IAM 8.7 - Changelog

The new Airlock 2FA Push Event Subscriber plugin sends custom notification messages to the Airlock 2FA app (or custom app using the Airlock 2FA SDK) whenever a subscribed IAM event occurs. The message texts can be configured, translated, and parameterized to contain event attributes as well as input from value providers.

The new event subscriber is available for the Loginapp and the Adminapp.

See Airlock 2FA Push Event Subscriber.

The new HTTP Request Cookie Value Provider provides HTTP cookie values from the current HTTP request.

FIDO now supports native apps on iOS (apple-app-site-association) and Android (assetlinks.json).

See also FIDO in native mobile apps.

Fixed an issue where FIDO authentication could trigger endless UI loops if FIDO is not supported by the browser. The FIDO fallback mechanism has been improved for these cases.

The Loginapp UI Design Kit now uses pnpm 11. If you want to use an older pnpm version, regenerate the pnpm-lock.yaml file.

In the target application configuration, the Allowed URI Patterns property of the Query Parameter URI Value Extraction plugin no longer accepts an empty list.

The Query Parameter URI Transformation plugin now provides the same property with the same behavior.

Ensure that the URI patterns configured in this property are valid, correct, and sufficiently restrictive. Lax regular expressions, such as .*, may lead to open redirect attacks.

Fixed an issue where date input in the Loginapp could be shifted by one day depending on the browser timezone. The Loginapp now handles date-only values correctly regardless of the browser timezone.

Fixed a bug where the device token list in the Loginapp's protected self-services did not return the user's devices after logging in with a username alias, such as an email address.

OAuth 2.0 Token Exchange tokens now always contain a random jti claim.

Improved performance in OAuth 2.0 setups with many static clients.

Fixed a bug in OAuth2/OIDC, where context data set in a non-interactive step immediately before flow termination, for example in a Set Context Data Step, was not propagated. Such context data is now propagated correctly.

Fixed a bug where the OAuth2 self-service did not display the session date correctly if its milliseconds fraction was exactly zero.

The advanced user search in the user management (Adminapp) can now find users by the mobile phone numbers of their mTAN tokens.

To enable this new feature, add the new plugin mTAN Token User Search Filter to the advanced search filters of the user management

The new search filter is also available through the Adminapp REST API as the mtan-phone-number filter on the users endpoint.

The Activities tab on the User Details page in the user management (Adminapp) now provides a search feature.

Additionally, every successful user identification now writes a user trail entry containing the flow ID (target application) and the browser/user agent, making these searches meaningful for tracing logins per application.

Fixed an issue where configuration activation could fail because IAM incorrectly counted the lost+found directory as an instance. IAM now ignores the lost+found directory during the license check.

Fixed a bug where entering a date in the Latest Successful Login Date Range Filter or the Latest Login Attempt Date Range Filter in the Adminapp 's Advanced Search UI caused an error. The filters now work again as expected.

Fixed a bug where custom Loginapp or Adminapp texts were displayed as raw translation keys after a page reload if no translation was available in the active language. Such texts now correctly fall back to the configured default language.

Added a Device Usage Consistency User Change Listener to keep device usage data synchronized when users are renamed or deleted.

Terms of service translations can now be used with country-specific language codes, such as de_CH.

Added support for Microgateway 5.1 and Microgateway 4.8.

Note that starting with Microgateway 5.0, Microgateway supports only Gateway API. Sidecar mode is no longer supported.

Updated Java, Guava, Tomcat, Bouncy Castle, Spring Boot, and Netty libraries to the latest revisions. Updated the Yubico library.

Legacy Remember-Me cookies from the JSP Loginapp (set in IAMs <8.0) are no longer supported. The corresponding configuration properties are automatically removed in the config migration process.

Fixed a bug in the OpenAPI specification and REST documentation where query parameters are now on path level instead of per method.

Fixed a bug in which the license manager was instantiated multiple times when querying Prometheus license metrics. This resulted in multiplied log messages and a potential performance impact for the metrics endpoint.

Fixed a bug where static roles configured with Grant Roles in the Database User Persister were persisted when other roles of the same user were modified. Static roles are now kept in memory only, while already persisted static roles remain unchanged.

Fixed a rare race condition that could cause a deadlock when the database layer was initialized by two concurrent requests.