v2.5.0

⚠️ Breaking change: OAuth 2.1 defaults in Auth Server

Auth Server now follows OAuth 2.1 by default (#15157). Clients that used older OAuth 2.0 patterns may stop working after upgrade.

What changed

• PKCE required: requirePkce now defaults to true. Authorization code requests without code_challenge are rejected (PKCE is required but code_challenge is missing).
• S256 only: code_challenge_method=plain, or no method at all, is rejected.
• Implicit and password (ROPC) grants removed from grantTypesSupported.
• No access token in query string: access_token as a URL parameter is rejected at /userinfo and /clientinfo. Send it in the Authorization: Bearer header.
• Refresh token rotation: public clients get a new refresh token on every refresh. The old one becomes invalid.
• Authorization code lifetime is capped at 600s.
• iss parameter is now included in authorization responses (RFC 9207).

Who is affected
Any authorization code client that does not send PKCE.

What to do

1. Recommended: update your clients to send code_challenge with code_challenge_method=S256 on /authorize, and code_verifier on /token.
2. Move implicit and ROPC clients to authorization code + PKCE, or to client credentials / device flow.
3. Send access tokens in the Authorization: Bearer header only.
4. Public clients must store the new refresh token returned on each refresh.
5. Temporary workaround only, not recommended: set requirePkce to false in the Auth Server configuration (via the TUI or Config API). Grants can be re-added to grantTypesSupported the same way. This lowers security; plan to migrate.

What's Changed

• docs: update README.md by @misba7 in #14987
• chore: make changes in Admin UI plugin backend so that Admin UI cooki… by @duttarnab in #14990
• fix(ci): run image consumers after the image build; honour TRACE by @mo-auto in #14993
• ci: automate terraform provider registry release by @mo-auto in #14996
• feat(jans-auth-server): github action migration -> use jwks instead of jwks_uri by @yuriyz in #14999
• fix(jans-fido2): read and enforce the crossOrigin member of client data by @imran-ishaq in #14974
• fix(jans-fido2): decode RSA and EC2 key variants that SignatureVerifier already supports by @imran-ishaq in #14975
• fix(jans-cedarling): reject entity type bound to conflicting token keys by @dagregi in #14941
• fix(docs): autogenerate docs by @mo-auto in #14984
• docs(cedarling): update benchmark summary by @mo-auto in #14983
• fix(deps): bump vulnerable Go and Python deps by @mo-auto in #14997
• fix(jans-auth-server): /bc-authorize endpoint makes validation only against jwks_uri but no validation against inlined jwks by @yuriyz in #15018
• ci: read AIO Dockerfile via API, not checkout by @mo-auto in #15020
• feat(jans-pycloudlib): add utilities to handle datetime-related functionalities by @iromli in #15003
• feat(jans-orm): merge orm changes by @yurem in #15010
• fix(jans-config-api): set the admin_ui_session_id cookie with SameSite=Strict or SameS… by @duttarnab in #15024
• fix(ci): stop double-counting integration test results by @mo-auto in #15021
• feat(cloud-native): reuse jans.pycloudlib.utils to handle datetime-related functionalities by @iromli in #15008
• feat(orm): add binary column types support by @yurem in #15026
• refactor(jans-fido2): derive advertised algorithms from decoder and verifier capability by @imran-ishaq in #15031
• feat(jans-fido2): validate topOrigin against a configurable cross-origin policy by @imran-ishaq in #15037
• ci(test-integration): report per-component results to Zulip by @mo-auto in #15038
• fix: correct urls by @misba7 in #15043
• fix(ci): name code owners only on failing modules by @mo-auto in #15045
• feat(jans-fido2): add ESP256 and ESP384 signature algorithms by @imran-ishaq in #15032
• feat(jans-fido2): add Ed25519 and Ed448 signature algorithms by @imran-ishaq in #15034
• chore(jans-cedarling): remove legacy JSON to policy store conversion by @haileyesus2433 in #14980
• feat(orm): add ORM integration tests by @yurem in #15040
• feat(orm): disable ssl cert check in tests by @yurem in #15056
• docs: move guide by @jgomer2001 in #15049
• feat(jans-cedarling)!: package portable Cedarling WASM binding by @Dahkenangnon in #14900
• chore(deps): bump io.grpc:grpc-bom from 1.82.0 to 1.83.0 in /jans-casa by @dependabot[bot] in #14645
• feat(jans-linux-setup): use sslfactory SingleCertValidatingFactory in… by @devrimyatar in #15071
• docs(cedarling): update benchmark summary by @mo-auto in #15014
• fix(cloud-native): inconsistent env naming used for modifying jans-config-api configuration by @iromli in #15062
• fix: add agama prog guide to nav by @ossdhaval in #15078
• docs: migrate documentation from MkDocs to Zensical by @ossdhaval in #14871
• chore(deps): bump org.pf4j:pf4j from 3.15.0 to 3.15.1 in /jans-casa by @dependabot[bot] in #15079
• chore(ci): name every workflow to the Category: Name convention by @mo-auto in #15083
• fix(jans-config-api): use injected endpoints when injection enabled by @mo-auto in #15076
• fix(jans-linux-setup): copy pgsql cert to test output dir by @devrimyatar in #15085
• feat(jans-fido2): add ML-DSA-44, ML-DSA-65 and ML-DSA-87 post-quantum algorithms by @imran-ishaq in #15047
• feat(jans-auth-server): forbid SSA creation with both one time and rotation enabled #14595 by @yuriyz in #15091
• fix(jans-cedarling): update vulnerable dependency by @olehbozhok in #15093
• fix(jans-linux-setup): allow MySQL db user from any host for test case by @devrimyatar in #15087
• fix(jans-fido2): trust proxy headers only from configured reverse proxies by @imran-ishaq in #15095
• fix(jans-cedarling): support npm 12 package staging by @Dahkenangnon in #15082
• feat(jans-auth-server): in role_based_scopes_update_token script, add user-INUM in access_token by @duttarnab in #15036
• fix(jans-fido2): close the two gaps left by the trusted-proxy validation by @imran-ishaq in #15101
• docs: Update custom-client-logs.md by @mmrraju in #14963
• fix(config-api): additional check for user role permission by @pujavs in #15069
• feat(jans-auth-server): added SameSite cookie property #15094 by @yuriyz in #15104
• fix(jans-auth-server): masked password attribute value from logs #14676 by @yuriyz in #15054
• feat(jans-fido2): per-RP attestationMode — policy model, resolver and enforcement by @imran-ishaq in #15115
• Jans config api per rp policy swagger by @imran-ishaq in #15119
• fix(setup): unset X-Forwarded-For in request by @yurem in #15107
• fix(jans-cedarling): align cedarling_wasm consumers and docs with the upgraded API by @Dahkenangnon in #15118
• fix(jans-cli-tui): preserve unknown relying-party fields and edit the… by @imran-ishaq in #15120
• feat(jans-cedarling): cap .cjar archive sizes to prevent zip-bomb resource exhaustion by @haileyesus2433 in #15050
• docs: reformat agama programming guide links by @jgomer2001 in #15132
• fix(jans-linux-setup): check disk space on /opt rather than on / by @devrimyatar in #15135
• fix(terraform-provider-jans): stop wiping undeclared config on update by @mo-auto in #15137
• refactor(jans-cedarling): remove redundant issuer_id in custom processor by @dagregi in #15131
• feat(jans-linux-setup): remove snap related code by @devrimyatar in #15145
• docs(cedarling): update benchmark summary by @mo-auto in #15102
• feat(config-api): enhance CORS validation and content security policy (CSP) by @pujavs in #15127
• docs: autogenerate cedarling WASM API docs on release by @mo-auto in #15159
• fix(ci): set the developer docs output path from a step by @mo-auto in #15161
• fix(ci): make the developer docs workflow runnable and correct by @mo-auto in #15162
• feat(jans-fido2): add async batched Lock Server audit-event client by @imran-ishaq in #15151
• fix(docs): update outdated import in application session sample script by @ossdhaval in #15153
• fix(docs): provide missing links and purpose information for scripts by @ossdhaval in #15055
• fix(docs): improve Jans CLI/TUI user management documentation by @ossdhaval in #15125
• ci(test-integration): run jans-orm persistence tests by @mo-auto in #15168
• feat(jans-cedarling): expose local telemetry snapshot API by @dagregi in #15041
• feat(jans-fido2): emit Lock audit events for passkey registration by @imran-ishaq in #15170
• feat(jans-fido2): emit Lock audit events for passkey authentication by @imran-ishaq in #15171
• feat(jans-config-api): merge the /license/retrieve and /license/activate endpoints in Admin UI plugin by @duttarnab in #15155
• fix(jans-fido2): cache the Lock audit access token instead of reissui… by @imran-ishaq in #15166
• chore(jans-cedarling): replace the O(n) token-metadata reverse lookup with a precomputed index by @haileyesus2433 in #15164
• docs: add a side note on health checks config by @misba7 in #15188
• feat(jans-lock): implement TRACE admin endpoints by @yurem in #15142
• fix(jans-pycloudlib): update kubernetes_meta.py by @ayushjain0702 in #15100
• feat(jans-fido2): add optional native-client telemetry envelope to model and DTOs by @imran-ishaq in #15177
• fix(jans-auth-server): resolve CIMD client_id in all lookup paths #15185 by @yuriyz in #15192
• feat(jan-lock): add TRACE verification services and tests clean up by @yurem in #15194
• feat(jans-fido2): wire native-client telemetry into metrics by @imran-ishaq in #15179
• feat(jans-fido2): let Fido2ClientFactory forward end-user IP and user agent by @imran-ishaq in #15190
• feat: error on opening TUI by @duttarnab in #15201
• feat(cloud-native): implement TRACE admin endpoints by @iromli in #15205
• fix(jans-auth-server): CIMD - authorization-decision path (AuthorizeService) doesn't resolve Client ID Metadata Document client_id → access_denied after login by @yuriyz in #15197
• docs(cedarling): update benchmark summary by @mo-auto in #15172
• fix(docs): autogenerate docs by @mo-auto in #15028
• feat(jans-fido2): tag RP ID hash mismatches with an internal diagnostic code by @imran-ishaq in #15183
• feat(jans-auth-server): upgrade to oauth 2.1 #15090 by @yuriyz in #15157
• feat(jans-auth-server): fixing audience validation for TUI by @duttarnab in #15216
• feat(jans-fido2): wire FidoValidator, Fido2Service and PasskeyInterceptionScript to forward end-user context by @imran-ishaq in #15211
• feat(jans-cedarling): expose current policy store ID by @dagregi in #15200
• feat(cloud-native): upgrade to oauth 2.1 by @iromli in #15220
• fix(config-api): stats service error handling#15178 by @pujavs in #15217
• docs(jans-fido2): document client-context forwarding to passkey telemetry by @imran-ishaq in #15223
• feat(cloud-native): add ability to change FQDN after installation by @iromli in #15173
• test(jans-auth-client): send PKCE in tests and fail fast on redirect by @mo-auto in #15226
• feat(jans-cli-tui): new config-api params by @devrimyatar in #15227
• fix(jans-auth-server): With PKCE required (the default after the OAuth 2.1 upgrade), the device authorization grant breaks at the verification step #15235 by @yuriyz in #15236
• feat(terraform-provider): sync resources & data-sources with current config-api endpoints by @mo-auto in #15229
• docs: Add link to auto-generated Cedarling Rust API docs by @haileyesus2433 in #15222
• fix(docs): improve password recovery wording by @ossdhaval in #15182
• fix config-api-test failures#15061 by @pujavs in #15237
• feat(jans-lock): implement TRACE client endpoints by @yurem in #15234
• fix(jans-cli-tui): claims for dynamic scope by @devrimyatar in #15246
• feat(jans-linux-setup): support bigint attributes by @devrimyatar in #15257
• feat(jans-linux-setup): move jansVersion to jans_schema.json by @devrimyatar in #15259
• fix(docs): autogenerate docs by @mo-auto in #15207
• fix(jans-casa): send PKCE in authn request by @mo-auto in #15299
• fix(deps): bump libs flagged in all-in-one scan by @mo-auto in #15297
• fix(docs): autogenerate docs by @mo-auto in #15273
• feat(jans-auth-server): add OAuth metadata endpoint for "/.well-known/oauth-authorization-server" #15260 by @yuriyz in #15268
• feat(jans-auth-server): added code_challenge_methods_supported to server metadata #15261 by @yuriyz in #15301
• feat(cloud-native): expose oauth-authorization-server metadata by @mo-auto in #15302
• chore: sync artifacts to OCI images by @iromli in #15271
• feat(jans-lock): update telemetry entries in test to confor Cedarling by @yurem in #15309
• fix: license-key is surrounded by double quotes in Admin UI by @duttarnab in #15314

Full Changelog: v2.4.1...v2.5.0