Connect2id server 14.3

This Connect2id server release fixes a bug in earlier 14.x versions that caused marshalling errors in deployments configured with a Redis store for cached and short-lived objects.

The optional op.reg.clientIDByteLength configuration property was updated to limit the possible lengths to 48 bytes. The preferred_client_id registration parameter is also bounded now, to 80 characters, and when exceeded will cause the client registration endpoint to return an HTTP 400 Bad Request with an invalid_client_metadata error.

The underlying OAuth 2.0 / OpenID Connect SDK dependency was updated and now includes support for RAR (RFC 9396). CustomTokenResponseComposer SPI plugins that implement RAR should be recompiled for potential conflicts with the new RAR API in the SDK, and updated when feasible to utilise the new type-safe RAR classes when adding an authorization_details parameter to the a token response.

Built-in RAR support is on the Connect2id server roadmap and will be included in a future release.

You can find more information about this new release in the notes below.

Download 14.3

For the signature validation: Public GPG key

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 14.3: Connect2id-server.zip

GPG signature: Connect2id-server.zip.asc

SHA-256: f0093e81657e540659c9240049a6ccb305d7e8508be9c22b0ffe8adc20b13d8f

Connect2id server 14.3 WAR package: c2id.war

GPG signature: c2id.war.asc

SHA-256: a8c79fc998bde94f46eed07688db1b578ab0a71f67002dcedd003e8d2c3bec82

Multi-tenant edition

Apache Tomcat package with Connect2id server 14.3: Connect2id-server-mt.zip

GPG signature: Connect2id-server-mt.zip.asc

SHA-256: a6853a25f1dd621b8615513d2d289224759c99659517c207bb93301c1da8c2bc

Connect2id server 14.3 WAR package: c2id-mt.war

GPG signature: c2id-mt.war.asc

SHA-256: 49c664dd9f0456876e33a4fea3985f07c5b694059502810c8599e2ef69a660ae

Questions?

If you have technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.


Release notes

14.3 (2023-08-07)

Summary

  • Connect2id server 14.x deployments with a Redis store should update to this release which fixes an issue related to ProtoBuf marshalling.

  • The OAuth 2.0 / OpenID Connect SDK dependency was updated to v10.13.2 which includes native OAuth 2.0 Rich Authorisation Requests (RAR) (RFC 9396) support. CustomTokenResponseComposer SPI plugins that implement RAR should be recompiled and updated if feasible to utilise the new type-safe methods of AccessTokenResponse when adding an "authorization_details" parameter to the response.

    Built-in RAR support is on the Connect2id server roadmap and will be included in a future release.

Configuration

  • /WEB-INF/oidcProvider.properties

    • op.reg.clientIDByteLength -- Updates the configuration property check, the length of generated client identifiers must not exceed 48 bytes.

Resolved issues

  • The client registration endpoint must return HTTP 400 Bad Request on a preferred_client_id that exceeds the max number of characters (80) that can be stored (issue server/901).

  • Fixes the authorisation code ProtoBuf marshalling in replication cluster and Redis based Connect2id server deployments (issue server/902).

Dependency changes

  • Upgrades to com.nimbusds:oauth2-oidc-sdk:10.13.2

  • Updates to com.nimbusds:oauth2-authz-store:24.5.2

  • Updates Infinispan to 14.0.13.Final

  • Updates to org.slf4j:slf4j-api:2.0.7

Connect2id server 14.2 introduces reuse grace period for rotated refresh tokens

The current OAuth 2.0 best practices mandate refresh tokens issued to public clients to be either sender-constrained (with mTLS or DPoP) or rotated, to prevent replay if the refresh token suffers a leak and gets in the hands of a malicious actor.

One recognised drawback of rotation is potential false positives for legitimate public clients with a slow or poor network connection, which may lead to situations when the OAuth 2.0 server has successfully processed the token request and output the response with new newly minted access and refresh tokens, but the client being unable to retrieve them due to an HTTP timeout or an interrupted connection. The client will then typically retry the request with the previous refresh token, but because the server has flagged that token as already rotated the client will get an invalid_grant error.

To mitigate such networking issues the Connect2id server introduces a short grace period during which the client may retry the token request with the same refresh token. This grace period is 5 seconds. To change it we added a new configuration property:

authzStore.refreshToken.rotatedReuseGracePeriod=5

To monitor the frequency of rotated refresh token reuses - those that were allowed to proceed within the grace period and those that were rejected, two new meters were added:

  • authzStore.rotatedRefreshTokenAllowedReuses -- Meters allowed reuses of rotated refresh tokens within the configured grace period.

  • authzStore.rotatedRefreshTokenReplayRevocations -- Meters authorisation revocations due to rotated refresh token replay.

The Connect2id server log records the individual rotated refresh token replays and what particular action was taken. Together this information may be used to fine-tune the grace period.

Example rotated refresh token reuse within the grace period (grep for AS0285):

INFO TOKEN - [OP6204] Confidential client authenticated: client_id=etxmlfglafhn2 method=client_secret_basic client_auth_id=dUEgk8M0Bue_5AJR
INFO AUTHZ-STORE - [AS0285] Expended refresh token check: Allowed reuse within 1s: last_token_iat=1689583263 checked_token_iat=1689583257
INFO AUTHZ-STORE - [AS0280] Issued access token: sub=alice act= client_id=etxmlfglafhn2 scope=[read, write]

Example rotated refresh token reuse that was denied and triggered the customary revocation of the client's tokens for the subject (grep for AS0278):

INFO TOKEN - [OP6204] Confidential client authenticated: client_id=hxds4i5olwtqc method=client_secret_basic client_auth_id=PNRC_b0DADRbx0Xx
INFO AUTHZ-STORE - [AS0278] Revoked authorizations due to replay of rotated self-contained refresh token: sub=alice act=null client_id=hxds4i5olwtqc
INFO AUTHZ-STORE - [AS0270] Invalid or expired refresh token: client_id=hxds4i5olwtqc
INFO TOKEN - [OP6201] Token error response: invalid_grant: Invalid grant

This release also fixes two store related bugs that appeared in major 14.0 release last month. You can find more information in the release notes below.

Download 14.2

For the signature validation: Public GPG key

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 14.2: Connect2id-server.zip

GPG signature: Connect2id-server.zip.asc

SHA-256: 82eb1e8590911a982928825e6b9e77027fb35f04378ab9e19a37fe8a9b6e5b9f

Connect2id server 14.2 WAR package: c2id.war

GPG signature: c2id.war.asc

SHA-256: 8a1b8e712afb4fad319ae784c51dfe0d496fcf84ad5b6cddf8ef15f106610624

Multi-tenant edition

Apache Tomcat package with Connect2id server 14.2: Connect2id-server-mt.zip

GPG signature: Connect2id-server-mt.zip.asc

SHA-256: 37764086c22ac4b2b35e539e647028010b919877892a81f794027daccd469109

Connect2id server 14.2 WAR package: c2id-mt.war

GPG signature: c2id-mt.war.asc

SHA-256: 9e8bad8ad454a7b2755fcd61fe2c07b32cf4006f16c6ba82e396fbbd734f3e6f

Questions?

If you have technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.


Release notes

14.2 (2023-07-17)

Configuration

  • /WEB-INF/authzStore.properties

    • authzStore.refreshToken.rotatedReuseGracePeriod -- New optional configuration property specifying a grace period in seconds during which a client may repeat a request with the same rotated refresh token without triggering the customary token revocation. Intended to enable token request retrial on slow / poor networks where the HTTP response times out after issue of the new token. Currently supported only for refresh tokens linked to short-lived (transient) authorisations. The default value is 5 seconds.

Web API

  • /token

    • A client may repeat a token request with a rotated refresh token within the configured "authzStore.refreshToken.rotatedReuseGracePeriod" period without triggering the customary token revocation when the Connect2id detects a replay of a rotated refresh token. Intended to enable token request retrial on slow / poor networks where the HTTP response times out after issue of the new token. Currently supported only for refresh tokens linked to short-lived (transient) authorisations.
  • /monitor/v1/metrics

    • "authzStore.rotatedRefreshTokenReplayRevocations" -- New meter of authorisation revocations due to rotated refresh token replay.

    • "authzStore.rotatedRefreshTokenAllowedReuses" -- New meter of the allowed reuses of rotated refresh tokens within the configured grace period.

Resolved issues

  • Fixes Redis HMGET retrieval of the "last used" (u) field in the Infinispan Redis connector that caused subject session max_idle > 0 to not be observed in Connect2id server deployments with a Redis store (issue server/899).

  • Writes to Oracle database CLOB / NCLOB fields with long strings that trigger the string concatenation work-around must escape quote chars (issue sql-store/20).

Dependency changes

  • Updates to com.nimbusds:oauth2-authz-store:24.5.1

  • Updates Infinispan to 14.0.11.Final

  • Updates to com.nimbusds:infinispan-cachestore-sql:7.0.4

  • Updates to com.nimbusds:infinispan-cachestore-redis:10.0.2

  • Updates to BouncyCastle 1.74

  • Updates to com.google.crypto.tink:tink:1.9.0

Connect2id server 14.1

This is a mini Connect2id server update to the 14.0 release that appeared on Tuesday. It fixes an incorrect server SDK dependency declaration, which means 14.1 is the version to upgrade to (and not 14.0) from 13.x or older versions.

Support for OpenID Connect Federation 1.0 is bumped to the most recent stable 29 draft, in particular the new policy language.

There is also a new config to disable the automatic inclusion of X.509 certificate chains (x5c) in the JWS headers of signed authorisation responses (JARM).

If the configured Connect2id server signing keys have certificates, the server will automatically include them in the JWS header, unless the server is instructed not to do so. This will result in smaller JARM JWTs:

op.authz.responseJWTIncludeX5C=true

This configuration works similarly to the existing op.idToken.includeX5C and authzStore.accessToken.includeX5C configs.

More information can be found in the release notes below. If you have questions or need assistance with the new release contact us.

Download 14.1

For the signature validation: Public GPG key

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 14.1: Connect2id-server.zip

GPG signature: Connect2id-server.zip.asc

SHA-256: c491ca76c1b8949f3a4df5147ec739eefb7057454091b26dc781b719eb3ee487

Connect2id server 14.1 WAR package: c2id.war

GPG signature: c2id.war.asc

SHA-256: ad70418441faf02a3895d0a2ac01365f679ff22208b9ed8aedfd26e84b83d261

Multi-tenant edition

Apache Tomcat package with Connect2id server 14.1: Connect2id-server-mt.zip

GPG signature: Connect2id-server-mt.zip.asc

SHA-256: 9fd68c5ca04ad91ad6939f56efbb48ce14879928fde062e7993bd24e9e5cfacb

Connect2id server 14.1 WAR package: c2id-mt.war

GPG signature: c2id-mt.war.asc

SHA-256: ad70418441faf02a3895d0a2ac01365f679ff22208b9ed8aedfd26e84b83d261

Questions?

If you have technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.


Release notes

14.1 (2023-06-30)

Summary

  • Upgrades OpenID Connect Federation 1.0 policy support to draft 29.

Configuration

  • /WEB-INF/oidcProvider.properties

    • op.authz.responseJWTIncludeX5C -- New optional configuration property of type boolean to enable / disable inclusion of the X.509 certificate chain ("x5c") header parameter in signed OAuth 2.0 authorisation responses (JARM) when the signing JWK is provisioned with a certificate. The default value is true (enabled).

Resolved issues

  • The com.nimbusds:c2id-server-sdk dependency must not be SNAPSHOT, but 4.58 (issue server/898).

Dependency changes

  • Upgrades to com.nimbusds:c2id-server-sdk:4.58

  • Upgrades to com.nimbusds:oauth2-oidc-sdk:10.10.1

  • Updates to io.dropwizard.metrics:metrics-core:4.2.19

Connect2id server 14.0 with new refresh token settings and Oracle database support

The new major Connect2id server release is here at last. What's in it and how to prepare for the upgrade?

New refresh token settings

Self-contained (JWT-encoded) refresh tokens for transient (non-persisted) authorisations can now also be optionally rotated. Previously the rotation was possible only for refresh tokens linked to a long-lived (persisted) authorisation. The rotation is a poor-man's protection against replay of a leaked refresh token that was issued to a public OAuth 2.0 client. The more secure and robust in case of slow / poor networks method to prevent replay is for public clients to receive sender-constrained refresh tokens, by means of mTLS or DPoP.

The refresh token rotation can now be set on a individual authorisation basis, using the optional refresh_token.rotate parameter in the consent of an authorisation session.

Example consent indicating the refresh token must be rotated:

{
  "scope"         : [ "openid", "email" ],
  "claims"        : [ "email", "email_verified" ],
  "refresh_token" : { "rotate" : true }
}

The direct authorisation endpoint and the token exchange and password grant handlers also support the new rotation parameter.

If the refresh_token.rotate parameter for a given authorisation is omitted a default policy will be applied, according to the new authzStore.refreshToken.defaultRotate configuration property.

The global authzStore.refreshToken.alwaysUpdate (always rotate) configuration property is deprecated and should no longer be used. Instead, set the authzStore.refreshToken.defaultRotate configuration property and override it for specific clients or authorisations.

ID token refresh

Another new feature is the option to refresh ID tokens, in response to a valid refresh token grant with the openid scope, and provided the end-user is considered logged into the OpenID provider.

The ID token refresh is allowed on a individual authorisation basis, by setting the optional id_token.allow_refresh parameter in the consent of an authorisation session.

Example consent allowing ID token refresh:

{
  "scope"    : [ "openid" ],
  "id_token" : { "allow_refresh" : true }
}

As long as the OpenID provider session where the user login took place remains present, the token endpoint will return a new ID token in the response to a refresh request. When the session is closed or expires an ID token will no longer be included in the token response (an access token will still be returned though).

The ID token refresh can thus be used by authorised relying parties to perform a back-channel check whether the user still has a session with the Connect2id server.

Note that the ID token refresh does not guarantee the end-user is actually present and properly authenticated, due to the back-channel nature of the token request. The standard prompt=none OpenID authentication request is intended for this purpose, as it's done via the front-channel (the browser) and cannot be triggered without an end-user interaction.

Claims source plugins can access the user sessions

Connect2id server plugins for sourcing the consented user claims that go into UserInfo responses or ID tokens can now access the end-user session where the claims sourcing was authorised.

This can be used to populate claims from information held in the session, such as authentication details, or claims that were saved in the claims fields at the time the user session was created.

Token introspection composer plugins can also access the user sessions

Plugins for shaping token introspection responses can now also access the user session where the token issue was authorised.

The presence of a session can a deployment specific condition for returning a an introspection response for an active (valid) access token. The session can also serve as a source for selected claims to include in the response, such as the optional claims field of the session.

Scope management

A new op.authz.limitScopeToRegistered configuration property was devised to limit the requested scope values in the consent prompt of the authorisation session API to those registered in the metadata of the requesting client.

If disabled or no "scope" client metadata field is registered, the authorisation request scope will be passed on to the consent prompt as it is.

This configuration property is enabled by default:

op.authz.limitToRegisteredScope=true

Simplified configuration

All Connect2id server configuration properties were revised and where appropriate given default values. This means there are now fewer Java system properties that must be set, making the configuration of deployments easier.

Note that the default timeouts for fetching external HTTP resources were increased and some properties were deprecated. Check the release notes to find out what those are.

SBOM

A Software Bill Of Materials (SBOM) in CycloneDX JSON and XML format is included in the c2id.war under /WEB-INF/sbom/CycloneDX-Sbom.json and /WEB-INF/sbom/CycloneDX-Sbom.json.

Infinispan upgrade

The underlying Infinispan layer received a sweeping upgrade from v9.4.x to v14.0.x, while retaining the existing stateless, stateless + Redis and replication Connect2id server clustering modes.

Oracle database support

The Oracle database is now supported, alongside the MySQL, PostgreSQL and Microsoft SQL Server relational databases.

Support for persistence to LDAP is removed

In v14.0 persisting Connect2id server data to an LDAP server will no longer be supported. Connect2id server deployments with an LDAP backend database have the choice to migrate to a supported SQL RDBMS or to AWS DynamoDB.

Bug fixes, optimisations

The code base received several bug fixes. The data persistence layer was optimised, which may result in CPU and storage bill savings in large deployments.

Upgrading from 13.x or older to 14.0

Connect2id server deployments in the stateless clustering mode can simply add new v14.0 node(s) and switch the requests to them.

Deployments with replication clustering or Redis can do the same. However, due to a change in the Infinispan in-memory data serialisation (which now uses ProtoBufs instead of the previous Java marshalling), all objects stored or cached in memory (such as subject sessions, data persisted to the database is not affected), will not be recognised and hence will be ignored by new Connect2id server 14.0 nodes. To transfer existing subject sessions to the new cluster you will need to perform a manual migration.

The new release requires an upgrade to the SQL database schema. This upgrade consists of a new "expended_tokens" table and new columns that must be added to theid_access_tokensandlong_lived_authorizations` tables. When the new Connect2id server 14.0 starts up it will automatically check the existing SQL database schema and perform the necessary table and column additions.

Deployments with DynamoDB, which is essentially a schema-less database, require no such operation.

Several configuration properties were deprecated. You may want to check what these are and update your configuration if necessary.

Finally, a class and methods related to the InitContext interface from the Connect2id server SDK marked deprecated about 3 years ago were removed. Suitable alternatives have been provided.

More information can be found in the release notes below. If you have questions or need assistance with the new release contact us.

Download 14.0

For the signature validation: Public GPG key

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 14.0: Connect2id-server.zip

GPG signature: Connect2id-server.zip.asc

SHA-256: 26a0ccecb349fa45bd5d63270c28aadfdb25281826a3f5d155459b1c31a49c77

Connect2id server 14.0 WAR package: c2id.war

GPG signature: c2id.war.asc

SHA-256: 90b37040a8b30835c952ae8ccd7ad536561134cd53e400f133c8fe797e0a78aa

Multi-tenant edition

Apache Tomcat package with Connect2id server 14.0: Connect2id-server-mt.zip

GPG signature: Connect2id-server-mt.zip.asc

SHA-256: 8ddf568d311a5b1871d539b79b0efdd89ac0e42a32d50066dd238114944c2d2d

Connect2id server 14.0 WAR package: c2id-mt.war

GPG signature: c2id-mt.war.asc

SHA-256: 252e2ad47d6a0612ff51d3e4c490ed07f45e80c38700fe000c36b2123fd05537

Questions?

If you have technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.


Release notes

14.0 (2023-06-27)

Summary

  • Support for refresh token rotation on an individual authorisation basis, overriding the global Connect2id server configuration.

    Self-contained (JWT-encoded) refresh tokens, which are linked to transient / non-persisted ("long_lived":false) authorisations, also receive the ability to be rotated.

    Previously refresh token rotation could only be set globally and apply only to identifier-based refresh tokens, which are linked to long-lived / persisted ("long_lived":true) authorisations.

  • Support for ID token refresh at the token endpoint, settable on an individual authorisation basis. The token response will include a new ID token when the refresh token authorisation allows such refresh and the subject (end-user) session bound to the refresh token is still present. If the session was closed or expired no ID token will be included in the token response.

    An authorised OpenID relying party may use the ID token refresh to do a back-channel check whether the end-user session with the OpenID provider still exists (i.e. that the session wasn't closed or expired). OpenID relying parties should use the standard "prompt=none" OpenID authentication request to ensure the end-user is actively present and properly authenticated, since this method involves the front-channel (the browser). An ID token refresh thus isn't equivalent to or a substitute for a "prompt=none" OpenID authentication request.

  • Public clients registered for OAuth 2.0 mutual TLS (RFC 8705) and the OAuth 2.0 refresh token grant will receive refresh tokens that are client X.509 certificate bound.

  • Allows registration of native applications (the client "application_type" metadata field set to "native") with non-localhost https redirection URIs, e.g. https://app.example.com/callback.

  • Introduces "urn:c2id:introspection_endpoint" as alternative fixed scope value for authorising access to the token introspection endpoint of the Connect2id server. Authorisations with a scope value set to the token introspection endpoint, e.g. https://op.example.com/token/introspect continue to be supported. The fixed scope value is intended for introspecting clients registered in Connect2id server deployment configured with OP / AS issuer aliases.

  • A new "op.authz.limitScopeToRegistered" configuration property to filter the requested scope values in the consent prompt of the authorisation session API to those registered in the metadata of the requesting client. If disabled or no "scope" client metadata field is registered, the authorisation request scope will be passed to the consent prompt as it is. Enabled by default.

  • The Connect2id server configuration properties were revised and given appropriate default values where applicable. Intended to reduce the configuration effort and the number of Java system properties necessary to deploy a Connect2id server.

  • Updates the TokenIntrospectionResponseComposer SPI to provide access to the subject (end-user) session where the token consent occurred, when the session is still present (not closed or expired). The subject session may be used by customised token introspection endpoints to include selected claims or other details from the session in the introspection responses.

  • Updates the AdvancedClaimsSource SPI to provide access to the subject (end-user) session where the claims sourcing was authorised, provided the session is still present (not closed or expired). The subject session may be used to source claims for UserInfo responses and ID tokens.

  • A Software Bill Of Materials (SBOM) in CycloneDX JSON and XML format is included in the c2id.war under /WEB-INF/sbom/CycloneDX-Sbom.json and /WEB-INF/sbom/CycloneDX-Sbom.json

  • Upgrades to Infinispan 14.0.

    Due to the switch of the internal object serialisation in Infinispan to Protocol Buffers (Protobuf) existing in-memory data in Connect2id server 13.x deployments in replication cluster mode or with Redis as in-memory data and cache store will not be recognised and hence ignored by a Connect2id server v14.0 deployment. If such in-memory data (subject sessions, etc.) needs to be preserved it must be manually migrated.

  • Adds Oracle 12c r1+ Database support.

  • Removes LDAP backend database support as part of the Infinispan 14.0 upgrade. Connect2id server deployments with an LDAP backend database can migrate to a supported SQL RDBMS or to AWS DynamoDB.

Configuration

  • /WEB-INF/oidcProvider.properties

    • op.authz.limitToRegisteredScope -- New optional configuration property of type boolean to limit the requested scope values in the consent prompt for OAuth 2.0 authorisation / OpenID authentication requests to those registered the in the "scopes" client metadata field (provided the metadata field is set). The default value is true.

    • op.authz.feedSubjectSessionClaimsIntoIDToken -- No longer a required configuration property, receives a default value of true.

    • op.reg.allowOpenRegistration -- Receives a default value false.

    • op.reg.rejectNonTLSRedirectionURIs -- Receives a default value true.

    • op.reg.refreshAccessTokenOnUpdate -- Receives a default value true.

    • op.reg.clientSecretLifetime -- Receives a default value 0 (no expiration).

    • op.reg.alwaysRefreshClientSecretOnUpdate -- Receives a default value true.

    • op.reg.resourceRetriever.httpConnectTimeout -- Increases the default value to 1000 ms.

    • op.reg.resourceRetriever.httpReadTimeout -- Increases the default value to 1000 ms.

    • op.idToken.defaultLifetime -- Receives a default value 300 seconds.

    • op.idToken.jwsAlgs -- Receives a default value of all supported, with "none" excluded.

    • op.idToken.jweAlgs -- Receives a default value of all supported.

    • op.idToken.jweEncs -- Receives a default value of all supported.

    • op.idToken.ignoreUserInfoError -- Receives a default value true.

    • op.authz.sessionLifetime -- Receives a default value 15 minutes.

    • op.authz.responseTypes -- Receives a default value of all supported.

    • op.authz.responseModes -- Receives a default value of all standard supported.

    • op.authz.requestJWSAlgs -- Receives a default value of all supported, with "none" excluded.

    • op.authz.requestJWEAlgs -- Receives a default value of all supported.

    • op.authz.requestJWEEncs -- Receives a default value of all supported.

    • op.authz.responseJWSAlgs -- Receives a default value of all supported.

    • op.authz.responseJWEAlgs -- Receives a default value of all supported.

    • op.authz.responseJWEEncs -- Receives a default value of all supported.

    • op.authz.includeClientInfoInAuthPrompt -- Receives a default value false.

    • op.authz.includeOtherConsentedScopeAndClaimsInPrompt -- Receives a default value false.

    • op.authz.alwaysPromptForConsent -- Receives a default value false.

    • op.authz.requireIDTokenHintWithPromptNone -- Receives a default value false.

    • op.authz.advertisedScopes -- Receives a default value "openid".

    • op.authz.advertisedClaims -- Receives a default value "sub".

    • op.authz.advertisedDisplayTypes -- Receives a default value page.

    • op.token.authMethods -- Receives a default value of all supported, with "tls_client_auth" and "self_signed_tls_client_auth" excluded.

    • op.token.authJWSAlgs -- Receives a default value of all supported.

    • op.userinfo.jwsAlgs -- Receives a default value of all supported.

    • op.userinfo.jweAlgs -- Receives a default value of all supported.

    • op.userinfo.jweEncs -- Receives a default value of all supported.

    • op.logout.sessionLifetime -- Receives a default value of 10 minutes.

    • op.logout.backChannel.httpConnectTimeout -- Increases the default value to 1000 ms.

    • op.logout.backChannel.httpReadTimeout -- Increases the default value to 1000 ms.

    • op.federation.httpConnectTimeout -- Replaces the op.federation.httpRequestTimeout configuration property, increases the default value to 1000 ms.

    • op.federation.httpReadTimeout -- Increases the default value to 1000 ms.

  • /WEB-INF/authzStore.properties

    • authzStore.refreshToken.defaultRotate -- New optional configuration property of type boolean for the default refresh token rotation setting. Can be overridden by individual authorisations. The default value is false (no rotation).

    • authzStore.refreshToken.alwaysUpdate -- Deprecated, use "authzStore.refreshToken.defaultRotate" instead.

    • authzStore.accessToken.includeX5C -- New optional configuration property of type boolean to enable / disable inclusion of the X.509 certificate chain ("x5c") header parameter in self-contained (JWT) access tokens when the signing JWK is provisioned with a certificate. The default value is true (enabled).

    • authzStore.accessToken.disableSubjectSecurity -- New optional configuration property of type boolean to disable the automatic encryption of self-contained (JWT-encoded) access tokens with public (non-pairwise) subject identifiers, in cases when the access tokens are issued to clients registered for pairwise subjects in ID tokens and UserInfo responses. The default value is false. Should be used only in exceptional circumstances.

    • authzStore.code.lifetime -- Receives a default value of 300 seconds (5 minutes).

    • authzStore.accessToken.defaultLifetime -- Receives a default value 600 seconds (10 minutes).

    • authzStore.accessToken.jwsAlg -- New optional configuration property to replace authzStore.accessToken.jwsAlgorithm which becomes deprecated. The default value is RS256.

    • authzStore.accessToken.jweAlgorithm -- New optional configuration property to replace authzStore.accessToken.jweAlgorithm which becomes deprecated. The default value is dir.

    • authzStore.accessToken.jweEnc -- New optional configuration property to replace authzStore.accessToken.jweMethod which becomes deprecated. The default value is A128GCM.

    • authzStore.accessToken.allowDirectInspection -- Receives a default value false.

    • authzStore.options.highlyAvailableMode -- Receives a default value true.

    • authzStore.options.legacyPlainKeysInStorage -- Removed, after being deprecated in Connect2id server 10.0.

  • /WEB-INF/sessionStore.properties

    • sessionStore.maxLifetime -- Receives a default value 259200 minutes (180 days).

    • sessionStore.authLifetime -- Receives a default value 43200 minutes (30 days).

    • sessionStore.maxIdleTime -- Receives a default value 14400 minutes (10 days).

    • sessionStore.quotaPerSubject -- Receives a default value 5.

    • sessionStore.onQuotaExhaustion -- Receives a default value CLOSE_OLD_SESSION.

  • /WEB-INF/infinispan-*.xml

    • Upgrades the XML schema to Infinispan 14.0.

    • Replaces the Infinispan "op.clientRegTokenMap" with a new generic "authzStore.expendedTokenMap" capable of storing keys for expended tokens that are rotated self-contained (JWT-encoded) refresh tokens, client registration tokens, client_secret_jwt and private_key_jwt tokens, DPoP tokens and other one-time-use objects.

  • /WEB-INF/infinispan-stateless-oracle.xml

    • New Infinispan configuration for stateless clustering and an Oracle database.
  • /WEB-INF/infinispan-stateless-redis-oracle.xml

    • New Infinispan configuration for stateless clustering and an Oracle database and Redis for caching and storage of short-lived objects.
  • /WEB-INF/infinispan-replication-oracle.xml

    • New Infinispan configuration for replication clustering and an Oracle database.
  • /WEB-INF/infinispan-multitenant-stateless-oracle.xml

    • New multi-tenant Infinispan configuration for stateless clustering and an Oracle database.
  • /WEB-INF/infinispan-multitenant-stateless-redis-oracle.xml

    • New multi-tenant Infinispan configuration for stateless clustering and an Oracle database and Redis for caching and storage of short-lived objects.
  • /WEB-INF/infinispan-*-{mysql|postgres95|sqlserver|oracle|h2}.xml

    • New optional "dataSource.createTableIfMissing" Java system property. When "true" (the default value) the Connect2id server will automatically create the required SQL tables on startup. It will also perform automatic table alternations where necessary in new major releases. When "false" the database administrator must create or alter the tables manually before server startup.

    • New optional "dataSource.maxPoolSize" Java system property. Controls the maximum size the SQL connection pool is allowed to reach, including both idle and in-use connections. The default size is 5.

    • Upgrades the SQL schema (the Connect2id server will automatically add the new table and columns on startup unless "dataSource.createTableIfMissing" is disabled):

      • Adds an "expended_tokens" table.

      • Adds a "sik" (session identifier key) column to the "id_access_tokens" table.

      • Adds an "idr" (ID token rotate) column to the "long_lived_authorizations" table.

  • /WEB-INF/infinispan-*-ldap.xml

    • The LDAP backend database XML configurations are removed and no longer supported.
  • /WEB-INF/sql

    • New directory containing the required SQL statements for manual table creation, to be used when the Connect2id is configured to disable automatic table creation (if missing) on server startup (with
      dataSource.createTableIfMissing=false).

Web API

  • /clients

    • Allows registration of native applications (where the client "application_type" metadata field is set to "native") with non-localhost https redirection URIs.
  • /token

    • Supports issue of rotated self-contained (JWT-encoded) refresh tokens.

    • Supports ID token refresh. Requires the refresh token authorisation to explicitly allow ID token refresh and the subject (end-user) session bound to the refresh token to be still present (not closed or expired), else an ID token will not be included in the token response.

      The expiration of the refreshed ID token will be set according to the globally configured "op.idToken.defaultLifetime". An ID token lifetime supplied to the consent object (with "id_token.lifetime") will not be replicated in refreshed ID tokens.

      The "max_age" OpenID authentication request parameter will trigger inclusion of the "auth_time" claim only in the ID token issued in the direct response to it, not in refreshed ID tokens. For an OpenID relying party to receive the "auth_time" claim in refreshed ID tokens it must be registered as client for the "require_auth_time" metadata parameter.

      The refreshed ID token will include all consented claims as well as any claims found in the subject session "claims" field (unless the "op.authz.feedSubjectSessionClaimsIntoIDToken" configuration property prevents this). Preset ID token claims supplied to the consent object (with "preset_claims.id_token") will not be replicated in refreshed ID tokens.

  • /token/introspect

    • Introduces "urn:c2id:introspection_endpoint" as alternative fixed scope value for authorising access to the token introspection endpoint of the Connect2id server.
  • /authz-sessions/rest/v3/

    • Adds an optional "refresh_token.rotate" parameter of type boolean to the consent object. Sets the refresh token rotation for the current authorisation. When omitted the "authzStore.refreshToken.defaultRotate" configuration will apply.

    • Adds an optional "id_token.allow_refresh" parameter of type boolean to the consent object. Allows an OpenID relying party to receive a new ID token at the token endpoint in exchange for a valid refresh token, with the subject session bound to the refresh token still being present.

  • /direct-authz/rest/v2/

    • Adds an optional "refresh_token.rotate" parameter of type boolean to the request object. Sets the refresh token rotation for the individual authorisation. When omitted the "authzStore.refreshToken.defaultRotate" configuration will apply.

    • Adds an optional "id_token.allow_refresh" parameter of type boolean to the request object. Allows an OpenID relying party to receive a new ID token at the token endpoint in exchange for a valid refresh token, with the subject session bound to the refresh token still being present.

    • Adds an optional "claims_data" parameter of type JSON object to the request object. The parameter will be passed in the request to retrieve the consented OpenID claims from the configured source(s). The claims data will be included in a "cld" (claims data) field in the issued access token(s) and in the long-lived authorisations if the consent is persisted. If the claims data must be kept confidential from the client either an identifier access token encoding must be chosen or if a self-contained (JWT) access token is chosen it must be additionally encrypted. An AdvancedClaimsSource SPI implementation can retrieve the claims data JSON object by a call to the "ClaimsSourceRequestContext.getClaimsData" method.

      This parameter is identical to the "claims_data" parameter in the consent object of the authorisation session web API.

  • /authz-store/rest/v3/

    • New "rtr" authorisation field of type boolean for the refresh token rotate setting. The default value is false.

    • New "idr" authorisation field of type boolean for the allow ID token refresh setting. The default value is false.

    • Removes the "/config" resource for retrieval (via HTTP GET) of the public authorisation store configuration.

  • /monitor/v1/metrics

    • Adds new "authzStore.numExpendedTokenEntries" gauge.

    • Removes the "clientStore.numCachedExpendedTokens" gauge (replaced by the
      new "authzStore.numExpendedTokenEntries" gauge).

SPI

  • Upgrades the Connect2id server SDK to com.nimbusds:c2id-server-sdk:4.58

    • The RefreshTokenSpec class receives a new optional rotation setting. If empty the default Connect2id server refresh token rotation policy will apply.

    • The IDToken spec class receives a new optional allow refresh setting. The default setting is no ID token refresh allowed.

    • The PasswordGrantHandler SPI can set a refresh token rotation preference.

    • The TokenExchangeGrantHandler SPI can set a refresh token rotation preference.

    • The TokenIntrospectionResponseComposer SPI adds access to the subject (end-user) session used for the token consent, provided the session is still present (not closed or expired). The session object can be accessed via the "TokenIntrospectionContext.getSubjectSession" method. The subject session may be used by customised token introspection endpoints to include subject claims or other details from the session in the responses.

    • The TokenIntrospectionResponseComposer SPI extends Lifecycle.

    • The AdvancedClaimsSource SPI adds access to the subject (end-user) session where the claims sourcing was authorised, provided the session is still present (not closed or expired). The session object can be accessed via the "ClaimsSourceRequestContext.getSubjectSession" method.

      The subject session is supplied in the following cases:

      • Claims sourcing for the UserInfo endpoint where the subject session where the claims consent occurred is still present (not expired or closed);

      • Claims sourcing for ID token issue for an OAuth 2.0 authorisation code, implicit (including OpenID Connect hybrid response type) and refresh token grants;

      • Claims sourcing for a direct authorisation request where a valid subject session ID was supplied, or a new subject session was created.

      • Claims sourcing made available to the TokenIntrospectionResponseComposer SPI.

      The subject session may be used as a source of subject authentication claims, or claims from the optional "claims" session field.

    • Adds an "AccessTokenAuthorization.getSubjectSessionKey" method, returns null by default. Intended to represent the new encrypted subject session ID key attribute ("sik") in access tokens. Connect2id server deployments with a custom codec (SelfContainedAccessTokenClaimsCodec SPI implementation) for the JWT claims for access tokens should update it to include the new attribute.

    • The IdentifierAccessTokenCodec SPI extends Lifecycle.

    • The SelfContainedAccessTokenClaimsCodec SPI extends Lifecycle.

    • Removes deprecated ServiceContext interface.

    • Removes deprecated InitContext.getIssuer method. Use the SPI request context getIssuer method instead.

    • Removes deprecated InitContext.getOPIssuer method. Use the SPI request context getIssuer method instead.

    • Removes deprecated InitContext.getTokenEndpoint method.

    • Removes deprecated InitContext.getServiceContext method.

Resolved issues

  • The SQL store must not set the client "application_type" to the default value "web" on record retrieval (issue server/838).

  • The Microsoft SQL Server id_access_tokens table column cnf must be VARCHAR (100), not NVARCHAR(100) (issue authz-store/199).

  • Retrieving an authorisation record by refresh token must echo the submitted refresh token value in the returned record instead of recreating it from the persisted "rts" field (issue authz-store/203).

  • Authorisation updates must always return a refresh token in the current format, not the legacy format (issue authz-store/204).

  • The direct authorisation endpoint must always return a refresh token in the current, not the legacy format (issue server/837).

  • Store retrieval of identifier-based access tokens must recreate the local subject when the subject type is pairwise (issue authz-store/201).

  • Removes redundant persistence of registration_client_uri, recreates it dynamically from the OP / AS issuer URL and the client_id (issue server/512).

  • The "cnf" column of the "id_access_tokens" SQL table must be increased from 100 to 150 VARCHAR for H2 and MS SQL Server to accommodate token
    authorisations that use both a x5t#S256 and a jkt binding (issue authz-store/206).

  • Adds missing DynamoDB persistence of the "cld" (claims data) authorisation record field (issue authz-store/210).

  • Automatic revocation of all authorisations on replay of a rotated refresh token (issue authz-store/212).

  • Persist only the subject session ID key in pending authorisation code entries (omitting the appended HMAC), to prevent exploitation of session IDs in case of unauthorised access to the backend database or a database record leak (issue server/863).

  • Fixes NPE in DirectAuthorizationRequest.getResolvedClaims (issue server/867).

  • Consented non-requested OpenID claims should not be included in the saved claims field ("scs") of authorisations and authorisation records (issue server/868).

  • Client registration POST with empty "jwks" must produce HTTP 400 instead of HTTP 500 (issue server/878).

  • The server configuration must be rejected when mTLS client authentication is enabled and an op.tls.clientX509CertHeader is not configured (issue server/882).

  • Tokens issued within 500ms of a revocation event must not be marked as revoked (issue authz-store/211).

Dependency changes

  • Upgrades to com.nimbusds:c2id-server-sdk:4.58

  • Upgrades to com.nimbusds:oauth2-oidc-sdk:10.9.1

  • Upgrades to com.nimbusds:c2id-server-jwkset:1.29.1

  • Updates to com.nimbusds:c2id-server-property-source:1.1.2

  • Updates to com.nimbusds:tenant-manager:8.0

  • Updates to com.nimbusds:tenant-registry:8.3

  • Updates to com.nimbusds:oauth2-authz-store:24.4.2

  • Updates to com.nimbusds:oidc-session-store:16.4.3

  • Updates to com.nimbusds:software-statement-verifier:2.2.5

  • Upgrades to com.nimbusds:common:2.52

  • Upgrades to com.nimbusds:infinispan-cachestore-common:3.1

  • Upgrades to BouncyCastle 1.73.

  • Upgrades to Infinispan 14.0.10.Final

  • Upgrades to com.nimbusds:infinispan-cachestore-sql:7.0.2

  • Upgrades to com.nimbusds:infinispan-cachestore-dynamodb:5.0.1

  • Upgrades to com.nimbusds:infinispan-cachestore-redis:10.0.1

  • Updates to com.nimbusds:jgroups-dynamodb-ping:1.2.6

  • Updates to com.thetransactioncompany:pretty-json:1.5

  • Adds com.oracle.database.jdbc:ojdbc11:21.8.0.0

  • Updates to com.unboundid:unboundid-ldapsdk:6.0.9

Connect2id server 13.7.4

This release of the Connect2id server fixes a bug that caused incorrect encoding of the state parameter in post-logout redirect URIs. Deployments that implement an OpenID provider logout endpoint are encouraged to update. Details are available in the release notes below.

This week we also released a preview of the upcoming Connect2id server 14.0.

Download 13.7.4

For the signature validation: Public GPG key

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 13.7.4: Connect2id-server.zip

GPG signature: Connect2id-server.zip.asc

SHA-256: 97442463a2d50000eb41478ee285dbe78ddf959d5e1f0d35868771fa6896be3b

Connect2id server 13.7.4 WAR package: c2id.war

GPG signature: c2id.war.asc

SHA-256: f94347483b3d04f06bbd1d38bba57aa23d6b6b4ddcb39708fec90e4933b2b7b8

Multi-tenant edition

Apache Tomcat package with Connect2id server 13.7.4: Connect2id-server-mt.zip

GPG signature: Connect2id-server-mt.zip.asc

SHA-256: 95a547da885cbcd33ae5468ce928502bec4572fa5ab45771f7e48e8bdc30a349

Connect2id server 13.7.4 WAR package: c2id-mt.war

GPG signature: c2id-mt.war.asc

SHA-256: 48c63e817000d8f9116e1b532e547998a9a4708e71e1fb1d7564cc10f34a159a

Questions?

If you have technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.


Release notes

13.7.4 (2023-05-09)

Resolved issues

  • The /logout-sessions/rest/v1 API must URL-encode the state parameter in the final post-logout redirection URI (issue server/873).

Dependency changes

  • Updates to com.nimbusds:software-statement-verifier:2.2.4