OpenID Connect - Premium Release Notes

22Q4 — .NET 6 and Minor Updates

• Migrated the application to .NET 6 (LTS).
• Added SHA1 and SHA256 certificate thumbprint values for SAML apps.
• Blocked access to the Client Apps screen until domain setup and system settings are complete.
• Blocked access to the System Settings screen until domain setup is complete.
• Rearranged the System Settings screen to prioritize iMIS EMS and move rarely used settings under an Advanced expander.
• Improved the first-time setup defaults on the System Settings screen, reducing errors on the first SSO connection.
• Updated the SAML app editor screen to a two-column layout to make better use of screen space.

21Q3 — PKCE

• Added support for the OAuth2 PKCE extension specification.
  • PKCE takes effect automatically when the correct parameters are passed. There is no on/off toggle for this feature — it is always on.

21Q2 — Configurable Access Restrictions

• Added the ability to return a value from the Profile IQA and, depending on that value, conditionally deny access to a specific client app.
  • The default No Access screen can be configured with a custom header and HTML body.
  • Alternatively, the user can be redirected to another site.
  • For configuration details, see the Client App documentation.

21Q1 — ROPC Support and ID Token Enhancements

• Added the ability to inject additional properties into ID tokens from the user's custom profile, using the configured IQA. For more information, see the OIDC Profile Data page.
• Added ROPC support for both public and confidential clients. To enable it, configure a client application and turn on either of the ROPC grant types.
• Fixed several bugs in first-time setup within the admin area.
• Clarified the error message generated by the SSO app when it is pointed to a different iMIS endpoint than the main Cloud ID instance.

20Q3 — SAML 2.0 Support

• Added support for SAML 2.0, including:
  • Customizable assertion attributes based on IQA results.
  • SP-initiated and IdP-initiated logon.
  • Optional single logout (legacy forms authentication identity mode only).
  • Request tracing for easier debugging.
• Added the ability to self-onboard a custom SSO domain.