Skip to content
Connect2id
Connect2id server

Connect2id server 20.2

Connect2id server 20.2 adds more control over key generation and rotation in dynamic key store mode. Deployments can exclude unused key types from the OpenID Provider JWK set and generate EC and EdDSA signing keys for OpenID Federation.

Select key types for the OpenID Provider

Some client libraries break when processing JWK sets that contain key types or curves they do not support, even when those keys are not used to validate tokens. Deployments can now exclude all EC keys, or only those using the secp256k1 curve, when generating or rotating OpenID Provider keys. The existing option to exclude EdDSA signing keys remains available.

The new keyStore.generateIfEmptyParams.op configuration property controls initial key generation. For example, to exclude secp256k1 EC keys and EdDSA keys:

keyStore.generateIfEmptyParams.op=no_ec_secp256k1:true,no_eddsa:true

To exclude all EC signing and encryption keys, use no_ec:true. RSA keys are always generated for the OpenID Provider context, with their default size controlled by keyStore.defaultRSAKeySize.

The key store web API accepts the same key-exclusion options as form parameters for generation and rotation requests. For example, to rotate the OpenID Provider keys without generating new secp256k1 EC signing keys:

POST /key-store/rest/v1/op/rotate HTTP/1.1
Host: demo.c2id.com
Authorization: Bearer ztucZS1ZyFKgh0tUEruUtiSTXhnexmd6
Content-Type: application/x-www-form-urlencoded

no_ec_secp256k1=true

If you use static key store mode to keep certain key types out of the published OpenID Provider JWK set, you can now use dynamic mode with the same exclusions and benefit from online key rotation.

The updated migration guide explains how to import your existing JWK set. After migration, specify the required exclusions in each rotation request. For example, if your deployment uses only RSA public keys:

POST /key-store/rest/v1/op/rotate HTTP/1.1
Host: demo.c2id.com
Authorization: Bearer ztucZS1ZyFKgh0tUEruUtiSTXhnexmd6
Content-Type: application/x-www-form-urlencoded

no_ec=true&no_eddsa=true

EC and EdDSA keys for OpenID Federation

The OpenID Federation key context can now generate EC signing keys with the P-256 curve and EdDSA signing keys with the Ed25519 curve, in addition to RSA.

To generate an EC signing key when the Federation key context is initially empty:

keyStore.generateIfEmptyParams.federation=ec:P-256

When EC or EdDSA generation parameters are specified without an rsa parameter, no RSA key is generated for this context. The default remains rsa:2048.

The API also accepts ec=P-256 and eddsa=Ed25519 in generation and rotation requests. For example, to rotate the Federation signing keys and generate 3072-bit RSA, P-256 EC and Ed25519 keys:

POST /key-store/rest/v1/federation/rotate HTTP/1.1
Host: demo.c2id.com
Authorization: Bearer ztucZS1ZyFKgh0tUEruUtiSTXhnexmd6
Content-Type: application/x-www-form-urlencoded

rsa=3072&ec=P-256&eddsa=Ed25519

Download 20.2

For the signature validation: Public GPG key

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 20.2: Connect2id-server.zip

GPG signature: Connect2id-server.zip.asc

SHA-256: 3a319e48efe3f30a67e78876f28a6b95d06c90146be093627be54b005eeb8dec

Connect2id server 20.2 WAR package: c2id.war

GPG signature: c2id.war.asc

SHA-256: 0bca578c90391ad34f741917d151be4dba8eaaad090bd79e38953b3d20ebb709

Multi-tenant edition

Apache Tomcat package with Connect2id server 20.2: Connect2id-server-mt.zip

GPG signature: Connect2id-server-mt.zip.asc

SHA-256: 6c42bd7c9ce6df6fba8348e1be02f3253f0f4245ad0fb9565893a9b29d401082

Connect2id server 20.2 WAR package: c2id-mt.war

GPG signature: c2id-mt.war.asc

SHA-256: 7f8a7ac316ea5dd522a40d38682e0075c3bc25f5a72e659d62479b28882ae0f2

Questions?

For technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.

Release notes

20.2 (2026-11-02)

Summary

  • The Connect2id server key store in dynamic mode now supports including or excluding specific key types during initial JWK set generation and key rotation. Keys can be excluded to avoid unused key types or improve compatibility with libraries that consume the OpenID Provider JWK set published at /jwks.json.

    The OpenID Provider key context now supports excluding all EC keys or only those using the secp256k1 curve.

    The OpenID Federation key context now supports generating EC (P-256) and EdDSA (Ed25519) signing keys, in addition to RSA.

Configuration

  • /WEB-INF/keyStore.properties

    • keyStore.generateIfEmptyParams.* – New optional configuration properties to specify parameters for the automatic generation of a JWK set when it is empty and keyStore.generateIfEmpty.* is enabled.

      The value is a comma-separated list of name:value pairs. Whitespace around commas and colons is ignored.

      For the OpenID provider context, configure the property as keyStore.generateIfEmptyParams.op. Supported parameters:

      • no_ec:true – Do not generate EC keys.
      • no_ec_secp256k1:true – Do not generate secp256k1 EC keys.
      • no_eddsa:true – Do not generate EdDSA keys.

      RSA keys are always generated for the OpenID provider context. Their size is controlled by keyStore.defaultRSAKeySize. The default value is none.

      For the OpenID Federation context, configure the property as keyStore.generateIfEmptyParams.federation. Supported parameters:

      • rsa:<size> – Generate an RSA key with the specified size. Supported sizes are 2048, 3072 and 4096 bits.
      • ec:P-256 – Generate an EC key with the P-256 curve.
      • eddsa:Ed25519 – Generate an EdDSA key with the Ed25519 curve.

      If EC and / or EdDSA parameters are specified without an RSA parameter, no RSA key is generated for the OpenID Federation context. The default value is rsa:2048.

Web API

  • /key-store/rest/v1

    • /key-store/rest/v1/{ctx}/generate – Adds support for new optional form parameters to control key generation.

      • The OpenID provider context (op) receives support for the optional form parameters no_ec and no_ec_secp256r1 with values true / false (default to false) to exclude specific key types from the generated JWK set.

        When no_ec is set to true, EC signing and encryption keys are not generated.

        When no_ec_secp256k1 is set to true, an EC signing key with curve secp256k1 is not generated.

      • The OpenID Federation (federation) context receives support for the optional form parameters ec and eddsa to include specific key types in the generated JWK set. Previously, only RSA signing keys could be generated, using the rsa form parameter, with values 2048, 3076 and 4096.

        When ec is set to P-256, an EC signing key with the specified curve is generated and included.

        When eddsa is set to Ed25519, an EdDSA signing key with the specified curve is generated and included.

    • /key-store/rest/v1/{ctx}/rotate – Adds support for new optional form parameters to control key generation.

      • The OpenID provider context (op) receives support for the optional form parameters no_ec and no_ec_secp256r1 with values true / false (default to false) to exclude specific key types from the generated JWK set.

        When no_ec is set to true, EC signing and encryption keys are not generated.

        When no_ec_secp256k1 is set to true, an EC signing key with curve secp256k1 is not generated.

      • The OpenID Federation (federation) context receives support for the optional form parameters ec and eddsa to include specific key types in the generated JWK set. Previously, only RSA signing keys could be generated, using the rsa form parameter, with values 2048, 3076 and 4096.

        When ec is set to P-256, an EC signing key with the specified curve is generated and included.

        When eddsa is set to Ed25519, an EdDSA signing key with the specified curve is generated and included.

Resolved issues

  • The INFO OP2794 log messages must include any configured Java https.* system properties as well (issue server / 1244).

  • The ClaimsSourceRequestContext passed to the AdvancedClaimsSource SPI must include the native client group (NCG) SubjectSession and its identifier (SubjectSessionID) when sourcing ID token claims as part of the processing an OAuth 2.0 token exchange grant for OpenID Connect Native SSO. This change enables claims sources to use the NCG session to retrieve claims or inform claims-sourcing decisions in OpenID Connect Native SSO (issue server / 1245).

  • Key store web API requests that attempt to modify a static (non-modifiable) JWK set must produce an HTTP 400 Bad Request error, not an HTTP 500 Internal Server error (issue key-store / 18).

Dependency changes

  • Upgrades to com.nimbusds:c2id-key-store:2.3

  • Updates to com.nimbusds:c2id-jwks-gen:5.1

  • Updates to Infinispan 16.3.1

  • Updates to Jersey (Jakarta REST 3.1) 3.1.12

  • Updates to org.ow2.asm:asm:9.11.1

  • Updates to com.fasterxml.jackson.core:jackson-databind:2.21.8