Release Notes
Looking for release notes older than 1.23.0? Look in the release notes archive. Looking to be notified of new releases?
Version 1.53.1
September 6, 2024
Fixed
- A user may fail to enroll a new Passkey (WebAuthn credential) used for reauthentication during a login workflow. Previously configured Passkeys should continue to work as expected. This bug was introduced in version
1.53.0
.- Resolves GitHub Issue #2861
Version 1.53.0 - Lambda Llama
September 5, 2024
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- A user may fail to enroll a new Passkey (WebAuthn credential) used for reauthentication during a login workflow. Previously configured Passkeys should continue to work as expected.
- Resolved in version
1.53.1
via GitHub Issue #2861
- Resolved in version
Changed
-
The Docker image for the
linux/arm/v7
architecture is not being published for this release.This deprecation was announced in version
1.52.0
, and while we had planned to continue publishing this build for the next few releases, Java 21 is not being built for this architecture which means we can no longer support it. Please see thread in Adoptium support or the Adoptium release status for additional details.- Related to GitHub Issue #2473
New
-
The Webhook Event Log! The Webhook Event Log will contain a record of each triggered event and the corresponding attempts to deliver the event to each configured webhook. This will be useful to monitor events that have succeeded or failed to be received by your configured webhooks. The attempt log will provide you timing, the status code returned by your webhook in addition to other meta-data.
The longer term goal of this feature will be to allow events to be retried when one or more webhooks failed to receive the event, or for some reason was unable to process the event. This is the first step towards that goal. You will find this new feature in the FusionAuth Admin UI under System -> Webhook Log .
See the API docs and Webhook Event Log documentation for more detail.
- Resolves GitHub Issue #1314
-
A new lambda function has been introduced that can be used to prevent login based on information in a user record, an application registration, and more. This allows the notion of a valid login to be extended beyond the standard items such as credential checks and MFA. See Login Validation Lambda for more detail.
- Resolves GitHub Issue #1282
Fixed
-
When using an SSO TTL of
0
seconds or a very small number, it is possible that a user may not be able to complete login using the FusionAuth hosted login pages. If you encounter this problem prior to this version, you may work around the issue by increasing the TTL to something larger than0
, ideally at least30
seconds.The potential for this issue has existed for some time, but some changes made in version
1.50.0
made it more likely for this to occur.- Resolves GitHub Issue #2736
-
When using the start and end times in the Advanced search criteria in the FusionAuth admin UI for the Audit Log, Event Log, and Login Records the selected values were being incorrectly adjusted. This bug was introduced in version
1.52.0
.- Resolves GitHub Issue #2843. Thanks to @runely for reporting this! ⭐️
Enhancements
-
In the FusionAuth admin UI, tables had one-too-many 😜 action buttons. These action buttons have been replaced with a dropdown menu. The number of buttons on some pages grew to the point that it was becoming difficult to differentiate between the buttons, and was also visually cluttering up the view. We hope you like it!
More UI and UX updates coming!
- Resolves GitHub Issue #2810
Internal
-
Java 21 LTS. Update to the latest long term support version of Java.
- Resolves GitHub Issue #2473
-
Improve database connection resiliency under heavy load by separating interactive and non-interactive tasks into separate connection pools. This change should improve performance and scalability.
Please note that if you are self-hosting FusionAuth you will see an increase in the number of open connections to the relational database from FusionAuth. Previously each FusionAuth node would open
10
connections. Starting in this release, this number will increase to a minimum of21
, and can scale to a maximum of50
. These numbers are subject to change in future releases.To calculate the total number of connections to the relational database, multiple these numbers by the number of nodes in your cluster. If you have a
3
node FusionAuth cluster, the minimum number of connections open to your database will be63
with a maximum of150
.- Resolves GitHub Issue #2700
-
Update dependencies.
- Upgrade
js/handlebars.js
4.7.6
->4.7.8
- Resolves GitHub Issue #2829
- Upgrade
Version 1.52.1
August 15, 2024
Fixed
- The SCIM Patch operation now properly handles removing multiple array elements, such as group memberships, in a single request.
- Resolves GitHub Issue #2834
Internal
- Update dependencies.
- Upgrade
io.fusionauth:fusionauth-scim
2.2.1
->2.2.2
- Resolves GitHub Issue #2858
- Upgrade
Version 1.52.0 - Passkey Platypus
August 8, 2024
When using the User Registrations API, the data
field for the FusionAuth application with Id 3c219e58-ed0e-4b18-ad48-f4f92793ae32
may now contain a preferences
object. This object is reserved and should not be modified.
Group Member API
The user
field on the Group Member API responses is being deprecated.
This field was not documented, and has never been populated on the API response. However, because this field was generated and part of the domain in FusionAuth client libraries, we are providing a deprecation notice in case this may affect your integration. Client library users should remove references at your earliest convenience.
Removal of this field is targeted for the end of 2024.
Docker architectures
We are planning to discontinue publishing Docker images for the following architectures: linux/arm/v7
, linux/ppc64le
, and linux/s390x
. The rationale behind this decision is that we do not believe they are actively being used, and we would like to move to the GraalVM Java distribution which does not provide builds for these architectures.
We plan to stop publishing docker images for these architectures at the end of 2024. If you are actively using any of these architectures, please let us know how this could affect you by contacting support or reaching out to sales.
Known Issues
- When using the start and end times in the Advanced search criteria in the FusionAuth admin UI for the Audit Log, Event Log and Login Records the selected value was being incorrectly adjusted.
- Resolved in version
1.53.0
via GitHub Issue #2843
- Resolved in version
Sicherheit
- When detecting impossible travel or similarly suspicious login events, it is possible that not all device trust cookies were correctly revoked. These are now automatically revoked.
- Resolves GitHub Issue #2753
New
- A free community license is now available, which adds WebAuthn (Passkeys) to the community edition. All those with a Community license will now find a license key in their FusionAuth account plan page. And there was much rejoicing! 🥳
- Resolves GitHub Issue #2662
- Resolves GitHub Issue #2663
Fixed
-
Clicking the toggle checkbox element in the admin UI quickly may cause the checkbox state to be inverted. This can be easily fixed by refreshing the page. You should now be able to click as fast as you want! Go forth and click!
- Resolves GitHub Issue #2718
-
Attempting to sort API keys by key value in the admin UI by clicking the key value header would result in an error.
- Resolves GitHub Issue #2738
-
When using the API Key API and specifying an invalid
tenantId
on the request in order to create a tenant-scoped API key, the request fails with a500
status code. This error has been corrected, and an appropriate validation error is now returned.- Resolves GitHub Issue #2749
-
The date picker that was being used for birthdates and custom date fields was not styled correctly based upon the selected theme. The date picker has been changed to the browser-default date picker, which should work much better on mobile devices. This picker style will now be used in themed hosted login pages, as well as the admin UI for searching a date range or selecting a birthdate. This change should not affect any existing advanced theme that may still use the older style date picker. See the updated
_helpers.ftl
file in the default theme to see the changes if you want to incorporate them into existing themes.- Resolves GitHub Issue #2770
-
Adding custom message keys to your theme messages using the admin UI was failing to persist these changed messages. The UI for editing messages in the simple theme editor has also been improved to make it easier to understand which messages have been modified.
- Resolves GitHub Issue #2778
-
When the Browser preview button was used to open a new tab for simple themes in the admin UI the page would render without any applied CSS when using the Firefox browser. Sorry Firefox users, we ask for your forgiveness. 😔
- Resolves GitHub Issue #2794
-
The default
orderBy
parameter value for the Group Member Search API did not provide a consistent ordering of results because the default sort was oninsertInstant ASC
which may not always be unique. This API is used by the SCIM Groups Resource API which then can cause inconsistent results for the SCIM client. The defaultorderBy
is now set toinsertInstant ASC, userId ASC, groupId ASC
to ensure a consistent result between API calls.- Resolves GitHub Issue #2798
-
When using the simple theme editor in the admin UI, the color picker did not always render next to the input field. The color picker will now always correctly render adjacent to the input field you select.
- Resolves GitHub Issue #2803
-
Newlines and tabs were not rendered when viewing audit entries in the view dialog from the admin UI. If you are using new lines or tabs in your audit log messages, you may now enjoy viewing them in all their intended glory!
- Resolves GitHub Issue #2808
-
When using the interactive maintenance mode to upgrade your database schema, it is possible that you had to click the Submit button twice to exit maintenance mode. This was only a cosmetic issue but may be annoying or confusing to the user. We are sorry if you had to click the Submit button twice. 😬
- Resolves GitHub Issue #2815
Enhancements
- Add the new health check endpoint (
/api/health
) that was added in1.51.1
to the client libraries.- Resolves GitHub Issue #2804
Internal
-
For users in FusionAuth Cloud, attempting to save a Simple theme may result in an error.
- Resolves GitHub Issue #2777
-
An equals (
=
) sign in query parameter value was not being parsed correctly. There are no known issues related to this bug as generally speaking an equals (=
) sign will be URL encoded as%3D
. However, because it is legal use an equals (=
) sign un-encoded in a query string name or query string value, this has been corrected.- Resolves GitHub Issue #2792
-
An unused template was removed from the self-service login workflow. In practice this page was never rendered and was not included in the theme configuration. This change should not impact anyone using themes.
- Resolves GitHub Issue #2818
-
Update dependencies.
- Upgrade
org.freemarker:freemarker
2.3.32
->2.3.33
- Upgrade
org.primeframework:prime-mvc
4.22.7
->4.22.12
- Upgrade
org.apache.kafka:kafka-clients
3.6.1
->3.7.1
- Upgrade
com.fasterxml.jackson.*
2.15.4
->2.17.2
- Upgrade base docker image
ubuntu:jammy (22.04)
->ubuntu:noble (24.04)
- Resolves GitHub Issue #2726
- Upgrade
Version 1.51.2
July 3, 2024
Sicherheit
- A XSS (Cross-Site Scripting) vulnerability was identified in the FusionAuth admin UI.
- Resolves GitHub Issue #2801
Version 1.51.1
June 12, 2024
Fixed
- An HTTP request sent to FusionAuth with non-ASCII characters in request header values caused the request to be rejected and caused the connection to be closed without a response. Generally speaking values outside of the ASCII character set are not allowed, but in practice they may be used, and so these values are now treated as opaque and ignored by the HTTP request parser.
- Resolves GitHub Issue #2774
- A typo was found in the description of the
user.password.reset.send
event on the tenant edit page.- Resolves GitHub Issue #2782
- The SCIM API is not properly handling reading, creating, and updating groups with more than one hundred memberships. Responses containing groups with more than one hundred memberships are only returning the first one hundred. Create and update operations are only creating or updating one hundred, and deleting the remainder. This defect also caused the FusionAuth event for
group.member.update
andgroup.member.update.complete
to contain the same truncated list of members.- Resolves GitHub Issue #2784
New
- A Health API
/api/health
has been added. Prior to this addition, the/api/status
endpoint was the best option for performing health checks. The Status API may not be ideal for all use cases because it returns a JSON body and the status code is used to indicate the status of various health checks that may not be valuable by a load balancer to indicate if requests should be routed to this node. This new endpoint provides a binary indication of the healthiness or unhealthiness of a FusionAuth instance by only returning a200
oder500
status code w/out a JSON response. This new API also runs fewer health checks and may perform better than the Status API.- Resolves GitHub Issue #1166
Internal
Update dependencies.
- Upgrade
io.fusionauth:java-http
0.3.4
to0.3.5
- Resolves GitHub Issue #2786
Version 1.51.0 - Theming Toucan
May 28, 2024
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Fixed
- In version
1.45.0
we added a hosted OAuth backend capability, allowing a developer to write a front end-only application, but still take advantage of an authorization code grant workflow by leveraging the backend provided by FusionAuth. Multi-segment domain suffixes (e.g..co.uk
) are not handled correctly by this hosted backend when setting the domain on cookies. Cookie domains are now set properly.- Resolves GitHub Issue #2735
- A SAML login request that is missing a
Content-Type
header yields a cryptic error message. A more meaningful error message is now provided. Additionally, sending abinding
parameter would lead to an error message, when this parameter is not one we process. We now ignore this parameter if it is provided.- Resolves GitHub Issue #2722
- A SMS two factor messages template can be set at the Tenant level and should be overridable at the Application level. When a template is set at the Application level it is not being honored and the Tenant-level template is always used. Application overrides of SMS two-factor templates are now used correctly.
- Resolves GitHub Issue #2728
Sicherheit
- Improve SAMLv2 callback handing with malformed requests.
- Resolves GitHub Issue #2757
New
- WYSIWYG theme editing! Version
1.51.0
introduces a new Simple Theme type, along with a visual editor. This first version of visual theme editing allows you to change the basic styling of FusionAuth hosted pages, including logos and background images, colors, fonts, and more. See the Simple Theme Editor docs for more information.- Resolves GitHub Issue #2669
Internal
- Update dependencies.
- Upgrade
org.graalvm.sdk:*:22.3.3
toorg.graalvm.polyglot:*:23.1.2
- Upgrade
org.graalvm.js:js
22.3.3
to23.0.3
- Upgrade
io.fusionauth:java-http
0.3.2
to0.3.4
- Resolves GitHub Issue #2727
- Upgrade
Version 1.50.1
April 25, 2024
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Fixed
- FusionAuth added a First Time Setup wizard in 1.50.0. This release fixes a couple of usability items related to the new wizard.
- Items related to the first time setup wizard are being show after upgrades, when the intent was to only show them for new installations. These are now only being shown for unconfigured FusionAuth instances.
- In the First Time Setup summary page, FusionAuth shows sample configuration for various quickstarts. The configuration for the React quickstart corresponds to a previous version of the quickstart and is incompatible with the current version. The React quickstart configuration is now formatted for the current quickstart version.
- Resolves GitHub Issue #2729
Version 1.50.0 - Scopes Salamander
April 24, 2024
This release makes significant changes to the default behavior of new Applications with regard to scopes in OAuth workflows.
The database migration will update existing Applications to behave in a backwards compatible manner.
See the OAuth Scopes documentation for more information, in particular the Relationship
, Unknown scope policy
, and Scope handling policy
configurations.
If you are using IFRAMEs to access the FusionAuth hosted login pages please check that the IFRAME src
is from the same domain as the FusionAuth pages.
FusionAuth uses cookies to manage user state with the SameSite
attribute set to Lax
oder Strict
. Browsers will block Set-Cookie
headers on cross-domain requests.
This release introduces a new redirect into the OAuth flows to /oauth2/consent
as part of the OAuth Scopes
feature. This redirect will occur during each browser-based interactive OAuth workflow. Prior to this version it was possible to complete an OAuth code grant
flow without cookies being set as long as there were no additional redirects to FusionAuth before the final redirect to the configured
redirect_url . As a result it did not matter if the Set-Cookie
headers were blocked. The redirect with the code would still work.
However, in this version the browser will not be able to send the FusionAuth cookies required to maintain user state along with the redirect to
/oauth2/consent
and the login flow will fail. The user will be redirected back to /oauth2/authorize
and will be unable to log in.
The use of JWT authentication for the /api/user
API is being deprecated. This functionality will be removed in a future release.
If you are using this API with JWT authentication, you will need to modify your integration to use the /oauth2/userinfo
endpoint if you have obtained your JWT using an OAuth2 grant, or authenticate the request to the User API using an API key.
Removal of this authentication type is targeted for the end of 2024.
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- When using an SSO TTL of
0
seconds or a very small number, it is possible that a user may not be able to complete login using the FusionAuth hosted login pages. You may work around the issue by increasing the TTL to something larger than0
, ideally at least30
seconds.- Resolved in version
1.53.0
via GitHub Issue #2736
- Resolved in version
Changed
-
The
/oauth2/userinfo
endpoint now requires theaud
claim to be present on the provided access token, allowing for tighter compliance with the OIDC spec. See the UserInfo endpoint for more detail.If you are not using OAuth, and your JWT does not contain the
aud
claim, consider using the JWT validate API instead.- GitHub issue pending
- Resolves GitHub Issue #2725
-
Applications now offer an
Unknown Scope Policy
. This can be used to enhance security by rejected or removing unrecognized scopes during an OAuth workflow. See the application Scopes tab for more detail.- Delivered as part of the Custom OAuth Scopes body of work, which resolves GitHub Issue #275 (see below)
-
Applications now have a new Scope Handling Policy. The
Strict
option provides behaviors that are more compliant with the OIDC specification, while theCompatibility
option provides backwards-compatible behavior. Specifically,Strict
mode limits information in access tokens and populates Id tokens and UserInfo responses based on the requested OAuth scopes. This option also restricts the UserInfo endpoint to accepting only access tokens containing theopenid
scope.See Scope handling policy for more detail.
- New applications will default to the
Strict
option. If your integration requires theCompatibility
policy because you need backwards compatible behavior, please specify that option when creating the application. - Resolves GitHub Issue #1582 and GitHub Issue #1475, thanks to @awoodobvio for the suggestions!
- New applications will default to the
-
The Refresh Token Grant request now supports requesting a subset of the original scopes. The former behavior was to respond with an
invalid_scope
OAuth error.- Resolves GitHub Issue #2590
-
Support for optional expansion of the
application.roles
andapplication.scopes
properties on the Application Search API.This change is backwards compatible, but you may optionally request the Search API omit these properties on the response which may improve performance. See the Application Search API for additional details on using the
expand
request parameter, and theexpandable
response value.- Resolves GitHub Issue #2724
-
The
/oauth2/device/user-code
endpoint now returns thescope
parameter value that should be used in the interactive portion of the Device Code Grant workflow. See Device User Code for more detail.- Addressed as part of the Custom OAuth Scopes body of work, which resolves GitHub Issue #275 (see below)
Fixed
- FusionAuth will now limit passwords to 50 characters when using the bcrypt algorithm. This restriction is due to limitations in the bcrypt algorithm. This limit will be enforced even when the tenant policy allows for a maximum password length greater than 50. If the tenant policy requires a maximum password length of less than 50, the tenant policy will take precedence.
- Resolves GitHub Issue #2671
- There are several scenarios where implicit email verification can occur. They are, during registration verification, password change, passwordless authentication, and MFA code validation. In these cases, a configured email verification email was not being sent, and the email verification event was not being generated. The email and event will both be triggered during implicit verification now.
- Resolves GitHub Issue #1651 and GitHub Issue #2672. Thanks to @ashutoshningot and @mou, respectively, for the suggestions!
- When configuring MFA for an application, the
Trust policy
selector is not being shown when MFA is required for the application, but only shown when MFA enabled for optional use. The selector is now shown when theOn login policy
is set to eitherEnabled
oderRequired
.- Resolves GitHub Issue #2593
- When using FusionAuth behind a proxy, a missing
X-Forwarded-Proto
header could incorrectly cause a warning of a missingX-Forwarded-Port
header. These warnings are now reported accurately. Additionally, FusionAuth will now be smarter about determining the forwarded port, taking it from one of multiple sources includingX-Forwarded-Host
,X-Forwarded-Port
, or inferring it fromX-Forwarded-Proto
. This should make FusionAuth work with more proxies out of the box without additional configuration.- Resolves GitHub Issue #2702
- When authentication with an identity provider fails due to misconfiguration, and a user falls back to logging in with a username and password, the
authenticationType
that is reported by FusionAuth is for the original identity provider despite the user having logged in with a username and password. FusionAuth now correctly reports the authentication type asPASSWORD
. Thanks to @charlesericjs for bringing this to our attention!- Resolves GitHub Issue #2670
Enhancements
- FusionAuth will now enforce a maximum password length of 256 characters in the tenant password policy. This decision was made to strike a balance between allowing for very secure passwords, but also for maintaining acceptable performance when using a large number of hash iterations.
- Resolves GitHub Issue #2688
New
-
Custom OAuth scopes are now supported for applications. Custom OAuth scopes come along with a number of related features, including support for third-party applications, themable user consent, and much more.
See the API docs and OAuth Scopes documentation for more detail.
- Resolves GitHub Issue #275, thanks to @badaz for the suggestion!
-
Applications may now be designated as third-party applications. In addition to the prompting for authorization that comes with the
Custom OAuth Scopes
feature (see above), limitations are being added to how third-party applications may interact with FusionAuth.- Resolves GitHub Issue #2723
-
Applications can now be configured to prompt users to grant consent to requested OAuth scopes using the
/oauth2/consent
themed page. See the OAuth Scopes for more detail.- Resolves GitHub Issue #411
-
A new lambda function has been introduced that can be used to customize the UserInfo response for an application. See UserInfo Populate Lambda for more detail.
- Resolves GitHub Issue #1647 and GitHub Issue #659, thanks to @themobi and @soullivaneuh for the suggestions!
-
A new, optional First Time Setup wizard has been added, which guides a developer through the basic setup needed to integrate their first application. After installing FusionAuth, you’ll be able to access this from the main admin dashboard, as well as from the top of the left hand navigation.
- Resolves GitHub Issue #2717
Internal
- Update dependencies.
- Upgrade
ch.qos.logback:logback-*
1.4.14
to1.5.6
- Upgrade
com.fasterxml.jackson.*
2.15.3
to2.15.4
- Upgrade
io.fusionauth:java-http
0.2.10
to0.3.2
- Upgrade
org.mybatis:mybatis
3.5.15
to3.5.16
- Upgrade
org.primeframework:prime-mvc
4.22.0
to4.22.7
- Upgrade
org.postgresql:postgresql
42.7.2
to42.7.3
- Upgrade
org.slf4j:slf4j-api
2.0.7
to2.0.13
- Resolves GitHub Issue #2678
- Upgrade
Version 1.49.2
March 20th, 2024
New
- The search index default refresh interval may now be configured. In general this should not be modified, but the configuration option has been added and will default to
1s
. The new configuration is namedfusionauth-app.search.default-refresh-interval
. See the Configuration reference for additional detail.- Resolves GitHub Issue #2679
Fixed
-
When configured to use an email verification strategy of
Form Field
without setting the unverified behavior toGated
the verification strategy was always functionally usingClickable Link
which means the user would receive an email with a clickable URL instead of a short code.With this fix, you may now use an unverified behavior of
Allow
with a verification strategy ofForm Field
. When you configure FusionAuth this way, it is assumed that you will be handling the verification process in your own application.- Resolves GitHub Issue #1734
-
When using the Bulk User Import API
/api/user/import
the search index refresh interval is modified to improve performance. Specifically the indexrefresh_interval
is set equal to-1
. When this API is called in parallel, it is possible that this index setting is not reset and will stay configured as-1
. The symptom of this error is that changes to the index are not reflected by the Search API and the search results may no longer be accurate.- Resolves GitHub Issue #2679
-
When Advanced Threat Detection is enabled, an IP location database will be downloaded and used for IP address resolution. For these licensed customers, it is possible that a corrupted IP location database was downloaded and not correctly discarded and as a result the IP address location data may not be available.
You may have been impacted if you were using version
1.47.0
or later, between February 1st, 2024 and February 23rd, 2024. The observable symptom would be that your license status for the Advanced Threat Detection will showAnhängig
instead ofActive
.This condition has already been corrected for FusionAuth Cloud. If you are self-hosting FusionAuth, upgrading will correct this condition. If you have a support contract and believe you are currently in this state and are not able to upgrade, please reach out to support for assistance.
- Resolves GitHub Issue #2673
Enhancements
- Add email and registration verification Ids to the User and Registration API responses when available for consistency and to better enable out of band management of these verification workflows.
- Resolves GitHub Issue#2681
Version 1.49.1 - Bugfix Beluga
March 6th, 2024
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Changed
- The Nashorn JavaScript engine has been removed from FusionAuth. All Lambda functions will now use the GraalJS engine which has been available since version
1.35.0
. No action is required, but please note that if you had any Lambda functions still configured to use the Nashorn engine they will be migrated to use GraalJS.- Resolves GitHub Issue #1828
- In prior versions of FusionAuth, if a new themed page was added, until you upgraded your theme by adding this new page, the end user may be shown a page indicate the page was missing. This was shown because it was assumed that a new page would only be shown for a new feature that had not been enabled, and this page would only ever been seen during development. In this release we are adding a new page that may be shown w/out any additional features being enabled. For this reason, we have removed this place holder page, and we will always fall back to the default theme when a page is missing. You will still want to upgrade your theme as part of your upgrade process, but this change will ensure that we will not break any new or existing workflows when a new page is added.
- Resolves GitHub Issue #2443
Sicherheit
- An incorrectly formatted SAML request may cause excessive CPU load.
- Resolves GitHub Issue #1681
- Disable additional JNDI settings in the LDAP connector. This update is proactive, there are no known exploits.
- Resolves GitHub Issue #2605
- Add additional protection against cross-site attacks when FusionAuth is acting as a SAML IdP.
- Resolves GitHub Issue #2611
- Audit log entries added by the FusionAuth admin application may contain sensitive information. Sensitive fields will now be masked when written to the audit log. Please note that this does not affect the Audit Log API, only the use of this API by the FusionAuth admin app.
- Resolves GitHub Issue #2623
- Added additional protection against cross-site attacks when using the self-service account pages.
- Resolves GitHub Issue #2626
Fixed
-
The default permissions in AWS RDS PostgreSQL version 15.2 caused the initial configuration of FusionAuth to fail to create the tables required to complete the initial configuration. The required permissions are now being explicitly granted, and the errors reported back to the user have been improved.
- Resolves GitHub Issue #2264
-
If a user starts a Forgot Password flow, and clicks on a change password link in an email after the link has expired, the redirect back to the original Forgot Password form will not include the locale parameter. This fix ensures that a locale parameter, when present in the change password link, is preserved through this workflow and allows for localization to remain consistent.
- Resolves GitHub Issue #2328
-
When setting up a Facebook IdP, an option was provided in the admin UI to select
Use vendor JavaScript
as a Login method. This option is not applicable and has been removed.- Resolves GitHub Issue #2351
-
Fix the SCIM filter when filtering on
userName eq {username}
to always return a single result.- Resolves GitHub Issue #2455
-
The LinkedIn APIs have changed, and the LinkedIn IdP no longer worked for new LinkedIn applications. This update allows FusionAuth to work with new and legacy LinkedIn applications.
- Resolves GitHub Issue #2496
-
The FusionAuth TypeScript client library was incorrectly encoding arrays values into query parameters. This bug was preventing a few specific search queries from working correctly.
- Resolves GitHub Issue #2513
-
When using MySQL, the default Admin user form was missing the
First name
field. The field could be added to the form, but was missing in the default version.- Resolves GitHub Issue #2529
-
When an invalid Tenant Id was provided on the
.well-known/openid-configuration
the default configuration was returned. This has been updated to return a404
status code.- Resolves GitHub Issue #2538
-
When creating a User with a group membership with a specified member Id that was already in use, the requested completed w/out a validation error and the membership was ignored. The API now correctly validates this condition and will return a
400
and a JSON response.- Resolves GitHub Issue #2586
-
When retrieving all refresh tokens for a user, the response may contain the user’s SSO token. The SSO token can be identified because it does not contain an
applicationId
and it may not be refreshed. Validation has been improved when using the Refresh Grant, or the Refresh API to ensure FusionAuth correctly fails indicating the token is invalid and may not be refreshed.- Resolves GitHub Issue #2594
-
A regression was introduced in version
1.47.0
to the Change Password themed page. The issue is that thepasswordValidationRules
variable may benull
on the first render. If you had been referencing this field in your template, the render may fail.- Resolves GitHub Issue #2616
-
The Identity Provider Link API states that a
token
parameter can be accepted during a create. When provided, the token was not being persisted on the link.- Resolves GitHub Issue #2622
-
Fix the “Getting Started” link found in the index page in the default theme.
- Resolves GitHub Issue #2625
-
When viewing a User’s Consents in the FusionAuth admin UI, if one or more of the consents have been granted by another user that is not a member of their family, an error is shown in the
Given by
column.- Resolves GitHub Issue #2639
-
When you have configured the JWT signing key with the
ES512
algorithm, the generated signature may be intermittently invalid. This means that JWTs may seemingly fail to validate randomly and you may think you are crazy. You are not crazy. If you are using this signing algorithm, it is recommended you use a different algorithm until you are able to upgrade.- Resolves GitHub Issue #2661
-
SCIM PATCH requests may fail to parse if an op path value contains a named schema containing a
.
(dot). This parsing error has been corrected.For example:
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department
- Resolves GitHub Issue #2667
-
When an SCIM create or update request contains schemas for which no properties exist, subsequent PATCH requests to those schema namespaces may fail.
For example, if the initial request contains a schema
urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
without any properties, the default lambda function used to map this request to FusionAuth was not persisting this schema namespace. Then a subsequent PATCH request to add a member to that namespace such asurn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department
would fail.The default SCIM request converter (Lambda function) has been updated to correct this behavior.
- Resolves GitHub Issue #2667
Enhancements
-
Link checkers are great. They aim to protect end users from malicious links and phishing attacks. However, they wreak havoc and pain on identity providers using email based workflows to complete passwordless login, or email verification. And FusionAuth is one of those identity providers!
FusionAuth has employed various tactics over the years to stay ahead of the techniques used by these 3rd party tools. Their techniques continue to evolve making it difficult or impossible to know the difference between a link checker and a real human interacting with the link.
A new confirmation page has been added that is intended to protect the user, and make our email workflows immune to link checkers.
For example, when a user initiates a request such as passwordless login, and then completes the request in the same browser, the user will not observe any change. If the user completes the request on a different browser, or completes a request they did not initiate - such as clicking on an email verification link sent when a use is provisioned by an administrator, the user will be prompted to confirm they wish to complete the request.
If you are using a custom theme, you will want to upgrade your theme to include this new page. Until you complete this upgrade, the default theme will be used for this new page. In the FusionAuth admin UI, the theme page will be named Confirmation required.
- Resolves GitHub Issue #2443
-
Ensure the Login API never fails validation due to a timing issue with an Application cache. This rarely affects runtime, but this can be useful for testing where you may create an application and immediately perform a login.
- Resolves GitHub Issue #2557
-
Add a trusted proxy configuration to the System Configuration. This new configuration allows you to define one or more trusted upstream proxies using an IP address, or range of addresses using a CIDR notation.
A client IP address will be captured in a login record, sent to webhooks, and used to provide access when IP ACLs are configured. To correctly resolve the client IP address, we often will need to use the
X-Forwarded-For
request header.This header is modified when it passes through a proxy. In order to trust the contents of this header and resolve the client IP address, FusionAuth must know if it can trust all proxies implicitly, or to only trust those that are explicitly configured as trusted. The change is to optionally configure FusionAuth to no longer trust any upstream proxy that is not explicitly configured as trusted.
This new configuration can be found in the FusionAuth admin UI by navigating to
Settings > System > Networking
, or on the System Configuration API.- Resolves GitHub Issue #2624
Internal
- Update dependencies.
- Upgrade
org.postgresql:postgresql
42.6.0
to42.7.2
- Upgrade
com.fasterxml.jackson.*
2.15.2
to2.15.3
- Upgrade
org.mybatis:mybatis
3.5.13
to3.5.15
- Resolves GitHub Issue #2534
- Upgrade
- During a reindex operation, log the progress based upon a fixed time interval instead of every 250k records. This ensures the output is predictable regardless of the reindex performance.
- Resolves GitHub Issue #2565
Version 1.48.3
December 6th, 2023
Fixed
- Update the refresh token TTL when using the sliding window with a maximum lifetime JWT Expiration Policy. The symptom of this bug is that a refresh token will expire before the maximum configured lifetime.
- Resolves GitHub Issue #2566
Version 1.48.2
November 21st, 2023
Fixed
- When paging beyond 10,000 in the FusionAuth admin UI for Users or Entities, the bottom set of pagination controls may not work. If you encounter an error when clicking on the pagination controls, use the top set of controls instead. This bug is specific to the new pagination introduced in version
1.48.0
.- Resolves GitHub Issue #2544
- In some cases when using with FusionAuth-hosted pages in an non-secure context, such as accessing FusionAuth on
localhost
, thePublicKeyCredential
JavaScript API will not be available. This may cause an error on your JavaScript consolePublicKeyCredential is not defined
. This error kept the form on the page from correctly submitting.- Resolves GitHub Issue #2500
- In version
1.48.0
a change was made to reject a link request from an OpenID Connect IdP when theemail_verified
claim is supplied with a value offalse
. An assumption was made that theemail
andemail_verified
claims would both be present in theUserinfo
response or theid_token
. Some providers may split these claims, so this assumption has been removed.- Resolves GitHub Issue #2542
Sicherheit
- Correct the validation of the
post_logout_redirect_uri
parameter on the OAuth2 Logout request for relative URIs intended for use for FusionAuth applications.- Resolves GitHub Issue #2539
Internal
- Improve our JWT validation for internal security schemes by failing faster on invalid tokens.
- Resolves GitHub Issue #2555
Version 1.48.1
October 29th, 2023
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Fixed
- A bug was identified in a change made in version
1.48.0
that may affect performance for those with > 1M users.- Resolves GitHub Issue #2535
Version 1.48.0 - Webhook Walrus
October 27th, 2023
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- A bug was identified in a change made in this version that may affect performance for those with > 1M users.
- Resolved in version
1.48.1
via GitHub Issue #2535
- Resolved in version
Changed
- We are officially announcing the end of life for the Nashorn JavaScript engine used by FusionAuth Lambda functions. All new functions have defaulted to the GraalJS since version
1.35.0
. The engine is not being removed in the release, but this is an official notice that we plan to remove this engine in early 2024. Please review your lambda functions and ensure theengineType
is set toGraalJS
.- Resolves GitHub Issue #1828
- We are officially announcing the end of life for the
fusionauth-search
package. This is currently available in a.deb
,.rpm
and.zip
bundle for various platforms. This package is still available, but the plan is to stop building this at the end of 2023. Please make plans to discontinue use of thefusionauth-search
package if you are currently using it.- Resolves GitHub Issue #2532
- When the OpenID Connect or External JWT Identity Provider is configured to Link by Email and the IdP returns a claim named
email_verified
and the value isfalse
, the link request will be rejected. This change is intended to reduce the risk of linking on an un-verified email address.- Resolves GitHub Issue #2423
Sicherheit
- When an IdP is configured to Link by Email or Link by Username and a user already exists with this email or username respectively, perform additional validation to ensure the user does not already have an existing link to the current Identity Provider. This only affects IdP that allow for one to many tenants to be accessed through a single IdP configuration. In practice this means that the IdP cannot guarantee that an email address is considered globally unique and only assigned to a single user.
- Resolves GitHub Issue #2512
- A bug was identified in the
multipart/form-data
parser that may cause elevated CPU usage in some specific cases.- Resolves GitHub Issue #2385
Fixed
- Enhance the widget used in multi-value select controls to accept a value when pasting. For example, you may now paste a value from the clipboard directly into the
Authorized redirect URLs
field. While previously the paste operation worked, the user would have to click the value to confirm. If you clicked off of the field, the value would not be saved.- Resolves GitHub Issue #1784
- Correct the error message when a user has enabled MFA and a webhook returns a non-200 status code for the
user.login.success
event. The message will now correctly indicate the webhook has failed instead of the previously incorrect error indicating an invalid token was used.- Resolves GitHub Issue #1955
- When viewing an Email Template in the FusionAuth admin UI, two dialogs open instead of one. This was the result of two event handlers being bound instead of one.
- Resolves GitHub Issue #2304
- When using the asynchronous tenant delete, it is possible for the delete job to fail if the system is under heavy load. When this occurs the delete job status may not be correctly updated and you are stuck in a
Deleting
state. The asynchronous job processor has been enhanced to account for this potential failure condition so the job can be correctly restarted if necessary.- Resolves GitHub Issue #2307
- Correct a potential race condition that could cause a request to the
/.well-known/jwks.json
endpoint to exception and return a500
status code when under heavy load.- Resolves GitHub Issue #2390
- The Lambda metrics introduced in version
1.47.0
may not always correctly increment the failed count when a lambda invocation failed. This affects thelambda.[*].failures
andlambda.[{webhookId}].failures
metric names.- Resolves GitHub Issue #2408
- When using the
PATCH
method on the Tenant API, if you previously had any explicit webhooks configured for this tenant, the association between the tenant and the webhook was lost. If you are not using webhooks, or all of your webhooks are configured forAll tenants
(webhook.global
), this bug would not affect you.- Resolves GitHub Issue #2411
- Improve the validation for the Entity API to correctly validate the
type.id
value. Because this value was not being correctly validated, it means the API caller may receive a500
status code instead of a400
with a developer friendly JSON response body to indicate how the input can be corrected.- Resolves GitHub Issue #2412
- A critical bug was identified that caused FusionAuth to incorrectly identify users eligible for deletion based upon the tenant policy to delete users with an unverified email address. Until you have upgraded to version
1.48.0
please disableDelete unverified users
if you currently have enabledEmail verification
,Verify email when changed
andDelete unverified users
.- Resolves GitHub Issue #2441
- A bug was identified that affected several APIs when using the
PATCH
method with fields that require custom deserializers in FusionAuth. Affected APIs included Application, Connector, Message Template and Identity Provider. The symptom you will observe is a failed request with a500
status code.- Resolves GitHub Issue #2454
- When using PostgreSQL, under heavy load, a potential deadlock conditions exists when attempting to write login metrics to the database. MySQL database was not affected by this bug. If you were to encounter this bug you may observe some exceptions in the log related to the LoginQueue.
- Resolves GitHub Issue #2465
- Fix a JavaScript error that was preventing Audit Log searches by user from returning results.
- Resolves GitHub Issue #2470
- Resolve an issue where users could not enable two-factor authentication during authentication when they were not registered for the application. Thanks to @wproffitt-elder for reporting!
- Resolves GitHub Issue #2474
- When using the Refresh Token API, un-expired SSO sessions may be incorrectly omitted from the API response. The result of this bug is that an active SSO session may not be displayed in the FusionAuth admin UI. This has now been corrected, and the FusionAuth admin UI and the Refresh Token API will correctly return all valid SSO sessions.
- Resolves GitHub Issue #2489
- If the
search.servers
configuration value was not added to thefusionauth.properties
configuration file, and you omit theSEARCH_SERVERS
environment value, FusionAuth would fail to start. The correct behavior is for FusionAuth to default tohttp://localhost:9021
.- Resolves GitHub Issue #2507
Enhancements
- Enhance the User and Entity Search APIs to paginate beyond 10,000 results. The Search API response will now include a
nextResults
value that can be used to ask for the next set of search results which enables the API to paginate through the entire available result set.- See the Entity Search APIs and User Search APIs for API details.
- Resolves GitHub Issue #494
- When using the Webhook test action in the FusionAuth admin UI, additional information will now be returned if the webhook returns a non-200 status code. This should make it simpler to debug your webhook integration. Prior to this change, the response would only indicate if the response was successful or not.
- Resolves GitHub Issue #793
- When using the Webhook test action in the UI, changes to the example request body were not preserved. Changes will now be preserved across send requests for the browser session. This means a test can be run repeatedly without having to perform the same edits to the default event request body.
- Resolves GitHub Issue #797
- Support specifying webhook SSL certificates from Key Master. Prior to this enhancement, if you needed to specify an SSL certificate, it had to be added to the webhook in PEM format. You may now store this certificate in Key Master and then use this same certificate between webhooks.
This change is backwards compatible, but the ability to manually specify X.509 certificates in PEM format on the webhook configuration has been deprecated and may be removed in the future. See the Webhook APIsslCertificateKeyId
field for additional details.- Resolves GitHub Issue #883
- Modal dialogs in the FusionAuth admin UI can now be closed by using the escape key or by clicking outside of the modal.
- Resolves GitHub Issue #903
- Add support for signing webhook events with a SHA-256 hash function. This feature will allow consumers of FusionAuth events to verify the message body has not been modified. The signature is contained in a JWT and will be sent using an HTTP request header named
X-FusionAuth-Signature-JWT
. You may use existing JWT verification strategies including consuming the public key from the JWKS endpoint.- See the Signing Webhooks and Webhooks APIs for signing and verification details.
- Resolves GitHub Issue #1859
- Expose the
id_token
returned by the Identity Provider to the Reconcile Lambda function when available. If theid_token
is returned by the IdP and the signature can be verified it will be now be passed to the lambda function in thetokens
argument. Example:tokens.id_token
.- Resolves GitHub Issue #2189
- Add the
curl
command to the FusionAuth Docker image. This allows you to use thecurl
command for use in health checks or anytime you need to usecurl
!- Resolves GitHub Issue #2272
- Support for optional expansion of the
user.registrations
anduser.memberships
properties on the User Search API.
This change is backwards compatible, but you may optionally request the Search API omit these properties on the response which may improve performance. See the User Search API for additional details on using theexpand
request parameter, and theexpandable
response value.- Resolves GitHub Issue #2319
- Enhance the error messaging returned to the end user when using the Test SMTP button in the FusionAuth admin UI. This enhancement will make it easier to test your SMTP configuration.
- Resolves GitHub Issue #2373
- Reduce un-necessary logging when fuzzers send parameter names containing
class
.- Resolves GitHub Issue #2393
- When updating a theme, a validation error will be returned if you are missing messages. Currently the error response does include the missing message keys. This error response is now enhanced to return the keys and the default values from the default theme. This allows you to optionally parse the response for the missing keys and values.
- Resolves GitHub Issue #2427
- Expose the
access_token
returned by the Identity Provider to the Reconcile Lambda function. Theaccess_token
will now be passed to the lambda function in thetokens
argument. Example:tokens.access_token
.- Resolves GitHub Issue #2494
- When the
id_token
is returned from the IdP and the signature can be verified it will now be used to optionally resolve theuniqueIdClaim
in addition to theemailClaim
andusernameClaim
. This means you can configure theuniqueIdClaim
to a claim that is only available in theid_token
. Prior to this change, theid_token
could only be verified if it was signed using the an HMAC algorithm using theclient_secret
. With this change, if the IdP publishes public keys using the JWKS endpoint that is resolved from the.well-known/openid-configuration
FusionAuth will attempt to validate the signature.- Resolves GitHub Issue #2501
Internal
- Update dependencies to remove CVE scan warnings and to stay current. These upgrades are simply a precautionary measure to stay current.
- Upgrade
com.google.inject:guice
5.1.0
to6.0.0
- Upgrade
com.google.guava:guava
30.1.0
to32.1.2
- Upgrade
io.fusionauth:java-http
0.2.0
to0.2.9
- Upgrade
org.apache.kafka:kafka-clients
2.8.2
to3.6.0
- Upgrade
org.primeframework:prime-mvc
4.11.0
to4.17.1
- Upgrade
org.xerial.snappy:snappy-java
1.1.8.1
to1.1.10.4
- Resolves GitHub Issue #2385
- Upgrade
- Upgrade to the latest Java 17 LTS. Upgraded from
17.0.3+7
to17.0.8+1
.- Resolves GitHub Issue #2386
- Update the logging configuration when using the
fusionauth-search
distribution (.deb
,.rpm
, or.zip
) to be more consistent with thefusionauth-app
logging configuration. If you are using Elasticsearch or OpenSearch in Docker or other off the shelf installation of Elasticsearch or OpenSearch this change will not affect you.- Resolves GitHub Issue #2391
- Update the FusionAuth static file resolution configuration to further limit class path resolution. While no known security risks exist with the current behavior, it is not necessary.
- Resolves GitHub Issue #2462
Version 1.47.1
July 27th, 2023
Fixed
- Revert the GC (garbage collection) logging change introduced in version
1.47.0
for compatibility with the FusionAuth docker image. - Resolves GitHub Issue #2392, thanks to @pigletto and @patricknwn for reporting.
Version 1.47.0 - Performance Panther
July 25th, 2023
Please be sure to read the notes in the Changed section before upgrading.
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- The garbage collection logging change introduced in version
1.47.0
was not compatible with the way the FusionAuth docker image was built. You will need to use version1.47.1
if you will be using the FusionAuth docker image.- Resolved in version
1.47.1
via GitHub Issue #2392
- Resolved in version
- The
passwordValidationRules
variable may benull
on the first render of the Change Password themed page. If you had been referencing this field in your template, the render may fail.- Resolved in version
1.49.1
via GitHub Issue #2616
- Resolved in version
Sicherheit
- A race condition exists when using a refresh token with a one-time-use policy where the same token value could successfully be used twice to obtain a new access token. In practice this would be very difficult to replicate outside of a scripted example.
- Resolves GitHub Issue #1840 Thanks to @avitsrimer for reporting the issue!
- Use a CSRF token with all federated login requests. This change will add additional protection when using a federated login to ensure the login is completed from the same browser that started the login workflow. This mitigates an attack vector that can be used in phishing attacks where a victim could be convinced to click on a link that would cause the user to unknowingly complete a login.
- Resolves GitHub Issue #2238
Changed
- A change was made to the OAuth2 origin validation code. This change is not expected to cause any change in behavior for anyone with configured Authorized Origin URLs. The change is to inspect the port in addition to the schema and host when comparing the request and the
Referer
oderHost
header to determine if the request has originated from FusionAuth. One possible edge case that could be affected is if you usinglocalhost
in development for both FusionAuth and another application. In this example, it is possible that FusionAuth was not validating the Origin of requests from your application running onlocalhost
correctly. If you encounter this case, you can either remove all Authorized Origin URLs from your configuration, or add the origin of your application so that it can be correctly validated. - Due to the necessary change related to adding a CSRF token when performing a federated login, a manual change may be required to your themed login pages. Please read through these details to understand if you will be affected.
If you are using any 3rd party IdP configurations such as OpenID Connect, SAML v2, Google, Facebook with a custom theme, you will need to make a modification to your template in order for federated login to continue to work correctly.
If you are not using any 3rd party IdP configurations, or you are not using a custom theme, no change will be necessary.
If you will be affected by this change, please review the following details and then make the update to your theme as part of your upgrade process.
- Find the
alternativeLogins
macro usage inoauth2Authorize
andoauth2Register
and addfederatedCSRFToken=federatedCSRFToken
as the last argument to this macro.
[#-- Updated macro usage. Line breaks added for readability. --]
[@helpers.alternativeLogins clientId=client_id
identityProviders=identityProviders
passwordlessEnabled=passwordlessEnabled
bootstrapWebauthnEnabled=bootstrapWebauthnEnabled
idpRedirectState=idpRedirectState
federatedCSRFToken=federatedCSRFToken/]
- Find the macro named
alternativeLogins
inhelpers
and addfederatedCSRFToken=""
as the last argument to this macro.
[#-- Updated macro in helpers. Line breaks added for readability. --]
[#macro alternativeLogins clientId
identityProviders
passwordlessEnabled
bootstrapWebauthnEnabled=false
idpRedirectState=""
federatedCSRFToken=""]
- Find the element
<div class="login-button-container">
in the macro namedalternativeLogins
inhelpers
and addid="login-button-container"
anddata-federated-csrf="${federatedCSRFToken}"
attributes.
[#-- Updated div in alternativeLogins macro. Line breaks added for readability. --]
<div id="login-button-container"
class="login-button-container"
data-federated-csrf="${federatedCSRFToken}">
Fixed
- Ensure a signed AuthN request always has the
Signature
element as the next sibling after theIssuer
element. This bug may cause some SAML v2 services provides to reject the signature of an AuthN request sent from FusionAuth.- Resolves GitHub Issue #2348
- Upgrade our phone number validation to include the Kosovo country code of
+383
. This upgrade will add support for various other country codes as well. See linked GitHub issue for more detail.- Resolves GitHub Issue #2355
- Defend against corporate link “checkers” such as Outlook Safe Links and Google Workspace during the Change Password email workflow. This fix resolves a specific symptom that may occur when a link sent to a user during a change password workflow and the user has multi-factor authentication enabled. The symptom the end user may encounter is that multiple codes may be sent to the user during this workflow. When the two-factor method is email, multiple emails may be received, and when two-factor method is SMS, multiple SMS messages may be received. The cause of this symptom is that the link is being inspected by an intermediate party prior to the user’s browser loading the link which functionally means the request is made more than once.
- Resolves GitHub Issue #2360
- Improve locale validation, and restrict the number of preferred languages per user to 20. This should not have any practical impact on users of FusionAuth, but it will better protect FusionAuth from storing erroneous values for the user’s preferred languages. If you have users that speak more than 20 languages, you will need to ask them to pick their top 20 favorites. 😎
- Resolves GitHub Issue #2363
- Improve username validation. This length limitation was already enforced by the schema, but the error message was not developer friendly. This change will add a proper validation error in the API response.
- Resolves GitHub Issue #2368
- Update the Tenant view dialog in the admin UI to reflect the changes made to the
/.well-known/openid-configuration
endpoint in version1.46.0
. This is a cosmetic change only, and does not include any functional fixes.- Resolves GitHub Issue #2333
- Fix Tenant select control on Group index page in the admin UI when only a single tenant is configured. This is just a cosmetic fix to how the form was being rendered.
- Resolves GitHub Issue #2338
- Reduce Kafka logging. So noisy.
- Resolves GitHub Issue #2359
- Protect the Kafka event sender from sending events related to it’s own failure. This protects us from overloading the Kafka topic.
- Resolves GitHub Issue #2362
- Fix the
user.registration.update.complete
event to include the updates roles if applicable.- Resolves GitHub Issue #1898, thanks to @sjswami for reporting the issue!
- Better defense against a truncated
oauth_context
request parameter. This parameter is passed around during various OAuth2 workflows to maintain context. This changes allows FusionAuth to fail more gracefully if this is value is intentionally or un-intentionally modified by a 3rd party.- Resolves GitHub Issue #2382
Enhancements
- hinzufügen
user.preferredLanguages
to the basic self-service registration to allow a user’s preferred language to be collected and then utilized to send localized emails without using advanced self-service registration.- Resolves GitHub Issue #1738, thanks to @glen-84 and @geoalexidis for their input and patience while we delivered this enhancement.
- Improve handling of cache reload requests under heavy load. This should improve system performance at scale when mass creating or deleting of various items such as applications and keys.
- Resolves GitHub Issue #2318
- Add timers and metrics around lambda invocations and the use of HTTP Connect within a lambda function. This should help customers tune and manage lambdas by providing additional insight into the total execution time.
- Resolves GitHub Issue #2389
- Add configuration to accept any named parameter as a login hint coming from the SAML v2 SP when FusionAuth is acting as the SAML v2 IdP. Prior to this change, FusionAuth would accept
login_hint
if provided on the request. However, this value can not be configured or optionally disabled.- Resolves GitHub Issue #2222
- hinzufügen
identityProviderName
to the IdP Link API response.- Resolves GitHub Issue #2337
New
- Support SAML v2 assertion encryption when FusionAuth is acting as the SAML v2 IdP. This means FusionAuth is now compatible with a SAML v2 SP that requires encrypted assertions.
- Resolves GitHub Issue #1741, thanks @annismckenzie for the request! This is a great addition to FusionAuth.
Internal
- Add aggregate HTTP request timers and metrics that can be retrieved by the Status API and Prometheus Metrics API.
- Resolves GitHub Issue #2369
- Update dependencies.
- Resolves GitHub Issue #2344
- Resolves GitHub Issue #2384
- Enable GC (garbage collection) logging. A new log named
fusionauth-app.gc.log
will be found in the log directory.- Resolves GitHub Issue #2388
- Improve performance and overhead when downloading and storing the IP location database required for resolving location meta-data for logins by IP address.
- Resolves GitHub Issue #2195
Version 1.46.0
June 19th, 2023
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Sicherheit
- An edge case exists where the CAPTCHA may be bypassed when using Advanced Registration forms.
- Resolves GitHub Issue #2221
- Perform additional validation on the
user_code
when completing a Device Grant by way of the Authorization Code Grant, Implicit Grant, or Password Credentials Grant.- Resolves GitHub Issue #2228
- Perform additional defensive validation on self-service edit form.
- Resolves GitHub Issue #2234
- Mitigate a potential directory traversal attack. CloudFlare, AWS and similar cloud providers will generally block these requests by default.
- Please note, FusionAuth Cloud customers are not vulnerable to this type of attack.
- Resolves GitHub Issue #2299
Fixed
- Always send email verification on user email change when configured for user self-service
- Resolves GitHub Issue #2210
- Resolve a JavaScript bug when enabling MFA during login. The bug caused an error to be written to the JavaScript console, but no functional errors occurred.
- Resolves GitHub Issue #2296
- When the
user.login.success
is configured to be transactional and the webhook returns a non200
status code when the event is fired during the final step of the change password workflow, the failed webhook may not fail the login attempt. - Resolves GitHub Issue #2288
- When enabling IdP initiated login on a SAMLv2 IdP, the base ACS url is hidden in the view dialog
- Resolves GitHub Issue #2146
- When an
applicationId
is provided on a Two Factor Start or Send APIs, the application variable may not available in the email template.- Resolves GitHub Issue #2149
- APIs that optionally take a
sourceId
to indicate you wish to copy will now fail validation if you provide additional parameters in the body that will otherwise be ignored.- Resolves GitHub Issue #2004, thanks to @Pycnomerus for the suggestion!
- When adding a user to multiple Groups using the
/api/group/member
API, the request may fail.- Resolves GitHub Issue #2197
- When using a wildcard for authorized origin URL, you may receive an invalid origin error.
- Resolves GitHub Issue #2227, thanks to @beezerk23 for letting us know!
- The memory value for
fusionauth-app.memory
set in thefusionauth.properties
file may not be set correctly.- Resolves GitHub Issue #2284
- When using custom data with nested values such as
user.data.company.name
anduser.data.company.id
in an Advanced Registration form the nested values may not be properly persisted.- Resolves GitHub Issue #2239
- When using the admin UI to update an IdP with >6k applications the request may cause a database error.
- Resolves GitHub Issue #2262
- Add index
entity_user_grants
to increaseSELECT
performance- Resolves GitHub Issue #2245
- When using the
validateJWT
method in the FusionAuth Java REST Client, theexp
oderiat
claims may have the incorrect precision.- Resolves GitHub Issue #2275
- OpenAPI spec missing some endpoints
- Resolves GitHub Issue #2247
- A change in behavior was introduced in version
1.41.0
that may cause an error when accessing FusionAuth in Docker. The change was how theHost
header was being parsed to pick up the local port.- Resolves GitHub Issue #2250, thanks to @MarekUniq for his report, persistence and contribution to java-http!
- The
user.create.complete
anduser.registration.create.complete
events may be sent before the transaction has closed during IdP Login.- Resolves GitHub Issue #2233
- Correct the internal authentication to receive an internal webhook between FusionAuth service nodes. If you encounter this error, you may see errors in the event log that mention
returned response code [401] when sending [JWTRefreshTokenRevoke] event
. This error was introduced in version1.37.0
and the error only occurs when you have more than one FusionAuth service node.- Resolves GitHub Issue #2257
- When you have enabled Implicit Email Verification, when completing a Multi-Factor login, a
user.email.verified
event may be sent even if the user has already verified their email address.- Resolves GitHub Issue #2258
- When the
user.reactivate
event is configured to be transactional and the webhook returns a non200
status code, the transaction may not be correctly rolled back.- Resolves GitHub Issue #2281
- When making a request to the self-service pages, such as
/account/
ensure any additional query parameters are preserved through a login workflow.- Resolves GitHub Issue #2282
- When the
user.create
event is configured to be transactional, ensure the Setup Password email is not sent if auser.create
webhook returns a non200
status code.- Resolves GitHub Issue #2287
- When using the Device Grant with the
/oauth2/device
themed page, you may be shown a Logout button if an SSO session exists during this workflow. Clicking this button will log the user out of the SSO session and return to this page. This fixes the logout link so that you do not receive an error when returning to the/oauth2/device
page. A workaround is documented in the linked GitHub issue.- Resolves GitHub Issue #2331
Enhancements
- The OAuth2 Introspect endpoint now optionally takes a
client_secret
.- Resolves GitHub Issue #1100
- A token obtained from the Client Credentials Grant may now be used with the OAuth2 Introspect endpoint.
- Resolves GitHub Issue #1434
- An additional JWT Expiration Policy is now available to configure a sliding window with a maximum lifetime.
- Resolves GitHub Issue #1729
- The OpenID Connect discovery endpoint will now accept the
tenantId
as a URL segment. This should make it easier to integrate with providers that would not otherwise allow a query parameter on this URL to specify thetenantId
.- Resolves GitHub Issue #2259
- Provide a validation error when using the
/api/jwt/reconcile
API with any IdP typeExternalJWT
.- Resolves GitHub Issue #2074
- Add configuration to allow unauthenticated access to
/api/status
and/api/prometheus/metrics
APIs from localhost.- Resolves GitHub Issue #2310
- Add additional support in the default theme to use Google reCAPTCHA v2 in an invisible mode w/ CAPTCHA fallback.
- Resolves GitHub Issue #2237
- Allow any string value in the
metaData.device.type
property on various APIs.
New
- Allow Device Grant to be completed out of band.
- New API
/oauth2/device/approve
- New API
/oauth2/device/user-code
- Resolves GitHub Issue #2218
- New API
- New API to retrieve a pending IdP link.
- New API
/api/identity-provider/link/pending
- Resolves GitHub Issue #2218
- New API
Internal
- Upgrade Apache FreeMarker from version
2.3.30
to2.3.32
.- Resolves GitHub Issue #2214
- Upgrade FusionAuth Java HTTP dependency from version
0.1.13
to0.1.14
.- Resolves GitHub Issue #2299
- Upgrade Prime MVC dependency from version
4.7.1
to4.9.10
.- Resolves GitHub Issue #2299
Version 1.45.4
July 25th, 2023
Fixed
- Ensure we correctly handle a truncated or malformed
oauth_context
request parameter when using the hosted login pages.- Resolves GitHub Issue #2382
Version 1.45.3
May 31st, 2023
Fixed
-
Update
fusionauth/java-http
to the most recent version to pick up a bug fix.This fixes a very low level HTTP server bug. In some rare cases, the HTTP response handler may not identify the end of the stream and effectively truncate the response body. It is difficult to say how may affect your integration if you were to encounter it. If you were to make an API call with a large response body, it may be possible the response would not include a valid JSON object if the response is truncated. When this error occurs, the HTTP status code will be valid, but the response will be truncated or non-existent. For additional detail see the linked commit in the linked GitHub issue.
- Resolves GitHub Issue #2292
Version 1.45.2
May 8th, 2023
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Fixed
-
If you have configured an access token signing key specific to an entity type, the signing key configuration may revert to the tenant configuration after upgrading to this version.
It is recommended to upgrade to this version at a minimum if you are coming from a version prior to version
1.45.0
.- For more information on this issue, see the Known Issues in the
1.45.0
release notes. - Resolves GitHub Issue #2249
- For more information on this issue, see the Known Issues in the
Version 1.45.1
April 14th, 2023
Changed
- Add additional validation when adding authorized origin to the OAuth2 configuration to ensure the values do not include a path or query string. This change will only affect validation when adding or editing the application configuration. This change will not affect existing configured origins or their use at runtime.
- Resolves GitHub Issue #2185
Fixed
- Support for wildcard configuration when using
post_logout_redirect_uri
parameter on the OAuth2 Logout request.- Resolves GitHub Issue #2164
- Fix salt validation for the
phpass-md5
oderphpass-sha512
. This will allow the import of users with this password hash when the salt includes a.
(period) character.- Resolves GitHub Issue #2206
Version 1.45.0
April 10th, 2023
Known Issues
-
When importing users using the
phpass-md5
oderphpass-sha512
schemes shipped in this release, if the salt contains a period (.
) the import will fail validation.- Resolved in version
1.45.1
via GitHub Issue #2206
- Resolved in version
-
If you have configured an access token signing key specific to an entity type, the signing key configuration may revert to the tenant configuration after upgrading to this version.
If you wish to upgrade before a fix is available, please document your access token signing key configuration for each entity type that has provided a specific signing configuration. Then, once the upgrade has completed, review each entity type and confirm the correct signing key configuration. If the configuration is not correct, set the signing key to the previously documented signing key.
To verify if this issue may affect you during upgrade, confirm your signing configuration for each configured entity type.
- Navigate to Entity Management -> Entity Types -> Edit -> JWT .
- If you have not enabled Entity Type specific JWT signing, this section will be collapsed and this entity type will not be affected during upgrade. If the signing configuration is enabled and you have configured a key for the
Access token signing key
field, you may be affected. Please record this setting and ensure it has not changed after the upgrade has completed.
If you have not yet upgraded to version
1.45.0
, it is recommended to move to version1.45.2
or later at a minimum and skip this version if you have confirmed you may be affected by this issue.- Resolved in
1.45.2
via GitHub Issue #2249
Sicherheit
- Update usage of
verificationId
on gated email or registration verification pages when configured to use a clickable link instead of a short code.- Resolves GitHub Issue #2182
- Update 3rd party dependencies to remove CVE scan warnings. No known exploits are vulnerabilities exist in FusionAuth as the result of using these 3rd party clients. These upgrades are simply a precautionary measure to stay current.
- Upgrade Elasticsearch client from version
7.10.2
to7.13.4
. - Upgrade GraalJS from version
22.3.0
to22.3.1
. - Resolves GitHub Issue #2183
- Upgrade Elasticsearch client from version
Fixed
- Validate the length of an entity name in order to provide a more friendly validation error message.
- Resolves GitHub Issue #2089
- Updates to the OpenAPI spec to correct an error related to
BaseSAMLv2IdentityProvider
.- Resolves GitHub Issue #2103
- Review and correct tooltips in the admin UI for Application specific email templates.
- Resolves GitHub Issue #2163
Enhancements
-
De-couple the self-service themed account pages from SSO. You may now use the self-service account pages even if you choose not to preserve your SSO session. For example, you can un-check the “Keep me signed in” checkbox and still use the self-service pages.
Also allow the self-service account session to be bootstrapped from a mobile application using token authentication, also known as the
Bearer
authentication scheme. This mechanism provides access to the self-service themed pages even if you are unable to share cookies with the web view used to complete login.Example request header:
Authorization: Bearer <access_token>
- Resolves GitHub Issue #1546, thanks to @ansonallard for the suggestion!
- Resolves GitHub Issue #1860
New
-
Add a policy to require a user to provide their current password when changing a password on the self-service account pages. See Applications -> Edit -> Registration -> Form settings -> Require current password .
- Resolves GitHub Issue #1578
-
Integrate the Authorization Code grant workflow into FusionAuth for use with single page web applications. This feature may be used with the FusionAuth React or Angular SDKs to support the use of the Authorization Code grant without having to write any backend code.
And there was much rejoicing. 😅
- Resolves GitHub Issue #1943
-
New Search APIs. These new APIs provide search and pagination capability across more APIs and may increase performance when using the FusionAuth admin UI with larger numbers of Tenants and Applications.
Applications, Consents, Groups, Tenants, Themes, Keys, API keys, User Comments, Email Templates, Identity Providers, Webhooks, and Lambdas. (🦁 🐯 🐻 … oh my!)
- Resolves GitHub Issue #2055
- Resolves GitHub Issue #2056
- Resolves GitHub Issue #2057
- Resolves GitHub Issue #2058
- Resolves GitHub Issue #2059
- Resolves GitHub Issue #2060
- Resolves GitHub Issue #2061
- Resolves GitHub Issue #2064
- Resolves GitHub Issue #2065
- Resolves GitHub Issue #2066
- Resolves GitHub Issue #2067
- Resolves GitHub Issue #2068
-
Add support for Drupal MD5, SHA-512 hashes for easier import
- New schemes include
phpass-md5
andphppass-sha512
. - See phpass MD5 and phpass SHA-512 for additional details.
- Resolves GitHub Issue #2165
- New schemes include
Internal
- Fix JSON exclusions for ignoring foreign keys.
- Resolves GitHub Issue #2198
Version 1.44.0
March 13th, 2023
Additional details
This migration will add an index to the identity_provider_links
table. It is not expected to negatively impact the migration time during upgrade, but please be aware that deployments with millions of Identity Provider Links may experience additional processing time during the migration.]
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Fixed
- A Lambda invocation may incorrectly fail indicating a recursive call was attempted. This is unlikely to occur, but under heavy load, it is possible.
- Resolves GitHub Issue #2102
- The Application API was failing to make a copy when using
sourceApplicationId
when the source Application has enabled and configured the SAML v2 IdP. This is a bug in a new feature that was added in version1.43.0
.- Resolves GitHub Issue #2118
Enhancements
- Add default configuration for read and connect timeouts to the SMTP server configuration. This helps protect FusionAuth against an SMTP server that never closes a socket. From time to time we observed an SMTP server hold open a socket, and tie up a send thread which may block other senders. This includes the
mail.smtp.timeout
andmail.smtp.connectiontimeout
settings. The default value is2000
for each. These may be overridden by navigating to theAdvanced
tab in your tenant and adding them to theSMTP settings
section.- Resolves GitHub Issue #1742
- Change Link API request body to match the response. Backwards compatibility is maintained, but this provides a more consistent API feel.
- Resolves GitHub Issue #1747
- Update the Google IdP JavaScript in the themed pages. This change removes the deprecated Google JavaScript library, and adds support for One Tap.
- Resolves GitHub Issue #1939, thanks to @Brunom50, @harishreddy-m, @forteilgmbh for their contribution.
- Return a
404
with status only for anything under/api/*
instead of rendering a404
page with HTML. It just seems like the right thing to do. Nobody wants HTML in their APIs!- Resolves GitHub Issue #2109
- Add a new index to the
identity_provider_links
table to increase performance. Better. Faster. Stronger.- Resolves GitHub Issue #2122
- hinzufügen
apiMode: [Public|Partner]
to allow the user to select between the public or partner Steam API. The Partner API is preferred if you have access to it because it is not rate limited.- Resolves GitHub Issue #2127
Internal
- Use
Cache-Control: no-store
more broadly in the FusionAuth admin application.- Resolves GitHub Issue #2097
Version 1.43.2
July 9th, 2023
Changed
- The User and User Registration APIs will now restrict
user.preferredLanguages
andregistration.preferredLanguages
to a maximum of20
values. Additionally each value can be no longer than24
characters. This change is not expected to impact any existing integrations. Do let us know if you have a use case that is not compatible with this change.
Fixed
- When an event fails to be sent to a Kafka topic, do not attempt to send an
event-log.create
event that results from the failed request. Correct an edge case that exists where anevent-log.create
event fails to be sent to a Kafka topic, and this error causes anotherevent-log.create
event to be triggered.- Resolves GitHub Issue #2362
- Limit the length of a valid value for
user.preferredLanguages
andregistration.preferredLanguages
to a maximum of24
characters, and restrict the total number of values to20
or less.- Resolves GitHub Issue #2363
Internal
- Reduce Kafka logging to make it much less noisy at runtime
- Resolves GitHub Issue #2359
Version 1.43.1
March 6th, 2023
Fixed
- Correct a potential FreeMarker render error caused by a missing CSRF token when performing an SAML v2 IdP initiated login to the FusionAuth admin UI. This error is a side effect of the caller not requesting the
scope=offline_access
parameter. With this fix, you should no longer encounter the error, and theoffline_access
scope is now optional on the request. A workaround is to request theoffline_access
scope.- Resolves GitHub Issue #2125
Version 1.43.0
February 15th, 2023
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- Creating a new application from another application with
sourceApplicationId
returns a500
error when the source application has SAML v2 enabled and configured. If you have not configured SAML v2, you will not be affected by this issue. Workaround is to call Create Application API without thesourceApplicationId
parameter and supply all the parameters copied from the source application.- Resolved in
1.44.0
via GitHub Issue #2118.
- Resolved in
Fixed
- Support importing an x.509 certificate with a private key into KeyMaster in the admin UI.
- Resolves GitHub Issue #1805, thanks to @konvergence for reporting!
- When using the Forgot Password workflow on the FusionAuth login page with a user without an email address, the page would refresh instead of redirecting to the success screen indicating an email had been sent.
- Resolves GitHub Issue #1809, thanks to one of our MVPs @epbensimpson for letting us know.
- The Change Password API was incorrectly failing indicating a Trust Token was required even when provided if the user has MFA enabled.
- Resolves GitHub Issue #1909, thanks to @timyourivh for the report!
- Ensure that we correctly terminate an SSO session when beginning a new passwordless login flow with a different user in the same browser.
- Resolves GitHub Issue #1912
- Fix various limitations with adding a consent to a self-service account form.
- Resolves GitHub Issue #1920
- An error may occur when logging into the FusionAuth admin UI with an IdP initiated request from a SAML v2 IdP.
- Resolves GitHub Issue #1941, thanks to @jon-at-advarra for filing the bug!
- An error may occur when logging into the FusionAuth admin UI with an IdP initiated request from a SAML v2 IdP and then navigating to your own profile page.
- Resolves GitHub Issue #1976, thanks to @jon-at-advarra, this was a great edge case.
- When taking a User Action, the duration is localized for the event. The localization is only available for a fixed number of locales. When an un-supported locale, such as Serbian is requested, an exception will occur. This has been fixed to avoid the exception, and if an un-supported Locale is requested, English will be used as the default.
- Resolves GitHub Issue #1978
- When sending a test event to verify the Kafka configuration, the topic was not being validated as required.
- Resolves GitHub Issue #1985, thanks to @sixhobbits, nice catch!
- When completing the forgot password workflow using the FusionAuth themed pages outside of an OAuth context, you may receive an error that says
Oops. It looks like you've gotten here by accident.
.- Resolves GitHub Issue #1989
- Update the Email Template preview in the view dialog to be consistent with the preview in the edit page.
- Resolves GitHub Issue #2007, thanks to @lancegliser for pointing this out!
- Restrict the Two Factor Trust during a Change Password request to be used for the workflow that started the request.
- Resolves GitHub Issue #2010
- Fix the edit Form Field in the FusionAuth admin UI for a consent field.
- Resolves GitHub Issue #2026
- Using password reset to unlock account may not work when MFA is enabled for the user. This is a bug in this new feature that was added in version
1.42.0
.- Resolves GitHub Issue #2032
Enhancements
- Additional configuration for the Apple IdP to support login from Mobile and Desktop.
- Resolves GitHub Issue #778, thanks to @johnmaia for his persistence!
- Resolves GitHub Issue #1248, thanks to @Brunom50 to documenting this limitation.
- Update the System Log viewer in the FusionAuth admin UI to order logs for easier viewing pleasure.
- Resolves GitHub Issue #1612
- Allow Forgot Password API usage when the Forgot Password Email template is not configured if
sendForgotPasswordEmail
isfalse
.- Resolves GitHub Issue #1735, thanks to @epbensimpson for the suggestion.
- Provide better developer feedback on the Change Password API when using an API key.
- Resolves GitHub Issue #1897, thanks to @sujkattimani for the feedback!
- Allow the SAML v2 IdP to be used for both SP and IdP initiated login. Previously to utilize SP and IdP initiated login for the same SAML v2 IdP, you would have to create two separate configurations. It is still recommended to use the separate SAML v2 IdP initiated configuration if you will not be using an SP initiated login.
- Resolves GitHub Issue #1900, thanks to @leesmith110 for opening the issue and providing us so much valuable feedback.
- Support for PostgreSQL 15
- Resolves GitHub Issue #1944
- Resolves GitHub Issue #2015
- Add an option to include archived logs in gzip format on the System Log Download API. This will be the default when downloading the logs in the FusionAuth admin UI.
- Resolves GitHub Issue #1942
- Allow the login hint that is passed to a 3rd Party SAML v2 IdP to be configured. Previously this was always
login_hint
, but Azure will expectusername
, this can now be configured.- Resolves GitHub Issue #1946
- hinzufügen
sourceApplicationId
to the Application API to create an app from an existing Application to copy settings. This allows you to more easily use a single Application as a template, or to just make a copy.- Resolves GitHub Issue #1957
- Ship default email templates for Add and Remove Multi-Factor methods.
- Resolves GitHub Issue #1993
- Add additional SAML IdP config to allow advanced assertion capabilities such as allow any destination, or alternate values. This is sort of a dangerous power user feature, but can be useful when migrating IdP configurations into FusionAuth w/out requiring each IdP to update their ACS.
- Resolves GitHub Issue #1995
- Add additional detail to the edit registration form in the FusionAuth admin UI so you know which user you are editing. Seemed like a good idea.
- Resolves GitHub Issue #2045
- Do not validate
Content-Type
when a payload has not been provided.- Resolves GitHub Issue #2085
New
- Support for wild cards in OAuth2 Authorized Origin and Authorized Redirect URL configurations. Use with caution - but have fun with it!
- Resolves GitHub Issue #437. This one has been a long time coming, and we really appreciate all of the feedback and suggestions on this issue. In chronological order, thank you to @SeanStayn, @Jank1310, @JuliusPC, @dystopiandev, @alessandrojcm, @sjmog, @huysentruitw and @mdnadm.
- Support for native TLS configuration in the FusionAuth HTTP server without the requirement to use a proxy with TLS termination.
- Resolves GitHub Issue #1996
- Add support for
salted-pbkdf2-hmac-sha512-512
password hash algorithm.- See Salted PBKDF2 HMAC SHA-512 for additional details.
- Resolves GitHub Issue #2054
Version 1.42.1
January 8th, 2023
Fixed
- A regression error in version
1.42.0
may cause a user to no longer be able to login after a successful login. In order to encounter this bug, you must have your tenant configured to re-hash passwords on login, and have a user login when their password encryption scheme or factor that does not match the configured tenant defaults. If you may have this type of configuration, please do not upgrade to version1.42.0
and instead upgrade directly to this version.- Resolves GitHub Issue #2043
Version 1.42.0
December 7th, 2022
Known Issues
- In this release, you may now create a policy to allow a user to unlock their account after too many failed login attempts by completing a forgot password workflow. A bug was identified in this new feature that may cause this workflow to fail if the user also has 2FA enabled.
- Resolved in
1.43.0
via GitHub Issue #2032
- Resolved in
- An error was introduced that may, after one successful login, cause subsequent logins to fail for a user. In order to encounter this bug, you must have your tenant configured to re-hash passwords on login, and have a user login when their password encryption scheme or factor that does not match the configured tenant defaults. If you may have this type of configuration, please do not upgrade to version
1.42.0
and instead upgrade directly to version1.42.1
.- Resolved in
1.42.1
via GitHub Issue #2043
- Resolved in
Changed
- When building a WebAuthn credential, the user’s current email address or username will now be used as the credential name. Previously this value was generated to be unique to help the user identify multiple credentials. However, Safari on macOS and Edge on Windows may display this value to the end user, so this will no longer be generated but set to a value the user should recognize.
- Resolves GitHub Issue #1929
- New themed templates for enabling two-factor authentication during login. Please review your themes to ensure the new templates and localized messages are added.
theme.templates.oauth2TwoFactorEnable -> /oauth2/two-factor-enable
theme.templates.oauth2TwoFactorEnableComplete -> /oauth2/two-factor-enable-complete
- Related GitHub Issue #197
Fixed
- Minor WebAuthn related fixes.
- Resolves GitHub Issue #1979
- Resolves GitHub Issue #1986
- When providing both the
entityId
anduserId
on the Entity Search API, an exception will occur.- Resolves GitHub Issue #1883
- Remove SCIM endpoints from the API key configuration in the admin UI, these endpoints do not use API keys.
- Resolves GitHub Issue #1987
- Fix various rendering issues with the Theme preview in the admin UI
- Resolves GitHub Issue #1755, thanks to Steve-MP for reporting!
Enhancements
- Allow a user to unlock their account after being locked due to too many failed authentication attempts by completing a password reset workflow. See the
Cancel action on password reset
in the Tenant configuration.Tenants > Edit > Password > Failed authentication settings
.- Resolves GitHub Issue #383, thanks @colingm for the request, and @davidmw and @Jlintonjr for the advice and feedback!
- Use the existing tenant configuration for
modifyEncryptionSchemeOnLogin
to also update the hash when changed.- Resolves GitHub Issue #1062
- Add additional configuration to the
Failed authentication settings
in the tenant configuration to optionally email the user when the configured action is also configured to allow emailing.- Resolves GitHub Issue #1823
- Update the
System > About
panel in the admin UI to report OpenSearch when using OpenSearch instead of Elasticsearch.- Resolves GitHub Issue #1982
New
- Additional Multi-Factor policy option to require a user to enable multi-factor during login if not yet configured. See
Tenants > Edit > MFA > Policies > On login > Required.
. Application specific configuration can also be configured, seeApplications > Edit > MFA > Policies > On login > Required.
, using the application configuration requires an Enterprise plan.- Resolves GitHub Issue #197
- Allow refresh tokens to be revoked for a user when enabling two-factor authentication. See
Tenants > Edit > JWT > Refresh token settings > Refresh token revocation > On multi-factor enable
.- Resolves GitHub Issue #1794
- A new lambda function can be assigned to perform custom validation for any step during a self-service registration. This feature is only available when using a custom form, and is not available when using basic self-service registration. This may be useful to perform advanced field validation, or to call a 3rd party API to perform additional identity verification.
- Resolves GitHub Issue #1833
Version 1.41.3
November 21st, 2022
Sicherheit
- Mitigate a potential directory traversal attack. CloudFlare, AWS and similar cloud providers will generally block these requests by default.
- Please note, FusionAuth Cloud customers are not vulnerable to this type of attack.
Version 1.41.2
November 17th, 2022
Fixed
- Allow licensed features such as SCIM or WebAuthn to be configured during kickstart.
- Resolves GitHub Issue #1969
Version 1.41.1
November 16th, 2022
Sicherheit
- Remove the app template files from the classpath.
- Resolves GitHub Issue #1964, thanks to @vtcdanh for reporting.
Fixed
- Improve synchronization of a user during a connector login. Specifically, allow previously obtained refresh tokens to be preserved during the user update procedures during a connector synchronization event.
- Resolves GitHub Issue #1907, thanks to @yuezhou1998 for letting us know.
- Allow for invalid language values to be provided in the
Accept-Language
HTTP request header. When an invalid language is provided, theAccept-Language
header will be discarded.- Resolves GitHub Issue #1958
- Better support for beginning a forgot password workflow using the API and completing the workflow in a themed page when a user also has 2FA enabled.
- Resolves GitHub Issue #1965
Version 1.41.0
November 10th, 2022
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- A change to the FusionAuth HTTP server may cause issues with reverse proxies that default upstream connections to
HTTP/1.0
. The HTTP server we are using no longer supportsHTTP/1.0
. We have identified thatnginx
defaults all upstream connections toHTTP/1.0
, and the HTTP server we are using no longer supportsHTTP/1.0
. Fornginx
specifically, you will need to set the proxy version by addingproxy_http_version 1.1;
to your proxy config.
Sicherheit
- Update
com.fasterxml.jackson.*
dependencies to version2.14.0
. This update is proactive, there are no known exploits. See [CVE-2022-42003](CVE-2022-42004 and )(https://nvd.nist.gov/vuln/detail/CVE-2022-42004).- Resolves GitHub Issue #1913
Changed
- New themed pages added for WebAuthn. Please review your themes to ensure the new templates and localized messages are added.
- WebAuthn re-authentication requires a new hidden form field named
userVerifyingPlatformAuthenticatorAvailable
to detect compatible devices/browsers and prompt the user to register a passkey. You can view the default templates to determine in which form to insert this field into any customized templates. This field must be present on the following pages:- OAuth authorize
- OAuth complete registration
- OAuth passwordless
- OAuth register
- OAuth two-factor
- OAuth WebAuthn (new)
Fixed
- Correct signature verification of a SAML v2 AuthN response after the certificate has been removed from Key Master.
- Resolves GitHub #1906
- An exception may be thrown when there are no keys to be returned from the
/api/jwt/public-key
when requesting keys by anapplicationId
.- Resolves GitHub Issue #1918
- When using Firefox, using the SSO logout a zero byte file may be downloaded.
- Resolves GitHub Issue #1934
- When multiple webhooks are configured, and more than one webhook is configured to receive the
event-log.create
event, a failed webhook may cause an event loop.- Resolves GitHub Issue #1945
- Correct deserialization of the
userType
andtitle
fields in a SCIM resource.- Resolves GitHub Issue #1954
Enhancements
- Support passing the Assertion Consumer Service (ACS) in the
RelayState
query parameter.- Resolves GitHub Issue #1785
- Support using an
appId
andsessionTicket
to complete login with the Steam Identity Provider.- Resolves GitHub Issue #1873
- Add back support for some legacy HTTP Servlet Request methods for use in themed templates.
- Resolves GitHub Issue #1904
New
- WebAuthn! Passkeys, Touch ID, Face ID, Android fingerprint, Windows Hello!
- Resolves GitHub Issue #77
- Allow users to be provisioned into the FusionAuth app using an IdP
- Resolves GitHub Issue #1915
- Allow FusionAuth to initiate a SAML v2 login request to a SAML v2 Service Provider.
- Resolves GitHub Issue #1927
Internal
- Update the docker image to
ubuntu:jammy
.- Resolves GitHub Issue #1936
- New HTTP server
Version 1.40.2
September 28th, 2022
Fixed
- A two-factor trust may expire early causing a user to be prompted to complete two-factor during login. This issue was introduced in version
1.37.0
.- Resolves GitHub Issue #1905
Version 1.40.1
September 26th, 2022
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Fixed
- A SAML v2 IdP Initiated login request will fail if PKCE is configured as required.
- Resolves GitHub Issue #1800
- The path attribute in some cookies may be set to the request path instead of
/
which may affect a SAML v2 IdP initiated login request.- Resolves GitHub Issue #1891
Enhancements
- Support
Content-Type
in Kickstart when usingPATCH
request to supportapplication/json-patch+json
andapplication/merge-patch+json
.- Resolves GitHub Issue #1885
- Remove un-necessary logging when the
Content-Type
request header is invalid or unset.- Resolves GitHub Issue #1895
Version 1.40.0
September 16th, 2022
Changed
- If you are using MySQL or plan to use MySQL you will need to manually download the JDBC connector to allow FusionAuth to connect to a MySQL database. If you are using PostgreSQL, this change will not affect you. See the installation guide for additional information. We apologize in advance for the inconvenience this causes you, but the Oracle GPL licensing model makes it difficult for FusionAuth to easily delivery this capability.
- Resolves GitHub Issue #1862
Fixed
- An exception may occur when you attempt to perform a
PATCH
request on a Group using aroleId
that does not exist.- Resolves GitHub Issue #1872
- URL escape the
identityProviderUser
in the admin UI to correctly build the View and Delete actions links.- Resolves GitHub Issue #1882, thanks to one of our MVPs @epbensimpson for letting us know and providing excellent recreation steps.
Enhancements
- Support changes to
user.active
forPUT
oderPATCH
on the SCIM User or Enterprise User endpoints.- Resolves GitHub Issue #1871
- Performance improvement for SAML v2 request parsing.
New
- Native Windows support has been re-instated. We apologize for the gap in native Windows support, for those who have been waiting to upgrade since version
1.37.0
you may now upgrade with a native installer. Thank you for all of you who have voiced your opinions with how we are support a native Windows installation.- Resolves GitHub Issue #1848
Version 1.39.0
September 11th, 2022
Fixed
- When appending the
locale
request parameter on the Authorize request to pre-select the user’s locale, the locale may still be incorrect for validation errors. For example, appendinglocale=fr
will allow the initial render of the page to be localized in French when available. However, because the user did not manually modify the locale selector on the page, if the login fails due to a validation error, the error messages will be returned in the default locale which is generally English.- Resolves GitHub Issue #1713
- Group application roles removed during a
PATCH
request to the Group API.- Resolves GitHub Issue #1717, thank you to @paul-fink-silvacom for raising the issue!
- Corrections to the SAML v2 SP and IdP meta data.
- The HTTP scheme was missing from the
entityID
. This issue was introduced in version1.37.0
. - The
NameIdFormat
found in the SP meta data was always showingurn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
regardless of the value configured in the SAML v2 IdP. - Resolves GitHub Issue #1842
- The HTTP scheme was missing from the
- The potential exists to see an exception in the FusionAuth system logs when the internal login record service runs. It is unlikely you will experience this error unless you have very large login volumes.
- Resolves GitHub Issue #1854
- There is the potential for the Elasticsearch index to become out of sync with respect to group memberships when groups are being deleted, or group members are being deleted from a group.
- Resolves GitHub Issue #1855
- Add missing support for
en_GB
time and data format support in the FusionAuth admin UI when setting your preferred locale toen_GB
.- Resolves GitHub Issue #1858, thanks to @adambowen for bringing this to our attention. It wasn’t our intention to force our friends in the United Kingdom 🇬🇧 to painfully read dates and times in the American 🇺🇸 format. Please accept our apologies. 😎
Enhancements
- Better support for JSON Patch. Now supporting RFC 7386
application/merge-patch+json
and RFC 6902application/json-patch+json
. Note that you may still make a request using thePATCH
HTTP method usingapplication/json
and the current behavior should not be changed. Allpatch*
methods found in the FusionAuth client libraries will still be usingapplication/json
for backwards compatibility. However, now that support for these new content types exists, we will be working to build support into our client libraries.- Resolves GitHub Issue #441
- Better developer feedback when the
Content-Type
request header is missing or incorrect.- Resolves GitHub Issue #604
- Additional SCIM support for the
PATCH
HTTP request method, andfilter
andexcludedAttributes
request attributes. The addition of these features allow the FusionAuth SCIM server to be compatible with Azure AD SCIM client and Okta SCIM client. The Group filter support has some limitations, see the SCIM Group API doc for additional details.- Resolves GitHub Issue #1761
- Resolves GitHub Issue #1791
- Add some missing message keys to default Theme message bundle.
- Resolves GitHub Issue #1839
- Remove an un-necessary db request when validating the user security scheme for a user in the FusionAuth admin UI.
- Resolves GitHub Issue #1856
Version 1.38.1
August 22nd, 2022
Fixed
- Static resources such as CSS and JS may be missing a
Content-Type
header which may cause a proxy usingX-Content-Type-Options: nosniff
to fail to load the resource. This issue was introduced in version1.37.0
.- Resolves GitHub Issue #1831, thanks to @sinqinc for reporting.
- Resolves GitHub Issue #1834, thanks to @Aaron-Ritter for reporting.
- Fix a potential error issue caused by a webhook handler calling back to FusionAuth which may trigger another webhook event. This fix should also improve the performance when sending many events for webhooks.
- Resolves GitHub Issue #1836
- Correct behavior during login when both self-service registration and require registration features are enabled. This configuration may cause a user to be directed to the registration required page during login instead of being registered automatically. If you encounter this error, you may either upgrade or disable the require registration configuration. This appears to be a regression introduced in version
1.36.5
.- Resolves GitHub Issue #1837
Version 1.38.0
August 17th, 2022
Fixed
- Remove dead Tomcat files from Docker image
- Resolves GitHub Issue #1820, thanks to @kevcube for letting us know!
New
- Group and Group Membership Webhooks
- Resolves GitHub Issue #633, thanks to @JLyne, @ric-sapasap and @rabshire for the feedback!
- Resolves GitHub Issue #1803, thanks to @matthew-jump for making the request.
Version 1.37.2
August 11th, 2022
Fixed
- A regression error was introduced in version
1.37.0
that causes HTTP request headers to be malformed when being sent to a Webhook, Generic Messenger or a Generic Connector.- Resolves GitHub Issue #1818
Enhancements
- In version
1.37.0
you may now create a user in the FusionAuth admin UI optionally performing email verification. The UI controls and messaging have been enhanced to remove potential confusion.- Resolves GitHub Issue #1819
Version 1.37.1
August 10th, 2022
Fixed
- An exception may occur while trying to capture the debug log event during an authentication request using a Connector.
- Resolves GitHub Issue #1799
- When configuring a User Action to prevent login and using that event with the Failed Login configuration, if you configure the User Action to email the user, the email will not be sent.
- Resolves GitHub Issue #1801
- Kickstart fails because it does not wait for FusionAuth to complete startup.
- Resolves GitHub Issue #1816
- Creating an application in the FusionAuth admin UI may fail due to a licensing error if you do not have an Enterprise license.
- Resolves GitHub Issue #1817
Version 1.37.0
August 9th, 2022
This release contains some significant internal changes to our HTTP server. While we do not expect any issues, please be aware of this change as you test and prepare for upgrades. Please also be aware of changes to our Windows bundling options.
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- Kickstart fails because it does not wait for FusionAuth to complete startup.
- Resolved in version
1.37.1
via GitHub Issue #1816
- Resolved in version
- Creating an application in the FusionAuth admin UI may fail due to a licensing error if you do not have an Enterprise license.
- Resolved in version
1.37.1
via GitHub Issue #1817
- Resolved in version
- A regression error was introduced in version
1.37.0
that causes HTTP request headers to be malformed when being sent to a Webhook, Generic Messenger or a Generic Connector.- Resolved in version
1.37.2
via GitHub Issue #1818
- Resolved in version
- Static resources such as CSS and JS may be missing a
Content-Type
header which may cause a proxy usingX-Content-Type-Options: nosniff
to fail to load the resource.- Resolved in version
1.38.1
via GitHub Issue #1831
- Resolved in version
- A two-factor trust may expire early causing a user to be prompted to complete two-factor during login.
- Resolved in version
1.40.2
via GitHub Issue #1905
- Resolved in version
- A theme issue may exist on a form action and may cause breaking changes when upgrading to this version.
- If you are upgrading, please verify your theme files accurately create a form action. The following themes should be updated as follows:
- OAuth authorize ->
action="/oauth2/authorize"
- Child registration not allowed ->
action="/oauth2/child-registration-not-allowed"
- OAuth passwordless ->
action="/oauth2/passwordless"
- OAuth register ->
action="/oauth2/register"
- OAuth two factor ->
action="/oauth2/two-factor"
- Change password form ->
action="/password/change"
- Forgot password ->
action="/password/forgot"
Sicherheit
- Allow deprecated XML signature algorithms that were removed in Java 17. It is still not recommended that you use any of these legacy SHA1 algorithms, but if you are unable to utilize a modern algorithm, they will be allowed.
- Resolves GitHub Issue #1814
Changed
- Windows install has been removed. Our strategy is to support Windows using WSL 2 with our provided debian package. Please plan to utilize this strategy, and open a GitHub issue if you encounter issues with the installation.
- Due to customer feedback, a native Windows installation option has been restored as of version
1.40.0
.
- Due to customer feedback, a native Windows installation option has been restored as of version
- Webhooks are no longer configured as “All applications” or limited to a single Application. They are now scoped to one or more tenants. If you previously had multiple webhooks configured within the same tenant, but scoped to separate Applications you will want to review your configuration and filter events in your own Webhook handler by the
applicationId
.- Resolves GitHub Issue #1812
- Deprecate Apache Tomcat specific configuration. See the Configuration reference for additional detail.
fusionauth-app.http.max-header-size
The default maximum size is now64k
.fusionauth-app.http.cookie-same-site-policy
In most cases, cookies will be written usingSameSite=Lax
, and cookies used by the FusionAuth admin UI utilizeSameSite=Strict
. If you think there would be value in further customizing cookies by name, or security settings such asSameSite
, please upvote GitHub Issue #1414 and describe your intended use-case.fusionauth-app.management.port
This was an Apache Tomcat specific port that is no longer required.fusionauth-app.ajp.port
is now deprecated, this was an Apache Tomcat specific binary protocol used by Java applications.fusionauth-app.http.relaxed-path-chars
This option was not likely documented or in-use by anyone.fusionauth-app.http.relaxed-query-chars
This option was not likely documented or in-use by anyone.
- FastPath and normal startup commands have changed. For example, starting FusionAuth based upon Apache Tomcat used
catalina.sh
odercatalina.bat
, the startup process will now usestart.sh
. See install documentation for more details. - When using the FusionAuth Docker image with MySQL, you will need to bundle the MySQL connector jar in the image, or add a layer to the stock FusionAuth image to ensure that
curl
is installed so that the MySQL connector jar can be downloaded it during startup. It is recommended that you build the connector into the image. See our example Dockerfile on GitHub for an example.
Fixed
- Add the appropriate feedback to the users when attempting to change an email during a gated email verification that is already in-use.
- Resolves GitHub Issue #1547
- Correct the validation when deleting a key from Key Master when in use by a de-activated application.
- Resolves GitHub Issue #1676
- Perform implicit email verification when enabled and a setup password email request is completed.
- Resolves GitHub Issue #1705
- Handle URL encoded characters in the user-information part of the URL when connecting to Elasticsearch. This allows a username or password to be provided in the URL that have been URL encoded.
- Resolves GitHub Issue #1745
- When using the Change Password workflow in the hosted login pages for a user that has enabled 2FA, if you are not adding the OAuth2 parameters found in the
state
on the Change Password link built in the email template an error may occur when the user tries to complete the workflow.- Resolves GitHub Issue #1764
- The Refresh Token retrieve API and the Session tab in admin UI will no longer show expired refresh tokens. While the previous behavior was working as designed, it was confusing to some clients, and an admin was not able to manually remove expired tokens.
- Resolves GitHub Issue #1772
- Fix Lambda JS validation when using ES6 features with the GraalJS engine.
- Resolves GitHub Issue #1790, thanks to @theogravity for reporting the issue!
Enhancements
- Administrative Email Verification using the API or FusionAuth admin UI. When creating a user in the admin UI, you may now optionally create the user with an un-verified email when Email verification is enabled. See the Verify Email API for additional details.
- Resolves GitHub Issue #1319
- The Oauth2 Logout does not log a user out of FusionAuth app if logging out of another application in the same default tenant.
- Resolves GitHub Issue #1699
- Updates to our initial SCIM Server implementation released in version
1.36.0
.- Resolves GitHub Issue #1702
- Resolves GitHub Issue #1703
- Better options to capture debug information when troubleshooting an SMTP connection issue. You no longer need to specify
mail.debug=true
in the advanced SMTP settings, and instead when enablingdebug
on the SMTP configuration a debug Event Log will be produced with the SMTP debug information.- Resolves GitHub Issue #1743
- Support larger email templates on MySQL. Prior to this version the
TEXT
column data type was utilized which has a maximum size of16k
in MySQL, now we are usingMEDIUMTEXT
which supports up to16M
.- Resolves GitHub #1788, thanks to @darkeagle1337 for making the request!
- Improvements to the OAuth2 Logout endpoint. This endpoint now correctly supports the
POST
method in addition to theGET
method, and you may now use an expiredid_token
in theid_token_hint
parameter.- Resolves GitHub Issue #1792
- Webhooks are now scoped to one or more tenants. Webhooks will no longer receive all events, but only events for the configured tenants. There is still an option for “All tenants” if you still wish to preserve the previous behavior.
- Resolves GitHub Issue #1812
- Any API response that returns a Refresh Token will now also return a
refresh_token_id
when in OAuth2 or arefreshTokenId
in all other APIs. This may be useful to identify a refresh token for revocation when using a one-time use Refresh Token. This identifier is the primary key of the Refresh Token and can be used by the Refresh Token API. - The Access Token will contain a new claim named
sid
which is the immutable identifier Refresh Token. This claim is not reserved, so it can be removed and will only be present when a refresh token is requested. This is different from thesid
claim that is already returned in theid_token
, thatsid
or Session Identifier is the SSO session identifier and is primarily used by FusionAuth to validate a logout request. - When available the Refresh Token is now returned in the
JWTRefreshTokenRevokeEvent
event in therefreshToken
field. - The Login Ping API may now optionally take the request as a POST body.
New
- Application scoped Multi-Factor authentication. This feature allows an application choose to participate in Multi-Factor when enabled, and optionally specify a separate TTL for trust scoped to a single application.
- Resolves GitHub Issue #763
- You may optionally disable the IdP linking strategy for an Identity Provider. This allows you to restrict any automatic linking and manage all IdP linking through the API.
- Resolves GitHub Issue #1551, thanks to @epbensimpson for the suggestion.
- Added
fusionauth-app.http.read-timeout
to the configuration to optionally set the maximum read timeout when making requests to FusionAuth. See the Configuration reference for additional detail.
Internal
- Remove Apache Tomcat as the underlying application server, in favor of a more modern HTTP server based upon Netty.
- Resolves GitHub Issue #1671
Version 1.36.8
July 4th, 2022
Fixed
- Fix the placeholder text in the entity grants search field.
- Resolves GitHub Issue #1774
- Correct the SCIM HTTP response code when a new resource is created to be
201
.- Resolves GitHub Issue #1775
- Correct the SCIM HTTP response code when a duplicate resource is attempted to be created to be
409
.- Resolves GitHub Issue #1776
Version 1.36.7
June 23rd, 2022
Sicherheit
- Ensure the provided
client_id
matches the Application represented by the Refresh Token when performing a Refresh grant. This is marked as a security fix because the intended design is to ensure the Refresh Token does indeed match the requestedclient_id
. However, the risk is minimal due to the caller still being required to have a valid set of client credentials, and must still present a valid refresh token.- Resolves GitHub Issue #1766 Thanks to @gnarlium for reporting the issue!
Fixed
- The initial “start” phase of a user action triggered by a failed login configuration is not sent.
- Resolves GitHub Issue #1654
- When a SAML v2 SP is using an HTTP redirect binding during the Logout request FusionAuth make fail to complete the logout request.
- Resolves GitHub Issue #1723
- A timing issue exists where under load of creating logins and then deleting applications programatically, a login record for a now deleted application may get stuck in the queue causing exceptions when attempting to write the record to the database.
- Resolves GitHub Issue #1765
- Correct the
Content-Type
HTTP response header returned from the SCIM endpoints.- Resolves GitHub Issue #1769
Version 1.36.6
June 16th, 2022
Fixed
- When using Rate Limiting for Failed logins, the user may be able to login successfully after being rate limited - but prior to the end of the configured time period.
- Resolves GitHub Issue #1758
- When using a JWT Populate lambda and modifying the default value of the
aud
claim to be an array instead of a string value, this token can no longer be used by the Introspect endpoint. This fix allows you to modify theaud
claim to be an array, and it may be used with the Introspect endpoint as long as the requestedclient_id
is contained in theaud
claim. The OAuth2 Logout endpoint was also updated to allow this sameaud
modification to be using anid_token
as theid_token_hint
. When using this style of token as anid_token_hint
, the first value in theaud
claim that is equal to a FusionAuth application Id will be utilized.- Resolves GitHub Issue #1759
Version 1.36.5
June 13th, 2022
Sicherheit
- Upgrade Java to get the patch for CVE-2022-21449. Note that in version
1.36.4
FusionAuth manually patched this vulnerability. To ensure you are not vulnerable to this vulnerability, upgrade to FusionAuth version1.36.4
or later, or discontinue use of the Elliptic Curve algorithm.- Resolves GitHub Issue #1672
- Fix validation of the Oauth2 Logout endpoint when using the
post_logout_redirect
parameter. As documented here, you must ensure that any value for this parameter is in the Authorized URLs list for the application. This may be a breaking change if you do not.- Resolves GitHub Issue #1750
Fixed
- Fix a UI bug that caused the application column to show “Single sign-on” instead of the Application name in the Session tab of the user management panel.
- Resolves GitHub Issue #1706
- If you have enabled Two-Factor authentication and self-service registration, a user may not be routed to the Complete Registration step correctly after completing the Two-Factor challenge.
- Resolves GitHub Issue #1708, thanks to @chimericdream for reporting the issue!
- The
displayName
property on the Link a User API is ignored. This is a regression bug that was introduced in version1.36.0
.- Resolves GitHub Issue #1728
- A 3rd party Web Application Firewall such as CloudFlare may inject JavaScript into the
<head>
element and this may cause a failure to properly initialize support for an Identity Provider such as Twitter.- Resolves GitHub Issue #1731, thanks to @atakane for helping us track this one down!
Internal
- Upgrade to the latest Java 17 LTS. Upgraded from 17.0.1+12 to 17.0.3+7.
- Resolves GitHub Issue #1672
Version 1.36.4
April 21st, 2022
Sicherheit
- Proactive patch for Java CVE-2022-21449. This release will patch the vulnerability described in the referenced CVE until we are able to release a version of FusionAuth using the upcoming patched release of Java. If you are not able to upgrade to this release, discontinue use of ECDSA keys in FusionAuth for JWT or SAML signing.
- Resolves GitHub Issue #1694
Version 1.36.3
April 19th, 2022
Fixed
- An additional edge case was identified in the issue resolved by GitHub Issue #1687. If you did encounter the issue resolved by GitHub Issue #1687, you should plan to upgrade to this patch version so that you can fully utilize the new
auth_time
claim introduced in1.36.0
.- Resolves GitHub Issue #1688
Version 1.36.2
April 14th, 2022
Fixed
- If you are using the
openid
scope which produces anid_token
, and you utilize a 3rd party library that consumes theid_token
to validate the signature, expiration or similar claims, the token may be incorrectly identified as expired. This is because after a refresh token is used to generate a newid_token
theauth_time
claim may have lost precision from the original value in the initialid_token
.- Resolves GitHub Issue #1687
Version 1.36.1
April 14th, 2022
Fixed
- When building an entity grant in the UI for a user or other entity, the search results may contain entities from all tenants. If you attempt to select an entity in a tenant other than the tenant for which the user or entity belongs, an exception will occur.
- Resolves GitHub Issue #1579
- If you create an empty directory in the FusionAuth plugin directory, or create a directory that does not contain any FusionAuth plugin jars, and have other plugin jars in the root of the plugin directory, the legitimate plugin jar may not be loaded. If you encounter this problem, either remove the empty directories, or make the empty directories read only.
- Resolves GitHub Issue #1683
- If you are using the Client Credentials Grant and omit the permissions from the
target-entity:
scope, the expected permissions will not be returned as part of the access token claims.- Resolves GitHub Issue #1686
Version 1.36.0
April 7th, 2022
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- If you create an empty directory in the FusionAuth plugin directory, or create a directory that does not contain any FusionAuth plugin jars, and have other plugin jars in the root of the plugin directory, the legitimate plugin jar may not be loaded. If you encounter this problem, either remove the empty directories, or make the empty directories read only.
- This has been resolved in version
1.36.1
.
- This has been resolved in version
- If you are using the Client Credentials Grant and omit the permissions from the
target-entity:
scope, the expected permissions will not be returned as part of the access token claims.- This has been resolved in version
1.36.1
.
- This has been resolved in version
- If you are using the
openid
scope which produces anid_token
, and you utilize a 3rd party library that consumes theid_token
to validate the signature, expiration or similar claims, the token may be incorrectly identified as expired. This is because after a refresh token is used to generate a newid_token
theauth_time
claim may have lost precision from the original value in the initialid_token
.- This has been resolved in version
1.36.3
.
- This has been resolved in version
Sicherheit
- Ensure that the Change Password identifier is revoked if an API is used to change a user’s password after the user has initiated a change password request.
- Resolves GitHub Issue #1632
Changed
- The JWT authorization method is no longer supported when using the
GET
method on the Retrieve Refresh Tokens API.- The reason for this potentially breaking change is due to concern of potential abuse. If you were previously using a JWT to authorize the request to the
GET
HTTP method, you will need to modify your integration to utilize an API key. See the Retrieve Refresh Tokens API for additional details. - Resolves GitHub Issue #1646
- The reason for this potentially breaking change is due to concern of potential abuse. If you were previously using a JWT to authorize the request to the
- Updated reserved JWT claims by grant type. The
amr
claims is marked as reserved, and will be available in a future release.- Reserved for authorization code and implicit grant,
amr
,exp
,iat
,sub
andtid
. Onlyamr
andtid
are new for this release. - Reserved for Vending API
amr
,exp
andiat
. Only theamr
claim is new for this release. - Reserved for Client Credentials grant,
amr
,aud
,exp
,iat
,permissions
,sub
andtid
. - Resolves GitHub Issue #1669
- Reserved for authorization code and implicit grant,
Fixed
- The requested
AssertionConsumerServiceURL
in a SAML v2AuthNRequest
is ignored and the first URL configured is used instead.- Resolves GitHub Issue #1278, thanks to @pakomp for letting us know!
- Entities don’t support the use of
:
in the permission name, this limitation has been removed.- Resolves GitHub Issue #1480, thanks to @matthewhartstonge for the help!
- An application role may not be immediately available to assign to a user after initial creation. This issue was due to some additional caching introduced in version
1.32.1
.- Resolves GitHub Issue #1575
- The Password Grant response is missing the Two Factor Method Ids when a Two-Factor challenge is required. This issue was introduced in version
1.26.0
when Two-Factor Method Ids were added to the Login API response.- Resolves GitHub Issue #1585
- The Tenant edit and add panel displays Webhook events that are not configured at the Tenant level.
- Resolves GitHub Issue #1593
- FusionAuth may fail to start on Windows when using the
startup.bat
script. See linked issue for a workaround.- Resolves GitHub Issue #1624, thanks to @James-M-Oswald for the assist!
- Enhance email validation to keep obviously incorrect emails from being used during self-service user registration.
- Resolves GitHub Issue #1625, thanks to @pablomadrigal for letting us know!
- When using the GraalJS Lambda engine, you cannot use ECMA 6 features such as
const
oderlet
.- This only affects version
1.35.0
when using the new GraalJS engine, and does not represent a regression because prior to version1.35.0
the only Lambda engine available was Nashorn which only supported ECMA 5.1. - Resolves GitHub Issue #1630
- This only affects version
- When using a Connector, a timing issue exists that could cause a login to fail. See the linked issue for an example exception that you may observe if you encounter this issue.
- Resolves GitHub Issue #1633
- The Tenant View dialog may show the incorrect Event transaction setting for a Tenant created via the API.
- Resolves GitHub Issue #1642
- When the
openid
scope is used along with theoffline_access
scope and then the resulting refresh token is used in a Refresh grant, the returnedid_token
may be signed with the key configured for theaccess_token
.- Resolves GitHub Issue #1643
- Ignore read-only directories inside of the configured plugin directory instead of throwing an exception.
- Resolves GitHub Issue #1655
Enhancements
- Add a separate execute thread pool in the Apache Tomcat configuration to separate incoming requests from localhost callback requests to reduce thread contention.
- Resolves GitHub Issue #1659
- Allow for plugins that require dependent jars in their classpath.
- To take advantage of this capability, create a sub-directory in the configured plugin directory. Place your plugin jar, and any dependant jars in the same directory or nested sub-directories. Each immediate sub-directory of the configured plugin directory will be considered a discrete classloader. Each of these class loaders will still share the parent classloader, so it is still advised to keep dependencies to a bare minimum such that you don’t conflict with existing dependencies of FusionAuth.
- Resolves GitHub Issue #1663
- Minimize the duration of the database Transaction during authentication. This should improve login performance, especially when using an LDAP or Generic Connector.
- Resolves GitHub Issue #1666 (666 😱 yikes)
- Alphabetize the Applications in Select form controls in the FusionAuth admin UI, this should make it easier for those are not robots to navigate when you have many applications.
- Allow a login using a 3rd party IdP such as Google to succeed even if an Elasticsearch exception occurs when attempting to re-index the user.
- Resolves GitHub Issue #1673
New
- Initial technology preview for SCIM Server, this feature is available in the Enterprise edition.
- Resolves GitHub Issue #106
- Nintendo Online Identity Provider, this feature is available with all licensed editions of FusionAuth.
- Resolves GitHub Issue #1206
- New Identity Provider Link & Unlink Events
- Resolves GitHub Issue #1589
- Default the Event Transaction Type in the Tenant configuration to
None
- Resolves GitHub Issue #1644
- New JWT claims
- The
tid
claim is now being set in all JWTs. This is the FusionAuth Tenant Id, and is marked as reserved. - The JWT header will also now contain a
gty
claim which will represent the grant types in order of use for this token. - Resolves GitHub Issue #1669
- The
Internal
- Update Apache Tomcat from
8.5.72
to8.5.77
.- Resolves GitHub Issue #1620
Version 1.35.0
March 10th, 2022
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Fixed
- When using the FastPath installation for Windows, the startup may fail to download Java if you are using the
startup.bat
option for starting services.- Resolves GitHub Issue #1597, thanks to @gkrothammer for the help!
- Using the Identity Provider Link API when more than one tenant is configured may fail unless you are specifying the tenant Id using the
X-FusionAuth-TenantId
HTTP request header.- Resolves GitHub Issue #1609
- Self-service registration may fail to validate an email address beginning with
@
.- Resolves GitHub Issue #1617, thanks to @pablomadrigal for letting us know!
- Using the Passwordless API without passing the OAuth2 state parameters on the URL such as
client_id
, and the user is not registered for the Application, the request may fail.- Resolves GitHub Issue #1623
New
- Initial technology preview for HTTP requests within a lambda function, termed Lambda HTTP Connect. All previously configured lambdas will continue to run on the legacy JS engine. Starting in this release the default engine for newly created lambdas will be GraalJS, but you have the ability to select the preferred engine. When using the GraalJS engine, you will be able to begin making HTTP requests within the lambda function. At some point in the future we will deprecate and fully remove the legacy JS engine (Nashorn). For the time being, use the new engine if you are able, and provide us feedback if you find anything is not working. If you do encounter a problem open an issue, and switch the lambda back to the Nashorn engine.
- HTTP requests (AJAX) in the lambda requires Essentials or Enterprise edition.
- Resolves GitHub Issue #267
- Resolves GitHub Issue #571
Version 1.34.1
February 23rd, 2022
Fixed
- SAML v2 Login to FusionAuth may fail due to an exception.
- Resolves GitHub Issue #1606, thanks so much to @kristianvld for letting us know.
Version 1.34.0
February 21st, 2022
Known Issues
- SAML v2 Login to FusionAuth may fail due to an exception. Please upgrade directly to FusionAuth version >= 1.34.1
- See GitHub Issue #1606 for additional details.
Sicherheit
- Resolve a potential vulnerability in the IdP Link API. If you are actively using any IdP configured to use the
CreatePendingLink
linking strategy, please upgrade at your earliest convenience.- Resolves GitHub Issue #1600
Changed
- When using the OpenID Connect identity provider, you have the option to select one of three client authentication options. You may select
none
,client_secret_basic
oderclient_secret_post
. Some 3rd party identity providers do not allow theclient_id
to be sent in the request body when usingclient_secret_basic
. A strict reading of the OAuth2 and OpenID Connect specifications imply that theclient_id
should only be present in the request body when a client secret is not used, or you have selectednone
oderclient_secret_post
for an authentication method. This change is to make FusionAuth more compliant with 3rd party IdPs that enforce this behavior. It is not expected that this change will have any negative impact on OpenID Connect configurations that have been working up until this release. However, please be aware of this change and verify existing OpenID Connect identity providers continue to behave as expected.- Resolves GitHub Issue #1595
- Utilize PKCE anytime FusionAuth is initiating an Authorization Code grant to FusionAuth. While most of this will be transparent and should not affect any of your integrations, there is one use case in which it is important for FusionAuth to utilize PKCE when performing an Authorization Code grant to FusionAuth. This use case is when you are using an application with PKCE configured as required, and you then use the Device grant using the themed FusionAuth pages. In this case FusionAuth must utilize PKCE in order to pass PKCE validation during the request.
- Resolves GitHub Issue #1598
- When using the interactive Setup Wizard to perform initial setup of FusionAuth, the checkbox to sign up for the FusionAuth newsletter has been changed to be checked by default. This means that prior to this release you had to opt-in, and starting in this release, you will need to opt-out during this step. You also have the option to un-subscribe from the newsletter at any point in the future.
- Resolves GitHub Issue #1577
New
- Native support for PBKDF2 using a 512-bit derived key length. The default PBKDF2 algorithm uses a 256-bit derived key length. Some IdPs such as KeyCloak use a 512-bit key, so this plugin should support an import from KeyCloak without using a custom plugin. This new algorithm is available using the value
salted-pbkdf2-hmac-sha256-512
during the User Import API.- Resolves GitHub Issue #1604
Version 1.33.0
February 7th, 2022
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Sicherheit
- hinzufügen
-Dlog4j2.formatMsgNoLookups=true
to thefusionauth-search
bundled version of Elasticsearch.- Please note, that if you are running a standalone version of Elasticsearch, this will not affect you, and you should still complete any suggested mitigation steps for your Elasticsearch instance. This VM argument added to the
fusionauth-search
bundle is only added to make people feel warm and fuzzy. FusionAuth Cloud users are not vulnerable to CVE-2021-44228, and even if you are self-hosting FusionAuth and utilizing the Elasticsearch bundled withfusionauth-search
you are not vulnerable if you have followed our suggested securing steps. Also due to the version of Java we are using to run Elasticsearch, you are not vulnerable. But we all like to put on our tinfoil hats sometimes, so we are making this change for good measure. - Resolves GitHub Issue #1520
- Please note, that if you are running a standalone version of Elasticsearch, this will not affect you, and you should still complete any suggested mitigation steps for your Elasticsearch instance. This VM argument added to the
- Updated PostgreSQL JDBC driver from version
42.2.22
to42.3.2
.- This update is only pertinent to you if you are using a PostgreSQL database. If you are using MySQL, you are not vulnerable.
- FusionAuth Cloud users are not affected. If you are self-hosting FusionAuth you are only vulnerable if you allow un-authorized modifications to your JDBC connection string used by FusionAuth to connect to the database. I hope you are not doing this. 😉 Please read the following CVE to better understand the vulnerability to see how it may or may not affect you.
- CVE-2022-21724.
- Resolves GitHub Issue #1535
- Proactively upgrade Logback. Instead of Log4J, FusionAuth uses Logback. In response to the recent vulnerabilities in Log4J, the Logback team has proactively added some additional hardening to their library to ensure similar vulnerabilities are not found.
- Resolves GitHub Issue #1530
- Better protection against malicious actors that have access to configuring Themed templates.
- Resolves GitHub Issue #1549
- Ensure we enforce a Two-Factor challenge before changing a password using the Change Password API.
- Resolves GitHub Issue #1591
Changed
-
If you are using the Change Password API with users that have Two-Factor enabled you may need to adjust your integration. Beginning in this release, to use the Change Password API for a user with Two-Factor enabled, you will need to obtain a Trust Token from the Two Factor Login API in order to complete this request. This is potentially a breaking change, the decision was made to make this potentially breaking change due to the enhanced security provided by this change.
- Resolves GitHub Issue #1591
Fixed
- The FastPath install may fail to download Java on versions
>= 1.32.0
. The issue was that thecurl
request needed to be configured to follow a redirect with the new URLs for the Java download. See the linked issue for a workaround if you want to use FastPath for an older version.- Resolves GitHub Issue #1519
- Ensure we are able to handle Login records that may contain more than one IP address. When passing through a proxy, the
X-Forwarded-For
HTTP request header may contain more than one IP address. This fix ensures we parse this header correctly and handle existing Login records that may have been recorded with more than one value.- Resolves GitHub Issue #1521
- Using the Login with Apple button on a themed login or registration page may fail when using Safari on iOS 12. A workaround is documented in the linked GitHub issue if you are unable to upgrade FusionAuth.
- Resolves GitHub Issue #1526
- The Event Log, Audit Log, Login Records search feature in the FusionAuth admin UI may not reset the pagination correctly when beginning a new search request.
- Resolves GitHub Issue #1501
- Group Membership may not be preserved after the first login request when using a Connector without migration.
- Resolves GitHub Issue #1432
- The
jwt.refresh-token.revoke
event may not be sent during a request to the Logout API (/api/logout
).- Resolves GitHub Issue #1522, thanks to @TimVanHerwijnen for all the help!
- A consent added to a self-service registration form may show up incorrectly during a complete registration step during login.
- Resolves GitHub Issue #1259
- Resolves GitHub Issue #1261
- Better support for
user.birthDate
when using Advanced self-service registration when Family is enabled with child registration. - When configuring more than one preferred language in the FusionAuth admin UI on the User or User Registration, the order may not be preserved. For example, if you configured
French, English
whereFrench
is the preferred languages, with a second option ofEnglisch
, when saving the form, the serialized value will becomeEnglish, French
and will not likely be saved in the order you expect. - Fix a potential memory leak in the Email services. If you are sending a lot of email through FusionAuth, this error may cause your FusionAuth service to run out of memory. Restarting the service periodically can mitigate this potential if you are unable to upgrade. This issue was most likely introduced in version
1.30.1
.- Resolves GitHub Issue #1548
- When completing a Family workflow where a parent joins a child to a family, the
parentEmail
field may not be properly updated in the search index.- Resolves GitHub Issue #1550
- If you have previously configured Basic Self-Service registration, and then begin using Advanced Self-Service it is possible that a validation may occur that you did not expect.
- Resolves GitHub Issue #1560
- Some edge cases exist when using the Async Tenant Delete API or deleting a Tenant in the FusionAuth admin UI where a tenant may get stuck in the Pending Delete state.
- Resolves GitHub Issue #1559
Enhancements
- Add the underlying host architecture and operating system name and version to the About panel in the FusionAuth admin UI. See System -> About .
- Resolves GitHub Issue #1531
- Add a tooltip to the Webhook Application configuration to help reduce some confusion until we deprecate this Application configuration.
- Resolves GitHub Issue #1542
- Support longer Refresh Tokens on the Refresh Tokens Import API. The previous limitation was that the refresh token was less than or equal to
191
characters. The assumption was made that this token was opaque and that191
was very adequate. Some IdPs utilize JWTs for Refresh Tokens and in this case, the length is likely to exceed the previous limitation. This enhancements allows for longer refresh tokens. In particular this will provide better support for importing Refresh Tokens from KeyCloak. See the Import Refresh Tokens API for additional details.- Resolves GitHub Issue #1541
- Use a better thread pooling strategy for Webhooks to better support a very large volume of events where the event recipient may not respond quickly enough. This allows more events to be queued up if we cannot send them fast enough while waiting for a response from the webhook.
- Resolves GitHub Issue #1500
- Improve licensing errors on the API and FusionAuth admin UI to better differentiate between not licensed, and a feature that requires a specific licensed feature. In particular, some of the features introduced as part of the Threat Detection feature require an Enterprise License with this feature enabled. So you may have a licensed edition of FusionAuth, and a feature may still not be available. This change should make it clearer why a particular feature cannot be enabled.
- Resolves GitHub Issue #1555
- hinzufügen
tokenExpirationInstant
to the Login Response similar to how the Token endpoint response returnsexpires_in
to indicate when the access token returned in the response will expire.- Resolves GitHub Issue #1309
- Additional User API validation in support of Family configuration with child registration restrictions.
- Resolves GitHub Issue #1561
- Support for ARM 64, the Apple M1, AWS Graviton, etc. Docker images are now published for Intel, and various ARM architectures, and FastPath and other installation paths have support for downloading Java for the correct architecture.
- Resolves GitHub Issue #1532, GitHub Issue #49. Thanks to many of our community superstars for the help with this one! @rscheuermann, @jerryhopper, @ceefour, @dmitryzan
- Add the option to use the
userId
on the Start Two-Factor API ** Resolves GitHub Issue #1571 - Move the
changePasswordId
to the request body during a POST request. For backwards compatibility, thechangePasswordId
will also be accepted on the URL segment.- Resolves GitHub Issue #1214
Version 1.32.1
December 13th, 2021
Fixed
- If you are modifying the user email or username in an Identity Provider Reconcile Lambda, the lambda may be invoked more than once after the initial link has been established. This may cause User registration data to be modified, or lost. If you have not yet upgraded to this version, it is advised that you wait until you can update to version
1.32.1
.- Resolves GitHub Issue #1517, thanks to @Oceanswave for letting us know and for the fantastic bug write up!
- The
1.32.0
version of the Docker image was initially released with a missing Java module that may cause the image to fail during startup. An updated version of the image has been released, if you encounter an issue, please delete your local version of the image and pull it again. The issue is also resolved in this version, so you may also pull thelatest
tag once this version is available.- Resolves GitHub Issue #1518
Version 1.32.0
December 10th, 2021
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Changed
- This version of FusionAuth will now run on Java 17. If you are using any SAML v2 IdP configurations that still utilize a legacy XML signature algorithm, this upgrade may break that integration.
- It is recommended to test your SAML v2 IdP logins with this version prior to upgrading, or confirm that all of your IdPs are not using any of the following restricted XML signature algorithms:
**
http://www.w3.org/2000/09/xmldsig#sha1
**http://www.w3.org/2000/09/xmldsig#dsa-sha1
**http://www.w3.org/2000/09/xmldsig#rsa-sha1
- See GitHub Issue #1202 for additional details and an optional workaround if you are unable to discontinue use of these algorithms.
- It is recommended to test your SAML v2 IdP logins with this version prior to upgrading, or confirm that all of your IdPs are not using any of the following restricted XML signature algorithms:
**
Fixed
- The global and application registration count rollup may fail when using PostgreSQL. This will cause the registration count reports to be incorrect.
- Resolves GitHub Issue #1498
- When using the Development Reset feature (technical preview) and the FusionAuth application is configured to use a specific theme, the reset will fail.
- Resolves GitHub Issue #1514
Enhancements
- Identity provider linking that was introduced in version 1.28.0 can now optionally be configured to limit the number of unique links to an IdP for a particular user.
- Resolves GitHub Issue #1310
- Allow application URIs to be configured as an OAuth2 Authorized request origin URLs. For example, you may now configure
android-app://com.example
as a valid Authorized request origin.- Resolves GitHub Issue #1443, thanks to @bonify-b2b for the request.
- Add configuration to allow implicit email verification to be disabled. For example, prior to this release, email based workflows such as Passwordless login, email based registration verification, email based password change, and verifying a two-factor code during login through an email would implicitly mark a user’s email as verified if email verification was enabled and the user had not yet completed email verification. In most cases this seems to be the best choice for the end user such that they do not perform redundant tasks to verify their email address once they have provided evidence they have access to the email address. This configuration allows this behavior to be disabled if you wish to require your end user to always go through a specific email verification process for legal or other similar reasons.
- Resolves GitHub Issue #1467, thanks to @lliu-20200701 for the request.
- Add a notice on the Device workflow panel when an existing SSO session exists to allow the user to optionally logout prior to continuing.
- Resolves GitHub Issue #1495
New
- You may optionally specify custom SMTP headers in the Tenant email configuration. These configured headers will be added to all outbound messages.
- Resolves GitHub Issue #628, thanks to arni-inaba for the suggestion.
Internal
- Java 17 LTS. Update to the latest long term support version of Java.
Version 1.31.0
November 18th, 2021
Known Issues
- If you are modifying the user email or username in an Identity Provider Reconcile Lambda, the lambda may be invoked more than once after the initial link has been established. This may cause User registration data to be modified, or lost. If you have not yet upgraded to this version, it is advised that you wait until you can update to version
1.32.1
.- Resolved in
1.32.1
by GitHub Issue #1517
- Resolved in
Changed
- You may now modify, or fabricate an email or username in the Identity Provider Reconcile Lambda regardless of the Identity Provider type.
- Some of this capability has been provided in the past for the OpenID Connect Identity Provider. This capability was removed in version
1.28.0
when Identity Provider Linking was introduced due to the additional use cases now supported through linking strategies. Due to high demand, and many real world use-cases presented by our users, this decision has been reversed in favor of flexibility for the developer. Please use caution when using this capability, and note that if you create or modify ausername
oderemail
in the Reconcile lambda, the lambda will be invoked twice during a single login request. - Resolves GitHub Issue #1425
- Some of this capability has been provided in the past for the OpenID Connect Identity Provider. This capability was removed in version
Fixed
- Requiring a birthdate on a self-service registration form when also requiring a parent email may cause an exception.
- Resolves GitHub Issue #702
- Improvements to locale handling to expand beyond ISO 639 support to support locales such as
es_419
,aghem
and others.- Resolves GitHub Issue #978
- Resolves GitHub Issue #1132
- Disabling webhooks on the tenant configuration by clicking on the Enabled table header doesn’t work as expected.
- Resolves GitHub Issue #1123
- Fix general message template issues when using the preview action for a message template, or a localized version of the template.
- Resolves GitHub Issue #1171
- An API key created using Kickstart is not validated for length correctly.
- Resolves GitHub Issue #1397, thanks to @miaucl for reporting!
- The error message returned to the end user when a webhook fails during a Self-Service Registration is not able to be customized through a theme.
- Resolves GitHub Issue #1446
- The Theme preview may not render the Account Edit themed page when a Self-Service form is configured
- Resolves GitHub Issue #1448
- Unable to delete an email template when an email template is not assigned to a Consent.
- Resolves GitHub Issue #1449
- A timing issue exists when creating a new Application role, and then immediately attempting to register a user with that role.
- This issue was introduced in version
1.30.2
- Resolves GitHub Issue #1452, thanks to one of our MVPs @johnmaia for reporting!
- This issue was introduced in version
- Using an expired Passwordless link may result in an infinite redirect
- This issue was introduced in version
1.27.0
when support for Microsoft Outlook Safe Links was added via GitHub Issue #629 - Resolves GitHub Issue #1456, thanks to @rscheuermann for the report!
- This issue was introduced in version
- Missing validation on the Registration API to ensure the User exists by Id when passing the
userId
on the HTTP request URL segment- Resolves GitHub Issue #1457
- When copying a Tenant in the FusionAuth admin UI when the source Tenant has Blocked domain configuration present, the Blocked domain configuration is not copied to the new tenant.
- Resolves GitHub Issue #1459
- When using the OAuth2 Password grant (Resource Owner Credentials grant), and the
client_id
is provided in the HTTP Basic Authorization header, but not in the HTTP post body, the resulting JWT will not contain theaud
claim.- Resolves GitHub Issue #1462
- A database foreign key violation may occur in the Registration Count aggregation service if you delete a Tenant before the aggregator runs.
- This issue was introduced in version
1.30.2
. - Resolves GitHub Issue #1466
- This issue was introduced in version
- Enabling Two-Factor in the Self-Service themed forms, or in the admin UI may fail to render the QR code if the encoded string used to build the QR code is between 192 and 220 characters in length.
- Resolves GitHub Issue #1470, thanks to @jasonaowen for letting us know and helping us debug it!
- When a user is assigned roles explicitly through a User Registration in addition to a Group membership, the roles assigned by the Group membership will not be returned.
- This issue was introduced in version
1.30.2
vi GitHub Issue #480 - Resolves GitHub Issue #1473
- This issue was introduced in version
- When using the Setup Password email template provided by FusionAuth with the User Registration API to create a User and a Registration in a single API call the URL generated and sent to the user may not be usable. A
client_id
will have been added to the URL which will result in an error when the FusionAuth page is rendered. To work around the issue prior to this release, please remove theclient_id
from the Email template.- Resolves GitHub Issue #1476
- A SAML v2 SP using an HTTP Redirect Binding that has URL encoded the query string using lower case percent encoding may cause FusionAuth to fail to validate the signature.
- Resolves GitHub Issue #1496, thanks to engineering team at HAProxy for the assist!
Enhancements
- You may now access the
id_token
when available during an OpenID Connect Reconcile lambda- Resolves GitHub Issue #323, thanks to @Thammada for opening the issue!
- Add additional support for
idp_hint
for Apple and Twitter Identity Providers.- Resolves GitHub Issue #1306
- Add an example use and changed user to the Audit Log Test event when using the Webhook Tester in the FusionAuth admin UI
- Resolves GitHub Issue #1360
- When FusionAuth is unable to discover OpenID endpoints using the configured Issuer during configuration of an OpenID Connect Identity Provider an Event Log will be produced to assist you in debugging the connection.
- Resolves GitHub Issue #1417
Internal
- Update the internal scheduler library.
- Resolves GitHub Issue #1461
Version 1.30.2
October 13th, 2021
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Fixed
- When logging in with an anonymous user from an IdP that now has a linking strategy other than Anonymous an exception occurs. This can occur if you change your linking strategy from Anonymous to something else, and users that were created while configured as Anonymous log in again.
- Resolves GitHub Issue #1316
- The view dialog may not completely render for an SAML v2 IdP Initiated IdP configuration. The dialog fails to completely render due to a FreeMarker exception.
- Resolves GitHub Issue #1324
- If you are activating FusionAuth Reactor during initial startup via Kickstart, and you have CAPTCHA enabled for the FusionAuth admin application, you may not be able to login until the Threat Detection feature comes online. Depending upon your network connection, this may take a few seconds, or a few minutes.
- Resolves GitHub Issue #1358
- The .NET client library handled
exp
and other JWT timestamp values incorrectly.- Resolves GitHub Issue #1362, thanks to @RyanDennis2018 for reporting.
- When using the duplicate Application button in the admin UI, if the source Application has SAML v2 configured, but not enabled, the copy may fail with an exception.
- Resolves GitHub Issue #1366
- Updating a connector will add an additional
*
domain configuration. This is a regression issue introduced in version1.28.0
.- Resolves GitHub Issue #1367
- When generating an RSA Key, a user cannot specify a certain Id.
- Resolves GitHub Issue #1368
- If using kickstart to activate a licensed instance with advanced threat detection enabled, it is possible to get stuck in the Setup Wizard.
- Resolves GitHub Issue #1369
- A user can add new entries to an access control list, but can’t delete them using the administrative user interface.
- Resolves GitHub Issue #1371
- Default lambdas are no longer available in Kickstart environment variables. This is a regression introduced in version
1.30.0
.- Resolves GitHub Issue #1373
- The event payload for a user deactivation was not complete when the deactivation happened via the administrative user interface. It lacked some information such as the IP address of the request.
- Resolves GitHub Issue #1375
- When both Kickstart and maintenance mode occur during an upgrade, a NullPointerException could occur if the default tenant Id was being modified.
- Resolves GitHub Issue #1382
- The IP address can be missing from login records in certain circumstances.
- Resolves GitHub Issue #1391
- Requests with IPv6 addresses cause NumberFormatExceptions.
- Resolves GitHub Issue #1392
- CAPTCHA may not work on the email verification required page.
- Resolves GitHub Issue #1396
- Rendering the passwordValidationRules object on the register page in theme preview does not work.
- Resolves GitHub Issue #1398
- User search widget has an empty value if the user does not have a name.
- Resolves GitHub Issue #1399
- Filling out a CAPTCHA through self service registration or other paths does not save device trust; the user will be prompted a second time.
- Resolves GitHub Issue #1400
- Setup Wizard may be shown in a multi-node environment after it has completed.
- Resolves GitHub Issue #1402
- When using advanced threat detection rate limiting, users are unable to set the rate limit configuration to 1 to allow a limited action be performed only once.
- Resolves GitHub Issue #1407
- Custom data for webhooks not displayed in the admin UI.
- Resolves GitHub Issue #1422
- A truncated deflated SAML AuthN request was not handled as well as it should have been.
- Resolves GitHub Issue #1424
- Some key pairs capable of signing a SAML request are not eligible in the UI.
- Resolves GitHub Issue #1430
- Custom data for connectors not displayed in the admin UI.
- Resolves GitHub Issue #1435
Enhancements
- When using MySQL with a large number of applications, and application roles, it may become slow to retrieve a user. This change should improve performance when using MySQL.
- Resolves GitHub Issue #480, thanks to @nikos and David B. for the assist!
- Improve the performance of using the Public Key API endpoint when you have a lot of applications and keys.
- Resolves GitHub Issue #1145, thanks to @nulian for reporting, and @Johpie for the additional debug.
- Display the database version and elastic search versions in the administrative user interface.
- Resolves GitHub Issue #1390
- Improve User and Registration API performance at scale.
- Resolves GitHub Issue #1415
- Try to support SAML POST bindings with SSO even when cookie samesite policy is set to
SameSite=Lax
.- Resolves GitHub Issue #1426
- Add a default NameID format when one is not provided on SAML AuthN or Logout requests.
- Resolves GitHub Issue #1428
Internal
- Update Apache Tomcat from
8.5.63
to8.5.72
.- Resolves GitHub Issue #1433
Version 1.30.1
August 25th, 2021
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- Registration counts may fail to be rolled up into reports when using PostgreSQL. Updating to
1.30.2
should resolve the issue.- Resolved in
1.32.0
by GitHub Issue #1498
- Resolved in
- A potential memory leak was introduced in this version. Updating to
1.33.0
should resolve the issue, if you are unable to upgrade, restarting the service periodically can mitigate this potential issue.- Resolved in
1.33.0
by GitHub Issue #1548
- Resolved in
Fixed
- The Text MIME type of an email may not render unicode correctly when the host system does not have
UTF-8
set as the default character set.- Resolves GitHub Issue #1122, thanks to @soullivaneuh for the report!
- Unable to assign an IP ACl to an application if one is not already assigned to the tenant.
- Resolves GitHub Issue #1349
- Unable to delete an IP ACL in use by a tenant
- Resolves GitHub Issue #1350
Enhancements
- General performance improvements for login, OAuth2 grants, and user create and registration.
- Add the User Two Factor methods to the Elasticsearch index.
- If you have existing users with Two-Factor enabled, you will want to perform a re-index in order to search on two-factor configuration.
- Resolves GitHub Issue #1352, thanks to one of our favorite FusionAuth users @flangfeldt for making the request.
Internal
- Performance improvements
Version 1.30.0
August 12th, 2021
Features that require the Threat Detection feature:
- CAPTCHA
- Domain blocking in registration
- IP access control lists
- IP location
- Some of the new events and transactional emails
- Rate limiting
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- If you are referencing any Reconcile Lambda Ids using the syntax
FUSIONAUTH_LAMBDA{type}_ID
- this may no longer work due to a change in how these default lambdas are initialized.- The current work around is to modify your kickstart to build your own version of this lambda instead of using the FusionAuth default.
- You will find a copy of the default lambdas shipped with FusionAuth in the Lambda documentation that you may use to copy into your kickstart.
- The issue is being tracked here GitHub Issue #1373
Fixed
- Unable to enable
user.action
event at the tenant using the UI. If you encounter this issue, you may work around it by using the Tenant API.- Resolves GitHub Issue #1307
- If you make an API request to
/api/two-factor/login
with an empty JSON body, an exception will occur instead of a validation error being returned with a400
status code.- Resolves GitHub Issue #1330
- When using an IdP with a linking mode other than Create Pending Link, the token may not correctly be stored. If you previously had been using the token stored on the User Registration, and are now looking for it in the Identity Provider Link, you may not find it. This fix resolves the issue.
- Resolves GitHub Issue #1341
- When you are using FusionAuth as a SAML v2 IdP with Redirect bindings, you were unable to use idp_hint to bypass the login page to federate to another provider.
- Resolves GitHub Issue #1331
Changed
- New themed page added for Unauthorized access.
- A macro available to themes named
[@helpers.input]
was modified to be able to build a checkbox. This change could affect you if you try to copy and paste the checkbox usage without modifying the macro definition in your Helper file. Review the Upgrading section for information on how to resolve potential breaking changes.
New
- JWT Vending machine
- This allows a JWT to be created for a not-yet-existing user with a payload defined by the API caller.
- Resolves GitHub Issue #525
- FusionAuth wasn’t awesome enough, so we added a robust Threat Detection feature for enterprise customers. This feature includes:
- IP Access Control for API keys
- This allows support for an API key to be further restricted by the origin IP address.
- Resolves GitHub Issue #933
- IP Access Control for SSO and self service forms
- This allows you to limit access to the FusionAuth SSO or a particular application login through SSO by IP address
- Blocked domain configuration to limit registrations from specific email domains
- Rate limiting per user for the following requests:
- Failed login (only used if Failed Login configuration is not in use)
- Forgot password
- Send email verification
- Send passwordless
- Send registration verification
- Send two-factor
- Captcha - add CAPTCHA to login and other end user forms to help ensure only humans are submitting forms.
- This feature is in tech preview and is subject to change.
- Support for Google ReCaptcha v2, Google ReCaptcha v3, HCaptcha and HCaptcha Enterprise
- Resolves GitHub Issue #278
- IP location.
- When possible, an IP address will be resolved to include city, country, region, zip code, longitude and latitude.
- IP location will be included in login records and will be available in some email templates and webhook events
- Used to calculate impossible travel between login locations
- New Webhook events:
- Audit Log Create
audit-log.create
- Event Log Create
event-log.create
- Kickstart Success
kickstart.success
- User Create Complete
user.create.complete
- User Delete Complete
user.delete.complete
- User Update Complete
user.update.complete
- User LoginId Duplicate On Create
user.loginId.duplicate.create
- User LoginId Duplicate Update
user.loginId.duplicate.update
- User Email Update
user.email.update
- User Login New Device
user.login.new-device
- User Login Suspicious
user.login.suspicious
- User Password Reset Success
user.password.reset.success
- User Password Reset Send
user.password.reset.send
- User Password Reset Start
user.password.reset.start
- User Password Update
user.password.update
- User Registration Create Complete
user.registration.create.complete
- User Registration Delete Complete
user.registration.delete.complete
- User Registration Update Complete
user.registration.update.complete
- User Two Factor Method Added
user.two-factor.method.add
- User Two Factor Method Removed
user.two-factor.method.remove
- See the Event Webhooks documentation for additional details.
- Resolves GitHub Issue #1308, thanks to @adoliver for the suggestion!
- Resolves GitHub Issue #1178
- Resolves GitHub Issue #1128
- Resolves GitHub Issue #1129
- Audit Log Create
- New transactional emails:
- Email update
- Login Id duplicate on create
- Login Id duplicate on update
- Login with new device
- Suspicious login
- Password reset success
- Password update
- Two-factor method added
- Two-factor method removed
Enhancements
- Search on
oldValue
,newValue
andreason
in the Audit Log.- See the Audit Log Search API for additional details on searching on
oldValue
,newValue
andreason
in the audit log.
- See the Audit Log Search API for additional details on searching on
- When using IdP linking in conjunction with the Oauth2 Device grant, the recently completed links will be available on the Device complete themed page by using the
completedLinks
variable.- See the Device Complete themed page documentation for additional details.
- More themed pages will have access to the currently logged in user using the
currentUser
variable.- See the Theme documentation for additional details.
Version 1.29.4
August 12th, 2021
Fixed
- When a user is required to complete registration after login, the user may no longer be able to login w/out a password reset. This is a regression from version 1.28.0, and only affects those using self-service registration that will have existing users that do not have all required fields on their account.
- Resolves GitHub Issue #1344, thanks to @flangfeldt for reporting the issue
Version 1.29.3
August 6th, 2021
Fixed
- A
404
may be returned when attempting to update a user withPUT
oderPATCH
on the User API if the user has an unverified email and email verification has been disabled.- Resolves GitHub Issue #1333
Version 1.29.2
July 31st, 2021
Fixed
- When using a SAML v2 IdP that does not send back a
KeyInfo
element in the XML response, an exception may occur when attempting to parse the response.- Resolves GitHub Issue #1332
Version 1.29.1
July 26th, 2021
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Fixed
- In a multi-tenant configuration, SSO sessions may be pre-maturely terminated if one tenant has a lower TTL configuration than the other tenants. To work around this issue prior to this release, ensure all SSO TTL configurations are equal.
- Resolves GitHub Issue #1262
- The arg names in the
LambdaType
enum were not all correct.- Resolves GitHub Issue #1284
- An IdP Debug event log may not get produced when a unique Id could not be resolved.
- Resolves GitHub Issue #1315
- When enabling the SAMl v2 IdP debug log an exception may be taken when attempting to produce the debug event log. The result is that the debug log will not be produced.
- Resolves GitHub Issue #1317
Version 1.29.0
July 10th, 2021
Fixed
- When viewing the theme preview for the
oauth2/start-idp-link.ftl
template, and error may be logged.- Resolves GitHub Issue #1276
- When a webhook transaction fails to create a user or registration on a themed page, a non-themed error page may be displayed
- Resolves GitHub Issue #1279
Enhancements
- Enhance the Link API to retrieve a user by a 3rd party unique Id to identify a FusionAuth user is linked to the user. See the Link API for additional details.
- Resolves GitHub Issue #1277
- During a device link request which contains a device linking token, show an intermediate page asking the user if they would like to sign in with an existing user or create a new user.
- Resolves GitHub Issue #1287
- Allow the IdP Login API to optionally be passed a request parameter to indicate a link should not be established and a
404
should be returned instead. This is useful if you wish to identify if a link exists first before starting an auxiliary workflow such as a device grant with a linking token. See the Login API for additional details.- Resolves GitHub Issue #1288
- Add additional configuration to the unique username configuration to support always appending a suffix even when the username is not in use. See the Tenant API for additional details.
- Resolves GitHub Issue #1290
- Add an additional debug event log when for the SAML IdP to debug the
AuthN
request sent to the SAML IdP- Resolves GitHub Issue #1293
- In version
1.28.0
the resolution of the value returned by the SAML v2 IdP in theNameID
was modified. If the IdP returns a format ofunspecified
with a value ofemail
then after upgrading to version1.28.0
your SAML IdP will not function properly. Ideally you would ask your IdP to return you a NameID format ofemailAddress
, but if that is not possible this enhancement will allow FusionAuth to accept the value returned in theNameID
if the format is returned asunspecified
.- Resolves GitHub Issue #1294
- Instead of logging FreeMarker exceptions to the system log and producing a stack trace that may end up in the UI, an event log will be produced. The message in the UI will be condensed based upon the runtime mode. When in
development
mode some details will be provided to assist in debugging your themed template. If inproduction
runtime mode only a message indicating an error occurred will be displayed to the user.- Resolves GitHub Issue #1299
Internal
- Update HikariCP from
3.4.1
to4.0.3
, and update PostgreSQL JDBC driver from42.2.14
to42.2.22
- Resolves GitHub Issue #1300
Version 1.28.1
June 21st, 2021
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Fixed
- Allow self-consent form field on a self-service form.
- Resolves GitHub Issue #1258
- Correct validation of a consent form field on edit. Control type was failing validation on edit.
- Resolves GitHub Issue #1260
- An imported user requiring password change, and email verification may fail to verify email verification with an email verification gate.
- Resolves GitHub Issue #1265
- Better parsing of the
X-Fowarded-For
HTTP request header. This header may contain one to many IP addresses, and only the first value should be preserved for the login record. Prior to this fix, it would be possible to see a login record that contained multiple IP addresses separated by a comma.- Resolves GitHub Issue #1267
- Correctly show the Verification URL in the OAuth2 configuration when the
Device
grant is selected. This issue was introduced in1.28.0
.- Resolves GitHub Issue #1268
- Use the correct FusionAuth redirect URL when using the Sony Playstation Network IdP.
- Resolves GitHub Issue #1269
- Use the correct FusionAuth redirect URL when using the Steam IdP. This IdP uses an Implicit grant and should be using the
/oauth2/callback/implicit
callback URL.- Resolves GitHub Issue #1272
- Allow the Epic Games IdP to function properly when omitting the
scope
configuration property.- Resolves GitHub Issue #1273
Tech Preview
- You may optionally start an account link when beginning a Device grant.
- Resolves GitHub Issue #1274
Version 1.28.0
June 7rd, 2021
The FusionAuth identity providers have undergone a significant improvement to add additional flexibility and support for 3rd parties. Please take time to test this upgrade with your existing configuration to ensure compatibility. Some of the features in this release are in tech-preview.
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- If you are using self-service registration there is a possibility that a user may be required to complete registration by adding additional fields to their account after they login. In this scenario it is possible that they will no longer be able to login and will be required to reset their password. The fix for this was added in
1.29.4
.- Fixed in
1.29.4
, under GitHub Issue #1344, thanks to @flangfeldt for reporting the issue
- Fixed in
- If you are using the SAML v2 Populate Lambda or the SAML v2 Reconcile Lambda the
NameID
field has been changed to an array. You will need to update your lambda code if you are using this field.
Changed
- You may no longer build a synthetic email address using a lambda for an OpenID Connect identity provider. This has been removed because you may now link a user by username or create a link w/out a username or an email to an existing FusionAuth user. If you are using this feature, you may need to plan for a migration to this new behavior. If you have a support contract with FusionAuth, please reach out and ask for additional information.
- When using FusionAuth as a SAML IdP, FusionAuth will now accept
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
in addition tourn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
. This should allow FusionAuth to work with SAML v2 service providers that only support the persistent NameID format. - Tokens returned by IdPs are no longer stored on the User Registration object in the
tokens
field. Each token is now stored with the IdP link for the User and the IdP. See the Link API for additional details.
New
- Reindex API
- Resolves GitHub Issue #1232
- See the Reindex API for usage.
- Account Link API
- This API will allow you to link and un-link users in 3rd party identity providers with a FusionAuth user.
- See the Link API for usage.
- IdP Linking options
- Each Identity Provider may now be configured with a linking strategy. The strategies will include linking by email, username, anonymous or a link to an existing user.
- Linking by username is now supported. There is a higher risk of account takeover using this strategy, you should use caution when using this feature.
- Tokens from identity providers should now be retrieved from the link, rather than the registration. More information can be found under
identityProviderLink.token
response value here
- Email Send API allows an email address in the To field instead of only allowing FusionAuth userIds
- See the Email Send API for additional details.
- SAML Identity Provider can now be configured to use any NameID format. Previously only the Email NameID format was utilized.
- This should allow the SAML identity provider configuration to be more flexible and work with additional SAML identity providers.
Enhanced
- When FusionAuth is acting as a SAML Identity Provider, you may now send a NameID format of Email or Persistent.
- This should allow FusionAuth to work with additional SAML service providers such as Slack.
- Resolves GitHub Issue #522
- The Email Send API now allows you to send to a user that does not yet exist in FusionAuth by allowing you to specify an email address for the
To:
field.- Resolves GitHub Issue #743
- See the Email Send API for additional details.
- The Facebook and Google Identity Providers will now default to using a redirect instead of a popup for login. All existing configurations will be migrated to use the popup dialog to remain consistent with the previous behavior. With this update you may now also use the
idp_hint
parameter to login with Facebook and Google.- Resolves GitHub Issue #909
- Additional PKCE and Client Authentication configuration
- You may now optionally configure PKCE as required, not required, or required when not using a confidential client. This offers better compatibility when multiple client types (a webapp and a mobile app, for example) are authenticating against a single FusionAuth application.
- Resolves GitHub Issue #1152
- Add the currently selected Two Factor method object to the Themed Two Factor page
/oauth2/two-factor
- Resolves GitHub Issue #1237, thanks to one of our MVPs - @flangfeldt for the suggestion!
- Allow using IdP buttons on the Themed registration page
- Resolves GitHub Issue #554, thanks to @gordody for the request!
- When using email verification required with the gated configuration, optionally send the user another email before entering the gated page if the user does not have an existing verification email that is not expired.
- Resolves GitHub Issue #1247, thanks to @lliu-20200701 for the suggestion.
Fixed
- Do not add the
NotBefore
assertion on the SAML AuthN response on the subject confirmation.- Resolves GitHub Issue #1215, thanks to @pakomp for pointing out this issue!
- When importing users with
passwordChangeRequired=true
w/out specifying the change reason an exception may occur during login.- Resolves GitHub Issue #1245, thanks to @lliu-20200701 for finding this bug.
- When using the email verification gate and self-service registration if a user requires their email to be verified and is forced through the complete registration flow they will not be correctly gated.
- Resolves GitHub Issue #1246, thanks to @lliu-20200701 for reporting!
- Fix a JavaScript bug that may cause some of the themed pages to render incorrectly in the view window.
- Resolves GitHub Issue #1228, thanks to @flangfeldt for reporting!
Tech Preview
- New IdPs for EpicGames, Nintendo, Sony PlayStation Network, Steam, Twitch, Xbox - see link for more information
- Resolves GitHub Issue #1205 - Sony Playstation Network
- Resolves GitHub Issue #1206 - Nintendo ** Note, the Nintendo IdP is not yet fully functional. This will be completed in a patch release.
- Resolves GitHub Issue #1207 - Twitch
- Resolves GitHub Issue #1208 - Steam
- Resolves GitHub Issue #1209 - Epic Games
- Resolves GitHub Issue #1210 - Xbox
- Development kickstart reset. When you are running in
development
runtime mode, you’ll see aZurücksetzen
menu item in the System navigation menu.- See System -> Reset
- There is now a JWT populate lambda for the Client Credentials grant. See link for more information.
- Resolves GitHub Issue #1233
Version 1.27.2
May 10th, 2021
Changed
- In version
1.26.0
the ability to useuser.data.email
for Forgot Password and Passwordless login flows was removed. Support for this behavior has been restored in this patch.- Resolves GitHub Issue #1204, thanks to @mcs for letting us know how this change impacted his usage.
Fixed
- When building a new theme starting with 1.27.0, you may encounter a JavaScript error during page render. This error should not cause any end user failures, but the login may not properly capture the browser type.
- Resolves GitHub Issue #1216
Version 1.27.1
May 7th, 2021
Fixed
- When migrating from 1.26.0 or earlier to version 1.27.0 the initial render of the add Tenant panel in the admin UI may fail to render. If you encounter this issue, you may upgrade or edit the FusionAuth tenant first and then try the request again.
- Resolves GitHub Issue #1196
- Make the verification flow simpler when you enable both email and registration verification during self-service registration.
- Resolves GitHub Issue #1198
- The view dialog for the SAML v2 IdP Initiated configuration may not render correctly.
- Resolves GitHub Issue #1200
- When configuring the SAML v2 IdP Initiated Login configuration for an IdP that has a
issuer
that is not a URL the configuration will fail because we are expecting a URL for this field.- Resolves GitHub Issue #1203
Version 1.27.0
May 5th, 2021
Some of the features in this release are in tech-preview. Please give us feedback and let us know how they work for you!
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Changed
- Login API now returns
213
for Registration Not Verified.- See the Login API response for additional details.
- The Login API and the User API may optionally return a
emailVerificationId
oderregistrationVerificationId
to assist the developer in completing a verification workflow when the verification strategy has been configured to use a short code instead of a long “clickable” link.- See the Login API response for additional details.
- The Verify Email API now takes the
verificationId
in the request body instead of a URL segment. See the Verify Email API for additional details.- This change is backwards compatible, but the deprecated use of the API may be removed in the future.
- The client libraries methods have also been preserved, but a new method has been added to accept a request body.
- The Verify Registration API now takes the
verificationId
in the request body instead of a URL segment.- This change is backwards compatible, but the deprecated use of the API may be removed in the future.
- The client libraries methods have also been preserved, but a new method has been added to accept a request body.
- When calling
PUT
on the Login API (ping) the response may optionally return anemailVerificationId
oderregistrationVerificationId
to assist the developer in completing a verification workflow when the verification strategy has been configured to use a short code instead of a long “clickable” link.- See the Login API response for additional details.
- The User API and Registration API may optionally return an
emailVerificationId
or a map of registration verification Ids to assist the developer in completing a verification workflow when the verification strategy has been configured to use a short code instead of a long “clickable” link.- See the User and Registration API response examples for additional details.
Fixed
- CleanSpeak username filtering may not always work when using advanced self-service registration forms with only one step.
- Resolves GitHub Issue #1158
- Link to SAML v2 IdP Initiated Add in the admin UI was missing. See GH issue for a work around.
- Resolves GitHub Issue #1181
- Fixes for the new API Key API - usages in the admin UI. Allow the admin UI to upgrade and downgrade API keys for Key Manager.
- Resolves GitHub Issue #1174
Tech Preview
- Application Themes. You may optionally assign a theme per application which will then be utilize instead of the tenant configuration.
- Email verification gate. When using the FusionAuth themed pages, you may force a user to verify their email address before being redirected back to your application.
- Configurable verification strategies to use an interactive form instead of a clickable link.
- May require a change to your email template, see the updated Email Verification documentation for additional details.
- GitHub Issue #1191
- Unique usernames. Allow more than one user to select the same username and allow FusionAuth to manage a unique suffix.
- Resolves GitHub Issue #1190
New
- Product Version API.
- Resolves GitHub Issue #1193
- Thanks to @jegger for the request!
- See Version API for additional details or find
retrieveVersion
in your FusionAuth client library.
Enhancements
- Try to support Microsoft Outlook Safe Links
- Hopefully 🤞 resolves GitHub Issue #629
- Support HTTP Basic Auth using an API key for the Prometheus Metrics endpoint added in 1.26.0.
- See Prometheus endpoint documentation for additional details on authenticating this endpoint.
- Resolves GitHub Issue #1189
Version 1.26.1
April 20th, 2021
Fixed
- If you use a non default theme for the FusionAuth default tenant, you may see an error when trying to log in to the admin UI after upgrading to version 1.25.0. You can workaround this by appending
?&bypassTheme=true
to your login URL, or append/admin/
to your base FusionAuth URL to log into the admin UI.- Resolves GitHub Issue #1175.
Known Issues
- You cannot create a “SAML v2 IdP Initiated” Identity Provider in the admin UI; it isn’t present in the “Add Identity Providers” dropdown. You can workaround this by entering the URL to add an Identity Provider manually:
\[GitHub Issue #1181](https://auth.example.com/admin/identity-provider/add/SAMLv2IdPInitiated
(append/admin/identity-provider/add/SAMLv2IdPInitiated
to your FusionAuth base URL). Tracking in https://github.com/FusionAuth/fusionauth-issues/issues/1181).
Version 1.26.0
April 20th, 2021
Lots of changes ahead! Read carefully to see how this release may affect you.
Two Factor APIs
Breaking changes. If you use this functionality, please review the API changes and test before upgrading. The Two-Factor API, two-factor fields on the User and Import User APIs and the Integrations API have changed and are not backwards compatible. If you use this functionality, please review the API changes and test before upgrading.
Upgrading from < 1.7.0
If you are upgrading from a version less than 1.7.0, you must do a two stage upgrade. Upgrade to a version greater than or equal to 1.7.0 but less than 1.26.0, then upgrade from that version to 1.26.0. There were internal migration changes which necessitate this two stage process.
Accessing the admin Login after upgrading:
The /
path of FusionAuth no longer automatically forwards to the admin login. To access the admin UI to complete this configuration append /admin/
to the URL. Once the theme configuration is complete, this root page will contain links to login and instructions on how to utilize this root landing page.
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- If you use a non default theme for the FusionAuth default tenant, you may see an error when trying to log in to the admin UI. You can workaround this by appending
?&bypassTheme=true
to your login URL.- Resolved in
1.26.1
, see GitHub Issue #1175 for additional details.
- Resolved in
Changed
- The Two-Factor API has changed which allows you to enable and disable Two-Factor methods as well as send codes.
- See the Two-Factor API for more details.
- The Two-Factor Login API now returns
409
for too many attempts. This allows the Two-Factor Login API to provide the same locking capability as the Login API when too many failed attempts occur.- See the Two-Factor Login API for more details.
- The Import API has changed for enabling Two-Factor.
- See the User Import API for changes.
- The User API has changed for enabling and disabling Two-Factor. See the User API for changes.
- See the User API for changes.
- Email and SMS Two-Factor methods will now require a paid edition of FusionAuth. Learn more about paid editions.
- If you are only using Authenticator/TOTP for Two-Factor, this functionality will continue to work properly in the community edition.
- If you are upgrading from a version less than 1.7.0, you must do a two stage upgrade. Upgrade to a version greater than or equal to 1.7.0 but less than 1.26.0, then upgrade from that version to 1.26.0. There were internal migration changes which necessitate this two stage process.
Fixed
- You can now delete a user registration for an inactive application
- Resolves GitHub Issue #1148
- Spurious text ‘[object Object]’ on FusionAuth admin UI screen when certain Chrome extensions present.
- Resolves GitHub Issue #1151. Thanks to @NikolayMetchev for filing this.
Tech Preview
- Entity Management
- Resolves GitHub Issue #881
New
- Prometheus Metrics endpoint
- Resolves GitHub Issue #362
- IdP initiated SSO
- Resolves GitHub Issue #566
- An API key to create API keys!
- Resolves GitHub Issue #887. Thanks to @Tintwo for filing this.
- Portions of GitHub Issue #960 were delivered, including features such as:
- Two-Factor step-up API
- SMS Two-Factor with configurable delivery methods
- Localized Message Templates which can be used for SMS Two-Factor messages
- Self service user profile page
- Resolves GitHub Issue #682
- Themeable root page
- Resolves GitHub Issue #378
- Messengers which are used to send SMS messages through Twilio, Kafka or a generic JSON REST API
- Licensing now supports air-gapped deployments
- Client Credentials grant
- Resolves GitHub Issue #155
Enhancements
- Add IP address to login success and failed events.
- Resolves GitHub Issue #1162
Version 1.25.0
March 10th, 2021
SAML v2 Logout is now fully supported. No action should be required. If you are currently using FusionAuth as a SAML v2 IdP, please verify your configuration as you may want to provide additional configuration to take full advantage of the SAML v2 Logout configuration. The additional of SAML v2 Logout means there is a new themed page to manage the user experience for SAML v2 Logout. Please review your theme to ensure your user experience is not interrupted. See additional details in the New section below.
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Changed
- In support of the SAML v2 Logout feature, the following theme changes have been made.
- New themed template
SAMLv2 logout template
. This template will be rendered when you utilize the SAML v2 Logout feature, it is nearly identical to the existing OAuth2 logout themed page. If you are using themes, please review your theme to ensure your user experience is not interrupted.
- New themed template
Fixed
- If you are using Elasticsearch version 6 you may encounter an error when using the Search API. This is due to a change in how we optionally request the document hit count in the search request to Elasticsearch. The change is not compatible with Elasticsearch version 6. As a work around, you can set
accurateTotal=true
in the API request. See the User Search API for additional details on using this parameter.- Resolves GitHub Issue #1135
- Using the HTTP
PATCH
method on the FusionAuth application may produce erroneous validation errors.- Resolves GitHub Issue #1110
- Adding additional Java options in the configuration file when the value contains a space may not work correctly.
- Resolves GitHub Issue #1065
- A
NullPointerException
may occur when you have users registered for an application in a non default tenant and you create a login report for only that application. Thanks to @NikolayMetchev for filing this.- Resolves GitHub Issue #1115
- When you omit the
state
parameter on the Authorization request, you may receive astate
parameter on theredirect_uri
that you did not expect.- Resolves GitHub Issue #1113
New
- Add full support for SAML v2 Logout
- Resolves GitHub Issue #1137
Enhancements
- Add a button to the Sessions tab in the FusionAuth admin UI to delete all user sessions at once, this action is also available from the drop down action list when managing a user.
- Resolves GitHub Issue #1094
- Add Debug to OAuth2 grants, this will primarily assist in debugging the Authorization Code grant auth code exchange with the Token endpoint.
- Resolves GitHub Issue #781
- Add CORS Debug, this will assist you in debugging CORS related
403
HTTP status codes.- Resolves GitHub Issue #1126
- Better SMTP debug for specific scenarios. This should assist with async connection issues and provide context to the tenant and template being rendered during the exception.
- Resolves GitHub Issue #1064
- Allow the Registration API to accept the
applicationId
as a URL segment- Resolves GitHub Issue #1127
- Twitter IdP Login API can optionally accept an access token. When building your own login page, if you complete the initial step with Twitter and utilize the
oauth_verifier
to perform some initial processing of the Twitter user, you may now still send the access token in the form ofoauth_token
andoauth_token_secret
to FusionAuth to complete the login. This is done by omitting theoauth_verifier
on the Login request. See Complete the Twitter Login for additional information.- Resolves GitHub Issue #1073
- When Key Master generates a
kid
because one is not provided on the request, if there is a public key, generate thekid
as a JWK thumbprint instead of a randomly generated value.- Resolves GitHub Issue #1136
- When using the Search feature in the FusionAuth admin UI, once you begin searching using a specific term or any of the advanced controls, the pagination result total will be an accurate representation of the number of matches returned by Elasticsearch. When no search criteria is provided, the number of matches will cap at the default value of 10,000 and the pagination results will indicate 10,000+ which means at least 10,000 users match the search criteria.
Internal
- Upgrade Tomcat from version
8.5.57
to8.5.63
.- Resolves GitHub Issue #1119
Version 1.24.0
February 11th, 2021
Known Issues
- If you are using Elasticsearch version 6 you may encounter an error when using the Search API. This is due to a change in how we optionally request the document hit count in the search request to Elasticsearch. The change is not compatible with Elasticsearch version 6. As a work around, you can set
accurateTotal=true
in the API request.- Resolved in
1.25.0
, see GitHub Issue #1135 for additional details.
- Resolved in
Sicherheit
- More consistent usage of the
Cache-Control
HTTP response header. The default for all pages will beCache-Control: no-cache
, and some pages that may contain potentially sensitive information such as the API key add, edit or index pages will use aCache-Control: no-store
. No known vulnerability exists with the previous behavior, this is just a proactive change to limit the possible mis-use of cached pages in the FusionAuth admin UI.- Resolves GitHub Issue #1103
- A vulnerability in an underlying SAML v2 library was resolved. If you are using SAML please upgrade FusionAuth to 1.24.0 or later as soon as possible.
Changed
- The
applicationId
androles
claims are no longer returned in theid_token
issued when requesting theopenid
scope. Theid_token
should not be used for authorization, this change makes it less likely to mis-use this token. If you have a requirement for these claims (you shouldn’t), you can add them back by using a JWT Populate lambda. See Id Token claims for additional information.- Resolves GitHub Issue #1102
Fixed
- When using the Add or Edit Identity Provider forms in the admin UI, if you have ~2,000 or more applications it is possible for the form request to be truncated by the underlying application server. This error is caused by the maximum number of request parameters being exceeded. This form in particular, along with the Group Add/Edit and Webhook Add/Edit contains a number of fields that is a function of the number of applications configured. An informational error may be written to the system log indicating this truncation has occurred, but no hard error would have occurred. The symptom will be that depending upon your configuration, a portion of it may be lost during this form submit. The entry in the log will contain this message
org.apache.tomcat.util.http.Parameters.processParameters More than the maximum number of request parameters (GET plus POST) for a single request ([10,000]) were detected. Any parameters beyond this limit have been ignored.
.- Resolves GitHub Issue #1057
- When you have registered a custom plugin for password hashing, using the View Tenant dialog may fail to render.
- Resolves GitHub Issue #1063
- Unable to remove a User from a Group using the admin UI dialog. This was a regression issue introduced in version 1.23.0.
- Resolves GitHub Issue #1081
- If a user was not currently in the Elasticsearch index, the user delete request may fail.
- Resolves GitHub Issue #1088
- The JWT returned from the Register API when you are creating a User and a Registration in one request may not contain the
roles
claim. This occurs when you do not assign the roles explicitly on the request, and instead are using default role assignment in the application configuration.- Resolves GitHub Issue #1106
- Updating a User that has existing group memberships may no longer be searchable in Elasticsearch by their Group memberships until the next time the user logs into FusionAuth.
- Resolves GitHub Issue #1087
- A Kafka Producer configuration that contains an equals sign
=
in the property value will fail to parse. This was identified in attempting to configure credentials to connect to CloudKarafka.- Resolves GitHub Issue #1107, thanks to @chris-bridges for letting us know!
Enhancements
- Support a Kickstart file with only a
licenseId
. Previously at least one API key was required because the intent of Kickstart is to call one or more APIs. While there is not a very practical use case for only providing alicenseId
and no API requests, this minimal configuration will no longer fail indicating an API key is required. See Set your License Id in the Kickstart documentation.- Resolves GitHub Issue #1080
- You may now import an RSA certificate with a key bit length less than
2048
into Key Master. The minimum supported RSA key length for signing a JWT is2048
, so this was previously the minimum requirement to import anything into Key Master. However, we have several configurations now that require a certificate that is only used to verify a signature from a third party. In these cases, we are not using the certificate to sign anything, and @trevorr rightly pointed out that we should allow smaller keys to be imported to support these use cases. Thank you for the (now obvious) insight! We really appreciate our community members that provide us value for value.- Resolves GitHub Issue #1085 & GitHub Issue #1091
- Added an additional Search API parameter to allow you to obtain the actual hit count from Elasticsearch. For performance reasons, the default behavior of an Elasticsearch query is to limit the hit count to 10,000. This means that if your query matched more than 10,000 records, the API response will only indicate that at least 10,000 records matched. This is very adequate for pagination purposes, or general queries. There are times where you are building a very specific query and the intent is to identify an accurate number of matching records. You may now provide an additional parameter to the search request named
accurateTotal
which will then return an accurate hit count on the API response. See the User Search API for additional details.- Resolves GitHub Issue #1086
- Allow the user to click on the Enabled column in the Webhook event configuration in the Webhook and Tenant configurations to enable or disable all events at once. This is just a usability enhancement to save you from clicking over and over. You’re welcome.
- Resolves GitHub Issue #1093
- For pages with potentially a lot of items such as Applications, Tenants, etc - that do not currently have pagination, add a count at the bottom of the panel. This allows you to look smart by knowing how many “things” you have without having to count them yourself.
- Resolves GitHub Issue #1104
Internal
- Some enhancements to JavaScript event handlers to perform better on pages with 2-3k+ applications. Pretty boring.
- Resolves GitHub Issue #1105
Version 1.23.3
January 21th, 2021
Fixed
- A tenant delete request may fail. See details in the linked GH issue for a work around. This issue was introduced in version 1.22.0.
- Resolves GitHub Issue #1075
Version 1.23.2
January 20th, 2021
Fixed
- A bug in the PostgreSQL migration will cause you to lose your SAML v2 IdP configuration. If you are using MySQL or you are not using the SAML v2 IdP configuration, this bug will not affect you. The issue was introduced in version 1.21.0, so if you are upgrading from a version prior to 1.21.0 to 1.23.2 you will not be affected. If you have already upgraded to 1.21.0 or any version greater than 1.21.0 prior to this patch, you will have already encountered the issue. If you do encounter this issue, you will need to update the SAML v2 IdP configuration found in each affected Application configuration.
- Resolves GitHub Issue #1074
Version 1.23.1
January 13th, 2021
Fixed
- When configured to sign the SAML v2 AuthN requests to the SAML v2 IdP, the SAML v2 SP metadata does not correctly reflect this settings. The attribute
AuthnRequestsSigned
should now reflect the signing configuration.- When configured to sign requests, the SP metadata response will now also contain the KeyDescriptor element to describe the X.509 certificate used to verify the signature.
- Resolves GitHub Issue #1067
Version 1.23.0
January 11th, 2021
The database schema has changed and an upgrade is required for this version of FusionAuth. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
See Database Upgrades for more information about database migrations.
Known Issues
- If you are upgrading to this version, are using PostgreSQL, and you intend to use the provided LinkedIn Reconcile lambda, you will need to make a small adjustment prior to using it.
- Navigate to Customizations -> Lambdas and edit the lambda named
Default LinkedIn Reconcile provided by FusionAuth
and click edit. You will see an error indicated by a red dot on line23
of the function body. To fix this error, delete the two empty lines between the end of line23
and25
, once the error indicator is gone, save the lambda.
- Navigate to Customizations -> Lambdas and edit the lambda named
- Unable to remove a User from a group using the admin UI dialog.
- Fixed in version 1.24.0 via GitHub Issue #1081
Fixed
- A validation error may not be visible when selecting self service registration options when the FusionAuth license has not been activated.
- Resolves GitHub Issue #951
- The User Action API was returning a
200
status code instead of a404
when requesting an action by Id that did not exist.- Resolves GitHub Issue #991, thanks to @hkolbeck-streem for the report!
- The IP address shown on the About panel may be the same for each node when viewed on a multi-node FusionAuth instance. This address is shown for informational purposes and was only a cosmetic defect w/out any functional issues.
- Resolves GitHub Issue #1030
- The SAML Response XML was failing XSD validation for the
Signature
element location when the request was not successful, or FusionAuth was configured to sign the response instead of the assertion.- Resolves GitHub Issue #1047, thanks to @MrChrisRodriguez for the excellent report!
- Fix a possible NPE when making an Update request to a group in a multi-tenant environment. With this fix, the correct API response will be returned.
- Resolves GitHub Issue #1052, thanks to @atrauzzi for the report!
- When creating an IdP from the API for Google, Facebook, Twitter, or HYPR - the API was allowing an Id to be provided. Each of these IdP types of which only one are allowed, have a fixed Id that is managed by FusionAuth. The API should ignore the requested Id and set the correct Id instead. If you encounter this issue, the work around is to omit the Id on the API request.
- Resolves GitHub Issue #1058
- Kickstart fails when using a variable in the
tenantId
field for an API key.- Resolves GitHub Issue #1060, thanks to @rhofland for the report and the excellent recreate steps!
New
- Sign in with LinkedIn. A new identity provider type is available for LinkedIn.
- Resolves GitHub Issue #34
- New FusionAuth roles oriented for Level 1 support personnel. These new roles are named
user_support_viewer
anduser_support_manager
, see FusionAuth application roles for additional detail.- Resolves GitHub Issue #1027
Enhancements
- Updates to the User and Import API to provide validation on the length of an email address. This will provide a developer a better error when the provided email address is too long.
- Resolves GitHub Issue #900
Client libraries
- Enhancements to the .NET Core client library to better support requests in a multi-tenant environment and to use the
IDictionary
reference instead ofDictionary
.- Resolves GitHub Issue #1049 and GitHub Issue #1050, thanks to @atrauzzi for sharing his .NET Core expertise!