Versions Compared

Old Version 1

changes.mady.by.user John Jellema

Saved on

compared with

New Version Current

changes.mady.by.user ubisebastian

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Please see the current Release Notes (here - scroll down to change log) for the active release change log

...

SSO 8.8.0 (09/06/2021)

New Features

  • IDS-105 - Administrators are now able to configure OpenID Connect methods in SSO Management UI without using the Management API. Read our Knowledge base article Configure OpenID Connect authentication method in SSO Management UI
  • IDS-2861 - UserInfo endpoint now supports POST requests. See Authorization code grant and web single sign-on - SSO for more information
  • IDS-2765 - SPI OpenID Connect CIBA method has been included to SSO. This allows CIBA method to be used as step-up method for your registered users. Read more about the configuration from OpenID Connect CIBA authentication method
  • IDS-2937 - New API calls have been added to the Accounting Service to get more information on the ticket granted events happening in your system. The API calls return method and application used for each of the events and are able to be queried daily, hourly or per minute. More information about the API calls can be found from Event details API section in Accounting Service API
  • IDS-2256 - Freja eID is now supported by SSO. Read our Knowledge base article Configure OpenID Connect Freja eID login
  • IDS-3008 - TOTP API has been extended with a new call to get information if a user has the TOTP method enabled or disabled for their account. Detailed information how to use the API is available in TOTP API swagger documentation that can be configured with the TOTP API - SSO

Improvements

  • IDS-2862 - In Authentication requests that require End-user interaction to continue although prompt parameter is none the error response has been changed from previous access_denied to interaction_required, according to the OpenID Connect Core 1.0 specifications
  • IDS-2847 - Hardcoded acr_value for Client Initiated Backchannel Authentications method has been removed
  • IDS-2833 - CIBA adapter (previously UBAA) OpenID Provider metadata has been updated with backchannel_token_delivery_modes_supported and token_endpoint_auth_signing_alg_values_supported values. More information about the metadata can be found from Installing and configuring Swedish BankID - SSO
  • IDS-2837 - invalid_grant error message has been updated to use LOGIN_CANCEL error message instead of previous AUTHENTICATION_METHOD_INVALID for CIBA methods
  • IDS-2940 - CIBA adapter's Spring Boot version has been updated and Swagger UI URL has changed, check the new URL from Installing and configuring Swedish BankID - SSO
  • IDS-1670 - Step-up method usability has been improved to not show any selection between step-up methods if there is only one configured for the application. For example, if only TOTP method is available as 2FA method in application, the user no longer needs to click "totp.1" button after signing in with password, but is immediately asked for TOTP code
  • IDS-2160 - Improved performance when generating and downloading reports from the Accounting Service. In our testing we have noted substantially decreased download times observable in larger datasets
  • IDS-2794 - Updated unix.config/win32.config file to include sso-api.uuid, totp.uuid and accounting.client.uuid to preserve the client IDs during upgrade of your system. Info about this can be found from Preserve essential configuration settings in upgrade
  • IDS-3019 - Accounting Service methods have been updated for CIBA methods. Previously named UBAA method is now referred to as UNREGISTERED.CIBA and registered CIBA method is referred to as DIR.CIBA. See Accounting Service - SSO for more information
  • IDS-3011 - Unregistered CIBA method: Transformation of id_token claims was changed to be same as in OpenID Connect method. Also added a new configuration option `usernameClaim` for defining the id_token claim used as the subject for the unregistered user
  • IDS-3015 - Token endpoint responses have been updated to have HTTP headers "Cache-Control: no-store" and "Pragma: no-cache" set by default to prevent information to be cached
  • IDS-3018 - Refresh token endpoint error responses have been updated in accordance to 
    OpenID Connect Core 1.0
  • IDS-3061 - New compatibility flag was introduced to resolve backwards incompatibility with OTP printout and TOTP secrets in the case that the users are stored in SQL database. If this is the case LegacyUserCredentialsTable needs to be added to the method for the users to keep using their set secrets. New SQL users or existing users recreating their secrets will be handled correctly. See more details from TOTP Authentication Method and OTP Printout authentication method - SSO
  • IDS-3062 - CIBA adapter has been updated to include client_id in aud claim and id_token expiration time. Configuration information can be found from Installing and configuring Swedish BankID
  • IDS-3009 - TOTP method can now be used without additional schema changes when using AD LDS as Ubilogin Directory together with external SQL directory

...

  • IDS-1511 - SSO Password reset: old tokens not invalidated.  There are built-in features that can be used to mitigate
    • OTP should be set to expire (policy.oauth.otp.timeout)
    • Password min-age should be set greater than OTP expiration time (policy.password.min-age)
  • IDS-2721 - MENU_INTRO2_TEXT in SSO messages properties has been fixed to show the client name in SSO login screen when configured in client_name is configured in the metadata. Review Login screens - SSO for more details
  • IDS-2247 - OTP_LOGIN_REMAINING_PASSWORD_AMOUNT in SSO properties has been fixed to show the remaining one-time passwords left on the printed list to warn the user to renew the list before it runs out of passwords. More details on configurations can be found from Login screens - SSO and OTP Printout authentication method - SSO
  • IDS-2750 - Refresh tokens were invalid for Unregistered SMS with an Ubilogin Directory user. This issue has been fully resolved.
  • IDS-3104 - SPI TOTP method: Account lockout policy section is now shown in TOTP method configuration in SSO Management UI and pressing "Update" without any changes doesn't remove the lockout policy configurations.

...

SSO 8.7.0 (20/01/2021)

New Features

  • IDS-1256 - SSO now supports Authorisation Code Flow with Proof Key for Code Exchange (PKCE) and will start validating the code_challenge and code_verifier for clients that are already sending them now. PKCE is currently only supported when SSO acts as Authorisation server (IDP). More information can be found from Authorization code grant - SSO and Provider metadata reference - SSO

Improvements

  • IDS-2784 - Accounting Service dependencies has been updated to remove vulnerabilities. You can find the latest versions used in the Accounting Table 2 on 3rd party licenses - SSO
    • Note: Related to Spring Boot updates, server.use-forward-headers property has been deprecated in favour of server.forward-headers-strategy and logging.name has changed to logging.file.name. Please review Accounting Service additional configuration - SSO for more details
  • IDS-2706 - SSO dependencies have been updated to remove vulnerabilities. You can find the latest versions used in the SSO Table 1 on 3rd party licenses - SSO
  • IDS-2498 - Issue with policy.password.history parameter has been fixed and new passwords are compared against the amount of previous passwords in the system. If value is set to 5, the user can not change to the any of the 5 previous passwords used. This policy still has issues with CustomerID and causes issues in user creation if enabled for password method used in CustomerID, see IDS-2851 in known issues
  • IDS-2985 - Refresh token logging have been extended with details of which refresh token was trying to be accessed to help with troubleshooting. This can be enabled by setting debug level on diag.protocol logs.

...

  • IDS-1885 - SSO now supports Time-based One-time Password as a new step-up method. See TOTP Authentication Method for more details
  • IDS-2631 - TOTP API application has been created for handling of user TOTP secrets. These API calls allow Administrators to set and remove the secrets for users through their own self-service UI/application (this is not provided within the Ubisecure Identity Server). See TOTP API - SSO for more info how to setup and configure 

Improvements

  • IDS-2714 - Support for PBKDF2-SHA256 password encoding has been added to SSO. All supported values can be found from Management UI authentication methods
  • IDS-2571 - Improvement for handling multiple IPs in "proxy.remote-addr-name = x-forwarded-for" configuration. If there are multiple IPs included in the request, all of the IPs will be shown in the audit logs, separated by ",". This will need to be taken into consideration when parsing the audit logs. Previously multiple IPs caused issues with Ubilogin Management, Logviewer and Search applications.
  • IDS-2717 - Changes to application configuration for two-factor authentication methods. If both password and a step-up method is enabled for an application, users who do not have the specific step-up method enabled on their account can log in to the application with password only. See Authentication and authorization process - SSO

SSO 8.5.2 (21/06/2021)

Corrections

...

SSO 8.5.0 (17/06/2020)

New Features

...

  • IDS-2516 - OAuth 2.0 applications can be extended with compatibility flag ExtendedOAuth2AuditLogging. This enables additional log entries to the audit log to facilitate Mobile Connect billing use cases. This can also be use for other OpenID Connect use cases. More detailed information can be found from Additional audit logging for OAuth 2.0
  • IDS-1304 - Authorisation policies have been updated with scope field. This will allow Administrators to specify which scopes should be evaluated for OpenID Connect and OAuth 2.0 applications. You can read more about how to Manage authorization policies - SSO here
  • IDS-2522 - Improved consent page includes requested scopes and confirm/cancel buttons instead of previous static text and checkbox. This improvement can be used for OpenID Connect methods and OAuth 2.0 applications. For other applications and methods, an updated static page of consent information will be shown to the end user. Read more about how to configure the consent screen from our Login screens - SSO and Internationalization - SSO documentation pages. 
  • IDS-1591 - Mobile ID (Mobiilivarmenne) phone number input field has been changed from 'text' to 'tel' to improve the user experience on mobile devices. Users default screen will show number keypad rather than alphabet keyboard, easing use of the service
  • IDS-2486 - Optimisation of LDAP search in Password Reset application related to lookup of available methods
  • IDS-2014 - Additional information for the different entry types has been added to our Audit log description - SSO
  • IDS-2034 - Improved documentation how to setup authentication methods using SSO Management API can be found from OpenID Connect authentication method - SSO
  • IDS-750 - Improved documentation related to handling of error situation not to expose any sensitive server or software information. Read more about how to use reverse proxy in our Security considerations for production environments - SSO
  • IDS-1487 - Improved version handling of SSO components in order to have a better understanding of which version is currently installed. Logging of correct version (i.e. same as the release version) during SSO startup
  • IDS-2445 - Improvement to how threads are handled for Health check API. In clustered environments it was noticed that the health check calls could go into a deadlock due to timing issue when connection was shutting down
  • IDS-2615 - OAuth2 / OpenID Connect Token responses have been changed to exclude the id_token for refresh requests. This is to make sure that no additional information is shared with the application that the user has not approved to be shared. Read more about Access Token and ID Token from Authorization code grant and web single sign-on - SSO
  • IDS-2608 - Updated audit log field "Web Application User ID" to get username sent to the application in the log entries that have this field available. More information can be found from Audit log description - SSO

Corrections

  • IDS-2158 - Version number in the footer of SSO Management UI now correctly displays the installed version of the application
  • IDS-2317 - UsernameUserMappingIdentityFactory flag has been set to disabled as default as specified in SSO 8.4.1 release notes. If this functionality needs to be enabled follow the Enabling UsernameUserMappingIdentityFactory instructions
  • IDS-2032 - Changing log levels in SSO management UI will now come into affect without restarting SSO application, this would previously require a restart
  • IDS-1182 & IDS-1469 - Documentation has been updated related to how to configure your reverse proxy in order not to expose any sensitive server or software information. Read more about how to use reverse proxy in our Security considerations for production environments - SSO page
  • IDS-2537 - Correction to jQuery call that broke WS-Federation logout in 8.4.0 and 8.4.1. If using WS-Federation methods, we suggest to upgrade to SSO 8.5.0 to resolve this issue

...

Corrections

  • IDS-2208 - Fix for StrictAudiencePolicy to be able to set the compatibility flag system-wide, this did not overwrite application or authentication method flags set in SSO 8.3.8 (OpenID Connect authentication method - SSO)

SSO 8.4.0 (12/11/2019)

New Features

Improvements

  • IDS-58 - Server side session storage/Redis product documentation (Use Redis with Identity Server)
  • IDS-79 - NameIDPolicy must be set for AuthnRequest sent by SSO
  • IDS-110 - Updated SSO external library (3rd party) dependencies (3rd party licenses - SSO)
  • IDS-684 - AuthnContextClassRef from a SAML Identity Provider to SSO (IdP Proxy) should also be possible to be forwarded to SP
  • IDS-930 - SSO management API for persistentID (PCR) name mapping
  • IDS-1080 - Identity Server supports BCrypt for password encoding

...