Skip to content
Connect2id
Connect2id server

Connect2id server 14.0 with new refresh token settings and Oracle database support

The new major Connect2id server release is here at last. What’s in it and how to prepare for the upgrade?

New refresh token settings

Self-contained (JWT-encoded) refresh tokens for transient (non-persisted) authorisations can now also be optionally rotated. Previously the rotation was possible only for refresh tokens linked to a long-lived (persisted) authorisation. The rotation is a poor-man’s protection against replay of a leaked refresh token that was issued to a public OAuth 2.0 client. The more secure and robust in case of slow / poor networks method to prevent replay is for public clients to receive sender-constrained refresh tokens, by means of mTLS or DPoP.

The refresh token rotation can now be set on a individual authorisation basis, using the optional refresh_token.rotate parameter in the consent of an authorisation session.

Example consent indicating the refresh token must be rotated:

{
  "scope"         : [ "openid", "email" ],
  "claims"        : [ "email", "email_verified" ],
  "refresh_token" : { "rotate" : true }
}

The direct authorisation endpoint and the token exchange and password grant handlers also support the new rotation parameter.

If the refresh_token.rotate parameter for a given authorisation is omitted a default policy will be applied, according to the new authzStore.refreshToken.defaultRotate configuration property.

The global authzStore.refreshToken.alwaysUpdate (always rotate) configuration property is deprecated and should no longer be used. Instead, set the authzStore.refreshToken.defaultRotate configuration property and override it for specific clients or authorisations.

ID token refresh

Another new feature is the option to refresh ID tokens, in response to a valid refresh token grant with the openid scope, and provided the end-user is considered logged into the OpenID provider.

The ID token refresh is allowed on a individual authorisation basis, by setting the optional id_token.allow_refresh parameter in the consent of an authorisation session.

Example consent allowing ID token refresh:

{
  "scope"    : [ "openid" ],
  "id_token" : { "allow_refresh" : true }
}

As long as the OpenID provider session where the user login took place remains present, the token endpoint will return a new ID token in the response to a refresh request. When the session is closed or expires an ID token will no longer be included in the token response (an access token will still be returned though).

The ID token refresh can thus be used by authorised relying parties to perform a back-channel check whether the user still has a session with the Connect2id server.

Note that the ID token refresh does not guarantee the end-user is actually present and properly authenticated, due to the back-channel nature of the token request. The standard prompt=none OpenID authentication request is intended for this purpose, as it’s done via the front-channel (the browser) and cannot be triggered without an end-user interaction.

Claims source plugins can access the user sessions

Connect2id server plugins for sourcing the consented user claims that go into UserInfo responses or ID tokens can now access the end-user session where the claims sourcing was authorised.

This can be used to populate claims from information held in the session, such as authentication details, or claims that were saved in the claims fields at the time the user session was created.

Token introspection composer plugins can also access the user sessions

Plugins for shaping token introspection responses can now also access the user session where the token issue was authorised.

The presence of a session can a deployment specific condition for returning a an introspection response for an active (valid) access token. The session can also serve as a source for selected claims to include in the response, such as the optional claims field of the session.

Scope management

A new op.authz.limitScopeToRegistered configuration property was devised to limit the requested scope values in the consent prompt of the authorisation session API to those registered in the metadata of the requesting client.

If disabled or no “scope” client metadata field is registered, the authorisation request scope will be passed on to the consent prompt as it is.

This configuration property is enabled by default:

op.authz.limitToRegisteredScope=true

Simplified configuration

All Connect2id server configuration properties were revised and where appropriate given default values. This means there are now fewer Java system properties that must be set, making the configuration of deployments easier.

Note that the default timeouts for fetching external HTTP resources were increased and some properties were deprecated. Check the release notes to find out what those are.

SBOM

A Software Bill Of Materials (SBOM) in CycloneDX JSON and XML format is included in the c2id.war under /WEB-INF/sbom/CycloneDX-Sbom.json and /WEB-INF/sbom/CycloneDX-Sbom.json.

Infinispan upgrade

The underlying Infinispan layer received a sweeping upgrade from v9.4.x to v14.0.x, while retaining the existing stateless, stateless + Redis and replication Connect2id server clustering modes.

Oracle database support

The Oracle database is now supported, alongside the MySQL, PostgreSQL and Microsoft SQL Server relational databases.

Support for persistence to LDAP is removed

In v14.0 persisting Connect2id server data to an LDAP server will no longer be supported. Connect2id server deployments with an LDAP backend database have the choice to migrate to a supported SQL RDBMS or to AWS DynamoDB.

Bug fixes, optimisations

The code base received several bug fixes. The data persistence layer was optimised, which may result in CPU and storage bill savings in large deployments.

Upgrading from 13.x or older to 14.0

Connect2id server deployments in the stateless clustering mode can simply add new v14.0 node(s) and switch the requests to them.

Deployments with replication clustering or Redis can do the same. However, due to a change in the Infinispan in-memory data serialisation (which now uses ProtoBufs instead of the previous Java marshalling), all objects stored or cached in memory (such as subject sessions, data persisted to the database is not affected), will not be recognised and hence will be ignored by new Connect2id server 14.0 nodes. To transfer existing subject sessions to the new cluster you will need to perform a manual migration.

The new release requires an upgrade to the SQL database schema. This upgrade consists of a new "expended_tokens" table and new columns that must be added to the id_access_tokensandlong_lived_authorizations` tables. When the new Connect2id server 14.0 starts up it will automatically check the existing SQL database schema and perform the necessary table and column additions.

Deployments with DynamoDB, which is essentially a schema-less database, require no such operation.

Several configuration properties were deprecated. You may want to check what these are and update your configuration if necessary.

Finally, a class and methods related to the InitContext interface from the Connect2id server SDK marked deprecated about 3 years ago were removed. Suitable alternatives have been provided.

More information can be found in the release notes below. If you have questions or need assistance with the new release contact us.

Download 14.0

For the signature validation: Public GPG key

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 14.0: Connect2id-server.zip

GPG signature: Connect2id-server.zip.asc

SHA-256: 26a0ccecb349fa45bd5d63270c28aadfdb25281826a3f5d155459b1c31a49c77

Connect2id server 14.0 WAR package: c2id.war

GPG signature: c2id.war.asc

SHA-256: 90b37040a8b30835c952ae8ccd7ad536561134cd53e400f133c8fe797e0a78aa

Multi-tenant edition

Apache Tomcat package with Connect2id server 14.0: Connect2id-server-mt.zip

GPG signature: Connect2id-server-mt.zip.asc

SHA-256: 8ddf568d311a5b1871d539b79b0efdd89ac0e42a32d50066dd238114944c2d2d

Connect2id server 14.0 WAR package: c2id-mt.war

GPG signature: c2id-mt.war.asc

SHA-256: 252e2ad47d6a0612ff51d3e4c490ed07f45e80c38700fe000c36b2123fd05537

Questions?

If you have technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.

Release notes

14.0 (2023-06-27)

Summary

  • Support for refresh token rotation on an individual authorisation basis, overriding the global Connect2id server configuration.

    Self-contained (JWT-encoded) refresh tokens, which are linked to transient / non-persisted (“long_lived”:false) authorisations, also receive the ability to be rotated.

    Previously refresh token rotation could only be set globally and apply only to identifier-based refresh tokens, which are linked to long-lived / persisted (“long_lived”:true) authorisations.

  • Support for ID token refresh at the token endpoint, settable on an individual authorisation basis. The token response will include a new ID token when the refresh token authorisation allows such refresh and the subject (end-user) session bound to the refresh token is still present. If the session was closed or expired no ID token will be included in the token response.

    An authorised OpenID relying party may use the ID token refresh to do a back-channel check whether the end-user session with the OpenID provider still exists (i.e. that the session wasn’t closed or expired). OpenID relying parties should use the standard “prompt=none” OpenID authentication request to ensure the end-user is actively present and properly authenticated, since this method involves the front-channel (the browser). An ID token refresh thus isn’t equivalent to or a substitute for a “prompt=none” OpenID authentication request.

  • Public clients registered for OAuth 2.0 mutual TLS (RFC 8705) and the OAuth 2.0 refresh token grant will receive refresh tokens that are client X.509 certificate bound.

  • Allows registration of native applications (the client “application_type” metadata field set to “native”) with non-localhost https redirection URIs, e.g. https://app.example.com/callback.

  • Introduces “urn:c2id:introspection_endpoint” as alternative fixed scope value for authorising access to the token introspection endpoint of the Connect2id server. Authorisations with a scope value set to the token introspection endpoint, e.g. https://op.example.com/token/introspect continue to be supported. The fixed scope value is intended for introspecting clients registered in Connect2id server deployment configured with OP / AS issuer aliases.

  • A new “op.authz.limitScopeToRegistered” configuration property to filter the requested scope values in the consent prompt of the authorisation session API to those registered in the metadata of the requesting client. If disabled or no “scope” client metadata field is registered, the authorisation request scope will be passed to the consent prompt as it is. Enabled by default.

  • The Connect2id server configuration properties were revised and given appropriate default values where applicable. Intended to reduce the configuration effort and the number of Java system properties necessary to deploy a Connect2id server.

  • Updates the TokenIntrospectionResponseComposer SPI to provide access to the subject (end-user) session where the token consent occurred, when the session is still present (not closed or expired). The subject session may be used by customised token introspection endpoints to include selected claims or other details from the session in the introspection responses.

  • Updates the AdvancedClaimsSource SPI to provide access to the subject (end-user) session where the claims sourcing was authorised, provided the session is still present (not closed or expired). The subject session may be used to source claims for UserInfo responses and ID tokens.

  • A Software Bill Of Materials (SBOM) in CycloneDX JSON and XML format is included in the c2id.war under /WEB-INF/sbom/CycloneDX-Sbom.json and /WEB-INF/sbom/CycloneDX-Sbom.json

  • Upgrades to Infinispan 14.0.

    Due to the switch of the internal object serialisation in Infinispan to Protocol Buffers (Protobuf) existing in-memory data in Connect2id server 13.x deployments in replication cluster mode or with Redis as in-memory data and cache store will not be recognised and hence ignored by a Connect2id server v14.0 deployment. If such in-memory data (subject sessions, etc.) needs to be preserved it must be manually migrated.

  • Adds Oracle 12c r1+ Database support.

  • Removes LDAP backend database support as part of the Infinispan 14.0 upgrade. Connect2id server deployments with an LDAP backend database can migrate to a supported SQL RDBMS or to AWS DynamoDB.

Configuration

  • /WEB-INF/oidcProvider.properties

    • op.authz.limitToRegisteredScope – New optional configuration property of type boolean to limit the requested scope values in the consent prompt for OAuth 2.0 authorisation / OpenID authentication requests to those registered the in the “scopes” client metadata field (provided the metadata field is set). The default value is true.

    • op.authz.feedSubjectSessionClaimsIntoIDToken – No longer a required configuration property, receives a default value of true.

    • op.reg.allowOpenRegistration – Receives a default value false.

    • op.reg.rejectNonTLSRedirectionURIs – Receives a default value true.

    • op.reg.refreshAccessTokenOnUpdate – Receives a default value true.

    • op.reg.clientSecretLifetime – Receives a default value 0 (no expiration).

    • op.reg.alwaysRefreshClientSecretOnUpdate – Receives a default value true.

    • op.reg.resourceRetriever.httpConnectTimeout – Increases the default value to 1000 ms.

    • op.reg.resourceRetriever.httpReadTimeout – Increases the default value to 1000 ms.

    • op.idToken.defaultLifetime – Receives a default value 300 seconds.

    • op.idToken.jwsAlgs – Receives a default value of all supported, with “none” excluded.

    • op.idToken.jweAlgs – Receives a default value of all supported.

    • op.idToken.jweEncs – Receives a default value of all supported.

    • op.idToken.ignoreUserInfoError – Receives a default value true.

    • op.authz.sessionLifetime – Receives a default value 15 minutes.

    • op.authz.responseTypes – Receives a default value of all supported.

    • op.authz.responseModes – Receives a default value of all standard supported.

    • op.authz.requestJWSAlgs – Receives a default value of all supported, with “none” excluded.

    • op.authz.requestJWEAlgs – Receives a default value of all supported.

    • op.authz.requestJWEEncs – Receives a default value of all supported.

    • op.authz.responseJWSAlgs – Receives a default value of all supported.

    • op.authz.responseJWEAlgs – Receives a default value of all supported.

    • op.authz.responseJWEEncs – Receives a default value of all supported.

    • op.authz.includeClientInfoInAuthPrompt – Receives a default value false.

    • op.authz.includeOtherConsentedScopeAndClaimsInPrompt – Receives a default value false.

    • op.authz.alwaysPromptForConsent – Receives a default value false.

    • op.authz.requireIDTokenHintWithPromptNone – Receives a default value false.

    • op.authz.advertisedScopes – Receives a default value “openid”.

    • op.authz.advertisedClaims – Receives a default value “sub”.

    • op.authz.advertisedDisplayTypes – Receives a default value page.

    • op.token.authMethods – Receives a default value of all supported, with “tls_client_auth” and “self_signed_tls_client_auth” excluded.

    • op.token.authJWSAlgs – Receives a default value of all supported.

    • op.userinfo.jwsAlgs – Receives a default value of all supported.

    • op.userinfo.jweAlgs – Receives a default value of all supported.

    • op.userinfo.jweEncs – Receives a default value of all supported.

    • op.logout.sessionLifetime – Receives a default value of 10 minutes.

    • op.logout.backChannel.httpConnectTimeout – Increases the default value to 1000 ms.

    • op.logout.backChannel.httpReadTimeout – Increases the default value to 1000 ms.

    • op.federation.httpConnectTimeout – Replaces the op.federation.httpRequestTimeout configuration property, increases the default value to 1000 ms.

    • op.federation.httpReadTimeout – Increases the default value to 1000 ms.

  • /WEB-INF/authzStore.properties

    • authzStore.refreshToken.defaultRotate – New optional configuration property of type boolean for the default refresh token rotation setting. Can be overridden by individual authorisations. The default value is false (no rotation).

    • authzStore.refreshToken.alwaysUpdate – Deprecated, use “authzStore.refreshToken.defaultRotate” instead.

    • authzStore.accessToken.includeX5C – New optional configuration property of type boolean to enable / disable inclusion of the X.509 certificate chain (“x5c”) header parameter in self-contained (JWT) access tokens when the signing JWK is provisioned with a certificate. The default value is true (enabled).

    • authzStore.accessToken.disableSubjectSecurity – New optional configuration property of type boolean to disable the automatic encryption of self-contained (JWT-encoded) access tokens with public (non-pairwise) subject identifiers, in cases when the access tokens are issued to clients registered for pairwise subjects in ID tokens and UserInfo responses. The default value is false. Should be used only in exceptional circumstances.

    • authzStore.code.lifetime – Receives a default value of 300 seconds (5 minutes).

    • authzStore.accessToken.defaultLifetime – Receives a default value 600 seconds (10 minutes).

    • authzStore.accessToken.jwsAlg – New optional configuration property to replace authzStore.accessToken.jwsAlgorithm which becomes deprecated. The default value is RS256.

    • authzStore.accessToken.jweAlgorithm – New optional configuration property to replace authzStore.accessToken.jweAlgorithm which becomes deprecated. The default value is dir.

    • authzStore.accessToken.jweEnc – New optional configuration property to replace authzStore.accessToken.jweMethod which becomes deprecated. The default value is A128GCM.

    • authzStore.accessToken.allowDirectInspection – Receives a default value false.

    • authzStore.options.highlyAvailableMode – Receives a default value true.

    • authzStore.options.legacyPlainKeysInStorage – Removed, after being deprecated in Connect2id server 10.0.

  • /WEB-INF/sessionStore.properties

    • sessionStore.maxLifetime – Receives a default value 259200 minutes (180 days).

    • sessionStore.authLifetime – Receives a default value 43200 minutes (30 days).

    • sessionStore.maxIdleTime – Receives a default value 14400 minutes (10 days).

    • sessionStore.quotaPerSubject – Receives a default value 5.

    • sessionStore.onQuotaExhaustion – Receives a default value CLOSE_OLD_SESSION.

  • /WEB-INF/infinispan-*.xml

    • Upgrades the XML schema to Infinispan 14.0.

    • Replaces the Infinispan “op.clientRegTokenMap” with a new generic “authzStore.expendedTokenMap” capable of storing keys for expended tokens that are rotated self-contained (JWT-encoded) refresh tokens, client registration tokens, client_secret_jwt and private_key_jwt tokens, DPoP tokens and other one-time-use objects.

  • /WEB-INF/infinispan-stateless-oracle.xml

    • New Infinispan configuration for stateless clustering and an Oracle database.

  • /WEB-INF/infinispan-stateless-redis-oracle.xml

    • New Infinispan configuration for stateless clustering and an Oracle database and Redis for caching and storage of short-lived objects.

  • /WEB-INF/infinispan-replication-oracle.xml

    • New Infinispan configuration for replication clustering and an Oracle database.

  • /WEB-INF/infinispan-multitenant-stateless-oracle.xml

    • New multi-tenant Infinispan configuration for stateless clustering and an Oracle database.

  • /WEB-INF/infinispan-multitenant-stateless-redis-oracle.xml

    • New multi-tenant Infinispan configuration for stateless clustering and an Oracle database and Redis for caching and storage of short-lived objects.

  • /WEB-INF/infinispan-*-{mysql|postgres95|sqlserver|oracle|h2}.xml

    • New optional “dataSource.createTableIfMissing” Java system property. When “true” (the default value) the Connect2id server will automatically create the required SQL tables on startup. It will also perform automatic table alternations where necessary in new major releases. When “false” the database administrator must create or alter the tables manually before server startup.

    • New optional “dataSource.maxPoolSize” Java system property. Controls the maximum size the SQL connection pool is allowed to reach, including both idle and in-use connections. The default size is 5.

    • Upgrades the SQL schema (the Connect2id server will automatically add the new table and columns on startup unless “dataSource.createTableIfMissing” is disabled):

      • Adds an “expended_tokens” table.

      • Adds a “sik” (session identifier key) column to the “id_access_tokens” table.

      • Adds an “idr” (ID token rotate) column to the “long_lived_authorizations” table.

  • /WEB-INF/infinispan-*-ldap.xml

    • The LDAP backend database XML configurations are removed and no longer supported.

  • /WEB-INF/sql

    • New directory containing the required SQL statements for manual table creation, to be used when the Connect2id is configured to disable automatic table creation (if missing) on server startup (with dataSource.createTableIfMissing=false).

Web API

  • /clients

    • Allows registration of native applications (where the client “application_type” metadata field is set to “native”) with non-localhost https redirection URIs.

  • /token

    • Supports issue of rotated self-contained (JWT-encoded) refresh tokens.

    • Supports ID token refresh. Requires the refresh token authorisation to explicitly allow ID token refresh and the subject (end-user) session bound to the refresh token to be still present (not closed or expired), else an ID token will not be included in the token response.

      The expiration of the refreshed ID token will be set according to the globally configured “op.idToken.defaultLifetime”. An ID token lifetime supplied to the consent object (with “id_token.lifetime”) will not be replicated in refreshed ID tokens.

      The “max_age” OpenID authentication request parameter will trigger inclusion of the “auth_time” claim only in the ID token issued in the direct response to it, not in refreshed ID tokens. For an OpenID relying party to receive the “auth_time” claim in refreshed ID tokens it must be registered as client for the “require_auth_time” metadata parameter.

      The refreshed ID token will include all consented claims as well as any claims found in the subject session “claims” field (unless the “op.authz.feedSubjectSessionClaimsIntoIDToken” configuration property prevents this). Preset ID token claims supplied to the consent object (with “preset_claims.id_token”) will not be replicated in refreshed ID tokens.

  • /token/introspect

    • Introduces “urn:c2id:introspection_endpoint” as alternative fixed scope value for authorising access to the token introspection endpoint of the Connect2id server.

  • /authz-sessions/rest/v3/

    • Adds an optional “refresh_token.rotate” parameter of type boolean to the consent object. Sets the refresh token rotation for the current authorisation. When omitted the “authzStore.refreshToken.defaultRotate” configuration will apply.

    • Adds an optional “id_token.allow_refresh” parameter of type boolean to the consent object. Allows an OpenID relying party to receive a new ID token at the token endpoint in exchange for a valid refresh token, with the subject session bound to the refresh token still being present.

  • /direct-authz/rest/v2/

    • Adds an optional “refresh_token.rotate” parameter of type boolean to the request object. Sets the refresh token rotation for the individual authorisation. When omitted the “authzStore.refreshToken.defaultRotate” configuration will apply.

    • Adds an optional “id_token.allow_refresh” parameter of type boolean to the request object. Allows an OpenID relying party to receive a new ID token at the token endpoint in exchange for a valid refresh token, with the subject session bound to the refresh token still being present.

    • Adds an optional “claims_data” parameter of type JSON object to the request object. The parameter will be passed in the request to retrieve the consented OpenID claims from the configured source(s). The claims data will be included in a “cld” (claims data) field in the issued access token(s) and in the long-lived authorisations if the consent is persisted. If the claims data must be kept confidential from the client either an identifier access token encoding must be chosen or if a self-contained (JWT) access token is chosen it must be additionally encrypted. An AdvancedClaimsSource SPI implementation can retrieve the claims data JSON object by a call to the “ClaimsSourceRequestContext.getClaimsData” method.

      This parameter is identical to the “claims_data” parameter in the consent object of the authorisation session web API.

  • /authz-store/rest/v3/

    • New “rtr” authorisation field of type boolean for the refresh token rotate setting. The default value is false.

    • New “idr” authorisation field of type boolean for the allow ID token refresh setting. The default value is false.

    • Removes the “/config” resource for retrieval (via HTTP GET) of the public authorisation store configuration.

  • /monitor/v1/metrics

    • Adds new “authzStore.numExpendedTokenEntries” gauge.

    • Removes the “clientStore.numCachedExpendedTokens” gauge (replaced by the new “authzStore.numExpendedTokenEntries” gauge).

SPI

  • Upgrades the Connect2id server SDK to com.nimbusds:c2id-server-sdk:4.58

    • The RefreshTokenSpec class receives a new optional rotation setting. If empty the default Connect2id server refresh token rotation policy will apply.

    • The IDToken spec class receives a new optional allow refresh setting. The default setting is no ID token refresh allowed.

    • The PasswordGrantHandler SPI can set a refresh token rotation preference.

    • The TokenExchangeGrantHandler SPI can set a refresh token rotation preference.

    • The TokenIntrospectionResponseComposer SPI adds access to the subject (end-user) session used for the token consent, provided the session is still present (not closed or expired). The session object can be accessed via the “TokenIntrospectionContext.getSubjectSession” method. The subject session may be used by customised token introspection endpoints to include subject claims or other details from the session in the responses.

    • The TokenIntrospectionResponseComposer SPI extends Lifecycle.

    • The AdvancedClaimsSource SPI adds access to the subject (end-user) session where the claims sourcing was authorised, provided the session is still present (not closed or expired). The session object can be accessed via the “ClaimsSourceRequestContext.getSubjectSession” method.

      The subject session is supplied in the following cases:

      • Claims sourcing for the UserInfo endpoint where the subject session where the claims consent occurred is still present (not expired or closed);

      • Claims sourcing for ID token issue for an OAuth 2.0 authorisation code, implicit (including OpenID Connect hybrid response type) and refresh token grants;

      • Claims sourcing for a direct authorisation request where a valid subject session ID was supplied, or a new subject session was created.

      • Claims sourcing made available to the TokenIntrospectionResponseComposer SPI.

      The subject session may be used as a source of subject authentication claims, or claims from the optional “claims” session field.

    • Adds an “AccessTokenAuthorization.getSubjectSessionKey” method, returns null by default. Intended to represent the new encrypted subject session ID key attribute (“sik”) in access tokens. Connect2id server deployments with a custom codec (SelfContainedAccessTokenClaimsCodec SPI implementation) for the JWT claims for access tokens should update it to include the new attribute.

    • The IdentifierAccessTokenCodec SPI extends Lifecycle.

    • The SelfContainedAccessTokenClaimsCodec SPI extends Lifecycle.

    • Removes deprecated ServiceContext interface.

    • Removes deprecated InitContext.getIssuer method. Use the SPI request context getIssuer method instead.

    • Removes deprecated InitContext.getOPIssuer method. Use the SPI request context getIssuer method instead.

    • Removes deprecated InitContext.getTokenEndpoint method.

    • Removes deprecated InitContext.getServiceContext method.

Resolved issues

  • The SQL store must not set the client “application_type” to the default value “web” on record retrieval (issue server/838).

  • The Microsoft SQL Server id_access_tokens table column cnf must be VARCHAR (100), not NVARCHAR(100) (issue authz-store/199).

  • Retrieving an authorisation record by refresh token must echo the submitted refresh token value in the returned record instead of recreating it from the persisted “rts” field (issue authz-store/203).

  • Authorisation updates must always return a refresh token in the current format, not the legacy format (issue authz-store/204).

  • The direct authorisation endpoint must always return a refresh token in the current, not the legacy format (issue server/837).

  • Store retrieval of identifier-based access tokens must recreate the local subject when the subject type is pairwise (issue authz-store/201).

  • Removes redundant persistence of registration_client_uri, recreates it dynamically from the OP / AS issuer URL and the client_id (issue server/512).

  • The “cnf” column of the “id_access_tokens” SQL table must be increased from 100 to 150 VARCHAR for H2 and MS SQL Server to accommodate token authorisations that use both a x5t#S256 and a jkt binding (issue authz-store/206).

  • Adds missing DynamoDB persistence of the “cld” (claims data) authorisation record field (issue authz-store/210).

  • Automatic revocation of all authorisations on replay of a rotated refresh token (issue authz-store/212).

  • Persist only the subject session ID key in pending authorisation code entries (omitting the appended HMAC), to prevent exploitation of session IDs in case of unauthorised access to the backend database or a database record leak (issue server/863).

  • Fixes NPE in DirectAuthorizationRequest.getResolvedClaims (issue server/867).

  • Consented non-requested OpenID claims should not be included in the saved claims field (“scs”) of authorisations and authorisation records (issue server/868).

  • Client registration POST with empty “jwks” must produce HTTP 400 instead of HTTP 500 (issue server/878).

  • The server configuration must be rejected when mTLS client authentication is enabled and an op.tls.clientX509CertHeader is not configured (issue server/882).

  • Tokens issued within 500ms of a revocation event must not be marked as revoked (issue authz-store/211).

Dependency changes

  • Upgrades to com.nimbusds:c2id-server-sdk:4.58

  • Upgrades to com.nimbusds:oauth2-oidc-sdk:10.9.1

  • Upgrades to com.nimbusds:c2id-server-jwkset:1.29.1

  • Updates to com.nimbusds:c2id-server-property-source:1.1.2

  • Updates to com.nimbusds:tenant-manager:8.0

  • Updates to com.nimbusds:tenant-registry:8.3

  • Updates to com.nimbusds:oauth2-authz-store:24.4.2

  • Updates to com.nimbusds:oidc-session-store:16.4.3

  • Updates to com.nimbusds:software-statement-verifier:2.2.5

  • Upgrades to com.nimbusds:common:2.52

  • Upgrades to com.nimbusds:infinispan-cachestore-common:3.1

  • Upgrades to BouncyCastle 1.73.

  • Upgrades to Infinispan 14.0.10.Final

  • Upgrades to com.nimbusds:infinispan-cachestore-sql:7.0.2

  • Upgrades to com.nimbusds:infinispan-cachestore-dynamodb:5.0.1

  • Upgrades to com.nimbusds:infinispan-cachestore-redis:10.0.1

  • Updates to com.nimbusds:jgroups-dynamodb-ping:1.2.6

  • Updates to com.thetransactioncompany:pretty-json:1.5

  • Adds com.oracle.database.jdbc:ojdbc11:21.8.0.0

  • Updates to com.unboundid:unboundid-ldapsdk:6.0.9