What Has Changed¶

WSO2 Identity Server 5.9.0 brings a range of new features and major improvements. In IS 5.9.0, the following aspects have been changed compared to the previous IS versions.

Changes to Resource Access Control¶

WSO2 Identity Server maintains a set of resources that requires user authentication. In previous versions, if a resource is not mentioned in the configuration, it was allowed to be accessed without user authentication. In WSO2 Identity Server 5.9.0, the configuration is changed to deny any request to a resource that is not mentioned in the configuration. In addition, the resources which do not require any user authentication, has to be explicitly mentioned in the deployment.toml file in the <IS_HOME>/repository/conf/ directory.

[[resource.access_control]]
context="<resource>"
secure="<true/false>"
http_method="<method>"
permissions=["<permission>"]

[resource_access_control]
default_access = "allow"

Log printing¶

WSO2 Identity Server has a log printing mechanism. With WSO2 Identity Server 5.9.0, a correlation Id is added to all the places where the logs are printed.

[2019-09-10 20:36:09,181] [16667e80-6470-425b-b63a-253f096c7e69]  INFO {org.wso2.carbon.core.services.util.CarbonAuthenticationUtil} - 'admin@wso2.com [1]' logged in at [2019-09-10 20:36:09,180+0530]

Storing the username in consent management¶

WSO2 Identity Server supports obtaining user consent at user authentication. Consent management in previous Identity Server versions, enforced case-sensitive usernames. But, Identity Server 5.9.0 supports case-insensitive usernames by default.

[user_store]
use_case_sensitive_username_for_cache_keys = true

Changes to the OIDC discovery response¶

WSO2 Identity Server has an OpendID discovery service that can be called by using the https://{server-ip}/oauth2/oidcdiscovery/.well-known/openid-configuration endpoint.

In previous versions, the response values of the request_parameter_supported and claims_parameter_supported properties were as follows.

"request_parameter_supported": "true",
"claims_parameter_supported": "true",

In WSO2 Identity Server 5.9.0 the values for above properties have been changed to boolean instead of string.

"request_parameter_supported": true,
"claims_parameter_supported": true,

Redirecting to callbackUrl in OAuth flow errors¶

In previous Identity Server versions, when an error occurs while using the OAuth 2.0 flow, the user was redirected to an error page at the authenticationendpoint/oauth2_error.do URL. According to the specification, unless the provided redirect URI and client Id are invalid, the user should be redirected to the provided redirect URI.

For WSO2 Identity Server 5.9.0 to be specification-compliant, unless the provided redirect URI or client Id are invalid, the user will be redirected to the given redirect URI with the error, error_description, and state parameters set to the query component of the redirection URI.

[oauth]
redirect_to_idp_error_page_on_error=true

Redirecting to PostLogoutUri in user consent denial for OIDC logout¶

When a user rejects the OIDC logout consent, in earlier versions of the WSO2 Identity Server the user was redirected to the oauth2_error.do page with “access_denied - End User denied the logout request” error message. Custom parameters such as “oauthErrorCode” and “oauthErrorMsg” were used to explain the issue to the user.

In WSO2 Identity Server 5.9.0, the user will be redirected to postLogoutUri with the parameters error and error_description which are defined in the OIDC specification.

[oauth.oidc]
redirect_to_post_logout_uri_on_consent_denial = false

Scope validation for token issuing¶

WSO2 Identity Server supports scope validation when issuing tokens for OAuth Service Providers.

In previous Identity Server versions, this capability was not available when issuing tokens for Authorization Code and Implicit grant types. Identity Server 5.9.0 supports these by default when using a scope validator.

[oauth.scope_validator.authz_implicit]
enable = false

Authentication Endpoint and Account Recovery Endpoint¶

In earlier versions of the WSO2 Identity Server the authenticationendpoint and the accountrecoveryendpoint was packed in as war files in the <IS_HOME>/repository/ deployment/server/webapps/ directory. In WSO2 Identity Server 5.9.0 the exploded war files are packed.

Log4j upgrade¶

WSO2 Identity Server 5.9.0 has switched from log4j to log4j2. You will notice that there is a log4j2.properties file in the <IS_HOME>/repository/conf/ directory instead of the log4j.properties file.

function getAge(birthDate) {
    ...   
}

var getAge = function (birthDate) {
    ...
};

Handling Role-based or XACML-based Scope Validation for Implicit and Authorization Code Grants¶

Scope validation has been enforced for authorization code grant and implicit grants.

[oauth]
scope_validator.authz_implicit.enable = false

Multi factor Authentication using FIDO¶

From IS 5.9.0 onwards, WebAuthn API is being used instead of U2F API. If you have used FIDO previously, your devices must be re-enrolled.

[fido.webauthn]
enable = false