Release notes

Changes and configuration guidance for Fortified ID Access releases.

3.9.0

SAML

SAML trust from application metadata (integrity-access#816)

SAML IdPs can now omit their assertion_config list or set it to [] to use loaded SP metadata and application/profile settings. A nonempty list remains the SP allowlist, with exact matches taking precedence over "*". Existing valid lists keep their behavior; metadata and security checks remain required in both modes. Metadata fallback uses send_failed_response=false.

SAML metadata logging now correctly handles configurations that load metadata only over HTTP, including the remote-source count and the check for missing metadata sources.

See SAML IdP for configuration and Breaking changes for invalid lists rejected during initialization.

Flexible re-authentication policy (integrity-access#743)

SAML IdPs can now require fresh authentication for selected service providers through assertion_config.force_re_auth, while other SPs handled by the same IdP can continue reusing the current authentication state. Exact target_sp matches take precedence over wildcard configuration.

SAML applications and SAML profiles can also set assertion_config.force_re_auth. Incoming ForceAuthn=true, global IdP policy, SP-specific IdP policy, and application/profile policy use OR semantics, so one source cannot disable a re-authentication requirement from another source.

See SAML Application, SAML Profile, and SAML IdP for configuration details.

Correct customer identifiers in SAML IdP events (integrity-access#725)

The WEB_100103 event now omits the cust field when the SAML IdP has no custom_identifier. A configured customer identifier continues to be logged as before, instead of a missing value being represented by the literal text custom_identifier.

Authenticators

Configurable Freja QR and app-switch timeout (integrity-access#720, frontend#381)

FrejaWithQRCode now uses allowed_polling_for_minutes as the total timeout for the complete QR or app-switch flow. Access rotates undelivered Freja transactions while preserving the original deadline, so a configured five-minute flow is not stopped by the shorter lifetime of an individual Freja transaction.

The browser uses the backend-provided countdownSeconds and remainingSeconds, keeping the displayed countdown aligned with the server-side timeout. See Freja e-ID with QR or app-switch for configuration and rotation behavior.

Single-submit Impersonate selection (frontend#368)

The Impersonate selector now locks its controls and shows a processing state after a selection is accepted. Repeated clicks no longer send duplicate actions, and the Access backend treats later actions for the completed Impersonate step as idempotent so the next authenticator is started only once.

eID logos available to Selector (integrity-access#719)

Selector assets now include light and dark eID logo variants, allowing eID authentication choices to use the intended product icon in different UI themes.

Pipes and valves

Map values to item properties (foss-mono#20)

The new MapProperty valve maps an expanded source value to a configured target item property. It supports a default value, case-insensitive matching, preservation of existing properties, and creation of an item when a mapping or default produces a value.

See the Pipes valve documentation for configuration and examples.

Preserve scalar JSON arrays as multi-value properties (integrity-access#721)

JsonToItems can now store arrays of scalar values as Pipes multi-value properties when array_to_mv is enabled. This is useful for Entra ID customSecurityAttributes collections such as schoolUnitCode; arrays containing objects, nested arrays, or null keep the previous behavior.

An empty include_patterns array in MVPropertyFiltering now includes all values as documented. See JSON To Items and Entra ID List Users for details.

3.8.0

Documentation

Improved product overview and guidance for Fortified ID Access

The Access documentation has been expanded and restructured to make it easier to understand what Fortified ID Access is, what it can be used for, and where to start depending on the reader’s goal.

The updated documentation now includes clearer overview content such as Why Access?, More than Authentication, and a more structured Common Use Cases section. The Getting Started page has also been positioned more clearly as an entry point for readers who want to move from overview to implementation.

These updates are intended to make the documentation more approachable for both business-oriented readers and technical readers, while giving a clearer picture of the breadth of scenarios that Fortified ID Access supports.

SAML

Untyped SAML AttributeValue support

SAML applications and SAML profiles can now set assertion_config.include_attribute_value_type to false to emit SAML AttributeValue elements without explicit xsi:type typing. The default remains true, so existing integrations keep the previous typed behaviour unless the setting is explicitly changed.

See SAML Application and SAML Profile for details.

Clearer signed AuthnRequest validation errors

When a signed SAML AuthnRequest is received but the SP metadata does not contain a usable signing certificate, Access now returns a clearer configuration error. This makes it easier to distinguish metadata problems from general SAML request validation failures.

SAML metadata reload filtering

Reloaded SAML metadata now respects include_entity_id, so filtered metadata stays limited to the configured trusted entity IDs after reload.

Thales Luna HSM uses the Crypto User role

Routine signing and encryption operations with a Thales Luna HSM now authenticate explicitly as Crypto User. Configure keystore_thales_hsm.pin with the Crypto User PIN for the selected slot; Crypto Officer credentials are no longer required for these operations.

See SAML module for configuration details.

OIDC

Overlapping OIDC signing key rotation

OIDC OpenID Provider configurations can now use multiple signing keys through sign_ref. This allows Access to publish overlapping keys in JWKS, keep previous keys available during rollover, and automatically select the active signing key based on certificate validity dates.

During overlap, Access continues signing with the oldest certificate that is still valid. If no configured certificate is currently valid, Access falls back to the first configured signing key.

See OIDC signing keys for configuration details and operational guidance.

UserInfo unresolved export claims

OIDC UserInfo now returns an empty claim value when a configured ${exports.*} expression cannot be resolved. The endpoint no longer returns the unresolved placeholder string as the claim value.

See User info endpoint for details.

Authenticators

Freja e-ID app-switch return handling

Freja QR and app-switch handling now avoids empty or duplicate originAppScheme parameters. Configurations without return_url still produce valid Freja start URLs, while configured return URLs are used consistently during start and QR polling.

See Freja e-ID with QR or app-switch for details.

Selector cancel preserves application context

When a user cancels a selected authenticator and returns to a Selector, the Selector now preserves the application context used for option filtering. This prevents options based on values such as exports.app_tag from disappearing after cancel.

See Selector for details.

Generic user-facing eID verification errors

FortifiedID eID authentication no longer exposes internal verification codes such as REVOCATION_UNAVAILABLE to the browser. Technical failure details remain available in system and event logging, while the user receives the generic AUTHENTICATION_FAILED code. User-driven states such as cancellation and rate limiting remain distinct.

See FortifiedID eID for details.

Pipes and valves

Multiple exports in one valve

ExportsPut can now create several exports from one configuration object, and ExportsRemove can remove several exports from one valve. Existing single-export configuration remains supported.

EntraIDRemoveUserFromGroups accepts UPN

EntraIDRemoveUserFromGroups can now resolve user_id from either an Entra object ID or a UPN before removing the user from configured groups.

HttpClient User-Agent enabled by default

HttpClient now enables the User-Agent request header by default. The default value remains Fortified-HttpClient unless a custom user_agent is configured.

Flow failure handling

Flow handling now respects soft-fail signals consistently between authenticators and valves, preventing failures from being ignored silently in mixed authentication and pipe flows.

ItemCreate request expansion

ItemCreate now expands request fields correctly when creating item properties. Request-based values no longer become empty only because they are read through item property configuration.

Configuration

Include arrays inside arrays

When an @include directive is used as an array element and the included file contains an array, the included elements are flattened into the parent array. Use @include_as_array when the included array should remain nested.

See File inclusion for details.

Operations

Trace ID in failure templates

Failure redirects to Information Endpoint templates now keep the Access trace ID available to the rendered template.

Bug fixes

• Freja app-switch (#712): Removed empty and duplicate originAppScheme handling from Freja QR and app-switch start URLs.
• Selector after cancel (#707): Selector option filtering now keeps application context such as exports.app_tag after returning from a cancelled selected authenticator.
• OIDC UserInfo claims (#710): Unresolved ${exports.*} UserInfo claim expressions now return empty values.
• SAML metadata reload (#699): Reloaded metadata now respects include_entity_id.
• SAML signed AuthnRequest errors (#690): Missing signing certificates in SP metadata now produce clearer validation errors.
• Information Endpoint templates (#673): Trace IDs are preserved for failure redirect templates.
• ItemCreate request fields (#704): Request-field expansion no longer produces empty item properties unexpectedly.
• FortifiedID eID verification errors (#722): Internal verification codes are replaced with a generic browser-facing authentication error while detailed logging is preserved.
• Thales Luna HSM role (#741): Routine cryptographic operations now authenticate with the least-privileged Crypto User role.

3.7.0

SAML

Application-level app tags

SAML applications can now override app_tag from the selected SAML profile. If no app_tag is configured on the application, the profile value is still used as before. If both are configured, the application value takes precedence.

See Breaking changes before upgrading if application-level app_tag is already present in existing configurations.

Single Logout for external IdPs

Single Logout support has been extended for external IdPs, making logout handling more complete in SAML federation scenarios.

SAML assertion encryption

The documented assertion_config.encrypt property is now honored for SAML assertion encryption. Assertion encryption also supports AES-256-CBC for service providers that require it.

Clearer logging for unmatched SAML applications

When an incoming SAML request cannot be matched to an application configuration, Access now logs a clear configuration error instead of surfacing a NullPointerException.

Enable/disable support for trusted application metadata

SAML trusted application metadata entries now support an enabled attribute. Disabled metadata entries are ignored and no metadata is loaded from them.

See SAML Application and SAML Profile for details.

OIDC

Deep OIDC trace logging

OIDC OP traffic can now be traced in more detail for troubleshooting federation flows. Deep tracing is gated by both a dedicated TRACE logger and verbose: true on the relevant OIDC configuration, so detailed request, response, redirect, and token logging must be explicitly enabled.

Safer OIDC logout handling

OIDC OP logout handling has been hardened for configurations using simple_logout=false. Post-logout redirects are now only performed when the redirect URI is registered and the logout request can be matched to the original session token. When those conditions are not met, Access completes the logout locally without redirecting back to the relying party. The legacy simple_logout=true behavior is unchanged.

Refresh token handling

Refresh-token sessions are now refreshed with touch() when reused, preventing valid refresh-token activity from leaving the backing session stale. Logging for expired refresh tokens has also been lowered in severity and clarified to reduce noise during normal expiry scenarios.

Authenticators

Selector option enable/disable support

Selector options now support an enabled attribute. Disabled options are excluded before include_expr is evaluated, making it possible to keep an option in configuration without presenting it to the user.

See Selector for details.

SITHS eID QR session handling

Starting a new login request after a previous SITHS eID QR or app-switch transaction timed out, expired, or was cancelled now creates a fresh authentication request instead of reusing stale session state.

OTP submit with Enter

Pressing Enter now submits OTP codes in the browser.

Pipes and valves

New HSA valve

A new HSA valve is available in the Pipes module.

New RADIUS PAP valve

A new RADIUS PAP valve is available, with RadSec support for secured RADIUS communication.

LDAPAdd and LDAPModify DN properties

LDAPAdd and LDAPModify can now read the target DN from a configured item property. This makes the valves more flexible in flows where the item ID is not the LDAP DN.

ItemRename destination expansion

ItemRename now supports expansion from properties on the current item when resolving dest.

Operations

Container customer JVM options

The container now supports java_customer_opts, making it possible to add customer-specific JVM options without replacing the standard startup configuration.

Bug fixes

• AuthController session cleanup (#644): Access sessions are now destroyed before redirecting through fail_location or failed_redirect.
• OIDC app-specific authorization session cleanup (#661): Access sessions are now destroyed when denied OIDC app-specific authorization redirects to a configured failure target.
• SAML app-specific authorization session cleanup (#645): Access sessions are now destroyed when denied SAML app-specific authorization redirects to a configured failure target.
• SAML assertion encryption property (#675): Fixed support for the documented assertion_config.encrypt property.
• Expired refresh token logging (#676): Expired refresh-token log messages now use a lower severity and clearer wording.
• Refresh token session reuse (#658): Reused refresh-token sessions are now touched to keep session expiry aligned with token activity.
• SITHS eID QR sessions (#255): New login requests after timeout or cancellation now start a new SITHS eID transaction.
• OTP form submit (#635): OTP codes can now be submitted with the Enter key.

3.6.0

App-specific authorization

OIDC Relying Parties, SAML applications, and SAML profiles can now be configured with application-specific authorization. An authorization pipe runs after authentication but before the final response is issued to the client. If the pipe fails, Access can redirect to a configured failure location or route to a specific target based on the pipe failure message.

See the documentation for OIDC Relying Party, SAML Application, and SAML Profile.

OIDC Device Authorization Flow

Access now supports OIDC Device Authorization Flow. This adds the device_authorize endpoint, device code polling on the token endpoint, and a dedicated verification flow where the user can enter a user_code and complete authentication on a separate device. The verification flow reuses existing authenticators and includes a default completion/failure page when no custom location is configured.

See the OIDC module page and the verification flow authenticator page.

OIDC security hardening

Several OIDC behaviours have been refined to align more closely with current OAuth and OpenID Connect best practices. This includes stricter handling of signed request objects, stronger PKCE enforcement when applicable, more restrictive token endpoint and UserInfo defaults, and improved scope handling for UserInfo access evaluation.

• signed request objects are now only accepted when they can be validated for the relying party
• PKCE-bound authorization code and refresh token flows now require code_verifier
• the token endpoint now only accepts form-encoded POST requests
• access_token in UserInfo query parameters is disabled by default and must be explicitly enabled for legacy compatibility
• UserInfo handling now persists and evaluates granted scope more consistently for newly issued access tokens

OIDC Relying Party

acr_values support

The OIDC RP authenticator now supports sending acr_values in authentication requests. Multiple values can be configured and must be space-separated. This is required for integrations such as Norwegian BankID, which uses ACR levels to control authentication method and assurance level.

Cancel mappings

OP errors can now be mapped to the authenticator's cancel_location. Configure cancel_on_errors to match specific error codes, or cancel_on_error_description_patterns to match against the full error_description. If neither matches, the callback goes to failure_location. See oidc-relying-party.md for details.

Failed authentication logging

Event logging for failed authentication attempts has been added to the OIDC RP authenticator. Previously only successful authentications were logged.

SMTP

OAuth2 (XOAUTH2) authentication

The SMTP module now supports OAuth2 authentication via the XOAUTH2 mechanism.

Passkey

Automatic trigger

Passkey authentication can now be configured to start automatically when the user arrives at the authenticator, removing the need for an extra click. Controlled via the auto_start parameter (default: true).

LDAPSearch

Multiple base_dn

LDAPSearch now supports configuring a list of base_dn values. Searches are performed against each configured entry and the results are merged into a single set. Duplicate entries are removed from the combined result.

Pipes and valves

Rule evaluation logging

Debug-level logging has been added for pipe rule evaluation. When a condition such as exec_if_expr is evaluated, the log now includes the expression, input values, and outcome. This makes it easier to diagnose why a valve is executed or skipped.

CleanMobile – support for 00-prefixed numbers

The CleanMobile valve now converts phone numbers starting with 00 to the + format. For example, 004670xxxxxxx is converted to +4670xxxxxxx, ensuring consistent handling of international numbers.

Valve default configuration updates

Default configurations have been updated for the following valves to ensure all parameters are visible and consistent in the administration interface:

• InstantTransformer
• HttpPost
• HttpPatch
• HttpPut
• MVPropertyFiltering
• CleanMobile
• JsonObjectCreate
• SessionPut
• DumpState
• DumpExports
• DumpRequest
• DumpSession

Property expansion – bracket notation

Property expansion now supports bracket notation for referencing properties with complex names such as URLs, OIDs, or names containing dots and colons. Previously these could not be used in ${...} expressions.

"${scope['urn:oid:1.3.6.1.4.1.5923.1.1.1.6']}"
"${scope.inner['key:with:colons']}"

See property-expansion.md for details.

cancel_location per authenticator

cancel_location is no longer inherited from a parent authenticator to its children. Each authenticator now has its own independent cancel destination. Previously, setting cancel_location on a Selector caused child authenticators to inherit the same value.

Bug fixes

• BankID – Samsung Internet on Android (#624): Fixed an issue where BankID authentication failed to launch the BankID app when using Samsung Internet on Android.
• EntraIDListUsers (#611): Fixed an issue where an empty filter value triggered a wildcard search, returning all users instead of applying no filter.
• Selector – button label overflow (#581): Fixed text alignment for option labels that wrap to multiple lines in the browser.
• SP metadata – single-line certificate (#616): SP metadata now supports certificates without line breaks, ensuring compatibility with IdPs such as Inera that reject multi-line certificate values.

3.5.0

Freja eID

Animated QR code

Support for animated QR codes has been added to the Freja eID authenticator, following the updated Freja eID specification.

Improved timeout handling

When a Freja eID authentication request times out, the user now stays on the current view and receives a clear error message. Previously the user was immediately redirected to the start page with no feedback. This aligns the behavior with BankID.

SAML

SAMLSPBroker – redirect to failure_location on SAML errors

SAMLSPBroker can now be configured to redirect to a failure_location when a SAML Responder status error is received (for example a canceled request). Previously these errors resulted in a generic 400 Bad Request response.

SAML SP – fixed assertion fall-through on missing nameId

If a nameId cannot be resolved during SAML SP authentication, the flow no longer falls through to the IdP default assertion. Authentication now stops at the SAML SP object and an error is written to the log.

Impersonate

Cancel button

A cancel button is now present in both the Impersonate and Impersonate with search authenticators.

Pipes and valves

ItemCreate – support for JSON array properties

ItemCreate now supports setting properties whose values expand to a JSON array. Previously, achieving this required the extra step of using a separate ItemPropertyAdd valve.

Pipe display name in logs

When a pipe writes to the system log, the display_name of the pipe is now used as the log entry name if one is configured. If no display_name is set the existing behavior is preserved.

Valve default configuration updates

Default configurations have been updated for the following valves to ensure all parameters are visible and consistent in the administration interface:

• CreateJwt
• HttpDelete
• HttpGet
• ParseJwt
• DnParser
• InstantToMsDateTransformer
• MsDateToInstantTransformer
• GenerateOtp
• ValidateOtp
• InstantGenerator

Bug fixes

• CefEventValve (#568): Fixed a startup error where EventPublisher could not be injected into CefEventValve.
• Selector without label (#580): Fixed an issue where a Selector authenticator without a configured display label rendered nothing in the browser with no error.

3.4.0

LDAPSearch

Improved handling of multi-value attributes when omitting requested return attributes or using "*".

Heartbeat improvement

Heartbeat endpoint now can be configured reading a json file. File is read at each get. No caching of data.

OIDC claims generation update

Improved handling of expansion including multi-values.

Improved certificate PEM parsing

Parsing of PEM now can handle certificates without PEM start or end tags.

OIDC Implicit flow authenticator updates

Now aligns with code flow authenticator

Require signed auth requests

Possible to require signed saml auth request per application. Configuration is done on application.

Implicit flow access token update

Can now issue as JWT token

OIDC error handling update

Errors in OIDC authentication is now sent back to calling OP.

Valve default configuration update

A number of valves have new default configuration.

ActiveDirectoryAddGroupToMembers
ActiveDirectoryAddMemberToGroups
ActiveDirectoryRemoveGroupFromMembers
ActiveDirectoryRemoveMemberFromGroups
ItemCreate
ItemPropertyAdd
ItemPropertyCopy
ItemPropertyRename
ItemPropertyReplace
ItemPropertySplit
ItemPropertyTokenReplace
ItemsMerge
LDAPAdd
LDAPBind
LDAPDelete
LDAPGroupFilter
LDAPModify
LDAPMove
LDAPSearch

EntraID get manager valve - EntraIDGetManager

Use for getting manager of a user in EntraID

UI updates

• Exclude footer text is now possible
• Optional information text can be added
• When on a mobile, entering OTP will present digits only.

CVE updates

Updating underlying building blocks, both front and backend, in order to keep CVE risks at a minimum.

3.3.0

SAML Application & profile

Moving toward a more application-centric configuration, SAML applications now include extended customisation options. This provides an easier and more flexible way to configure any custom behavior required by a SAML Service Provider (SP). saml-application.md

For applications with similar requirements, they can be grouped using profiles. saml-profile.md

Application tag

OIDC RPs, SAML profiles, and SAML applications can now include application tags — one or more labels attached to the authentication state during login. The purpose of application tags is to enable conditional execution based on the application context. In combination with the user context, this provides powerful and flexible conditional handling while simplifying administration.

OIDC improvements

• If opaque access tokens are used, the access_token_claims parameter must not be set as mandatory.

• The nonce value must always be included in the id_token JWT if it was present in the authentication request.

  If the RP sends a nonce, the OP must echo it back in the ID Token.

  It must never appear in Access Tokens or UserInfo responses.

• access_token_claims is now used exclusively for claims included in JWT-formatted Access Tokens.

  A new configuration parameter, userinfo_claims, has been introduced to define the data returned by the UserInfo endpoint when using opaque Access Tokens.

• OIDC Relying Parties now support verification of JWTs signed with:

  • RSA: RS256, RS384, RS512, PS256, PS384, PS512
  • ECDSA: ES256, ES384, ES512
  • EdDSA: OKP / Ed25519

  Previously, only RS256 and RS512 were supported.

Event log updates

The vast majority of authenticators have been updated to provide clearer and more comprehensive log entries. The ID of the configured authenticator is now included to improve traceability in multi-tenant environments. Logging clarity improvements have also been implemented.

SAML SPBroker – Configurable RequestedAuthnContext Support

SPBroker now supports configurable inclusion of a specific AuthnContextClassRef in the generated AuthnRequest.

"requested_authn_context": "http://schemas.microsoft.com/claims/multipleauthn"

AuthController – Conditional Execution Support

Added support for controlling whether the AuthController should execute based on the exec_if condition.This allows more flexible and configurable authentication flow handling.

Selector – Optimised behavior for SSO Sessions with lazy_expiry

Enhanced the selector logic for SSO scenarios where the user has already authenticated and lazy_expiry is enabled.

Previously, when "expiry": "PT1S" was configured, the selector always prompted the user to choose an authentication method again, treating it as a new authentication.

With this update, when used in combination with lazy_expiry, the selector now evaluates whether the previously used method is still among the available options.

• If it is, that method is automatically marked as executed (pass-through) without requiring re-authentication.
• If it is not available, the user must select a new method (if multiple options exist) or is automatically routed through the only available method.

Broadcom SiteMinder – Updated Direct Integration Handling

Now includes fully updated support for Broadcom SiteMinder (Agent API 12.8 and later).This update improves compatibility, reliability, and performance for environments integrating Fortified ID Access as an Identity Provider with SiteMinder.It enables seamless use of modern authentication methods (BankID, Freja eID, FIDO2, OIDC, SAML 2.0), simplifies migration from legacy components, and strengthens centralised policy and session management.

UI updates

A number of UI improvements for a smoother user experience.

CVE updates

Updating underlying building blocks, both front and backend, in order to keep CVE risks at a minimum.

Bug fixes

ExternalFlow – Corrected Export Value Propagation

Fixed an issue where ExternalFlow could reuse stale export values in generated JWTs, causing previously sent data (e.g., hk_eleg_pnr, givenname, surname) to persist between authentication sessions.

The update ensures that each new authentication sequence correctly includes current export values in the signed JWT sent to external targets such as Forms, without requiring an Access restart.

3.2.2

Support for M2M Flows

We have added support for machine-to-machine (M2M) integrations through the client_credentials flow.

This enables trusted clients to obtain access tokens without end-user involvement, making it easier to support backend services and automated system-to-system communication.

New authenticator, EnrichIdentity

Simplifying identity enrichment.

ExternalFlow authenticator updates

• Improved logging
• Configurable exports
• Conditional execution

Compacted logging

Removed excess trace when logging error

Exposed new JMX endpoints

Possibility to execute a PIPE with custom data.

Possibility to deploy and execute a PIPE with custom data.

This feature is mainly targeting Management Center

LDAPSearch valve improvements

Better multi value handling.

Impersonate updates

Conditional executing

Improved user selection

Improved error messaging

• Enhanced validation and error handling when using a keystore in OIDCAuthCodeFlow.
• Clearer log messages are now provided for misconfigured keystores. For example, if the configuration contains keystore: "${globals.keystore_oidc}", the login attempt will fail with an explicit error message instead of a generic log entry without cause.

Simplified HttpClient keystore configuration

• When HttpClient is configured with a keystore containing only one alias, that alias is now used automatically.
• If no private key password is provided, the keystore password will be used by default.

Improved error reporting for invalid authenticator path

• Fixed issue where an invalid authenticator path (e.g. ${globals.default_login_suffix}) caused module startup failures with limited diagnostic information.
• Log messages now clearly indicate which authenticator caused the error, making it easier to identify and correct misconfiguration without having to manually inspect all authenticators.

Improved Freja eID accessibility compliance

Freja eID integration has been updated to better meet accessibility requirements, ensuring a more inclusive and user-friendly authentication experience.

Correct JSON typing in JsonObjectCreate

• Fixed an issue where arrays/objects were stringified. roles now remains a JSON array and act_as remains a JSON object in the output.
• Safe interpolation of dynamic fields: unresolved expressions no longer create empty keys/values; such entries are skipped with a clear warning.
• Improved diagnostics: logs now include the exact claim path and key when interpolation fails.

Configurable TTL for UserInfo endpoint

• Added support for configuring the TTL (time-to-live) of the UserInfo endpoint response.
• Previously fixed to 60 seconds; now customizable via configuration.

Ordering support for Selector options

• Added support for an order attribute to control how Selector options are presented.
• Ensures predictable and meaningful sorting of options instead of relying on default ordering.

3.2.1

Swedish BankID QR code updates

Aligning with revised QR code regulations for better usability and accessibility.

See more on https://www.bankid.com/tillgaenglighet-i-bankid/tillgangliga-qr-koder

3.2.0

LDAP Valve improvements

Handling items in more robust manner. Handles multiple items across all LDAP valves.

Missing log - unsolicited authenticated

Log was missing when doing unsolicited login

Support for new Freja e-d attributes

UNIQUE_PERSONAL_IDENTIFIER and LOA_LEVEL are now supported

UI improvements using Information endpoint module

UI fixes for Windows Edge.

Header white listing case insensitive

When declaring headers to let through to service. Case is now insensitive.

SAML meta data validation

Meta data loaded from URL can be validated using a certificate

New authenticator

externalflow.md authenticator added

Improved session security

User-Agent is now fingerprinted.
See more info at /common/server/http-listener/#http-fingerprinting

OIDC refresh token update

It is now possible to reuse refresh tokens. This is default behaviour when interacting with Microsoft Entra ID.

Include improvement

Deeper include structures previously had unexpected behaviour.

CVE updates

Updating underlying building blocks, both front and backend, in order to keep CVE risks at a minimum.

3.1.0

Authenticators with more default values

All authenticators with web UI now has default values for:

overlay_dir

web_root

This reduces configuration. Se authenticator documentation for default values.

New authenticator SSOAuthenticator

Use for generic SSO login when target not supporting OIDC or SAML 2.0

Default location for http listener

When configured, the HTTP listener can now handle requests to / by redirecting the user agent to a predefined target URL.:

"redirect_url": "/userinfo/generic/"

Updated validation rules on incoming SAML assertion when brokering

Updated documentation is found here saml-broker.md

Source ip behind proxy

Source IP now is actual calling client when behind proxy

Include improvements

@inclunde expressions is now more powerful. More information here file-inclusion.md

Chain authenticator updates

Execution order can now be configured using "order" attribute for each entry in "chain". See more on chain.md

CVE updates

Updating underlying building blocks, both front and backend, in order to keep CVE risks at a minimum.

List of used components and known CVE's is available on request.

3.0.1

Request throttling

Improved handling of request management on request flooding.

Changed product name in CEF

New name is Access

Unsolicited saml logins

SAML idp now can have a default sp configured.

Task authenticator update

Button added for manual app-switch.

Simplified handling of overriding translation in authenticator

By introcucing scopes in translation files all translation/overrdides now can be in one locales file.

Start up order of modules updated

All modules used for enxternal communication now starts in node group "first". Rest is in default.

Bug fixes

Handling multiple OP's now works

Error SSO between protocols fixed

Using FrejaID on same device now returns to same browser tab

3.0.0

New valve - GUIDToString

Valve to create a string format GUID ("b9d663ed-50dc-4260-b37e-147a62caa7f6") from the internal 16 byte binary representation used by AD / EntraID.

New valve - Base64Converter

Converts a base 64 value to another representation

SithsWithQr updates

Changed default behaviour, assuming using card reader instead of mobile app.

Improvement saml metadata loading

In previous version broken cash data stops server.

Set custom HTTP security headers

CSP, HSTS,XFO can now be set manually.

Improvement information endpoint module

logout now is attached to installation allowing for overriding logout look and feel.

AD binary attributes are now supported

UI updates

A number of UI improvements for a smoother user experience.

CVE updates

Updating underlying building blocks, both front and backend, in order to keep CVE risks at a minimum.

Bug fixes

#268 errors are not sent back to calling SAML IDP