We added possibility to set the X-Frame-Options header in the response with the property token.server.engine.security.xFrameOptions or environment variable TOKEN_SERVER_ENGINE_SECURITY_X_FRAME_OPTIONS. More information can be found in the documentation.
The application version shown in the admin panel corresponds to the current version of the application.
We have fixed the JWT Access Token consumption in KeyEnrollment v3 and PushEnrollment v3 APIs. In some situations, the access token of type JWT was treated as invalid.
The Onegini Token Server read the connection timeouts for the API client incorrectly which caused an unexpected resource drain.
When performing API calls towards /api/v1/configuration/applications/{app_id}/platforms/{platform}/versions using GET or PATCH methods it is not required anymore to add "/" at the end of the URL.
Improved the integrity check for mobile apps. This improved integrity check is
required for new mobile apps introduced to the Google Play Store after August 1st, 2021. The existing apps, both running on Android and iOS, will continue to
work without any changes. Still, it is recommended to plan an update of the Onegini SDK and use the improved integrity check.
Added the ability to delete access and refresh tokens when using the End-session endpoint for OpenID
Connect. This is enabled by default for clients with the authentication method PKCE. Refer to the OpenID Connect configuration for more information
Some users could face an issue in the first phase of the authorization process related to how the state was preserved on the client-side (cookies). The
problem is fixed. For more information, please refer to the upgrade instructions.
The process of registering a new mobile application requires both parties, the device, and the server, to have their time/date settings set correctly. Some
users are explicitly modifying their time which prevents them from successfully finishing the onboarding process. To improve the user experience
Onegini Token Server will handle such situations more gracefully by detecting clock skew and informing the client about the root cause of the rejection.
API client configurations could not be saved in a Microsoft SQL Server database.
This has been fixed.
When Cross-Origin Resource Sharing (CORS) was enabled without specifying allowed origins, requests were rejected by some browsers. This has been fixed.
OpenID Connect session management has been updated to be compliant with draft version 30 of its
specification
The events API now returns the name of the Application or Web client with new events.
Cordova apps on Android that use cordova-plugin-push to receive push notifications require the push
message in a specific format. The Onegini Token Server will now send push notifications in this format when
the app version configuration indicates that the app is built with Cordova.
Within Onegini CIM the user data can be stored in different partitions. When the Onegini Token Server requests user data, it can pass the
specific partition with the request.
When incorrect credentials were provided with the Resource Owner Password Credentials flow, the Onegini Token Server returned an incorrect error response
with internal_server_error. This has been fixed to return an error response with invalid_grant.
Relying Parties can now request the Identity Assurance Level (IAL) from the Onegini Token Server when initiating the authorization. The IAL conveys the degree
of confidence (Assurance) that the user's claimed identity is their real identity.
As of now, the Payload Encryption functionality could only be set during the Application Version configuration phase (prior to any actual mobile application
registrations). The Onegini Token Server is now allowing the administrators to manipulate this property value at any time given the mobile applications that
are referring to it are using PrivateKeyJWT client authentication method.
The Onegini Token Server was incorrectly attempting to decrypt the incoming SAML Assertion in case the encryption credentials were available, but the
Assertion was not actually encrypted.
JSON Web Keys API calls made by the Onegini Token Server could cause the Onegini Token Server to become less responsive when the endpoints are unavailable or
take a long time to respond. These API calls are made when using private key JWT authentication. This has been fixed by adding read and connection timeouts.
The nonce value was being lost when the consent page was shown during OpenID Connect flows. It should now be returned in the id_token as expected. Please
review the upgrade instructions related to the changes in templates.
Users using separate clients will no longer be logged out from all Identity Providers in the session when logging out from one.
Private key JWT has been added as authentication method for OAuth and API endpoints.
A new version of the Device API returns more information about the devices of an end-user. The response now contains
the model of the device and its version of the operating system.
It is now possible to configure an alphanumeric SMS Sender ID when sending SMS
messages during mobile authentication. Not all countries support alphanumeric sender IDs, for example, Belgium does not support this, but it is supported in
the Netherlands. You can now configure the Token Server in such a way that Belgium customers get an SMS from a Belgium phone number while your Dutch customers
get an SMS message with an alphanumeric sender ID, e.g "Onegini".
The Onegini Security Proxy blocked requests to some Onegini Token Server endpoints because the Payload Encryption policy status could not be
resolved for all clients. The OIDC User info endpoint was one of the affected endpoints.
Onegini CIM can store custom attributes and return them in the Person API or as part of SAML claims. The Onegini Token Server is consuming
these custom attributes and returning them in the ID token and token introspection response. This release adds support for custom attributes with type object.
Previously, a custom attribute could only contain a single string value. Now, a custom attribute can contain a multivalue attribute in JSON. This is helpful
when you want to have a (simple) group setup or a collection of values.
If you wanted to use the “staat der Nederlanden Root CA-G3” TLS certificate, you had to make it work by creating a custom keystore. We are now basing our
Docker images on the official library/openjdk images, which do include this root CA in the default truststore. So, there is no need to create the custom
keystore anymore.
Introduced a new Security Controls protocol. This makes client registration and authentication for mobile applications that use the Onegini SDK faster, easier
and more secure. It also improved the Payload Encryption mechanism by using the latest technologies. The new Security Controls will be used after upgrading to
the latest mobile SDK, which will be available soon!
The Onegini Token Server sets cookies for the authorization flow when it redirects to a SAML or OAuth identity provider to sign in. Some browsers do not store
these cookies during the redirect. Without cookies the customer cannot sign in. The Onegini Token Server can now show a page to set the cookies. This page
will send the customer automatically to the login page, but it can and probably will be visible for a short period. This step was introduced to ensure that
the cookies for the Onegini Token Server will be set correctly. This page is optional and is disabled by default. Enable this page with the environment
variable
AUTHENTICATION_FLOW_RENDER_PAGE_BEFORE_REDIRECT_TO_IDP=true.
With some SAML identity providers login could fail, because there was no support for the element NameIDPolicy. This has been improved. From now on, the
optional element NamedIDPolicy will be included in authentication requests towards SAML identity providers depending on conditions in the SAML identity
provider configuration.
In Onegini Token Server version 11.0.0, the support for Microsoft SQL Server and Oracle databases had been removed. This support has been restored: the
Onegini Token Server can use Microsoft SQL Server or Oracle for storage again. Refer to the upgrade instructions.
The Onegini Token Server could return an error. This has been fixed and may require an upgrade of Redis. The error
occurred under the following conditions:
a mobile app had obtained an access token via a previously issued refresh token
the mobile app fetched data via multiple calls to its resource gateway within a very short time frame
the resource gateway requested token introspection for each of these data again within a very short time frame
In authentication requests towards SAML identity providers, the element NameIDPolicy contained an attribute SPNameQualifier. Login failed with some SAML
identity providers because this attribute should not be present for requests from the Onegini Token Server. This problem has been solved: the attribute
SPNameQualifier is no longer sent with SAML authentication requests.
When the authentication failed at a SAML identity provider, the Onegini Token Server did not return the underlying error cause to the OAuth client. This has
been solved: the underlying error cause is now returned to the client.
When Bearer authentication was used with an invalid or expired token, the response header WWW-Authenticate did not contain error information as specified in
RFC 6750, section 3. This has been fixed by adding the error information to the WWW-Authenticate header.
Users get an improved single sign on experience when multiple OpenID Connect Relying Parties connect to a single Onegini CIM or other kind of
SAML identity provider via the Onegini Token Server.
The test client now fetches resources directly via the browser. This is a more realistic test scenario for single page apps.
When the person API of Onegini CIM was
called and it returned an attribute without a value, the Onegini Token Server would throw an error. This has been fixed.
The test client could expose arbitrary endpoints of an internal network to the outside world. The test client is now restricted to access preconfigured
endpoints only.
When an OpenID Connect relying party performed an authentication request with prompt=none, the Onegini Token Server did not always comply to
the OpenID Connect specification. This has been fixed. Refer to the upgrade instructions
for the impact on error handling.