Upgrade instructions 10.x

10.0.0-M2

Run all database scripts

Warning: The migration V10_00_00_03__add_correlation_id_to_access_tokens.sql will take some extra time if the access_tokens table is large.

  • V10_00_00_03__add_correlation_id_to_access_tokens.sql

Zip archive handling

Zip files are now by default limited to 10MB and/or 100 files. This includes message and template zip files. These limits can be modified via environment properties as described in Zip archive handling

Thymeleaf upgrade

The Thymeleaf template engine and its dialects have been upgraded. If you have customized the templates based on the default template set they will probably still work. Thymeleaf has made changes to its templating language and logs warnings for the usage of deprecated features. We recommend to plan an upgrade of custom templates.

The most common changes are:

  • layout:decorator is deprecated. Use layout:decorate instead.
  • Replace $DECORATOR_TITLE with $LAYOUT_TITLE.
  • The attributes th:include and layout:include are deprecated. Replace them with th:insert and layout:insert. Note that insert has a different behavior than include.
  • Existing fragment expressions are deprecated.

Example of a deprecated Thymeleaf 2 fragment expression:

<th:block th:include="fragments/fragment-inputs :: csrfToken"/>

Example of an updated Thymeleaf 3 fragment expression

<th:block th:insert="~{fragments/fragment-inputs :: csrfToken}"/>

Refer to the Thymeleaf 3 migration guide and Layout dialect migration guide for full details.

Removal of Deprecated APIs and Minimum supported SDKs increased

The minimum supported SDK versions have been increased. Android SDK must be at least version 5.01.00, iOS SDK must be at least version 4.08.03

  • V1 & V2 of the Devices API has been removed. Use version 3 of the API.
    • /api/v1/users/{userId}/devices/*
    • /api/v2/users/{userId}/devices/*
  • The Authentication applications API has been removed. Use version 3 of the Device API as a replacement.
    • /oauth/api/v1/users/{userId}/authentication/apps/*

See other planned deprecations

Changes in custom Token Server plugins

The class com.onegini.tokenserver.engine.OauthEngineConstants was moved to com.onegini.tokenserver.engine.core.OauthEngineConstants. You may need to update some imports.

Application Version API Updated

The JSON keys for the Application Version API have been updated to be more consistent with the Admin UI and reflect the type of values each contains (e.g. boolean values have _enabled suffix).

The key changes are applicable for all of the defined endpoints. Here is a summary of the differences:

Old JSON key New JSON key
app_signature application_signature
tampering_protection tampering_protection_enabled
payload_encrypytion payload_encrypytion_enabled
use_apns_development_environment use_apns_development_environment_enabled
send_badge_number send_badge_number_enabled
payload_encrypytion payload_encrypytion_enabled
  • List of App versions per platform now returns the whole object (except application_signature) instead of just the version_name and status.
  • New endpoint for getting a single version of an application version.
  • Export now requires an API client with onegini_api_config.

10.0.0-M1

Run all database scripts

Warning: The migration V10_00_00_02__add_access_token_format_to_client_config.sql will take some extra time if the access_tokens table is large.

  • V9_01_00_02__add_additional_audiences_client_config.sql
  • V10_00_00_00__add_encryption_cols_for_open_id_config
  • V10_00_00_01__add_api_application_version_scope.sql
  • V10_00_00_02__add_access_token_format_to_client_config.sql

Changes in API

From this version, the Web Clients API requires access via the Config API scope instead of the Admin API scope. Create an API Client that supports the Config API scope if you are using the Web Clients API.

The Admin API scope is still used for the API Clients API.

Database connection configuration

From this version the Token Server uses a different database connection pooling mechanism. Some variables were no longer needed while other custom variable names were removed.

Changed variable names

The following variables were renamed to align with other products of Onegini:

Old variable name New variable name
TOKEN_​SERVER_​COMMON_​DB_​TYPE DATABASE_TYPE
TOKEN_​SERVER_​COMMON_​DB_​ENCRYPTION_​PASSWORD DATABASE_ENCRYPTION_PASSWORD
TOKEN_​SERVER_​COMMON_​DB_​ENCRYPTION_​POOLSIZE DATABASE_ENCRYPTION_POOLSIZE

Changed to Spring Boot defaults

The following variables were replaced by Spring Boot database variables:

Old variable name New variable name
TOKEN_​SERVER_​COMMON_​DB_​JDBC_​URL SPRING_DATASOURCE_URL
TOKEN_​SERVER_​COMMON_​DB_​USER SPRING_DATASOURCE_USERNAME
TOKEN_​SERVER_​COMMON_​DB_​PASSWORD SPRING_DATASOURCE_PASSWORD
TOKEN_​SERVER_​COMMON_​DB_​DRIVER_​CLASS SPRING_DATASOURCE_DRIVER_CLASS_NAME
TOKEN_​SERVER_​COMMON_​DB_​PLATFORM SPRING_JPA_PROPERTIES_HIBERNATE_DIALECT

Changed to Flyway defaults

The following variables were replaced by Flyway environment variables:

Old variable name New variable name
TOKEN_​SERVER_​COMMON_​DB_​MIGRATION_​ENABLED FLYWAY_ENABLED
TOKEN_​SERVER_​COMMON_​DB_​MIGRATION_​INIT_​VERSION FLYWAY_BASELINE_VERSION
TOKEN_​SERVER_​COMMON_​DB_​MIGRATION_​OUT_​OF_​ORDER FLYWAY_OUT_OF_ORDER
TOKEN_​SERVER_​COMMON_​DB_​MIGRATION_​FOLDER FLYWAY_LOCATIONS

Removed variables

The following variables are no longer used to configure the database connection and should be removed:

  • TOKEN_SERVER_COMMON_DB_CONNECTIONS_INITIAL_SIZE
  • TOKEN_SERVER_COMMON_DB_CONNECTIONS_MAX_ACTIVE
  • TOKEN_SERVER_COMMON_DB_CONNECTIONS_MAX_IDLE
  • TOKEN_SERVER_COMMON_DB_CONNECTIONS_MAX_WAIT
  • TOKEN_SERVER_COMMON_DB_CONNECTIONS_MAX_LIFETIME_MILLIS
  • TOKEN_SERVER_COMMON_DB_VALIDATION_QUERY
  • TOKEN_SERVER_COMMON_DB_SHOW_SQL