JSON Web Keys API calls made by the Onegini Token Server could cause the Onegini Token Server to become less responsive when the endpoints are unavailable or
take a long time to respond. These API calls are made when using private key JWT authentication. This has been fixed by adding read and connection timeouts.
12.6.0
Bug fixes
The nonce value was being lost when the consent page was shown during OpenID Connect flows. It should now be returned in the id_token as expected. Please
review the upgrade instructions related to the changes in templates.
Users using separate clients will no longer be logged out from all Identity Providers in the session when logging out from one.
Improvement
Ability to use JSON Web Tokens (JWT) as Access tokens for mobile applications.
12.5.0
Bug fixes
Push messages for mobile authentication could not be sent to iOS devices. This has been fixed. Android devices were not affected.
Mobile app version configurations could not be saved when using an Oracle database. This has been fixed.
Improvements
Private key JWT has been added as authentication method for OAuth and API endpoints.
A new version of the Device API returns more information about the devices of an end-user. The response now contains the model of the device and its version of the operating system.
12.4.1
Bugfixes
Event log in admin console shows only data on a need to know basis. The existing configuration has been updated to prevent use of earlier shown data.
12.4.0
Improvements
It is now possible to configure an alphanumeric SMS Sender ID when sending SMS messages during mobile authentication. Not all countries support alphanumeric sender IDs, for example, Belgium does not support this, but it is supported in the Netherlands. You can now configure the Token Server in such a way that Belgium customers get an SMS from a Belgium phone number while your Dutch customers get an SMS message with an alphanumeric sender ID, e.g "Onegini".
The Onegini Security Proxy blocked requests to some Onegini Token Server endpoints because the Payload Encryption policy status could not be resolved for all clients. The OIDC User info endpoint was one of the affected endpoints.
12.3.0
Features
Onegini CIM can store custom attributes and return them in the Person API or as part of SAML claims. The Onegini Token Server is consuming these custom attributes and returning them in the ID token and token introspection response. This release adds support for custom attributes with type object. Previously, a custom attribute could only contain a single string value. Now, a custom attribute can contain a multivalue attribute in JSON. This is helpful when you want to have a (simple) group setup or a collection of values.
Improvements
Extended the OIDC session management documentation by documenting the restrictions.
Bugfixes
If you wanted to use the “staat der Nederlanden Root CA-G3” TLS certificate, you had to make it work by creating a custom keystore. We are now basing our Docker images on the official library/openjdk images, which do include this root CA in the default truststore. So, there is no need to create the custom keystore anymore.
12.2.0
Features
Introduced a new Security Controls protocol. This makes client registration and authentication for mobile applications that use the Onegini SDK faster, easier and more secure. It also improved the Payload Encryption mechanism by using the latest technologies. The new Security Controls will be used after upgrading to the latest mobile SDK, which will be available soon!
Improvements
Added support for the Azure AD IdP using the SAML protocol.
Bug fixes
When an exception occurred in the SAML login flow, and the user was redirected back to the client with an error, the exception was not logged.
Loading the error template caused a Hibernate lazy initialization exception in some cases.
12.1.2
Improvements
The Onegini Token Server sets cookies for the authorization flow when it redirects to a SAML or OAuth identity provider to sign in. Some browsers do not store
these cookies during the redirect. Without cookies the customer cannot sign in. The Onegini Token Server can now show a page to set the cookies. This page will
send the customer automatically to the login page, but it can and probably will be visible for a short period. This step was introduced to ensure that the
cookies for the Onegini Token Server will be set correctly. This page is optional and is disabled by default. Enable this page with the environment variable
AUTHENTICATION_FLOW_RENDER_PAGE_BEFORE_REDIRECT_TO_IDP=true.
With some SAML identity providers login could fail, because there was no support for the element NameIDPolicy. This has been improved. From now on, the
optional element NamedIDPolicy will be included in authentication requests towards SAML identity providers depending on conditions in the SAML identity
provider configuration.
Bug fixes
Logout could fail when multiple SAML identity providers were configured in the Onegini Token Server. This has been fixed.
12.1.0
Features
In Onegini Token Server version 11.0.0, the support for Microsoft SQL Server and Oracle databases had been removed. This support has been restored: the
Onegini Token Server can use Microsoft SQL Server or Oracle for storage again. Refer to the upgrade instructions.
Bug fixes
The Onegini Token Server could return an error. This has been fixed and may require an upgrade of Redis. The error
occurred under the following conditions:
a mobile app had obtained an access token via a previously issued refresh token
the mobile app fetched data via multiple calls to its resource gateway within a very short time frame
the resource gateway requested token introspection for each of these data again within a very short time frame
In authentication requests towards SAML identity providers, the element NameIDPolicy contained an attribute SPNameQualifier. Login failed with some SAML
identity providers because this attribute should not be present for requests from the Onegini Token Server. This problem has been solved: the attribute
SPNameQualifier is no longer sent with SAML authentication requests.
When the authentication failed at a SAML identity provider, the Onegini Token Server did not return the underlying error cause to the OAuth client. This has
been solved: the underlying error cause is now returned to the client.
When Bearer authentication was used with an invalid or expired token, the response header WWW-Authenticate did not contain error information as specified in
RFC 6750, section 3. This has been fixed by adding the error information to the WWW-Authenticate header.
Users get an improved single sign on experience when multiple OpenID Connect Relying Parties connect to a single Onegini CIM or other kind of SAML identity provider via the Onegini Token Server.
The test client now fetches resources directly via the browser. This is a more realistic test scenario for single page apps.
Bug fixes
When the person API of Onegini CIM was called and it returned an attribute without a value, the Onegini Token Server would throw an error. This has been fixed.
The test client could expose arbitrary endpoints of an internal network to the outside world. The test client is now restricted to access preconfigured endpoints only.
When an OpenID Connect relying party performed an authentication request with prompt=none, the Onegini Token Server did not always comply to the OpenID Connect specification. This has been fixed. Refer to the upgrade instructions for the impact on error handling.