New release: 5.5.0 & 5.5.1 ~ “Katip Arzuhalim” + “Burning Bridges”

Announcements
1

What’s in Passbolt 5.5.0 & 5.5.1?

Zero-knowledge mode for encrypted metadata (all editions)

For teams that prioritize privacy over server-side audit trails, zero-knowledge mode ensures the server never has access to resource metadata. Admins explicitly share the metadata key once a new user completes activation. Until then, actions requiring the shared metadata key (e.g., sharing a resource, moving private items to shared folders) are blocked.

Learn more: https://www.passbolt.com/blog/passbolt-5-5

SCIM (beta) on Passbolt Pro

Automate user lifecycle from your IdP. Create, update, and deactivate users without touching the Passbolt UI. The first iteration targets Microsoft Entra ID (Azure AD). Group provisioning will follow once invited-user onboarding edge cases are resolved. Okta is expected to work in most scenarios, but deactivation flows may still need refinement.

Learn more: https://www.passbolt.com/blog/simplifying-user-provisioning-using-scim

Fixes & improvements

  • Resolved a Chrome issue where the extension could appear unconfigured after update, sometimes triggering unnecessary recovery prompts.

  • Go CLI compatibility with new resource types, v0.4 is on track to graduate from beta with official support.

Changelogs

A follow-up release with stability fixes and minor polish on the above:

Enjoy Passbolt? Drop a :star::star::star::star::star: review:

chrome | firefox | edge | ios | android | windows

Thank you to everyone who reported issues, your feedback helped bring these capabilities to all users. :heart:

Try it now and let us know if you have any feedback below.

2 Likes
2

Hi everyone :waving_hand:

With the new SCIM (beta) support in Passbolt, I’ve built an open-source Keycloak plugin that automatically provisions users and groups to Passbolt using the SCIM v2 API.

:link: GitHub: github.com/Termindiego25/keycloak-scim-outbound

I started this project because the existing Keycloak SCIM connectors I found didn’t allow fine-grained control, such as filtering which users are synced based on a specific Keycloak group.
This plugin adds that capability — making it easier to decide exactly who gets provisioned.

The idea is for it to be standard and generic, although so far the proof of concept has been tested primarily with Passbolt.
It should work with any SCIM-compatible application.

:brain: Main features:

  • Sync user create / update / delete to SCIM targets

  • Optional group-based filtering for selective sync

  • Configurable directly from the Keycloak Admin Console

  • Custom userName mapping (username, email, or custom attribute)

It’s open source and ready for testing — feedback, ideas, and pull requests are very welcome! :raising_hands:

1 Like
3

And documentation for SCIM now live.
https://www.passbolt.com/docs/admin/user-provisioning/scim/