This section describes changes in Airlock IAM 8.1 that require manual changes. Whether changes are necessary depends on the used features and/or custom extensions.
Check if using discontinued features. Further information can be found in features removed in Airlock IAM 8.1.
IAM Module | Affected Feature(s) | Issue(s) | Required Action | Version |
|---|---|---|---|---|
All | New Features | - | If using new IAM 8.1 features, the database schema must be upgraded. It is especially important for the following features:
It is recommended to upgrade the database schema when upgrading even if not using new features. | 8.1 |
Loginapp, Adminapp | Session timeout settings | AI-17616 | The session timeout settings in the Loginapp and Adminapp have been made more flexible and should be reviewed after config migration.
| 8.1 |
Loginapp | OAuth 2.0 / OIDC with Basic Auth | AI-16970 | IAM does now implement OAuth 2.0 Basic Auth correctly (both as client and as authorization server) by applying an additional URL-encoding/decoding on the client ID and secrets. If OAuth 2.0 Basic Auth is used with credentials containing special characters (characters that would be encoded when applying URL-encoding; for example the colon, percent-sign, etc.), the client now sends them URL-encoded and the authorization server now expects them correctly URL-encoded. In very rare cases this may result in credentials being rejected by the Authorization Server. In this case, the credentials must be set correctly in the client or stored correctly in the authorization server. | 8.1 |
Loginapp | OAuth 2.0 dynamic client registration | AI-16806 | Persisted OAuth 2.0 Clients (registered using Dynamic Client Registration) now honor their registered scopes correctly. If no explicit scopes were registered, all requested scopes are accepted (as before). However, this behavior can now be configured in the OAuth 2.0 Persisted Clients settings in the authorization server configuration. | 8.1 |
Loginapp | Loginapp UI redirect URI patterns | AI-9385 | The Target URI Resolver in the Loginapp's Authentication UI Settings now prevents too lax patterns allowing open redirects. Existing configurations may not be activated if too open patterns are used (e.g. | 8.1.2 |
IAM Module | Affected Feature(s) | Issue(s) | Required Action | Version |
|---|---|---|---|---|
Loginapp, Admnapp | Custom Event Handlers | AI-14083 | Custom event handlers must be adapted and have an Not doing so results in the event handlers being executed synchronously. This may lead to blocking IAM requests. | 8.1 |
Loginapp, | Custom code | AI-17382 | The method | 8.1 |
Loginapp | Custom code | AI-17799 | To be able to store session data in an external Redis session repository, custom implementations of Note that support for custom code not implementing the | 8.1 |