• IDS-2161 - Merged changes made in SSO 8.3.8 that did not make it into SSO 8.4.0 release (see Change log - SSO)

• IDS-2058 - Addition of compatibility flag for UsernameUserMapping legacy feature in order to prevent exhaustion of LDAP connections. This will be disabled by default in upcoming SSO 8.5.0 release (Disabling UsernameUserMappingIdentityFactory)

• IDS-2166 - Inclusion of KeyID in metadata generated by SSO Management API (OpenID Connect authentication method - SSO)

• IDS-2283 - Client metadata extension ubisecure_request_parameters / acr_values has been updated to have highest priority in outbound requests in order to ensure that correct values are sent (OpenID Connect authentication method - SSO)

• IDS-1999 - Ability to configure RequestedAuthnContext through AuthnContextClassRef or AuthnContextDeclRef together with comparision for SAML authentication methods (SAML IDP Proxy - SSO)

• IDS-2303 - Ability to configure the thread pool size of Mobile PKI authentication method (Installing and configuring ETSI MSS Mobile PKI - SSO)

• IDS-2208 - Fix for StrictAudiencePolicy to be able to set the compatibility flag system-wide, this did not overwrite application or authentication method flags set in SSO 8.3.8 (OpenID Connect authentication method - SSO)

• IDS-1103 - Accounting Service 

  • More information about this feature can be found from our Developer portal (Accounting Service - SSO)

• IDS-994 - Per user authentication matching 

  • More information about this JavaScript based frontend user interface extension can be found from our public Github repository (https://github.com/ubisecure/per-user-authentication-matching)

• IDS-58 - Server side session storage/Redis product documentation (Use Redis with Identity Server)

• IDS-79 - NameIDPolicy must be set for AuthnRequest sent by SSO

• IDS-110 - Updated SSO external library (3rd party) dependencies (3rd party licenses - SSO)

• IDS-684 - AuthnContextClassRef from a SAML Identity Provider to SSO (IdP Proxy) should also be possible to be forwarded to SP

• IDS-930 - SSO management API for persistentID (PCR) name mapping

• IDS-1080 - Identity Server supports BCrypt for password encoding

• IDS-653 - Name change: Agent has been replaced with Application in SSO UI

• IDS-683 - Fix for deadlock in JLDAP

• IDS-712 - Fix usability on Unregistered SMS login screens. Focus set to OTP field

• IDS-1106 - Fix for SSO server jwks interoperability issue in Chrome

• IDS-1190 - Fix for one time feature not working for OAuth applications when there is SSO session available

• IDS-1412 - Fix for REDIS failover when the node configured in SSO goes offline

This release improves the compatibility with Finnish Trust Network. It also includes improvements on general OpenID Connect compatibility.

• IDS-2037: OpenID Connect: Ability to duplicate parameters outside the request object when sending Authorization requests as JWTs

• IDS-2107: OpenID Connect: Implementation of Key ID in JWKs, JWS and JWE

• IDS-2108: OpenID Connect: Send client_id as a request parameter in Token requests when using client assertions

• IDS-2110: OpenID Connect: Ability to perform relaxed or strict JWT aud claim validation

• IDS-2113: OpenID Connect: Improved UI locale handling

• IDS-2114: OpenID Connect: Ability to perform Authentication request with HTTP POST instead of GET

• IDS-2115: OpenID Connect:: Include the aud claim in client assertions

• IDS-2164: OpenID Connect: Ability to define static ubisecure_request_parameters to be sent with Authorization requests

• This version was omitted from public consumption due to limited use functionality

• IDS-1412: Improvements in support for Redis Cluster failover during server startup and runtime.

  • SSO now supports configuring more than one initial seed nodes which are used during SSO startup. Instructions on setting the initial seed nodes can be found here.

  • SSO now recovers from changes in the Redis cluster's topology during runtime, such as nodes going down and back up.

• IDS-1460: The errors "User not found" and "Invalid credentials" are no longer revealed in "subStatus" attribute of the JSON object "view", which can be found when viewing the page source of the login page.

• IDS-1354: Fixed warning of missing library file commons-daemon.jar in application server log during startup

  • This issue occurred in version 8.3.4 but does not cause regression other than the warning note in the logs

• IDS-1308: Finnish Trust Network: Support for SAML2 LG extension as specified in FTN SAML2 Profile v1.0 chapter 3.5.3.1.

  • SSO is now able to read the LG extension from inbound SAML 2.0 Authentication Requests and use it as the login UI locale; and write it to outbound SAML 2.0 Authentication Requests.

  • For SAML 2.0 Authentication Methods, writing the extension in an Authentication Request requires a new Compatibility Flag FinnishTrustNetwork set for the method.

  • For SAML 2.0 Applications, the Extension is read from an Authentication Request automatically if one is available.

• IDS-1326: Running the setup.sh for Enterprise Linux doesn't require high system entropy.

  • This was an errored requirement used only in 8.3.2 and 8.3.3

• IDS-1279: Mobile Connect Authentication v1.1: Error responses for Mobile Connect authentication requests are now compatible with the updated Authentication 1.1 profile.

• IDS-1146: One-time password format in OAuth SMS/SMTP grant can be freely formatted.

  • Check the documentation from Configuration of unregistered SMTP - SSO and Installing SMS authentication method - SSO.

• IDS-1117: Support for HTML emails in OAuth SMTP-OTP Grant.

  • You can set a new parameter in OAuth and our language files to set an explicit content type for emails and if omitted then plain text will be used for backward compatibility.

  • Check the documentation from Configuration of unregistered SMTP - SSO and Password Reset application internationalization - SSO.

• IDS-947: Corrected ForceAuthn authentications when user has already an existing authentication.

• IDS-1037: Made it possible to update Tomcat version.

  • Check the RefreshServlet security chapter from Security considerations for production environments - SSO and Configuring CORS with credentials - SSO.

• IDS-1106: Corrected JWK interoperability issue with Chrome browser.