AWS-PARIS AWS-DUBLIN S3NS
This release delivers enhanced WebAuthn configuration options, improvments about authentication, support of new OIDC scopes and claims, along with important bug fixes.
Delivery Timeline
-
Staging:
-
Production:
New Features
Standard OIDC Scopes
Standard OpenID Connect scopes profile, email, address, phone can now be configured without claim mapping in the Memority federation portal, allowing faster federation setup.
https://doc.memority.eu/configuration-guide/latest/federation
New criteria for adaptive authentication
The target application can now be used as a criteria in context conditions of authentication mechanisms, allowing fine-grained authentication per application.
https://doc.memority.eu/configuration-guide/latest/authentication-mechanisms
Improvements and Enhancements
-
Added support of AMR and ACR claims in the
id_tokenfor OAuth2 Device Flow, and in the UserInfo endpoint response -
Removed CGU and "Need Help" links from authentication pages to let clients display their own links
-
Enforced verification between the external authenticated user and the Memority one when delegating the authentication to an external identity provider
-
Added validation format of JWKS URL in the configuration of OAuth2/OIDC clients
-
Added control to forbid the configuration of several scopes with the same name
-
Parameter
id_token_hintis no longer required in OIDC logout requests sent to Memority
Patches
-
Applied technical and security updates to address known vulnerabilities and maintain platform stability.
Bug Fixes
-
Fixed incoherent user verification behavior between WebAuthn enrollment and authentication
-
Fixed SAML IdP metadata by removing invisible characters and adding a missing tag
-
Fixed potential request length overflow when using the Change Login feature.
-
Fixed min and max values of token lifetime configured on an OAuth2/OIDC client