Upgrade instructions 12.x

12.6.0

Changes in templates

The default template consent.html has been updated to include the nonce variable in the consent form post. If your custom template set contains this consent.html template, you need to update your customized template set. Download the default template set to compare your version of consent.html with the standard version.

e.g.: <input type="hidden" name="nonce" value="${nonce}"/>

12.5.0

Device API

Device API version 4 has been introduced. It shows more information about the devices of an end-user. Another change is that property names in the JSON response objects of Device API version 4 are using camelCase. The older versions were using snake_case.

Changes in the database schema

Run the following database scripts if your installation does not automatically update the database schema:

  • V12_04_02_00__delete_mobile_platform_version_keys.sql
  • V12_04_03_00__add_jwks_uri_to_client_jwks.sql
  • V12_04_03_01__add_device_model.sql
  • V12_05_00_00__change_mpv_keys_fingerprint_column_type.sql (this script is for Oracle only)

12.4.1

Changes in the database schema

Run the following database scripts if your installation does not automatically update the database schema:

  • V12_04_01_00__delete_mobile_platform_version_keys.sql

12.4.0

Changes in the database schema

Run the following database scripts if your installation does not automatically update the database schema:

  • V12_04_00_00__add_sender_id_to_auth_properties.sql

12.2.0

Changes in the database schema

Run the following database scripts if your installation does not automatically update the database schema:

  • V12_02_00_02__add_mobile_platform_version_keys_on_delete_cascade.sql

12.1.2

Changes in the database schema

Run the following database scripts if your installation does not automatically update the database schema:

  • V12_02_00_01__add_mobile_platform_version_keys.sql

12.1.0

Redis

This release requires a Redis server version 4 or higher.

Changes in the database schema

For MySQL there are no new database scripts.

For Microsoft SQL Server or Oracle run the following database scripts if your installation does not automatically update the database schema:

  • V11_00_00_00__add_pkce_support.sql
  • V11_00_00_01__add_dum_engine_configs.sql
  • V11_00_00_02__add_refresh_token_expiration_time.sql
  • V11_00_01_00__add_integrity_check_to_application_version.sql
  • V11_00_01_01__app_signature_made_optional.sql
  • V11_00_01_02__add_registration_id_and_assertion_public_key_to_the_client.sql

12.0.0

Change in OpenID Connect check session template

The default template check-session.html has been modified to support reading cookies in iOS12 and other browsers that ignore cookies with a SameSite=None flag inside an iframe. If your custom template set contains this check-session.html template, you need to update your customized template set. Download the default template set to compare your version of check-session.html with the standard version.

Change in error handling

When something goes wrong during the OAuth authorization code flow or the OpenID Connect Authentication request the Onegini Token Server often showed an HTML error page, while it could redirect back to the client with an error code. This HTML page was not compliant with parts of the OpenID Connect Authentication request specification. This redirect may also simplify customized error templates for the Onegini Token Server.

The Onegini Token Server will now redirect back to the client with an error code in the following situations if the client_id and redirect_uri are correct:

  • The Onegini Token Server cannot determine which identity provider to use for authentication.
  • Fetching the metadata of a SAML identity provider fails.
  • An OpenID Connect Relying Party requests prompt=none for a user that has a session with Onegini Token Server but lost their session with the SAML identity provider.
  • The SAML identity provider returns an authentication response with a failure status. The underlying cause is returned to the client.

Changes in the database schema

Run the following database scripts if your installation does not automatically update the database schema:

  • V11_00_01_00__add_integrity_check_to_application_version.sql
  • V11_00_01_01__app_signature_made_optional.sql
  • V11_00_01_02__add_registration_id_and_assertion_public_key_to_the_client.sql