2026.4.0

2026.4.0 extends the external system permissions to Elasticsearch, Apache Doris, MongoDB, and Redis and Valkey. All four agents run beside the system and keep its own access control in step with the policies. On the identity and authorization side, it adds DingTalk organization sync, direct user grants, and export and import of the resource catalog. See the GitHub comparison for every change.

Elasticsearch

• Elasticsearch service plug-in: indices and data streams, their fields, and the cluster; signs in with a password, an API key or a TLS client certificate; see Elasticsearch.
• Agent beside the cluster: keeps Elasticsearch's own role for every user, assigned to native users and through role mappings to users of other realms, with field- and document-level security where the licence allows it; index patterns stay patterns, so new indices are reachable at once; see Elasticsearch agent.
• Accesses come from the audit log files. Integration tests cover Elasticsearch 8.19, 9.3, 9.4 and 9.5.

Apache Doris

• Doris service plug-in: catalogs, databases, tables, columns and workload groups; connects to one or more FEs and signs in with a password; see Apache Doris.
• Agent beside the cluster: policies become Doris's own roles, column grants, workload group grants and row policies, granted to every identity of the user; a whole database or catalog is granted only when Doris would not give more by it; see Apache Doris agent.
• Accesses come from Doris's audit log table. Integration tests cover Doris 2.1, 3.1, 4.0 and 4.1.

MongoDB

• MongoDB service plug-in: databases and collections; connects to a replica set or a sharded cluster and signs in with SCRAM, a client certificate, LDAP or Kerberos; see MongoDB.
• Agent beside the deployment: keeps one MongoDB role for every user and replaces its privileges in one step; from the inherited privileges MongoDB reports, it tells what built-in and custom roles outside GrantForge actually grant; see MongoDB agent.
• Accesses come from the Enterprise or Percona audit log files, or from the profiler. Integration tests cover MongoDB 6.0, 7.0, 8.0 and 9.0, with Kerberos verified on Percona Server for MongoDB.

Redis and Valkey

• Redis service plug-in: keys, channels and nodes; connects to a standalone server with its replicas or to a cluster, and signs in as an ACL user, optionally over TLS; see Redis.
• Agent beside the deployment: keeps every user's ACL selectors in step with the policies on every node and replaces them with one command; root permissions stay with the operators, and the agent asks Redis with ACL DRYRUN whether they allow access the policies deny; see Redis agent.
• Refusals come from each node's ACL log. Integration tests cover Redis 7.2, 7.4, 8.2 and 8.10 and Valkey 8.1 and 9.1, as well as a Redis 8.10 cluster.

Agents

• The ClickHouse, PostgreSQL and OpenSearch agents and this release's new agents beside a system share the new grantforge-agent-sync core: launcher, settings, timers, sync loop, audit read positions and log file tailing. Each agent keeps only what belongs to its system; settings and log formats are unchanged.

Identity and organization

• Data sources: organization sync is configured apart from identity sources, and the first adapter is DingTalk, using its official server SDK; after an SSO sign-in, users are linked to their departments and primary department by their trusted email address; the tables migrate on all six supported databases, SQL Server and Oracle included; see Identity sources (LDAP and OIDC).
• OpenID Connect identity sources can sync the phone number and the avatar and can add parameters to the authorization request (such as Casdoor's provider_hint); the protocol's own parameters cannot be overridden.

Authorization and resource catalog

• Direct user grants: allow menus, pages, buttons or APIs of a business application for a single user, optionally until an expiry time; they combine with role permissions, and a role's denial still wins; see Users.
• The resource catalog can export an application's resource tree as JSON and import it into another application: the import is previewed first and nothing applies when it conflicts; platform administrators can clear eligible application trees; see Resource and API catalog.

Server

• At startup the server prints a GrantForge banner with its version and the Java version instead of the Spring Boot banner.

Documentation and release

• The plug-ins tab opens with an overview, groups the systems by kind in a folding sidebar, and lists each system's enforcement, row filter and masking support and verified versions; every README lists the components in the same order.
• CI checks that every page is translated completely into every language: the same paragraphs, headings, tables, code blocks and links as the Chinese page, no text in another language's script, and nothing copied from the English page; the 11 READMEs get the same checks against the English README. Every missing translation the check found has been filled in.
• The version check keeps the version badge of every README current.
• The publish docs and release workflows no longer run on forks.
• The server grantforge-server is no longer published to Maven repositories: it bundles every plug-in and exceeds their size limit; it ships in the release archive and the image.

Fixes

• Changing a resource's type in the resource editor clears the resource code that no longer applies.
• The last code block of the JavaScript integration guide no longer swallows the text after it, and the console address on the Docker and quick start pages no longer turns the following text into a link.
• Dependencies upgraded to versions that fix security advisories: MariaDB Connector/J 3.5.11, OpenTelemetry 1.67.0, Guava 33.7.2, Snappy 1.1.10.9, and vue-i18n, glob and minimatch in the console and the SDK.