[Unity-idm-discuss] Unity 3.13.0 release

[Krzysztof B. <kb...@un...>]

Dear Subscribers,

I'm happy to announce availability of a new Unity release.

As always all relevant links are available at 
https://unity-idm.eu/releases/release-3-13-0/

The 3.13.0 release brings implementation of several OSS community 
requests. The main development effort was on technical debt reduction, 
and at the same time preparation for the changes planned in Unity 4. 
Effects of that work are not visible today, will add a value upon the 
next major release.


      Registration form information for remote signup

Registration forms can have a separate 2nd stage form information. This 
information is shown, together with separately configured title after 
returning from remote IdP, during signup with remote identity.


      Support for Unity certificate rollover for SAML IdP and SP

Unity SAML IdP allows for configuring additional credential. This 
credential is advertised in generated metadata as another certificate. 
It is useful for IdP certificate roll-over, when, for a short time, 
service providers in federation should learn a new certificate, and 
prepare to accept it.

Similar, but more complex, feature was added to SAML authenticator (an 
SP in SAML nomenclature). It is possible to configure additional 
credential which can be used to decrypt incoming messages (typically 
authentication or attribute assertions), as an alternative to the main 
credential. What is more it is possible to control, whether this 
alternative credential is included in generated SAML metadata or not.

Configuration in the case of SP is more complex as the certificate 
rollover process is also more involving. Typically admin want to first 
advertise a new certificate in metadata, and be ready to accept message 
encrypted with it (step 1). Next the credentials are swapped and the old 
credential is removed from metadata, however decryption with it is still 
possible (step 2).


      User attributes as claims in OAuth JWT tokens

OAuth clients may requests putting user claims in OAuth access token (if 
is issued as JWT) and/or in OIDC id token.


      Other improvements

  * Update of realm is automatically picked by endpoints using it.
    Before the endpoints had to be manually reloaded.
  * For certain 2nd facto credentials like OTP, invalid try to provide
    it is not resulting in reset of the whole authentication and return
    to the first factor. Instead it is possible to provide the 2nd
    factor credential again.
  * UpMan invitations grid won’t crash, when some invitations has not
    been sent yet


Best regards,
Krzysztof