IAM 8.6 - Changelog
Toggle navigation
About
Release and support
Release notes
Changelog
Required upgrade actions
Deprecation announcement
Incubating features
Installation and upgrade
Operation
Initial configuration
Configuration management
Authentication
Self-services
Target applications
OAuth and OIDC
SAML
API access control
Flows (Airlock IAM concept)
Loginapp Configuration
Adminapp Configuration
Service Container Configuration
Transaction Approval Configuration
IAM REST APIs
Customizing UIs and texts
Security best practices
Third-party licenses
Release and support
Changelog
IAM 8.6 - Changelog
Airlock IAM 8.6.1
The following tables show the changes from Airlock IAM 8.6.0 to 8.6.1
Bugfixes and improvements
Improvement
AI-22680
Performance of OAuth 2.0 is improved by caching static clients.
Improvement
AI-22521
Updated Java, Tomcat, Bouncy Castle, log4j, Netty, Angular, and UBI images to the latest revisions.
Security
Improvement
AI-22499
AI-22376
All tokens issued by OAuth 2.0 Token Exchange will contain a jti claim.
OAuth 2.0
Improvement
AI-22471
OAuth2/OIDC Discovery/JWKS callers now use an asynchronously refreshing cache, eliminating lag on refresh.
OAuth 2.0
Improvement
AI-22304
FIDO now supports native apps on iOS (apple-app-site-association) and Android (assetlinks.json).
FIDO
Bugfix
AI-22686
Snippet imports will correctly import external secrets resolution.
Bugfix
AI-22504
Fixed the password visibility toggle to display in the correct location. This may be breaking if a customer has enabled the visibility toggle and already fixed the placement issue.
Loginapp UI
Bugfix
AI-22480
Fixed proxy support for Cronto Push.
Cronto
Bugfix
AI-22118
Added a User Change Event Listener for Device Usage to keep data in sync when deleting or renaming users.
Persistency
Airlock IAM 8.6.0
The following tables show the changes from Airlock IAM 8.5 to 8.6.
Authentication and Loginapp
New
AI-18260
In addition to the default online QR codes, IAM also supports
short-lived
QR codes that expire after a short time. This reduces the time window during which an attacker could persuade victims to forward the QR code. Short-lived online QR codes are configured in the Airlock 2FA plugins used in authentication flows.
See also
Short-lived online QR codes
.
New
AI-21843
Airlock 2FA display names are now checked for uniqueness by default. To ensure backward compatibility, this validation is automatically disabled for existing configurations during migration.
New
AI-21775
The pattern for the Airlock 2FA login ID is now configurable. You can specify it in the
Airlock 2FA Authentication Step
plugin, in the
Login ID
section, under
Pattern
.
New
AI-21666
When logging in with Airlock 2FA using the Mobile Only authentication factor, end-users can now also use other authentication factors for transaction approval, e.g., One Touch.
New
AI-21082
The
Loginapp UI
now supports accessibility features and can be used to comply with WCAG 2.2 Level AA. See
Web content accessibility (WCAG)
.
New
AI-21582
The
Cronto Letter Order Step
(
Loginapp
) and the Cronto Token Controller (
Adminapp
) now trigger the new event
Cronto Letter Ordered
(
CRONTO_LETTER_ORDERED
event type).
New
AI-14043
Added the new password hashing plugin
Argon2id Password Hash
as a modern alternative to the
Scrypt Password Hash
plugin.
Improvement
AI-21778
The
Resident Key
property of the
FIDO Settings
plugin has been renamed and changed from a boolean (true or false) to an enum that accepts one of the following values:
discouraged
,
preferred
, or
required
.
Improvement
AI-21695
IAM can now handle FIDO use cases where the
AuthenticatorAssertionResponse
has an invalid format (observed only with the Google Password Manager).
Improvement
AI-21897
FIDO settings now allow disabling double registration prevention. This can improve compatibility with old Android devices. See the new config property
Prevent Double Registration
in the
FIDO Settings
.
Improvement
AI-21758
The
User Statistics Map
has been extended with additional fields, providing more information on user registration status, locking, validity periods, and unlock activities.
Improvement
AI-21550
The plugins
mTAN Registration Number Provider
and
mTAN Registration Label Provider
have a new optional property,
Mandatory
. When enabled (which is the default), the provided value must not be null. If it is null, an error is returned.
Improvement
AI-21449
The
Loginapp
no longer sends a
Content-Type
header for empty requests.
Bugfix
AI-21417
Fixed an issue with Airlock 2FA payload encryption that caused failures with hardware tokens in Offline QR Code authentication and approval steps.
Using payload encryption with hardware tokens now gracefully fails instead of causing a technical error.
The new property
Unencrypted Payload for Hardware Tokens
in the
Airlock 2FA Settings
allows sending unencrypted data to hardware tokens even if payload encryption is enabled.
Bugfix
AI-18860
Fixed an issue with timeout handling during Airlock 2FA authentication and approval flows.
Bugfix
AI-21791
Fixed an issue with failure counter resets when the
User Identification with FIDO Authentication
step was used.
The step now correctly sets the
Authentication Method ID
to
PASSWORD
for username/password authentication and to
FIDO
for FIDO authentication.
Bugfix
AI-21938
Fixed a potential endless loop in the
Gateway Session Terminator Subscriber
that could occur if some Airlock Gateway sessions could not be terminated successfully.
Bugfix
AI-21567
Fixed a bug where additional JavaScript files were not bundled with
iam-custom.js
.
Bugfix
AI-16568
Fixed a bug where custom translations for specific flows, steps, and UI tenants were incorrectly displayed.
Flows
New
AI-21301
The new
Scriptable Validator
plugin can be used to validate user data during the user self-registration flow. It enables more complex validation logic than the default built-in validators and removes the need for custom IAM extensions.
See also
Scriptable Validator plugin
.
New
AI-21069
The following new value provider plugins are available:
Boolean From Map Value Provider
Date And Time From Map Value Provider
Date From Map Value Provider
Integer From Map Value Provider
They complement the existing
String From Map Value Provider
.
These value providers allow extracting individual values of the specified type from a Value Provider Map. They can also transform formatted strings into the type specified by the value provider.
The primary use case is extracting individual entries from the
Script Execution Result Value Map Provider
.
New
AI-21329
The new
mTAN Token Flow Value Map
provides phone numbers and labels of registered, updated, or deleted mTAN tokens for use during approval. The new
Phone Number Masking String Transformer
allows masking of these phone numbers.
Improvement
AI-21845
Improved performance of large
Loginapp
flows with many steps and plugins.
Improvement
AI-18573
The
Scriptable Step
now supports Lua lists and maps as script output types. See also
Scriptable Step: Output
.
Additionally, fixed a bug where negative Unix timestamps were not accepted as output from the
Scriptable Step
.
Bugfix
AI-22029
Fixed a bug where a Lua script used in a
Scriptable Step
could cause memory leaks.
Bugfix
AI-21714
Fixed an issue where the
Scriptable Step
used the system root
/tmp
directory for temporary files instead of the directory defined by the application parameter
iam.workdir
.
The directory for Unix sockets used by the
Scriptable Step
can now be configured via the application parameter
iam.scriptable.lua.socket.dir
. The absolute path must not exceed 90 characters.
Application parameters are defined in the
instance.configuration
file or as environment variables.
Bugfix
AI-21550
Fixed a bug in the
Scriptable Step
where value maps containing entries with null values were passed to the Lua script as input. Null values should not be provided to the script, according to the plugin documentation.
Bugfix
Fixed a bug where
iam.input_map
could contain explicit
cjson.null
values. Trying to retrieve a non-existent entry from the map will now always return a
nil
value.
OAuth / OIDC / SAML
New
AI-21467
OAuth 2.0 Token Exchange: Generic string arrays from the actor token can now also be added to the exchanged token.
New
AI-20345
The
OAuth 2.0 Dynamic Client Registration
plugin contains a new property,
Return Technical Client ID
. If enabled, the technical client ID is included in the dynamic client registration response.
See also
Dynamic client registration (DCR) setup
.
New
AI-21498
Scopes that are accepted or denied during an OAuth 2.0 login or as part of a self-service now trigger a new event.
Improvement
AI-21557
IAM no longer supports OAuth 2.0 and OpenID Connect tokens with unlimited validity.
Improvement
AI-12544
OAuth 2.0/OpenID Connect access tokens and ID tokens can now also include boolean claims, both static and dynamic.
Bugfix
AI-21836
Fixed a bug where unknown requests to UTLs under
/oauth2/v3/
returned a 500 error instead of the correct 400 status code.
Bugfix
AI-21774
Fixed a bug where the
ForceAuthn=true
flag sent by a SAML2 SP was handled incorrectly by the IdP. User sessions are now terminated correctly again.
Bugfix
AI-21586
The OAuth 2.0 Scope Translations now work across all pages where scopes are displayed. Translations from both the backend and frontend are taken into account.
Bugfix
AI-21115
Fixed a bug where OAuth 2.0 consent translations were not applied in Self-Service Consent Management. Scopes on the user's Consent Management page are now translated when a corresponding translation is available—in line with the authentication flows.
Bugfix
AI-21245
Fixed an issue where the OAuth 2.0 endpoints only accepted private key JWT authentication if the
client_id
request parameter was included. This is no longer required.
Adminapp and Config Editor
Improvement
AI-21937
Improved helpdesk and user trail logs. When updates occur, the keys of affected context data are now logged.
Improvement
AI-21717 AI-21268
Significantly improved the performance of the Config Editor by up to 20×.
Performance when navigating longer and more complex configurations in strict validation mode has also improved, depending on the configuration’s complexity.
Bugfix
AI-21881
Fixed a bug in the
Adminapp
user details dialog that sometimes caused Chrome to crash.
Bugfix
AI-21820
Fixed an
Adminapp
bug in the
User Profile
tab where a user role was not selectable if it was the only configured role. This issue only occurred in Chrome and Edge browsers.
Bugfix
AI-21661
Fixed an issue where the
Adminapp
could crash if IAM contained classes not available on the
Adminapp
classpath.
Bugfix
AI-20676
When the number of users on the system is approaching the number of licensed users, the warning message currently displayed in the
Adminapp
is now also logged.
Bugfix
AI-19745
Fixed a bug where bulk migration of user authentication methods was impossible when using custom authentication method IDs.
Bugfix
AI-21485
Fixed a bug where two structural errors in the
Adminapp
OpenAPI specification did not trigger validation errors. The specification has been corrected.
Config automation
New
AI-21294
Introduced
Modifications in Snippets
, a feature that allows config snippets to contain a “recipe” defining how to connect plugins
Improvement
AI-20402
The Config Editor's
History
dialog now allows importing both XML and YAML configurations, regardless of the currently active format.
Bugfix
AI-21578
Fixed an issue that caused the duplicate creation of the
License and Usage Analytics
plugin during migration.
Miscellaneous
New
AI-21238
The new feature “Reliable event delivery” supports the serialization and storage of events in an event outbox repository (database table), and the forwarding of the events to external message brokers. See also
Reliable event delivery
.
Note that generic step result events can be excluded from being stored. See
Specifying the outbox settings
.
New
AI-21798
The
Service Container
component now supports publishing events to an outbox repository using the new
Event Outbox Processor Service
. See also
Reliable event delivery
.
New
AI-21730
Added support for sending Airlock IAM event messages to Apache Kafka clusters. This integration allows for reliable, asynchronous event processing by streaming IAM events into Kafka topics with support for various authentication and encryption mechanisms.
New
AI-20891
The database schema includes a new table named
schema_metadata
from which the current schema version can be retrieved.
See also
Database schema version
.
New
AI-21798
Added the
User Locked
event to the
Lock Inactive Accounts Task
. This task regularly checks all user accounts and locks those that have been inactive for a configured period. It now publishes a
User Locked
event for each newly locked user.
New
AI-21757
The
Delete Users Task
now supports deleting locked user accounts.
Improvement
AI-21477 AI-21769
The
SMTP Email Server
plugin now supports XOAUTH2 authentication using the OAuth 2.0 Client Credentials Grant as required by Office 365.
Improvement
AI-21975
The latest versions of the Java JDK disable support for legacy and insecure algorithms in TLS 1.2 handshakes. This includes:
Signature algorithms using SHA-1, including
RSA-PKCS1-SHA1
and
ECDSA-SHA1
TLS cipher suites that rely solely on RSA (those starting with
“TLS_RSA_”
)
This change does not affect TLS 1.3, which only supports modern, secure algorithms.
Improvement
AI-21924
Added SMPP TON and NPI configuration options for the
Swisscom REST SMS Gateway
plugin.
Improvement
AI-21877 AI-21639 AI-20797
Updated Java (to Java 25), Tomcat, Spring Boot, and UBI images to the latest revisions.
Improvement
AI-21750
The minimum supported DB versions are now:
H2: 2.1.214
MariaDB: 10.6
MySQL: 8.0
SQL Server: 2017
PostgreSQL: 14
Oracle: 19c
Improvement
AI-21581
WARN and ERROR logs no longer include personally identifiable information.
Improvement
AI-21437
Added target URI information to logs reporting “external service unavailable”.
Improvement
AI-18389
The metrics endpoint has been enhanced with license-related metrics.
Improvement
AI-19928
The Elasticsearch integration now also supports HTTPS URLs in the
iam.log.elasticsearch.url
property.
Improvement
AI-21421
hCaptcha response validation is now more lenient, allowing the use of
hCaptcha Enterprise
. However,
hCaptcha Enterprise
features are not available in Airlock IAM.
Improvement
AI-22109
In previous IAM releases, the
application.wadl
file was publicly accessible. This file contained information already available in the IAM REST documentation. To minimize potential attack surface, IAM no longer generates this file.
Bugfix
AI-21925
Fixed a bug where Structured Webserver and Access log outputs did not set the
label
field defined by the
iam.log.label
system property.
The logs now include the
program
field, allowing them to be filtered and distinguished from other logs, analogous to Structured Log4J logs in the main IAM modules.
Bugfix
AI-19770
Fixed a bug where the log message
“Could not determine request URI from configured Gateway/Microgateway, using the URI from the request. Are Gateway settings configured without using a Gateway?”
was logged at INFO level. The message is now logged at DEBUG level.
Bugfix
AI-21889
Fixed an issue where the bundled Fluent Bit and Lua binaries were no longer compatible with older Linux distributions.
Bugfix
AI-21846 AI-21708
To improve compatibility, server certificates created with the
iam init
CLI command include
localhost
as
subjectAlternativeName
and strictly use positive numbers as
serialNumber
.
Bugfix
AI-21722 AI-21723
Fixed an issue where user and session locks were released too early, before the response delay had expired. This could allow concurrent requests on the same session during the response delay period.
Bugfix
AI-21978
Fixed an issue where reporting log messages were forwarded to incorrect destinations, causing log files to fill up even when they were disabled in the
instance.properties
configuration file.
Bugfix
AI-21559 AI-21847
Fixed an issue where starting an IAM container in XML config mode failed when the instance directory did not already exist.
Bugfix
AI-21749
The configuration migration when upgrading from Airlock IAM 8.2 to 8.3 for plugin
Template-based String Provider
has been fixed.
If you have already migrated your config from version 8.2 or earlier to a version later than 8.2, ensure that the property
Value Map Provider
is set correctly.