Identity Server 2024.1 Release Notes
Release highlights
This release focuses on introduction of the following new features and improvements:
Swedish BankID has updated the core Authentication Flow used for all two-device user authentications with their BankID application. The key differentiator is the required use of animated QR (quick reference) codes for the purpose of ensuring secure connections and limiting fraud and phishing potential attack vectors present when using prior authentication flows.
We have highlighted the details for the Swedish BankID in our developer portal. Ubisecure's Swedish BankID is compatible with BankID Web service API v.6.0
As always, there is regular on going system maintenance. In IDS 2024.1 we include support for RedHat 9 (Rocky9), Redis 7 and the latest available updates for Tomcat, OpenLDAP and PostgreSQL utilised in Identity Server.
Please ensure you review the updated System Recommendations page and are aware of the 3rd Party License page.
Contents
Change log
SSO 9.4.0
New Features
- IDS-4438 - We have updated the Swedish BankID authentication implementation to include BankID Web service API v6.0. This is experienced by end-users as the animated QR codes when authenticating sessions or payments on the web (via two-device or mobile phone scanning of the animated QR code).
Improvements
- IDS-4108 - We have optimised the codebase, deprecating
"tokeninfo_endpoint"from /uas/oauth2/metadata.json. Please use the more general "introspection_endpoint" instead. - IDS-4545 - We have verified the ability of Identity Platform to run on Red Hat Linux 9 compatible platforms.
- IDS-4493 - We have improved SSO’s CORS handling process by allowing browser application to make calls to the /introspection and /userinfo endpoints. Please review Restricting allowed origins.
Corrections
IDS-3174 - There was a known issue within common-ubiutil that returned an unescaped value where an escaped value is expected. This was identified during a misconfiguration and has not been reported to impact any operational environments. This error has been corrected and will no longer occur.
CustomerID 6.4.0
New Features
Improvements
IDS-3681 - It was possible to receive too many notifications due to the incorrect configuration of renotify.roleinvitation. Product documentation improvements have been made to better describe the use cases of Expiration periods - CustomerID and Reminder periods - CustomerID.
- IDS-3826 - It was possible to misconfigure PostgreSQL which would result in continuous invitations being sent out by CustomerID. The invitation worker code has been updated to ensure this no longer happens.
- Under the hood improvements to CustomerID
Corrections
Please review the change log if you are upgrading your system from a prior version to IDS 2023.2: Identity Platform
Deviations
The following deviations are found within Identity Platform and are expected to be corrected over time. For a listing of known issues found on Identity Platform please see: Considerations, limitations and known issues
SSO
Ticket number | External description |
|---|---|
| IDS-561 | There is a known issue where SSO does not check the mappingURL value when creating or editing an inboundDirectoryMappings when using the SSO REST API. Directory Mappings are possible to be created, but then not opened or edited. |
| IDS-1030 | There is a known issue where running the CertAP setup.cmd in a windows environment will post errors of missing linux tags. While these errors are unsightly, they can be safely ignored. This issue will be corrected in a future release. |
| IDS-1499 | There is a known issue where SSO will return http 401, rather than http 400 when token introspection without an authentication header or when invalid credentials are present. |
| IDS-1629 | There is a known issue resulting in unclear error messages. When a user is configured without a phone number and SMS OTP method is added to their profile result in one of two error messages. If the SMS OTP is the only authentication method enabled, the message will be “The user account is disabled”. If there are other authentication methods enabled, the message will be “Access to the requested resource is denied”. |
| IDS-1648 | This is a known issue that only is only present with password2. User is presented with a popup "Update: Invalid account Status" if one of the previous three passwords are used when asked to update their password. There is no known work around. |
| IDS-1662 | The use of the following special characters when making any search will result in an internal sever error 500 and a stack trace. Symbols: + = # ; , < > Work around, administrators should not use the special symbols when naming users or searching for users. |
| IDS-1893 | There is a known issue if you use OpenID authentication, a user cannot access SAML or Ubilogin web applications. Work around use any other non-OpenID authentication method. If OpenID is required, then use OAuth 2.0 application. |
| IDS-2090 | There is a known issue where the SSO management UI will not filter results correctly if the filter expression is short, contains incorrect filter expressions and there are Scandinavian characters included. |
| IDS-2244 | There is a known issue when using special characters within SSO management API in persistentID name mapping that may result in incorrect side or policy id values being returned. Recommended work around, do not use special characters, like “=” “,” “#” in site and policy mapping names. |
| IDS-2260 | There is a known installation issue when using SSO Password reset. Using the installation instructions for password reset tool requires an administrator to run tomcat update. This occasionally results in an empty context.xml file being created which causes SSO to fail when being restarted. Workaround, repeat the run tomcat update step which will create a correct .xml file and SSO will restart. |
| IDS-2314 | There is a known issue with passing a refresh token to token endpoint results in "invalid_grant" error, if the refresh token has been issued to an unregistered user from an authentication method having a connected Directory Service. |
| IDS-2478 | There is a known issue in SSO that it is not possible to have different localisations for access_denied returned by IdP and local access_denied, for example if directory user mapping fails after successful authentication |
| IDS-2790 | There is a known issue with sending in invalid formatted request to introspection endpoint returns stack trace including server version number. This can be mitigated by following our Security considerations for using reverse proxy and customising error pages with HAProxy Security considerations for production environments - SSO |
| IDS-3092 | There is a known issue where Administrators are unable to alter password encoding through the SSO management UI. There is no known UI work around. |
| IDS-3625 | There is a known issue where an ERROR 500 message with stack-trace is shown in the browser if there is no valid encryption key available in SSO. Mitigation use reverse proxy to catch all 500 error with user friendly information Security considerations for production environments - SSO |
| IDS-3665 | There is a known issue where the authorisation endpoint may become corrupted if a URL contains "%20" in URL encoded format. |
| IDS-3730 | There is a known issue where using “Force Reauthentication” configuration for an application that uses refresh tokens, the refresh tokens are immediately invalidated. Workaround is to not use “Force Reauthentication”, set max age to 0 in auth request → Authentication is forced and refresh tokens are valid. |
| IDS-3971 | There is a known issue which results in a non-impacting stack trace being logged when updating metadata using ManagedScheudledExecutorService for SAML 2 AP. There is no known work around to this non-impacting log event. |
| IDS-4202 | There is a known issue where attributes forwarded from an external authentication method are not available after the access token has been refreshed. No known work around is available at this time. |
| IDS-4431 | There is a known issue where SSO will provide an incomplete OAuth2 response when access has been denied. There is no work around for this defect. |
| IDS-4448 | There is a known issue that prevents the Accounting service scheduled cleaner from running on a subsequent day after restart. This is due an invalid check for the earliest removal date of events. Work around, events can be manually removed from the service log. |
| IDS-4526 | There is a know issue that occurs in SSO Management UI when removing the last user from an existing application, the UI will appear blank with no application to select. Recommended work around, do not remove the final user from an application, ensure that at least one user is assigned to an application. |
| IDS-4644 | There is a known issue where the use of special characters within a users name, like “)” for example “Bud)”, will break the user mapping view. Work around, do not permit special characters within user names. |
| IDS-4669 | There is a known issue where the status refresh does not update entryTtl for dynamic session objects. There is no known work around at this t |
| IDS-4733 | There is a known issue within SSO which could permit XML expansion from an external entity. Additionally, there is a known issue within SSO which could allow for header injection. Both items will be corrected in an upcoming patch, SSO 9.4.1. |
CustomerID
Ticket number | Description |
|---|---|
| IDS-1373 | There is a known issue in CustomerID when a new user is created in a non-virtual organisation, the invitation can contain a role when no role has been approved for that user. |
| IDS-1509 | There is a known issue where a new user being invited to a virtual organisation the CustomerID administrator cannot approve the user; an internal server error occurs. |
| IDS-1706 | There is a known issue with null values (DbAssignable.set and DbAssignable.isNull) which may result in NullPointer exceptions when using REST calls. This impacts Roles, Mandates and Invitations. |
| IDS-2312 | There is a known issue in approval view where changing technical name of an organization to include Scandinavian letters doesn't work. |
| IDS-2683 | There is a known issue where CID REST API's 2.0 and 2.1 do not locate organisations with URL encoded characters in their names. Work around, if possible, ensure there are no URL encoded characters within organisation names. (example Ä Ö Å). |
| IDS-2703 | There is a known issue where a role name with different case can be created which results in one LDAP entry and two SQL entries. |
| IDS-2876 | There is a known issue if user is rejected from UI error is logged "Error when trying to get approval request with ID: null". A stack trace is logged. This stack trace can be safely ignored. |
| IDS-2934 | There is a known issue in CustomerID within Mandates, where no renotify email is sent to new user to register using mandate invitation. Admin user sends mandate from Admin UI to new user that is not registered to the system. Email is sent correctly, but no renotify is sent to register to the system.Mandate expires correctly also and email is sent that mandate was expired. |
| IDS-2941 | There is a known issue where a NPE will occur if an administrator is viewing an ORG2PER mandate from the CustomerID management UI. |
| IDS-3058 | There is a known issue where in change password application of CustomerID where the return URL is missing a forward slash (returns "https:/" not "https://") resulting in failed redirect if the cancel button would be enabled. |
| IDS-3765 | There is an issue with JDK 11.0.15 that prevents Wildfly from working |