spring-authentication-server

Logo

Release Notes

Date: Not yet released

Date: 2026-10-13

The OpenID Provider’s federation client closes every HTTP response. Before, a 404 or error answer from a resolver or trust mark issuer left the connection in use, and once all connections were taken, the next federation call, for example fetching the OpenID Provider’s own trust marks, waited three minutes before failing. See #30.
The reference service shows “Reference OP” in the page heading and title during OpenID Connect logins, and “Reference IdP” only during SAML logins. See #29.

Date: 2026-10-08

An OpenID Provider follows version 1.2 of the Signature Extension for OpenID Connect. A signature request sent as a JWT of its own must now hold iss and aud, so clients that leave them out are rejected. See #21.
A new setting, authn-server.oidc.max-jwt-age, limits how old a request object, signature request or client assertion signed by a client may be. A JWT signed by a client is also rejected if its iat is in the future. See #21.

Date: 2026-10-06

An OpenID Provider may now offer a scope without supporting all of its claims. claims_supported lists only the claims that the OpenID Provider can deliver.
The Sweden Connect reference server delivers a simulated user’s coordination number as a coordination number, not as a personal identity number.
An OpenID Provider treats an authentication request without prompt as prompt=login, as the OpenID Connect Profile for Sweden Connect requires. This can be turned off for deployments outside Sweden Connect. See #12.
A request object whose response_type differs from the one in the request is rejected. See #13.
A client assertion without iat is accepted. See #14.
A + in state is returned unchanged to the Relying Party. See #15.
An authentication request with a signature request, but without the sign or sign approval scope, is rejected. See #16.

Date: 2026-10-06

This site is open source. Improve this page.