--- collection: auth-identity collection_name: Auth & Identity week_start: 2026-10-05 title: Clerk's directory sync gets role mapping as Auth0 opens up token scopes release_count: 70 generated: 2026-10-12 canonical: https://releases.sh/collections/auth-identity/digest/2026-10-05 --- # Clerk's directory sync gets role mapping as Auth0 opens up token scopes Clerk shipped a role-mapping step for self-serve Directory Sync and let SAML connections trust several signing certificates at once, while Auth0 took access token scope customization for Actions to general availability. ### Enterprise identity gets more forgiving Clerk spent the week making enterprise setups survive change. Admins configuring Directory Sync from the self-serve flow inside OrganizationProfile can now [assign an organization role to each directory group their IdP pushes](https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.39.0), pick which group wins when someone belongs to several, and toggle role syncing off entirely — a capability that landed across the shared SDK, the UI package, and the localizations bundle at once so the setup screen, the underlying hooks, and the strings ship together. Members who fall into no mapped group keep the organization's default role, and the step stays read-only for anyone without `org:sys_memberships:manage`. SAML connections got the same treatment for key rotations: Clerk now [trusts up to five signing certificates on a connection](https://clerk.com/changelog/2026-10-02-multiple-saml-signing-certificates), so you can park an IdP's next certificate in the Dashboard before the rotation happens and sign-ins keep working across the switch. The old single-certificate field still parses but is deprecated, and the certificate list is manageable through `idp_certificates` on the Backend API. Alongside it, `handleRedirectCallback()` and `AuthenticateWithRedirectCallback` gained an `enterpriseConnectionsUrl` option for choosing between multiple enterprise connections that share an email domain — useful when one company runs several IdPs behind the same domain. On the Auth0 side, [access token scope customization for Actions](https://auth0.com/changelog#1XGBthpxlSgDVxlWVGehN2) left early access and reached GA, now covering Post Login Actions as well as Credentials Exchange. Actions can add, remove, set, or clear the scopes considered when an access token is issued; removals are always honored, additions only granted when the user and application are actually authorized, and `event.transaction.target_scopes` reflects changes across chained Actions. The practical effect is that scope narrowing can be enforced centrally rather than duplicated in every API. ### Client-side fixes and the iOS session model Clerk's iOS SDK put out a run of updates mostly aimed at correctness around sessions. It now [only authorizes active sessions in `Clerk.has`](https://github.com/clerk/clerk-ios/releases/tag/1.6.0) rather than any session object lying around, and the code resend countdown [keeps running for its full cooldown](https://github.com/clerk/clerk-ios/releases/tag/1.5.9) instead of resetting, with a failed reconfigure that wiped local data now signing out in memory rather than leaving a stale session behind. A third pass cleaned up decoding: [null role and permission descriptions, enterprise connections without a logo, and session actors](https://github.com/clerk/clerk-ios/releases/tag/1.6.1) that weren't being parsed as JSON all decode correctly now, credit ledger timestamps read as RFC 3339, and the Delete account row follows the user's `deleteSelfEnabled` flag. Elsewhere in the JavaScript SDK, the Electron bridge now [throws a Clerk error asking for the `renderer` option](https://github.com/clerk/javascript/releases/tag/%40clerk/electron%400.1.0) in `createClerkBridge()` instead of surfacing Electron's cryptic "No handler registered", and TanStack Start users [need Start 1.168.10 or newer](https://github.com/clerk/javascript/releases/tag/%40clerk/tanstack-react-start%401.7.0) and must register `createCsrfMiddleware()` ahead of `clerkMiddleware()` to restore CSRF protection that gets skipped when `src/start.ts` is present. Two smaller cleanups landed too: `` is [exported from the main `@clerk/nextjs` entry](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.9.13) so custom flows can import it, and a Protect challenge failing on the SSO callback [no longer swallows the error](https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.38.1) — it surfaces on `useSignIn()`/`useSignUp()` and routes failed sign-ups to sign-up rather than sign-in. Expo's `useBiometricCredentials()` also [gained `revokeCurrentDeviceCredential()`](https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.10.0) so you can drop this device's passkey without holding onto the ID from `enroll()`. The rest of the week was the usual dependency ripple — shared, backend, and the framework wrappers moving in step — plus a wording fix clarifying that [`clerk init` needs no account and writes temporary dev keys](https://github.com/clerk/javascript/releases/tag/%40clerk/shared%404.39.1). ## Releases covered ### Auth0 - [Auth0 Actions access token scope customization reaches GA with Post Login support](https://auth0.com/changelog#1XGBthpxlSgDVxlWVGehN2) ### Clerk - [Clerk JavaScript SDK 6.39.0 adds directory group role mapping for Directory Sync](https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.39.0) - [Clerk SAML connections now trust multiple signing certificates](https://clerk.com/changelog/2026-10-02-multiple-saml-signing-certificates) - [Clerk iOS SDK 1.6.0 scopes Clerk.has to active sessions](https://github.com/clerk/clerk-ios/releases/tag/1.6.0) - [Clerk iOS SDK 1.5.9 fixes code resend countdown and session sign-out](https://github.com/clerk/clerk-ios/releases/tag/1.5.9) - [Clerk iOS SDK 1.6.1 fixes decoding of null roles, missing logos, and session actors](https://github.com/clerk/clerk-ios/releases/tag/1.6.1) - [@clerk/electron 0.1.0 adds clear error for missing OAuth renderer option](https://github.com/clerk/javascript/releases/tag/%40clerk/electron%400.1.0) - [@clerk/tanstack-react-start v1.7.0 requires TanStack Start 1.168.10+ for reliable CSRF imports](https://github.com/clerk/javascript/releases/tag/%40clerk/tanstack-react-start%401.7.0) - [Clerk @clerk/nextjs 7.9.13 exports HandleSSOCallback from main entry point](https://github.com/clerk/javascript/releases/tag/%40clerk/nextjs%407.9.13) - [Clerk JavaScript SDK v6.38.1 fixes SSO callback error handling in Protect challenge](https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-js%406.38.1) - [@clerk/expo 4.10.0 adds revokeCurrentDeviceCredential to useBiometricCredentials](https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.10.0) - [Clerk JavaScript SDK v4.39.1 clarifies init command doesn't require account signup](https://github.com/clerk/javascript/releases/tag/%40clerk/shared%404.39.1)