IAM 8.5 - Changelog

A new CLI command iam config check-license, which checks the license coverage of a configuration.

See Configuration CLIs

New domain events for a password change in public self-service flows and password letter orders (Loginapp self-service and Adminapp).

See also Event producers.

New plugin Username Password with FIDO Authentication Step. It allows users to log in using passkeys through a browser-integrated dialog, while offering a username/password fallback on the same page UI.

CAPTCHAs are not supported. All other features of the Username Password Authentication Step and the FIDO Passwordless Authentication Step are supported.

See Use case: FIDO passkeys as first auth factor in IAM.

The new Gateway Session Terminator event subscriber allows terminating Airlock Gateway sessions when certain events occur, such as the changing of a user's password.

See Event subscribers and Gateway Session Terminator.

The INFO log messages include a new field showing the transport mode of Airlock 2FA messages to Futurae. Possible values are jwe or plain_text_array.

The mTAN authentication/approval steps now include the option to always prompt the end-user to select a number, even if only one end-user number is available.

Added an option to the OCSP Certificate Status Checker to disable nonce validation.

Local deployments to the Procivis One core can now be configured as a service in SSI steps.

Fixed a bug in the Remember-Me Identifying Step, where the step was skipped in the case of concurrent access. Now, the step fails.

Added a new condition Login from new Device, which evaluates to true when the user logged in from a device for the first time.

The Password Letter Order Step is now also available for protected self-service and authentication flows. Until now, it was only supported in public self-service flows.

See Password letters.

The new OAuth2 Access Token String Value Provider plugin now allows retrieving an access token via the Client Credential Grant.

The access token is cached and can be used to authenticate IAM calls to external services. Basic Auth, Private Key JWT and mTLS authentication are supported. 

During a SAML2 Single Logout (SLO), requests to rest/public/authentication and /login-oneshot are now blocked, preventing other users from logging in on the same Gateway session.

During OAuth 2.0 dynamic client registration, the client can now specify the client ID.

The OpenAPI specification of the Loginapp API Security now also contains protection for the OAuth2 endpoints. An update of the Gateway mappings is recommended.

The new Adminapp property Admin Cannot Delete User With Same Name prevents admin users from deleting end-users with the same username. It ensures that administrators do not accidently delete their own accounts.

See The User Details dialog in the Adminapp.

Usage Analytics now uses a sanitized version of the IAM configuration with all sensitive data removed.

Subscribers of user-created events can now filter for specific context data values.

See Event filtering.

The Vasco Cronto Handler plugin now includes a new property: Account Token Usages Threshold. This property ensures that Vasco account tokens assigned to new users have not already been used too often.

All administrators, regardless of their permissions, can now choose how many user activities are shown in the user's Activities tab in the Adminapp. Previously, this setting's radio buttons were disabled.

Fixed some UIs issues in the Vasco OTP dialog that lists available tokens in the Adminapp.

Fixed a bug in the Adminapp that caused an exception when displaying Airlock 2FA activation letters generated by IAM versions <= 8.3. These letters contained a nullable Airlock2FAActivationCodeShort, which triggered the error.

Fixed a bug that could cause a null pointer exception when rolling back to the last successfully activated configuration after an activation failure.

Loginapp/Adminapp: Browser support is now defined by the “widely available” support definition of Baseline (see also Baseline definition).

This means that the following browsers are no longer supported:

See Browser compatibility

The old REST API documentation (Miredot) was removed from the IAM artifacts and replaced by a more modern version that is based on the OpenAPI specification.

SEQUENCEs are schema objects in Oracle databases that generate unique numeric values assigned to insertion operations. Oracle automatically increases these counters with each insertion. In IAM, these SEQUENCEs were historically created without cache (NOCACHE option). As of this release, we have changed the default for the 13 IAM SEQUENCE objects from NOCACHE to CACHE 20. This change will increase the performance of insertion operations substantially, especially in the case of many inserts, e.g., into the Token table.

To implement this change in existing Oracle databases, a database migration is required. If you work with IAM 8.4, you can use the iam-schema-migration-8_4-8_5.sql file provided in Oracle as Airlock IAM database.

For more information, see the following Techzone article: Performance Optimization for Oracle DB Sequences

Airlock Gateway supports Brute Force Protection starting with release GW 8.4. In the IAM Mapping Template for Gateway 8.4 and later, this feature is now enabled by default.

The RADIUS client and server are now protected against Blast-RADIUS attacks.

Performed the following maintenance and security updates:

The minimum supported DB versions are now:

Fixed an issue with reading domain-wide Active Directory “Fine Grained Password Policies” (FGPP) when the pwdProperties LDAP field contained another policy than DOMAIN_PASSWORD_COMPLEX.

Fixed an issue with the role filter in the LDAP Connector.

Fixed an issue where requests from technical clients were blocked by the “BOT detection in header value” deny rule. The Gateway mapping templates now include new deny rule exceptions to ensure that the respective requests are accepted.

Encrypted password hash now supports GCM and CBC as block cipher mode.