Connect2id server 3.3

2015-07-29

We would like to announce a new release of our OpenID Connect / OAuth 2.0 server which improves the login page API in a few small but significant ways.

1. Updating the session cookie when the consent step is skipped

The final HTTP 302 redirect response will include a Subject-Session-ID header if for some reason a new end-user session was created and the consent step was skipped. Whenever this header is present in the 302 redirection response the session cookie must be updated accordingly. Previously developers had to rely on the op.authz.alwaysPromptForConsent configuration to find out the new session ID in such a case.

Example 302 response with a new session ID:

HTTP/1.1 302 Found
Location: https://client.example.com/cb?code=Iebie6wovee9Pai5&state=ahShui6OooHeev8z
Subject-Session-ID: Foapaa8augeeHi0Wvui7er2I

2. New simple method to feed claims into the ID token

Connect2id server integrators can now enjoy a new simple way for including custom claims into the ID token. Whenever the end-user is authenticated one can also store selected claims in the session object. These will then be automatically fed into the ID tokens that are issued during the remainder of the user session (for all clients).

Example new user session, specifying name and email claims to be included in the issued ID tokens:

{
   "sub"    : "alice",
   "claims" : { "name"  : "Alice Adams",
                "email" : "[email protected]" }
}

The resulting ID token claims:

{
   "sub"   : "alice",
   "iss"   : "https://demo.c2id.com,
   "iat"   : 12345678,
   "exp"   : 12345678,
   "name"  : "Alice Adams",
   "email" : "[email protected]" }
 }

This behaviour is controlled by the op.authz.feedSubjectSessionClaimsIntoIDToken configuration setting (enabled by default).

Download

To download a ZIP package of Connect2id server 3.3:

https://connect2id.com/assets/products/server/download/3.3/Connect2id-server.zip

As WAR only:

https://connect2id.com/assets/products/server/download/3.3/c2id.war

Questions?

Don't hesitate to contact Connect2id support.