Connect2id server 20.1

14 October 2026

Connect2id server 20.1 improves signing algorithm migration for JWT-based client authentication. The release also adds logging to help diagnose back-channel logout networking issues.

Flexible signing algorithms for client authentication

Clients using private_key_jwt or client_secret_jwt can now migrate between signing algorithms without being restricted to a single algorithm in their registration. For example, a client using private_key_jwt can gradually switch from RS256 to PS256.

When the optional token_endpoint_auth_signing_alg metadata parameter is omitted, the server accepts any suitable JWS algorithm it supports for the client’s authentication method. This enables a gradual rollout of a new signing algorithm across client instances.

Example registration request for private_key_jwt authentication that leaves the JWS algorithm unspecified:

POST /clients HTTP/1.1
Host: demo.c2id.com
Content-Type: application/json

{
  "redirect_uris"              : [ "https://client.example.org/callback" ],
  "token_endpoint_auth_method" : "private_key_jwt",
  "jwks"                       : { "keys" : [ { "kty" : "RSA", "e" : "AQAB", "n" : "gmlDX_mgMcHX.." ] } ] }
}

Clients that require a specific signing algorithm can continue to declare it explicitly with token_endpoint_auth_signing_alg. The change aligns handling of this parameter with OpenID Connect Dynamic Client Registration 1.0:

token_endpoint_auth_signing_alg

OPTIONAL. JWS algorithm that MUST be used for signing the JWT used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods. All Token Requests using these authentication methods from this Client MUST be rejected, if the JWT is not signed with this algorithm. Servers SHOULD support RS256. The value none MUST NOT be used. The default, if omitted, is that any algorithm supported by the OP and the RP MAY be used.

For client_secret_jwt registrations that leave the signing algorithm unspecified, newly provisioned client secrets are now long enough for all supported HMAC JWS algorithms, including HS384 and HS512.

Back-channel logout diagnostics

OpenID Connect Back-Channel Logout enables registered client applications to receive logout notifications from the IdP as signed JWTs.

The Connect2id server uses the Java HTTP client to deliver these notifications in HTTP POST requests. When this client is initialised, the server now logs the configured Java http.* system properties at INFO level under OP2794. This helps operators diagnose proxy configuration and other networking issues affecting logout delivery.

INFO BC-LOGOUT [main] [OP2794] Back-channel logout: Java HTTP system property: http.proxyHost=proxy.example.com
INFO BC-LOGOUT [main] [OP2794] Back-channel logout: Java HTTP system property: http.proxyPort=8888
INFO BC-LOGOUT [main] [OP2794] Back-channel logout: Java HTTP system property: http.nonProxyHosts=localhost|127.*|[::1]

Download 20.1

For the signature validation: Public GPG key

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 20.1: Connect2id-server.zip

GPG signature: Connect2id-server.zip.asc

SHA-256: f45018eb6e835afedb7ae40221563377855232d591d6ce6738a84ca0e8f6425b

Connect2id server 20.1 WAR package: c2id.war

GPG signature: c2id.war.asc

SHA-256: b9be3515d219ee99050570d760808b72c053f13af69b17167907e01acd041f66

Multi-tenant edition

Apache Tomcat package with Connect2id server 20.1: Connect2id-server-mt.zip

GPG signature: Connect2id-server-mt.zip.asc

SHA-256: 9fc69421c6b1db11e94113de59de497768e7c827e283fda1c87071765327eae7

Connect2id server 20.1 WAR package: c2id-mt.war

GPG signature: c2id-mt.war.asc

SHA-256: 4216dfd11b4b4c9ddb1dba20b443943f0f9c269aefb5d56ea201b238c8f132de

Questions?

For technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.

Release notes

20.1 (2026-10-14)

Improves support for JWS algorithm migration in JWT-based client authentication. When a client registered for client_secret_jwt or private_key_jwt omits the optional token_endpoint_auth_signing_alg metadata parameter, the Connect2id server no longer fixes the client registration to a single JWS algorithm. The client may authenticate with any suitable JWS algorithm supported by the OpenID provider / OAuth 2.0 authorisation server, enabling gradual migration from one signing algorithm to another.

For client_secret_jwt registrations without a specific token_endpoint_auth_signing_alg, newly provisioned client secrets are now generated with sufficient length for all supported HMAC JWS algorithms, including HS384 and HS512.

This change also aligns handling of token_endpoint_auth_signing_alg with OpenID Connect Dynamic Client Registration 1.0.

Resolved issues

Logs configured Java http.* system properties at INFO level under OP2794 when the OpenID Connect back-channel logout HTTP client is initialised, to help diagnose JVM HTTP client proxy and networking configuration (issue server / 1239).
The ClaimsSourceRequestContext passed to the AdvancedClaimsSource SPI must include the native client group (NCG) SubjectSession when processing an OAuth 2.0 refresh token grant with the device_sso scope. Previously, non-web subject sessions were excluded from calls to this SPI. This change enables claims sources to use the NCG session to retrieve claims or inform claims-sourcing decisions in OpenID Connect Native SSO (issue server / 1237).
The ClaimsSourceRequestContext passed to the AdvancedClaimsSource SPI must include the native client group (NCG) SubjectSession when processing an OAuth 2.0 token exchange grant for OpenID Connect Native SSO. This change enables claims sources to use the NCG session to retrieve claims or inform claims-sourcing decisions in OpenID Connect Native SSO (issue server / 1240).
Permits client registration with an unspecified token_endpoint_auth_signing_alg, which is compliant with OpenID Connect Dynamic Client Registration 1.0 (issue server / 1218).

Dependency changes

Updates to com.google.guava:guava:33.7.2-jre
Updates to org.postgresql:postgresql:42.7.14