UAA Release Notes 4.11.0
Stories included in release
Features
- Upgrade to Spring Security SAML 1.0.4.RELEASE
- Propagate response type error message in query parameters for missing response_type parameter
- Authorization request missing the response_type parameter returns error
- cloudfoundry/uaa #772: UaaTokenStore: Don't fall over when failing to expire oauth codes
- Add email_verified mapping documentation for IDPs
- Expose email_verified as a claim in the id_token and /userinfo endpoint
- Support MFA through CLIs as part of password grant type
- Enable passcode prompt for MFA login through SSO
- Allow mapping for email_verified claim - LDAP
- Allow mapping for email_verified claim - SAML
- Allow mapping for email_verified claim - OIDC
- Adapt implementation of MfaAuthenticationSuccess/FailureEvent
- Allow UAA user attributes to be sent in SAML Assertion
- Information for CF Security for Export Compliance
- cloudfoundry/uaa #767: Extend interface UaaTokenEnhancer with a generic enhance
- Updated Java JDK to 8u162
Bug Fixes
- /Users?attributes never return groups or approvals
- Password Grant with MFA is not marked as not yet ready for production use
- MFA registration back button (which just uses logout.do) no longer works
- Unable to change user's password because current password is not being accepted when username exists for multiple origins
- cloudfoundry/uaa #749: omit not needed libs
- IdentityProviderAuthenticationSuccess events show unknown authentication type
- UAA CSRF token under /login context path prevents users from logging in
- Changing username while MFA is enabled breaks login if you are already authenticated
- mfaprovider issuer field cannot contain colons