Blog »

Connect2id server 14.0 RC6 with new refresh token settings, optional ID token refresh and Oracle database support

2023-05-08

This is a stable snapshot of the upcoming Connect2id server 14.0. The final release will include more features and changes.

New refresh token settings

Self-contained (JWT-encoded) refresh tokens that link to transient (non-persisted) authorisations can now also be optionally rotated. Previously the rotation was possible only for refresh tokens linked to a long-lived (persisted) authorisation. The rotation is intended as a poor-man's protection for public OAuth 2.0 clients against replay of a leaked refresh token. The more secure and robust in case of slow / poor networks method to prevent replay is for public clients to use sender-constrained refresh tokens, by means of mTLS or DPoP.

The refresh token rotation can now be set on a individual authorisation basis, by setting the optional refresh_token.rotate parameter in the consent of authorisation sessions.

Example consent setting refresh token rotation:

{
  "scope"         : [ "openid", "email" ],
  "claims"        : [ "email", "email_verified" ],
  "refresh_token" : { "rotate" : true }
}

The direct authorisation endpoint and the token exchange and password grant handlers also support the new rotation parameter.

If the refresh_token.rotate parameter for a given authorisation isn't set a default policy will be applied, according to the new authzStore.refreshToken.defaultRotate configuration property.

The global authzStore.refreshToken.alwaysUpdate (always rotate) configuration property is deprecated and should no longer be used. Instead, set the authzStore.refreshToken.defaultRotate configuration property and override it for specific clients or authorisations.

ID token refresh

ID token refresh can be allowed on a individual authorisation basis, by setting the optional id_token.refresh parameter in the consent of authorisation sessions.

Example consent allowing ID token refresh:

{
  "scope"    : [ "openid" ],
  "id_token" : { "allow_refresh" : true }
}

As long as the OpenID provider session where the user login took place remains present, the token endpoint will return a new ID token in response to the refresh token. When the session is closed or expires issue of the ID token will cease (but an access token will still be returned).

The ID token refresh can thus be used by authorised relying parties to perform a back-channel check whether the user still has a session with the Connect2id server.

Note that the ID token refresh does not guarantee the end-user is actually present and properly authenticated, due to the back-channel nature of the token request. The standard prompt=none OpenID authentication request is intended for this purpose, as it's done via the front-channel (the browser) and cannot be triggered without an end-user interaction.

Infinispan upgrade

The underlying Infinispan layer received a sweeping upgrade from v9.4.x to v14.0.x, while retaining the existing stateless, stateless + Redis and replication Connect2id server clustering modes.

Oracle database support

The Oracle database is now supported, alongside the MySQL, PostgreSQL and Microsoft SQL Server relational databases.

Support for persistence to LDAP is removed

In v14.0 persisting Connect2id server data to an LDAP server will no longer be supported. Connect2id server deployments with an LDAP backend database have the choice to migrate to a supported SQL RDBMS or to AWS DynamoDB.

Bug fixes, optimisations

The code base received several bug fixes. The data persistence layer was optimised, which may result in CPU and storage bill savings in large deployments.

More information can be found in the release notes below.

Download 14.0-rc.6

For the signature validation: Public GPG key

Standard Connect2id server edition

Apache Tomcat package with Connect2id server 14.0-rc.6: Connect2id-server.zip

GPG signature: Connect2id-server.zip.asc

SHA-256: b44819da65977c4e66ec78d8166c5d55f6f87acd60fb066674ed26abcd6f03e7

Connect2id server 14.0-rc.6 WAR package: c2id.war

GPG signature: c2id.war.asc

SHA-256: 64c8f713b0101079eae9ccedfb3a273406f97adcf787c6999636dbcacc34ad37

Questions?

If you have technical questions about this new release contact Connect2id support. To purchase a production license for the Connect2id server, renew or upgrade your support and updates subscription, email our sales.

Release notes

14.0 (2023-05-06)

Summary

  • Support for refresh token rotation that can be set on an individual authorisation basis, overriding the global Connect2id server configuration.

    Self-contained (JWT-encoded) refresh tokens, which are linked to transient / non-persisted ("long_lived":false) authorisations, also receive the ability to be rotated.

    In previous Connect2id server versions refresh token rotation could only be set globally and apply only to identifier-based refresh tokens, which are linked to long-lived / persisted ("long_lived":true) authorisations.

  • Support for ID token refresh at the token endpoint, set on an individual authorisation basis. The token response will include a new ID token provided the refresh token authorisation allows such refresh and the subject (end-user) session bound to the refresh token is still present. If the session was closed or expired no ID token will be included in the token response.

    An authorised OpenID relying party may use the ID token refresh to do a back-channel check whether the end-user session with the OpenID provider still exists (i.e. that the session wasn't closed or expired). OpenID relying parties should use the standard "prompt=none" OpenID authentication request to ensure the end-user is actively present and properly authenticated, since this method involves the front-channel (the browser). An ID token refresh thus isn't equivalent to or a substitute for a "prompt=none" OpenID authentication request.

  • Public clients registered for OAuth 2.0 mutual TLS (RFC 8705) and the OAuth 2.0 refresh token grant will receive refresh tokens that are client X.509 certificate bound.

  • Upgrades to Infinispan 14.0.

  • Adds Oracle 12c r1+ Database support.

  • Removes LDAP backend database support as part of the Infinispan 14.0 upgrade. Connect2id server deployments with an LDAP backend database can migrate to a supported SQL RDBMS or to AWS DynamoDB.

Configuration

  • /WEB-INF/oidcProvider.properties

    • op.authz.feedSubjectSessionClaimsIntoIDToken -- No longer a required configuration property, receives a default value of true.

  • /WEB-INF/authzStore.properties

    • authzStore.refreshToken.defaultRotate -- New optional configuration property for the default refresh token rotation setting. Can be overridden by individual authorisations. The default value is false (no rotation).

    • authzStore.refreshToken.alwaysUpdate -- Deprecated, use "authzStore.refreshToken.defaultRotate" instead.

  • /WEB-INF/infinispan-*.xml

    • Upgrades the XML schema to Infinispan 14.0.

    • Replaces the Infinispan "op.clientRegTokenMap" with a new generic "authzStore.expendedTokenMap" capable of storing keys for expended tokens that are rotated self-contained (JWT-encoded) refresh tokens, client registration tokens, client_secret_jwt and private_key_jwt tokens, DPoP tokens and other one-time-use objects.

  • /WEB-INF/infinispan-stateless-oracle.xml

    • New Infinispan configuration for stateless clustering and an Oracle database.

  • /WEB-INF/infinispan-stateless-redis-oracle.xml

    • New Infinispan configuration for stateless clustering and an Oracle database and Redis for caching and storage of short-lived objects.

  • /WEB-INF/infinispan-replication-oracle.xml

    • New Infinispan configuration for replication clustering and an Oracle database.

  • /WEB-INF/infinispan-multitenant-stateless-oracle.xml

    • New multi-tenant Infinispan configuration for stateless clustering and an Oracle database.

  • /WEB-INF/infinispan-multitenant-stateless-redis-oracle.xml

    • New multi-tenant Infinispan configuration for stateless clustering and an Oracle database and Redis for caching and storage of short-lived objects.

  • /WEB-INF/infinispan-*-{mysql|postgres95|sqlserver|oracle|h2}.xml

    • New optional "dataSource.createTableIfMissing" Java system property. When "true" (the default value) the Connect2id server will automatically create the required SQL tables on startup. It will also perform automatic table alternations where necessary in new major releases. When "false" the database administrator must create or alter the tables manually before server startup.

    • New optional "dataSource.maxPoolSize" Java system property. Controls the maximum size the SQL connection pool is allowed to reach, including both idle and in-use connections. The default size is 5.

  • /WEB-INF/infinispan-*-ldap.xml

    • The LDAP backend database XML configurations are removed and no longer supported.

  • /WEB-INF/sql

    • New directory containing the required SQL statements for manual table creation, to be used when the Connect2id is configured to disable automatic table creation (if missing) on server startup (with
      dataSource.createTableIfMissing=false).

Web API

  • /token

    • Supports issue of rotated self-contained (JWT-encoded) refresh tokens.

    • Supports ID token refresh. Requires the refresh token authorisation to explicitly allow ID token refresh and the subject (end-user) session bound to the refresh token to be still present (not closed or expired), else an ID token will not be included in the token response.

      The expiration of the refreshed ID token will be set according to the globally configured "op.idToken.defaultLifetime". An ID token lifetime supplied to the consent object (with "id_token.lifetime") will not be replicated in refreshed ID tokens.

      The "max_age" OpenID authentication request parameter will trigger inclusion of the "auth_time" claim only in the ID token issued in the direct response to it, not in refreshed ID tokens. For an OpenID relying party to receive the "auth_time" claim in refreshed ID tokens it must be registered as client for the "require_auth_time" metadata parameter.

      The refreshed ID token will include all consented claims as well as any claims found in the subject session "claims" field (unless the "op.authz.feedSubjectSessionClaimsIntoIDToken" configuration property prevents this). Preset ID token claims supplied to the consent object (with "preset_claims.id_token") will not be replicated in refreshed ID tokens.

  • /authz-sessions/rest/v3/

    • Adds an optional "refresh_token.rotate" parameter of type boolean to the consent object. Sets the refresh token rotation for the current authorisation. When omitted the "authzStore.refreshToken.defaultRotate" configuration will apply.

    • Adds an optional "id_token.refresh" parameter of type boolean to the consent object. Allows an OpenID relying party to receive a new ID token at the token endpoint in exchange for a valid refresh token, with the subject session bound to the refresh token still being present.

  • /direct-authz/rest/v2/

    • Adds an optional "refresh_token.rotate" parameter of type boolean to the request object. Sets the refresh token rotation for the individual authorisation. When omitted the "authzStore.refreshToken.defaultRotate" configuration will apply.

    • Adds an optional "id_token.refresh" parameter of type boolean to the consent object. Allows an OpenID relying party to receive a new ID token at the token endpoint in exchange for a valid refresh token, with the subject session bound to the refresh token still being present.

  • /authz-store/rest/v3/

    • New "rtr" authorisation field of type boolean for the refresh token rotate setting. The default value is false.

    • New "idr" authorisation field of type boolean for the allow ID token refresh setting. The default value is false.

  • /monitor/v1/metrics

    • Adds new "authzStore.numExpendedTokenEntries" gauge.

    • Removes the "clientStore.numCachedExpendedTokens" gauge (replaced by the
      new "authzStore.numExpendedTokenEntries" gauge).

SPI

  • Upgrades the Connect2id server SDK to com.nimbusds:c2id-server-sdk:4.53

    • The RefreshTokenSpec class receives a new optional rotation setting. If empty the default Connect2id server refresh token rotation policy will apply.

    • The IDToken spec class receives a new optional allow refresh setting. The default setting is no ID token refresh allowed.

    • The PasswordGrantHandler SPI can set a refresh token rotation preference.

    • The TokenExchangeGrantHandler SPI can set a refresh token rotation preference.

Resolved issues

  • The SQL store must not set the client "application_type" to the default value "web" on record retrieval (issue server/838).

  • The Microsoft SQL Server id_access_tokens table column cnf must be VARCHAR (100), not NVARCHAR(100) (issue authz-store/199).

  • Retrieving an authorisation record by refresh token must echo the submitted refresh token value in the returned record instead of recreating it from the persisted "rts" field (issue authz-store/203).

  • Authorisation updates must always return a refresh token in the current format, not the legacy format (issue authz-store/204).

  • The direct authorisation endpoint must always return a refresh token in the current, not the legacy format (issue server/837).

  • Store retrieval of identifier-based access tokens must recreate the local subject when the subject type is pairwise (issue authz-store/201).

  • Removes redundant persistence of registration_client_uri, recreates it dynamically from the OP / AS issuer URL and the client_id (issue server/512).

  • The "cnf" column of the "id_access_tokens" SQL table must be increased from 100 to 150 VARCHAR for H2 and MS SQL Server to accommodate token
    authorisations that use both a x5t#S256 and a jkt binding (issue authz-store/206).

  • Adds missing DynamoDB persistence of the "cld" (claims data) authorisation record field (issue authz-store/210).

  • Automatic revocation of all authorisations on replay of a rotated refresh token (issue authz-store/212).

  • Persist only the subject session ID key in pending authorisation code entries (omitting the appended HMAC), to prevent exploitation of session IDs in case of unauthorised access to the backend database or a database record leak (issue server/863).

  • Fixes NPE in DirectAuthorizationRequest.getResolvedClaims (issue server/867).

  • Consented non-requested OpenID claims should not be included in the saved claims field ("scs") of authorisations and authorisation records (issue server/868).

Dependency changes

  • Upgrades to com.nimbusds:c2id-server-sdk:4.53

  • Upgrades to com.nimbusds:oauth2-oidc-sdk:10.9

  • Updates to com.nimbusds:c2id-server-property-source:1.1.1

  • Updates to com.nimbusds:tenant-manager:7.4.1

  • Updates to com.nimbusds:tenant-registry:8.2

  • Updates to com.nimbusds:oauth2-authz-store:23.0

  • Updates to com.nimbusds:oidc-session-store:16.4

  • Updates to com.nimbusds:software-statement-verifier:2.2.3

  • Upgrades to com.nimbusds:common:2.52

  • Upgrades to com.nimbusds:infinispan-cachestore-common:3.1

  • Upgrades to Infinispan 14.0.7.Final

  • Upgrades to com.nimbusds:infinispan-cachestore-sql:7.0.2

  • Upgrades to com.nimbusds:infinispan-cachestore-dynamodb:5.0.1

  • Upgrades to com.nimbusds:infinispan-cachestore-redis:10.0.1

  • Updates to com.nimbusds:jgroups-dynamodb-ping:1.2.6

  • Adds com.oracle.database.jdbc:ojdbc11:21.8.0.0