Skip to content
Connect2id
Connect2id server

Connect2id server 19.15

Connect2id Server 19.15 introduces configurable retry for OpenID Connect Back-Channel Logout notifications, helping deployments cope with transient network failures between the IdP and relying applications.

Back-channel logout is an OpenID Connect mechanism that enables Connect2id server deployments to notify relying applications (relying parties) directly, server-to-server, that a user session has ended. Unlike front-channel logout, it doesn’t depend on the user’s browser, making the delivery of logout events significantly more reliable. Applications receive a signed logout token (JWT) and can immediately terminate the corresponding local session.

In practice, however, delivery can occasionally fail because of temporary problems such as TCP connection resets, proxy failures, or network timeouts. Prior to this release, such failures resulted in lost notifications.

Version 19.15 adds retry for these transient transport errors, which is configurable.

Retries are intentionally limited to HTTP transport failures. If the application backend returns an HTTP response - regardless of whether it is a success or an error response - the delivery is considered complete and no retry is attempted. This avoids repeatedly sending logout notifications to an endpoint that is reachable and has already processed (or intentionally rejected) the request.

The release also includes a bug fix and updates several dependencies.

Download 19.15

For the signature validation: Public GPG key

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 19.15: Connect2id-server.zip

GPG signature: Connect2id-server.zip.asc

SHA-256: 6d20a32ca51192e4d23f20b86c2e1799c8f8a11cca6bf4c6e158d12c30472d1e

Connect2id server 19.15 WAR package: c2id.war

GPG signature: c2id.war.asc

SHA-256: d523f5deed718f59bf57f308f1bb6d7bc65d964ec1084fe646be55ac3a7b5a2e

Multi-tenant edition

Apache Tomcat package with Connect2id server 19.15: Connect2id-server-mt.zip

GPG signature: Connect2id-server-mt.zip.asc

SHA-256: 22ba4d64d680505c646dd58acaa2e09dd1b33d02be7c489d5858c125a9c16597

Connect2id server 19.15 WAR package: c2id-mt.war

GPG signature: c2id-mt.war.asc

SHA-256: 9d72f59c97ec49a2d9ac70867a6c4415ae8dae8f24a7d69b2c0357304ed2a1f0

Questions?

For technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.

Release notes

19.15 (2026-08-03)

Summary

  • Introduces configurable retry for the delivery of OpenID Connect back-channel logout notifications. Deployments can now configure the number of retry attempts and the delay between retries following HTTP transport errors, such as connection failures and timeouts. Retries are not attempted when the notification endpoint returns an HTTP response, regardless of its status code.

Configuration

  • /WEB-INF/oidcProvider.properties

    • op.logout.backChannel.deliveryRetries – New optional configuration property to specify the maximum number of retry attempts for delivering a logout token after an HTTP transport error, such as a connection failure or timeout. Retries are not attempted for HTTP responses returned by the relying party. Must not be negative. Zero disables retries. The default value is 2.

    • op.logout.backChannel.retryDelay – New optional configuration property to specify the delay, in milliseconds, before retrying logout token delivery after an HTTP transport error. Must not be negative. The default value is 1000 ms.

Resolved issues

  • Fixes the pairwise subject codec to properly validate the format of decoded parts and produce a descriptive typed exception instead of a general exception. Cases of invalid pairwise subjects, due to failed decryption or format errors, are logged at WARN level (issues oidc-sdk/562, server/1213).

Dependency changes

  • Upgrades to com.nimbusds:oauth2-oidc-sdk:11.38.1

  • Updates to com.fasterxml.jackson.core:jackson-databind:2.22.1

  • Updates to Log4j 2.26.1

  • Updates to org.postgresql:postgresql:42.7.13