> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/readme/about-this-release/release-notes.md). # Release notes ## 3.8.0 #### Documentation **Improved product overview and guidance for Fortified ID Access** The Access documentation has been expanded and restructured to make it easier to understand what Fortified ID Access is, what it can be used for, and where to start depending on the reader’s goal. The updated documentation now includes clearer overview content such as [Why Access?](/access/readme/why-access.md), [More than Authentication](/access/readme/more-than-authentication.md), and a more structured [Common Use Cases](/access/common-use-cases.md) section. The [Getting Started](/access/getting-started.md) page has also been positioned more clearly as an entry point for readers who want to move from overview to implementation. These updates are intended to make the documentation more approachable for both business-oriented readers and technical readers, while giving a clearer picture of the breadth of scenarios that Fortified ID Access supports. #### SAML **Untyped SAML AttributeValue support** SAML applications and SAML profiles can now set `assertion_config.include_attribute_value_type` to `false` to emit SAML `AttributeValue` elements without explicit `xsi:type` typing. The default remains `true`, so existing integrations keep the previous typed behaviour unless the setting is explicitly changed. See [SAML application](/access/key-components/modules/saml/saml-application.md) and [SAML profile](/access/key-components/modules/saml/saml-profile.md) for details. **Clearer signed AuthnRequest validation errors** When a signed SAML AuthnRequest is received but the SP metadata does not contain a usable signing certificate, Access now returns a clearer configuration error. This makes it easier to distinguish metadata problems from general SAML request validation failures. **SAML metadata reload filtering** Reloaded SAML metadata now respects `include_entity_id`, so filtered metadata stays limited to the configured trusted entity IDs after reload. #### OIDC **Overlapping OIDC signing key rotation** OIDC OpenID Provider configurations can now use multiple signing keys through `sign_ref`. This allows Access to publish overlapping keys in JWKS, keep previous keys available during rollover, and automatically select the active signing key based on certificate validity dates. During overlap, Access continues signing with the oldest certificate that is still valid. If no configured certificate is currently valid, Access falls back to the first configured signing key. See [OIDC signing keys](/access/key-components/modules/oidc/signing-keys.md) for configuration details and operational guidance. **UserInfo unresolved export claims** OIDC UserInfo now returns an empty claim value when a configured `${exports.*}` expression cannot be resolved. The endpoint no longer returns the unresolved placeholder string as the claim value. See [User info endpoint](/access/key-components/modules/oidc/user-info-endpoint.md) for details. #### Authenticators **Freja e-ID app-switch return handling** Freja QR and app-switch handling now avoids empty or duplicate `originAppScheme` parameters. Configurations without `return_url` still produce valid Freja start URLs, while configured return URLs are used consistently during start and QR polling. See [With QR or "app-switch"](/access/key-components/authenticators/credential-validators/freja-e-id/with-qr-or-app-switch.md) for details. **Selector cancel preserves application context** When a user cancels a selected authenticator and returns to a Selector, the Selector now preserves the application context used for option filtering. This prevents options based on values such as `exports.app_tag` from disappearing after cancel. See [Selector](/access/key-components/authenticators/flow-control/selector.md) for details. #### Pipes and valves **Multiple exports in one valve** `ExportsPut` can now create several exports from one configuration object, and `ExportsRemove` can remove several exports from one valve. Existing single-export configuration remains supported. **EntraIDRemoveUserFromGroups accepts UPN** `EntraIDRemoveUserFromGroups` can now resolve `user_id` from either an Entra object ID or a UPN before removing the user from configured groups. **HttpClient User-Agent enabled by default** `HttpClient` now enables the `User-Agent` request header by default. The default value remains `Fortified-HttpClient` unless a custom `user_agent` is configured. **Flow failure handling** Flow handling now respects soft-fail signals consistently between authenticators and valves, preventing failures from being ignored silently in mixed authentication and pipe flows. **ItemCreate request expansion** `ItemCreate` now expands request fields correctly when creating item properties. Request-based values no longer become empty only because they are read through item property configuration. #### Configuration **Include arrays inside arrays** When an `@include` directive is used as an array element and the included file contains an array, the included elements are flattened into the parent array. Use `@include_as_array` when the included array should remain nested. See [File inclusion](/access/configuration-reference/file-inclusion.md) for details. #### Operations **Trace ID in failure templates** Failure redirects to Information Endpoint templates now keep the Access trace ID available to the rendered template. #### Bug fixes * **Freja app-switch** (#712): Removed empty and duplicate `originAppScheme` handling from Freja QR and app-switch start URLs. * **Selector after cancel** (#707): Selector option filtering now keeps application context such as `exports.app_tag` after returning from a cancelled selected authenticator. * **OIDC UserInfo claims** (#710): Unresolved `${exports.*}` UserInfo claim expressions now return empty values. * **SAML metadata reload** (#699): Reloaded metadata now respects `include_entity_id`. * **SAML signed AuthnRequest errors** (#690): Missing signing certificates in SP metadata now produce clearer validation errors. * **Information Endpoint templates** (#673): Trace IDs are preserved for failure redirect templates. * **ItemCreate request fields** (#704): Request-field expansion no longer produces empty item properties unexpectedly. ## 3.7.0 #### SAML **Application-level app tags** SAML applications can now override `app_tag` from the selected SAML profile. If no `app_tag` is configured on the application, the profile value is still used as before. If both are configured, the application value takes precedence. See [Breaking changes](/access/readme/about-this-release/breaking-changes.md) before upgrading if application-level `app_tag` is already present in existing configurations. **Single Logout for external IdPs** Single Logout support has been extended for external IdPs, making logout handling more complete in SAML federation scenarios. **SAML assertion encryption** The documented `assertion_config.encrypt` property is now honored for SAML assertion encryption. Assertion encryption also supports AES-256-CBC for service providers that require it. **Clearer logging for unmatched SAML applications** When an incoming SAML request cannot be matched to an application configuration, Access now logs a clear configuration error instead of surfacing a `NullPointerException`. **Enable/disable support for trusted application metadata** SAML trusted application metadata entries now support an `enabled` attribute. Disabled metadata entries are ignored and no metadata is loaded from them. See [SAML application](/access/key-components/modules/saml/saml-application.md) and [SAML profile](/access/key-components/modules/saml/saml-profile.md) for details. #### OIDC **Deep OIDC trace logging** OIDC OP traffic can now be traced in more detail for troubleshooting federation flows. Deep tracing is gated by both a dedicated `TRACE` logger and `verbose: true` on the relevant OIDC configuration, so detailed request, response, redirect, and token logging must be explicitly enabled. **Safer OIDC logout handling** OIDC OP logout handling has been hardened for configurations using `simple_logout=false`. Post-logout redirects are now only performed when the redirect URI is registered and the logout request can be matched to the original session token. When those conditions are not met, Access completes the logout locally without redirecting back to the relying party. The legacy `simple_logout=true` behavior is unchanged. **Refresh token handling** Refresh-token sessions are now refreshed with `touch()` when reused, preventing valid refresh-token activity from leaving the backing session stale. Logging for expired refresh tokens has also been lowered in severity and clarified to reduce noise during normal expiry scenarios. #### Authenticators **Selector option enable/disable support** Selector options now support an `enabled` attribute. Disabled options are excluded before `include_expr` is evaluated, making it possible to keep an option in configuration without presenting it to the user. See [Selector](/access/key-components/authenticators/flow-control/selector.md) for details. **SITHS eID QR session handling** Starting a new login request after a previous SITHS eID QR or app-switch transaction timed out, expired, or was cancelled now creates a fresh authentication request instead of reusing stale session state. **OTP submit with Enter** Pressing `Enter` now submits OTP codes in the browser. #### Pipes and valves **New HSA valve** A new HSA valve is available in the Pipes module. **New RADIUS PAP valve** A new RADIUS PAP valve is available, with RadSec support for secured RADIUS communication. **LDAPAdd and LDAPModify DN properties** `LDAPAdd` and `LDAPModify` can now read the target DN from a configured item property. This makes the valves more flexible in flows where the item ID is not the LDAP DN. **ItemRename destination expansion** `ItemRename` now supports expansion from properties on the current item when resolving `dest`. #### Operations **Container customer JVM options** The container now supports `java_customer_opts`, making it possible to add customer-specific JVM options without replacing the standard startup configuration. #### Bug fixes * **AuthController session cleanup** (#644): Access sessions are now destroyed before redirecting through `fail_location` or `failed_redirect`. * **OIDC app-specific authorization session cleanup** (#661): Access sessions are now destroyed when denied OIDC app-specific authorization redirects to a configured failure target. * **SAML app-specific authorization session cleanup** (#645): Access sessions are now destroyed when denied SAML app-specific authorization redirects to a configured failure target. * **SAML assertion encryption property** (#675): Fixed support for the documented `assertion_config.encrypt` property. * **Expired refresh token logging** (#676): Expired refresh-token log messages now use a lower severity and clearer wording. * **Refresh token session reuse** (#658): Reused refresh-token sessions are now touched to keep session expiry aligned with token activity. * **SITHS eID QR sessions** (#255): New login requests after timeout or cancellation now start a new SITHS eID transaction. * **OTP form submit** (#635): OTP codes can now be submitted with the `Enter` key. ## 3.6.0 #### App-specific authorization OIDC Relying Parties, SAML applications, and SAML profiles can now be configured with application-specific authorization. An authorization pipe runs after authentication but before the final response is issued to the client. If the pipe fails, Access can redirect to a configured failure location or route to a specific target based on the pipe failure message. See the documentation for [Relying Party](/access/key-components/modules/oidc/relying-party.md), [SAML application](/access/key-components/modules/saml/saml-application.md), and [SAML profile](/access/key-components/modules/saml/saml-profile.md). #### OIDC Device Authorization Flow Access now supports OIDC Device Authorization Flow. This adds the `device_authorize` endpoint, device code polling on the token endpoint, and a dedicated verification flow where the user can enter a `user_code` and complete authentication on a separate device. The verification flow reuses existing authenticators and includes a default completion/failure page when no custom location is configured. See the [Device Authorization Flow](/access/key-components/modules/oidc/device-authorization-flow.md) and the [Device Authorization Flow](/access/key-components/authenticators/protocol-managers/oidc/device-authorization-flow.md). #### OIDC security hardening Several OIDC behaviours have been refined to align more closely with current OAuth and OpenID Connect best practices. This includes stricter handling of signed request objects, stronger PKCE enforcement when applicable, more restrictive token endpoint and UserInfo defaults, and improved scope handling for UserInfo access evaluation. * signed request objects are now only accepted when they can be validated for the relying party * PKCE-bound authorization code and refresh token flows now require `code_verifier` * the token endpoint now only accepts form-encoded `POST` requests * `access_token` in UserInfo query parameters is disabled by default and must be explicitly enabled for legacy compatibility * UserInfo handling now persists and evaluates granted `scope` more consistently for newly issued access tokens #### OIDC Relying Party **acr\_values support** The OIDC RP authenticator now supports sending `acr_values` in authentication requests. Multiple values can be configured and must be space-separated. This is required for integrations such as Norwegian BankID, which uses ACR levels to control authentication method and assurance level. **Cancel mappings** OP errors can now be mapped to the authenticator's `cancel_location`. Configure `cancel_on_errors` to match specific error codes, or `cancel_on_error_description_patterns` to match against the full `error_description`. If neither matches, the callback goes to `failure_location`. See [OIDC Relying Party](/access/key-components/authenticators/protocol-managers/oidc/oidc-relying-party.md) for details. **Failed authentication logging** Event logging for failed authentication attempts has been added to the OIDC RP authenticator. Previously only successful authentications were logged. #### SMTP **OAuth2 (XOAUTH2) authentication** The SMTP module now supports OAuth2 authentication via the XOAUTH2 mechanism. #### Passkey **Automatic trigger** Passkey authentication can now be configured to start automatically when the user arrives at the authenticator, removing the need for an extra click. Controlled via the `auto_start` parameter (default: `true`). #### LDAPSearch **Multiple base\_dn** LDAPSearch now supports configuring a list of `base_dn` values. Searches are performed against each configured entry and the results are merged into a single set. Duplicate entries are removed from the combined result. #### Pipes and valves **Rule evaluation logging** Debug-level logging has been added for pipe rule evaluation. When a condition such as `exec_if_expr` is evaluated, the log now includes the expression, input values, and outcome. This makes it easier to diagnose why a valve is executed or skipped. **CleanMobile – support for 00-prefixed numbers** The `CleanMobile` valve now converts phone numbers starting with `00` to the `+` format. For example, `004670xxxxxxx` is converted to `+4670xxxxxxx`, ensuring consistent handling of international numbers. **Valve default configuration updates** Default configurations have been updated for the following valves to ensure all parameters are visible and consistent in the administration interface: * `InstantTransformer` * `HttpPost` * `HttpPatch` * `HttpPut` * `MVPropertyFiltering` * `CleanMobile` * `JsonObjectCreate` * `SessionPut` * `DumpState` * `DumpExports` * `DumpRequest` * `DumpSession` #### Property expansion – bracket notation Property expansion now supports bracket notation for referencing properties with complex names such as URLs, OIDs, or names containing dots and colons. Previously these could not be used in `${...}` expressions. ``` "${scope['urn:oid:1.3.6.1.4.1.5923.1.1.1.6']}" "${scope.inner['key:with:colons']}" ``` See [Property expansion](/access/configuration-reference/property-expansion.md) for details. #### cancel\_location per authenticator `cancel_location` is no longer inherited from a parent authenticator to its children. Each authenticator now has its own independent cancel destination. Previously, setting `cancel_location` on a Selector caused child authenticators to inherit the same value. #### Bug fixes * **BankID – Samsung Internet on Android** (#624): Fixed an issue where BankID authentication failed to launch the BankID app when using Samsung Internet on Android. * **EntraIDListUsers** (#611): Fixed an issue where an empty filter value triggered a wildcard search, returning all users instead of applying no filter. * **Selector – button label overflow** (#581): Fixed text alignment for option labels that wrap to multiple lines in the browser. * **SP metadata – single-line certificate** (#616): SP metadata now supports certificates without line breaks, ensuring compatibility with IdPs such as Inera that reject multi-line certificate values. ## 3.5.0 #### Freja eID **Animated QR code** Support for animated QR codes has been added to the Freja eID authenticator, following the updated [Freja eID specification](https://frejaeid.atlassian.net/wiki/spaces/DOC/pages/718012422/Dynamic+QR+Code+Implementation). **Improved timeout handling** When a Freja eID authentication request times out, the user now stays on the current view and receives a clear error message. Previously the user was immediately redirected to the start page with no feedback. This aligns the behavior with BankID. #### SAML **SAMLSPBroker – redirect to failure\_location on SAML errors** `SAMLSPBroker` can now be configured to redirect to a `failure_location` when a SAML `Responder` status error is received (for example a canceled request). Previously these errors resulted in a generic 400 Bad Request response. **SAML SP – fixed assertion fall-through on missing nameId** If a `nameId` cannot be resolved during SAML SP authentication, the flow no longer falls through to the IdP default assertion. Authentication now stops at the SAML SP object and an error is written to the log. #### Impersonate **Cancel button** A cancel button is now present in both the Impersonate and Impersonate with search authenticators. #### Pipes and valves **ItemCreate – support for JSON array properties** `ItemCreate` now supports setting properties whose values expand to a JSON array. Previously, achieving this required the extra step of using a separate `ItemPropertyAdd` valve. **Pipe display name in logs** When a pipe writes to the system log, the `display_name` of the pipe is now used as the log entry name if one is configured. If no `display_name` is set the existing behavior is preserved. **Valve default configuration updates** Default configurations have been updated for the following valves to ensure all parameters are visible and consistent in the administration interface: * `CreateJwt` * `HttpDelete` * `HttpGet` * `ParseJwt` * `DnParser` * `InstantToMsDateTransformer` * `MsDateToInstantTransformer` * `GenerateOtp` * `ValidateOtp` * `InstantGenerator` #### Bug fixes * **CefEventValve** (#568): Fixed a startup error where `EventPublisher` could not be injected into `CefEventValve`. * **Selector without label** (#580): Fixed an issue where a Selector authenticator without a configured display label rendered nothing in the browser with no error. ## 3.4.0 ### LDAPSearch Improved handling of multi-value attributes when omitting requested return attributes or using "\*". ### Heartbeat improvement Heartbeat endpoint now can be configured reading a json file. File is read at each get. No caching of data. ### OIDC claims generation update Improved handling of expansion including multi-values. ### Improved certificate PEM parsing Parsing of PEM now can handle certificates without PEM start or end tags. ### OIDC Implicit flow authenticator updates Now aligns with code flow authenticator ### Require signed auth requests Possible to require signed saml auth request per application. Configuration is done on application. ### Implicit flow access token update Can now issue as JWT token ### OIDC error handling update Errors in OIDC authentication is now sent back to calling OP. ### Valve default configuration update A number of valves have new default configuration. ActiveDirectoryAddGroupToMembers\ ActiveDirectoryAddMemberToGroups\ ActiveDirectoryRemoveGroupFromMembers\ ActiveDirectoryRemoveMemberFromGroups\ ItemCreate\ ItemPropertyAdd\ ItemPropertyCopy\ ItemPropertyRename\ ItemPropertyReplace\ ItemPropertySplit\ ItemPropertyTokenReplace\ ItemsMerge\ LDAPAdd\ LDAPBind\ LDAPDelete\ LDAPGroupFilter\ LDAPModify\ LDAPMove\ LDAPSearch ### EntraID get manager valve - EntraIDGetManager Use for getting manager of a user in EntraID ### UI updates * Exclude footer text is now possible * Optional information text can be added * When on a mobile, entering OTP will present digits only. ### CVE updates Updating underlying building blocks, both front and backend, in order to keep CVE risks at a minimum. ## 3.3.0 ### SAML Application & profile Moving toward a more application-centric configuration, SAML applications now include extended customisation options. This provides an easier and more flexible way to configure any custom behavior required by a SAML Service Provider (SP). [SAML application](/access/key-components/modules/saml/saml-application.md) For applications with similar requirements, they can be grouped using profiles. [SAML profile](/access/key-components/modules/saml/saml-profile.md) ### Application tag OIDC RPs, SAML profiles, and SAML applications can now include application tags — one or more labels attached to the authentication state during login. The purpose of application tags is to enable conditional execution based on the application context. In combination with the user context, this provides powerful and flexible conditional handling while simplifying administration. ### OIDC improvements * If opaque access tokens are used, the access\_token\_claims parameter must not be set as mandatory. * The nonce value must always be included in the id\_token JWT if it was present in the authentication request. If the RP sends a nonce, the OP must echo it back in the ID Token. It must never appear in Access Tokens or UserInfo responses. * access\_token\_claims is now used exclusively for claims included in JWT-formatted Access Tokens. A new configuration parameter, userinfo\_claims, has been introduced to define the data returned by the UserInfo endpoint when using opaque Access Tokens. * OIDC Relying Parties now support verification of JWTs signed with: * RSA: RS256, RS384, RS512, PS256, PS384, PS512 * ECDSA: ES256, ES384, ES512 * EdDSA: OKP / Ed25519 Previously, only RS256 and RS512 were supported. ### Event log updates The vast majority of authenticators have been updated to provide clearer and more comprehensive log entries. The ID of the configured authenticator is now included to improve traceability in multi-tenant environments. Logging clarity improvements have also been implemented. ### SAML SPBroker – Configurable RequestedAuthnContext Support SPBroker now supports configurable inclusion of a specific AuthnContextClassRef in the generated AuthnRequest. `"requested_authn_context": "http://schemas.microsoft.com/claims/multipleauthn"` ### AuthController – Conditional Execution Support Added support for controlling whether the AuthController should execute based on the exec\_if condition.This allows more flexible and configurable authentication flow handling. ### Selector – Optimised behavior for SSO Sessions with lazy\_expiry Enhanced the selector logic for SSO scenarios where the user has already authenticated and lazy\_expiry is enabled. Previously, when "expiry": "PT1S" was configured, the selector always prompted the user to choose an authentication method again, treating it as a new authentication. With this update, when used in combination with lazy\_expiry, the selector now evaluates whether the previously used method is still among the available options. * If it is, that method is automatically marked as executed (pass-through) without requiring re-authentication. * If it is not available, the user must select a new method (if multiple options exist) or is automatically routed through the only available method. ### Broadcom SiteMinder – Updated Direct Integration Handling Now includes fully updated support for Broadcom SiteMinder (Agent API 12.8 and later).This update improves compatibility, reliability, and performance for environments integrating Fortified ID Access as an Identity Provider with SiteMinder.It enables seamless use of modern authentication methods (BankID, Freja eID, FIDO2, OIDC, SAML 2.0), simplifies migration from legacy components, and strengthens centralised policy and session management. ### UI updates A number of UI improvements for a smoother user experience. ### CVE updates Updating underlying building blocks, both front and backend, in order to keep CVE risks at a minimum. ### Bug fixes ### ExternalFlow – Corrected Export Value Propagation Fixed an issue where ExternalFlow could reuse stale export values in generated JWTs, causing previously sent data (e.g., hk\_eleg\_pnr, givenname, surname) to persist between authentication sessions. The update ensures that each new authentication sequence correctly includes current export values in the signed JWT sent to external targets such as Forms, without requiring an Access restart. ## 3.2.2 ### Support for M2M Flows We have added support for machine-to-machine (M2M) integrations through the client\_credentials flow. This enables trusted clients to obtain access tokens without end-user involvement, making it easier to support backend services and automated system-to-system communication. ### New authenticator, [EnrichIdentity](/access/key-components/authenticators/flow-control/enrichidentity.md) Simplifying identity enrichment. ### [ExternalFlow](/access/key-components/authenticators/flow-control/externalflow.md) authenticator updates * Improved logging * Configurable exports * Conditional execution ### Compacted logging Removed excess trace when logging error ### Exposed new JMX endpoints Possibility to execute a PIPE with custom data. Possibility to deploy and execute a PIPE with custom data. This feature is mainly targeting [Management Center](https://www.fortifiedid.se/products/management-center) ### LDAPSearch valve improvements Better multi value handling. ### [Impersonate](/access/key-components/authenticators/flow-control/impersonate.md) updates Conditional executing Improved user selection ## Improved error messaging * Enhanced validation and error handling when using a keystore in OIDCAuthCodeFlow. * Clearer log messages are now provided for misconfigured keystores. For example, if the configuration contains keystore: "${globals.keystore\_oidc}", the login attempt will fail with an explicit error message instead of a generic log entry without cause. ## Simplified HttpClient keystore configuration * When HttpClient is configured with a keystore containing only one alias, that alias is now used automatically. * If no private key password is provided, the keystore password will be used by default. ## Improved error reporting for invalid authenticator path * Fixed issue where an invalid authenticator path (e.g. ${globals.default\_login\_suffix}) caused module startup failures with limited diagnostic information. * Log messages now clearly indicate *which authenticator* caused the error, making it easier to identify and correct misconfiguration without having to manually inspect all authenticators. ## Improved Freja eID accessibility compliance Freja eID integration has been updated to better meet accessibility requirements, ensuring a more inclusive and user-friendly authentication experience. ## Correct JSON typing in JsonObjectCreate * Fixed an issue where arrays/objects were stringified. roles now remains a JSON array and act\_as remains a JSON object in the output. * Safe interpolation of dynamic fields: unresolved expressions no longer create empty keys/values; such entries are skipped with a clear warning. * Improved diagnostics: logs now include the exact claim path and key when interpolation fails. ## Configurable TTL for UserInfo endpoint * Added support for configuring the TTL (time-to-live) of the UserInfo endpoint response. * Previously fixed to 60 seconds; now customizable via configuration. ## Ordering support for [Selector](/access/key-components/authenticators/flow-control/selector.md) options * Added support for an order attribute to control how Selector options are presented. * Ensures predictable and meaningful sorting of options instead of relying on default ordering. ## 3.2.1 ### Swedish BankID QR code updates Aligning with revised QR code regulations for better usability and accessibility. See more on ## 3.2.0 ### LDAP Valve improvements Handling items in more robust manner. Handles multiple items across all LDAP valves. ### Missing log - unsolicited authenticated Log was missing when doing unsolicited login ### Support for new Freja e-d attributes UNIQUE\_PERSONAL\_IDENTIFIER and LOA\_LEVEL are now supported ### UI improvements using Information endpoint module UI fixes for Windows Edge. ### Header white listing case insensitive When declaring headers to let through to service. Case is now insensitive. ### SAML meta data validation Meta data loaded from URL can be validated using a certificate ### New authenticator [ExternalFlow](/access/key-components/authenticators/flow-control/externalflow.md) authenticator added ### Improved session security User-Agent is now fingerprinted.\ See more info at ### OIDC refresh token update It is now possible to reuse refresh tokens. This is default behaviour when interacting with Microsoft Entra ID. ### Include improvement Deeper include structures previously had unexpected behaviour. ### CVE updates Updating underlying building blocks, both front and backend, in order to keep CVE risks at a minimum. ## 3.1.0 ### Authenticators with more default values All authenticators with web UI now has default values for: *overlay\_dir* *web\_root* This reduces configuration. Se authenticator documentation for default values. ### New authenticator `SSOAuthenticator` Use for generic SSO login when target not supporting OIDC or SAML 2.0 ### Default location for http listener When configured, the HTTP listener can now handle requests to / by redirecting the user agent to a predefined target URL.: ```json "redirect_url": "/userinfo/generic/" ``` ### Updated validation rules on incoming SAML assertion when brokering Updated documentation is found here [SAML Broker](/access/key-components/authenticators/protocol-managers/saml/saml-broker.md) ### Source ip behind proxy Source IP now is actual calling client when behind proxy ### Include improvements @inclunde expressions is now more powerful. More information here [File inclusion](/access/configuration-reference/file-inclusion.md) ### Chain authenticator updates Execution order can now be configured using "*order*" attribute for each entry in "chain". See more on [Chain](/access/key-components/authenticators/flow-control/chain.md) ### CVE updates Updating underlying building blocks, both front and backend, in order to keep CVE risks at a minimum. List of used components and known CVE's is available on request. ## 3.0.1 ### Request throttling Improved handling of request management on request flooding. ### Changed product name in CEF New name is Access ### Unsolicited saml logins SAML idp now can have a default sp configured. ### Task authenticator update Button added for manual app-switch. ### Simplified handling of overriding translation in authenticator By introcucing scopes in translation files all translation/overrdides now can be in one locales file. ### Start up order of modules updated All modules used for enxternal communication now starts in node group "first". Rest is in default. ### Bug fixes Handling multiple OP's now works Error SSO between protocols fixed Using FrejaID on same device now returns to same browser tab ## 3.0.0 ### New valve - GUIDToString Valve to create a string format GUID (`"b9d663ed-50dc-4260-b37e-147a62caa7f6"`) from the internal 16 byte binary representation used by AD / EntraID. ### New valve - Base64Converter Converts a base 64 value to another representation ### SithsWithQr updates Changed default behaviour, assuming using card reader instead of mobile app. ### Improvement saml metadata loading In previous version broken cash data stops server. ### Set custom HTTP security headers CSP, HSTS,XFO can now be set manually. ### Improvement information endpoint module logout now is attached to installation allowing for overriding logout look and feel. ### AD binary attributes are now supported ### UI updates A number of UI improvements for a smoother user experience. ### CVE updates Updating underlying building blocks, both front and backend, in order to keep CVE risks at a minimum. ## Bug fixes \#268 errors are not sent back to calling SAML IDP --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.fortifiedid.se/access/readme/about-this-release/release-notes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.