In Onegini Token Server version 11.0.0, the support for Microsoft SQL Server and Oracle databases had been removed. This support has been restored: the
Onegini Token Server can use Microsoft SQL Server or Oracle for storage again. Refer to the upgrade instructions.
Bug fixes
The Onegini Token Server could return an error. This has been fixed and may require an upgrade of Redis. The error
occurred under the following conditions:
a mobile app had obtained an access token via a previously issued refresh token
the mobile app fetched data via multiple calls to its resource gateway within a very short time frame
the resource gateway requested token introspection for each of these data again within a very short time frame
In authentication requests towards SAML identity providers, the element NameIDPolicy contained an attribute SPNameQualifier. Login failed with some SAML
identity providers because this attribute should not be present for requests from the Onegini Token Server. This problem has been solved: the attribute
SPNameQualifier is no longer sent with SAML authentication requests.
When the authentication failed at a SAML identity provider, the Onegini Token Server did not return the underlying error cause to the OAuth client. This has
been solved: the underlying error cause is now returned to the client.
When Bearer authentication was used with an invalid or expired token, the response header WWW-Authenticate did not contain error information as specified in
RFC 6750, section 3. This has been fixed by adding the error information to the WWW-Authenticate header.
Users get an improved single sign on experience when multiple OpenID Connect Relying Parties connect to a single Onegini CIM or other kind of SAML identity provider via the Onegini Token Server.
The test client now fetches resources directly via the browser. This is a more realistic test scenario for single page apps.
Bug fixes
When the person API of Onegini CIM was called and it returned an attribute without a value, the Onegini Token Server would throw an error. This has been fixed.
The test client could expose arbitrary endpoints of an internal network to the outside world. The test client is now restricted to access preconfigured endpoints only.
When an OpenID Connect relying party performed an authentication request with prompt=none, the Onegini Token Server did not always comply to the OpenID Connect specification. This has been fixed. Refer to the upgrade instructions for the impact on error handling.