v3.8.0.0

Version 3.8.0 2026-02-26

Features

• Security Key PIN setup is now possible before registration, if the key does not have a PIN set yet.
• Selection of credential to use. If there are multiple matching credentials on the authenticator, a selection for the username will be displayed. To show the usernames, the device PIN is required. There is fallback implemented, but if the initial request did not want a PIN, you will have to touch your security key twice. See the FIDO section of the configuration documentation for more detail.

Enhancements

• Added a two-tier expiry system with lazy eviction (see refill behavior) for offline credentials.

  • The configuration can later be received from the privacyIDEA server if it's implemented there.
  • 'offline_expiration_days': days without successful refill after which the credential will be inactive (not usable for authentication, but not deleted yet. Refill will still be attempted).
  • 'offline_delete_after_days': days AFTER becoming inactive, after which the credential will be deleted automatically.
  • Example: expiry=3d, deletion=1d. The credential will expire after 3 days without successful refill. Then, after another day without refill, the credential will be deleted.

• Improved refill behavior for FIDO credentials.

  • Refill is checked before usage.
  • Refill is done for all tokens of the user as soon as the user is known. This is the default behavior. Previously, the refill was only done for the token that was actually used, which could easily cause stale credentials in the offline file.
  • 'check_all_offline_credentials=1' allows you to remove the "refill per user" constraint so that all offline credentials are checked. Only use this if you are sure there is a limited number of offline credentials on the machine. Checking too many credentials will add a significant delay to the login and degrade the user experience. (We are also working on improving this.)

• Always use Windows Hello (Credential Broker UI) for CredUI scenarios.

  • Allows selection of the credential to be used.
  • The native implementation can be activated with 'disable_windows_hello_for_credui=1', which is not recommended.

• Added option passkey_first_step which will cause the Credential Provider to start passkey authentication instantly. Be aware that it can only be cancelled, if it is still waiting for a device. If a device is already inserted, and you are prompted to touch your security key, the operation can no longer be aborted because the control is already given to the security key. You can then either touch it and then cancel the authentication or wait for a timeout.

Fixes

• Fixed password change for machines that are not in a domain
• Fixed behavior when the passkey is not on the authenticator that is currently used:
  • Offline file exists with other credentials, and the machine is online, so a sign request is also present from the server:
    • Tries offline first -> ERROR_NO_CREDENTIALS -> then tries online and succeeds
  • Offline file exists with the correct credentials (being online or not does not matter in this case):
    • Tries offline first -> success
  • Offline file exists with other credentials, machine is offline:
    • Tries offline -> ERROR_NO_CREDENTIALS as expected
  • Offline credentials are not deleted just because the authenticator returns ERROR_NO_CREDENTIALS; it could just be the wrong YubiKey. Offline credentials are only deleted if the refill indicates that they should be, or by the expiry.

v3.7.0.3

Version 3.7.0 2024-08-05

This version introduces a few changes, especially in the order the user is prompted for inputs. Please take a moment to read the updated configuration documentation.

Summary of Changes

The default order of prompts is now username -> MFA -> password. This allows for a meaningful usernameless passkey login. While the password is still required, the Credential Provider is prepared for a solution that does not need the password input from the user.

Alternatively, you can configure the flow to be username+password -> MFA. The option to have username+password+OTP in a single step has been removed.

All texts that have been configurable via dedicated registry entries are now configurable via the translation system. If you previously used one of these customized texts, please see the documentation on how to do it with the new system. There is also information on which old registry entry corresponds to which message ID.

Installing this version will remove unused registry entries automatically.

Features

• Passkey Login, allowing a usernameless FIDO authentication
• Passkey enrollment during authentication with the enroll_via_multichallenge policy
• Passkey offline
• Exluded Group to exclude a group of users from MFA

Enhancements

• FIDO authentication and registration will now work properly in RDP scenarios using windows hello
• Configurable accept-language for http requests
• Fallback url
• Background thread that does the polling when doing push authentication will now timeout after 5 minutes in case of ghost sessions
• hide_first_step_response_error to hide the message when sending an empty password or the password in the first step did not trigger a challenge
• Smartphone container can be enrolled with the enroll_via_multichallenge policy
• Added option to cancel enroll_via_multichallenge enrollments with privacyIDEA 3.12+
• Added register for safe mode to installer
• Updated installer to reflect most of the new configuration options and removed old options
• Added options webauthn_offline_second_step, webauthn_offline_preferred and webauthn_offline_hide_first_step to customize the behavior of offline WebAuthn.

Fixes

• Fixed a bug where prefill_username would still overwrite another username that was entered after the field was prefilled, resulting in a logon attempt of the wrong user.
• Fixed implementation of GET requests so that polling for push authentications works with privacyIDEA 3.11 and higher

v3.7.0.1

Version 3.7.0 2024-08-05

This version introduces a few changes, especially in the order the user is prompted for inputs. Please take a moment to read the updated configuration documentation.

Summary of Changes

The default order of prompts is now username -> MFA -> password. This allows for a meaningful usernameless passkey login. While the password is still required, the Credential Provider is prepared for a solution that does not need the password input from the user.

Alternatively, you can configure the flow to be username+password -> MFA. The option to have username+password+OTP in a single step has been removed.

All texts that have been configurable via dedicated registry entries are now configurable via the translation system. If you previously used one of these customized texts, please see the documentation on how to do it with the new system. There is also information on which old registry entry corresponds to which message ID.

Installing this version will remove unused registry entries automatically.

Features

• Passkey Login, allowing a usernameless FIDO authentication
• Passkey enrollment during authentication with the enroll_via_multichallenge policy
• Passkey offline
• Exluded Group to exclude a group of users from MFA

Enhancements

• FIDO authentication and registration will now work properly in RDP scenarios using windows hello
• Configurable accept-language for http requests
• Fallback url
• Background thread that does the polling when doing push authentication will now timeout after 5 minutes in case of ghost sessions
• hide_first_step_response_error to hide the message when sending an empty password or the password in the first step did not trigger a challenge
• Smartphone container can be enrolled with the enroll_via_multichallenge policy
• Added option to cancel enroll_via_multichallenge enrollments with privacyIDEA 3.12+
• Added register for safe mode to installer
• Updated installer to reflect most of the new configuration options and removed old options

Fixes

• Fixed a bug where prefill_username would still overwrite another username that was entered after the field was prefilled, resulting in a logon attempt of the wrong user.
• Fixed implementation of GET requests so that polling for push authentications works with privacyIDEA 3.11 and higher

v3.6.0

Enhancement

• WebAuthn via NFC. However, this feature is marked as experimental by libfido2, which is used here. So there might be devices that do not work or other problems.
• WebAuthn token can be used for offline authentication if it is marked as such in privacyIDEA.
• Use of user_verification=discouraged policy in privacyIDEA is now considered. In offline scenarios, the PIN prompt can be controlled via webauthn_offline_no_pin registry setting.
• Changed translation system to allow adding or changing translations without the need to install a new version. Also added spanish translation. Both contributed by charlyR (#158)

Fixes

• Fixed a bug that would cause otp_link_text to be ignored.
• Fixed a bug that would cause the (customizable) OTP failure text to not be displayed.

v3.5.3

Fixes

• Fixed a bug that would result in two_step_hide_otp being ignored when selecting another credential provider
• Fixed a bug that would not reset the login to the first step if "the user could not be found in any resolver in this realm" occured
• Fixed a bug that would prevent the FIDO device recognition on the second try if it was cancelled once

v3.5.2

Fixed inverted translation that occured for some texts

v3.5.1

Fixes

• Fixed successful offline authentication with HOTP not ending the authentication
• Fixed the info text displayed for offline token for webauthn
• Fixed refreshing of refilltoken for webauthn offline
• Fixed FIDO device search cancellation
• Fixed some texts
• Added texts for refill phases to be distinguished from authentication

v3.5.0

Features

• WebAuthn online
• WebAuthn offline, requires privacyIDEA 3.10 which will be released on a later date

Enhancements

• Added CredentialProvider version to the useragent
• Added ComputerName to useragent (optional). This will be needed for the WebAuthn offline management of refilltoken in the server.

Fixes

• Fixed reset_link_text to be actually used when set
• Fixed a bug when using RDP with UPN would result in the UPN not being split properly and therefore producing a wrong username, making login impossible.

Dummy subscription is attached

v3.4.0

Features

• If 'send_upn' is enabled and the username input contains an '@' and no '', it will be send as is to privacyidea, the realm will be omitted in this case. This feature does not yet check with AD if the UPN is correct.

Fixes

• Fixed a bug where a password reset for an expired password was not recogized.
• Fixed a bug where the '%' was not properly encoded when communicating with privacyidea.

v3.3.0

Features

• Token enrollment via challenge-response (introduced in privacyIDEA 3.8) can be used in the CP.
• Added whitelist for the filter to spare other credential providers from being filtered.

Fixes

• If sending password or emtpy password was enabled and machine was offline, it was impossible to get to the second step for an offline authentication, because of the error caused by the attempt to send something. This is now fixed and offline is possible even if an error occured in the first step.
• If the excluded_account included a '.', it was not resolved to the local machine name before comparing with the input. Now both input and registry setting will have the '.' resolved before comparing values.