins until you turn it on under General → Advanced Features and set up a connection.
  • Bitbucket: your existing connection keeps working. It shows "add token expiry date" until you next save it with the expiry date of your token.
  • GitHub is not a supported source control provider. Bitbucket is the supported one.