[Unity-idm-discuss] New release: 2.6.0

[Krzysztof B. <kb...@un...>]

Dear Subscribers,

On behalf of the Unity Team, I'm happy to announce that release *2.6.0 
is out.*

2.6.0 is a major Unity milestone concluding our architectural changes 
started in the previous release. The release focus was on 
authentication: a reworked authentication screen, 2 factor 
authentication, step up authentication and improved remember me are 
available.

When installing this release as an update a migration will be performed 
and some configuration changes may be necessary. Make sure to make 
backup and read update instructions in the documentation. At the same 
time the good news is that this is the last release with breaking 
changes. We have no more planned in the near-to-mid term, so subsequent 
updates should be much easier. We are also planning to have couple of 
2.6.x revision releases bringing smaller improvements and bugfixes next, 
before 2.7.0 which can take more time.


The highlights of the 2.6.0 are:

  * We are introducing *authentication flow* concept. Authentication
    flow is used *to configure two factor authentication* (2FA, MFA). So
    far Unity allowed for configuring MFA in a simplistic way by
    requiring to login with two fixed authenticators. With
    authentication flows which replace the old mechanism it is possible
    to control 2FA flexibly:
      o 2nd factor authenticator can be selected at runtime, depending
        on active user's credentials,
      o it is possible to set a policy which controls when 2FA is
        required. Besides simple always required 2FA, it is possible to
        delegate the decision to end user, who can opt-in to use 2FA.
      o The new syntax will allow us in future to introduce risk based
        authentication models easily, without additional breaking
        configuration changes.
  * *Authentication screen* was fully reworked, the former tiles concept
    was dropped. This is the biggest breaking change – authentication
    screen will need to be configured and branded from scratch. However,
    this process should be way easier and result with great UX, not
    possible before.
      o Authentication options are organized in configured number of
        columns (typically 1 or 2).
      o All options visible on the screen can be immediately used. No
        more extra clicking to select an option to authenticate with.
      o Unity takes care about formatting of options so that the screen
        looks nice and is following the common authentication patterns
        that are popular on the web (and should be familiar to end users).
      o Authentication screen can be made dynamic, adapting to user. The
        most useful option is to only show the previously used
        authentication widget for returning users. This simplifies login
        experience a lot.
      o A lot of effort was made to make the screen easy to style. The
        top bar is gone. All types of elements have distinct classes
        making it easy to address then in custom CSS.
  * *Remember me feature*, making device trusted for easier login in
    future, was fully rewritten. First of all we are using safer
    architecture then before. What is more the feature can be enabled
    only for 2nd factor authentication. Finally users have access to
    remembered devices on HomeUI and can clear the list.
  * *Additional/step up authentication* before executing *sensitive
    operations*. Unity can be configured to expose (via HomeUI) certain
    sensitive operations to end-users. The most obvious one is changing
    of user’s password, but also SMS telephone number (for SMS
    credential) or email address (used for password reset) are falling
    into this category. In this release we are adding possibility to
    configure how to ensure security of those operations. User may be
    forced to authenticate again, or to perform step up authentication
    with 2nd factor (even if it was not needed for initial
    authentication) before being able to perform a sensitive operation.
  * *Composite password* can be used to create an *authenticator* which
    will present a single password-login widget, which will under the
    hood use one of many configured password verification methods. Using
    this feature you can mix local password authentication (even with
    multiple password credentials) with say remote LDAP authentication,
    without making this anyhow visible to end-users.

Other, smaller changes:

  * Microsoft Azure/AD can be be easily used as a new preconfigured
    remote OAuth authentication service.
  * SAML metadata Service Providers with multiple endpoints advertised
    in metadata are now properly supported, including full support for
    metadata indexing of endpoints.
  * Consent and email confirmation screens have top header removed, what
    allows for easier branding.
  * It is possible to configure messages which are sent to users upon
    account removal and deactivation.
  * Users bulk operations subsystem have a new action, which can send
    notification to the selected users. This can be used to send for
    instance information prior to disabling or removing an account or
    simply to mass-send any form of update.
  * IdP endpoints (SAML and OAuth) can be configured to ask user for
    selecting attribute values, which will be active for the login
    session. This can be used to ask for active role, organization etc.
    It is possible to offer single or multi selection of values.


As always for more details see: http://www.unity-idm.eu/downloads/

With this release we have completed a big milestone that we planned over 
a year ago, to bring all fundamental core features that IdM software 
should offer. Unity was excellent in many advanced and complex 
scenarios, but was lacking in some simpler ones. Now this has changed.

We still want to provide many more core features (as risk based 
authentication, server LDAP interface, easier to use mobile 
authentication to name a few), but our focus will slightly change now to 
create a better administration experience for Unity.

Best regards,
Krzysztof