You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Draft release notes for 1.60.0
* Update astro/src/content/docs/release-notes/index.mdx
Co-authored-by: Dan Moore <dan@fusionauth.io>
* Update astro/src/content/docs/release-notes/index.mdx
Co-authored-by: Dan Moore <dan@fusionauth.io>
* copy
* Working
* Working
* Working
* Fixed a typo and some formatting
* Working
* Working
* Working
* Better description
* Update astro/src/content/docs/release-notes/index.mdx
Co-authored-by: Brent Halsey <211656+bhalsey@users.noreply.github.com>
* copy
* copy
* copy
---------
Co-authored-by: Dan Moore <dan@fusionauth.io>
Co-authored-by: Daniel DeGroff <daniel@fusionauth.io>
Co-authored-by: Brent Halsey <211656+bhalsey@users.noreply.github.com>
Copy file name to clipboardExpand all lines: astro/src/content/docs/release-notes/index.mdx
+193-2Lines changed: 193 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,11 +47,202 @@ import { YouTube } from '@astro-community/astro-embed-youtube';
47
47
48
48
Looking for release notes older than 1.44.0? Look in the [release notes archive](/docs/release-notes/archive). Looking to be [notified of new releases?](/docs/operate/roadmap/releases#release-notifications) <spanclass="not-prose no-underline"><aclass="ml-2"href="/docs/releases.xml"><iclass="fas fa-xs fa-rss text-orange-700 text-2xl"width="50px" /></a></span>
FusionAuth accepts access tokens to authenticate requests and to initiate user authentication workflows.
56
+
57
+
Improvements have been made to how tokens are accepted, processed and validated to ensure they are suitable to authenticate the request. This will improve security now and will be necessary to support access tokens more extensively for authenticating requests.
58
+
</Issue>
59
+
60
+
### Changed
61
+
62
+
* <Issueissue="3177">
63
+
Some changes have been made to the way JWTs are produced and validated. Please read the following carefully to understand if any of these changes could impact you.
64
+
65
+
**Moved claims**
66
+
67
+
* The `gty` claim has been moved from the JWT header to the body.
68
+
* This claim is present in an access token or id token produced by an OAuth grant.
69
+
* The `use` claim has been moved from the JWT header to the body.
70
+
* This claim is present in an access token produced by an OAuth client credentials grant to authenticate a FusionAuth SCIM server.
71
+
72
+
**New and reserved claims**
73
+
74
+
The following claims are now reserved.
75
+
-`auth_time` - Reserved for all user tokens, excludes client credentials
76
+
-`gty` - Reserved for all tokens
77
+
-`tty` - Reserved for all tokens
78
+
-`use` - Reserved for the client credentials grant
79
+
80
+
We do not expect this change to impact our customers. If you are adding, removing or modifying these claims using a lambda function, you will need to plan to modify your integration.
81
+
82
+
These claims are not considered reserved for the Vend API.
83
+
84
+
**Token validation**
85
+
86
+
It is possible that an existing access token or id token that has not yet expired will no longer be considered valid by FusionAuth. If you are using a short lived access token with a refresh token, refreshing the access token will correct itself. These changes will not have any affect on your use of the JWTs produced by FusionAuth.
87
+
88
+
**Deprecated features removed**
89
+
90
+
The User API JWT authentication method which was deprecated in version `1.50.0` has now been removed.
91
+
92
+
</Issue>
93
+
94
+
### New
95
+
* <Issueissue="2208">
96
+
FusionAuth supports the OIDC _prompt_ parameter! This enables various use cases, such as silent authentication, as well requesting re-authentication and consent prompting.
97
+
98
+
Thanks to all of the community members that have helped us define this requirement, and waited patiently for it! 🎉
99
+
100
+
See [prompt](/docs/lifecycle/authenticate-users/oauth/prompt) for more information.
101
+
</Issue>
102
+
103
+
### Fixed
104
+
* <Issueissue="2691">
105
+
When decommissioning a license in a FusionAuth cluster, the change may not be reflected in all cluster nodes immediately. This can provide intermittent and inconsistent access to licensed features, depending on which node is handling a request.
106
+
</Issue>
107
+
108
+
* <Issueissue="2887">
109
+
A user can be shown a rendering error while attempting to complete an email based MFA login.
110
+
111
+
The error occurs when send rate limiting has been enabled as part of Advanced Threat Detection. When the user reached the rate limit threshold for requesting emails to be sent to complete login, the intended error was not shown an instead a page rendering error was displayed.
112
+
</Issue>
113
+
114
+
* <Issueissue="2936">
115
+
When a user completes a forgot password workflow, the failed login count will be reset.
116
+
117
+
This should reduce frustration for a user that changed their password after exceeding the configured failed login count. In this scenario, if the user had entered the the incorrect password again they would be required to wait for the configured time period before attempting login again. This could be quite frustrating.
118
+
119
+
Now that the failed count has been reset, the user will at least be allowed to enter the wrong password a few more times before we thwart their efforts. 😅
120
+
</Issue>
121
+
122
+
* <Issueissue="2966">
123
+
When running in dark mode, or using a dark theme with a FusionAuth simple theme, some QR code scanners are unable to read the QR code for setting up MFA. We have added a light border to ensure that the QR code is still readable on a dark background. The QR code should have a high-contrast border to allow these readers to work.
124
+
</Issue>
125
+
126
+
* <Issueissue="3148">
127
+
When previewing the `Phone verification required`, `Complete registration`, and `Passwordless` theme templates in an advanced theme preview window, a FreeMarker exception is displayed to the user.
128
+
129
+
This was introduced in version `1.59.0`.
130
+
</Issue>
131
+
132
+
* <Issueissue="3151">
133
+
A race condition exists, when attempting to activate FusionAuth using an air-gapped license without any outbound network access that may cause the the request to fail and not correctly persist the license.
134
+
135
+
When this issue is encountered the system becomes un-licensed.
136
+
</Issue>
137
+
138
+
* <Issueissue="3160">
139
+
When regenerating Reactor's encryption key, the _Breached Password Detection_ status may take longer than expected to return to _Active_.
140
+
141
+
If you were to encounter this issue, deactivating and reactivating your license will also correct the state. You can also reach out to support if you see something like this as well.
142
+
</Issue>
143
+
144
+
* <Issueissue="3164">
145
+
Improved MFA configuration workflow during self-service registration when configured as required.
146
+
</Issue>
147
+
148
+
* <Issueissue="3175">
149
+
In version `1.59.0`, changes were introduced that made it impossible to set webhooks for a handful of event types as transactional.
150
+
151
+
See release notes for `1.59.1` below for additional information.
152
+
</Issue>
153
+
154
+
### Enhancements
155
+
* <Issueissue="3177">
156
+
General improvements to how we handle and proces JWTs in the form of access tokens and refresh tokens.
157
+
158
+
* Adding `tty` claim to all tokens produced to easily differentiate between an access token and id token.
159
+
* Moving the `gty` claim from the header to the body for tokens produced by an OAuth grant.
160
+
* Moving the `use` claim from the header to the body for tokens produced by the client credentials grant for a SCIM server.
161
+
* Better support of the `token_type_hint` on the Introspect endpoint.
162
+
* Allow the use of refresh tokens on the Introspect endpoint with a `token_type_hint` of `refresh_token`
163
+
</Issue>
164
+
165
+
* <Issueissue="2886">
166
+
Move the `gty` and `use` claims from the JWT header to the body. This should improve interoperability with various identity providers such as AWS and Microsoft.
167
+
168
+
The `gty` claim will be present for all tokens produced by an OAuth grant. The `use` claim will be present in an access token produced to authenticate the SCIM server.
169
+
</Issue>
170
+
171
+
* <Issueissue="3032">
172
+
Signicantly improved performance for the bulk User Import API.
173
+
174
+
Performance will particularly be improved when you have thousands of configured applications.
175
+
</Issue>
176
+
177
+
* <Issueissue="3154">
178
+
Our release process now auto-updates the the example JSON payload for usage data on collected metrics.
179
+
180
+
This documentation will remain up to date going forward.
181
+
182
+
The example data can be found on the [Collected Metrics](/docs/get-started/download-and-install/collected-metrics#detailed-metrics) page, look for Demo Data under the Detailed Metrics.
183
+
</Issue>
184
+
185
+
* <Issueissue="3159">
186
+
In version `1.59.0` the password is now optional when creating or updating a user.
187
+
188
+
When returning from a third-party login, a user may be prompted to complete registration by entering a password when self-service is enabled and is configured to require a password.
189
+
190
+
This was unintended and has been corrected.
191
+
</Issue>
192
+
193
+
* <Issueissue="3165">
194
+
During a password reset workflow, for a user that has MFA configured, the user will be prompted to complete the MFA challenge.
195
+
196
+
When the user completes the challenge, the remember this device checkbox even when checked may not be honored.
197
+
198
+
The result is that once the user completes the change password workflow by completing an MFA challenge, the user will be prompt again on next login. This can be frustrating, and has been corrected.
199
+
</Issue>
200
+
201
+
* <Issueissue="3171">
202
+
When performing the initial setup of FusionAuth outside of FusionAuth Cloud maintenance mode assists you with configuring the connecting to the database and search service.
203
+
204
+
When we cannot connect to the database, or you have not provided enough information to make these connections an error page is displayed.
205
+
206
+
This page has been enhanced to provide better messaging and links to documentation to help you out if you need to troubleshooting the setup process.
207
+
</Issue>
208
+
209
+
* <Issueissue="3172">
210
+
FusionAuth now supports multiple assertions in the SAML AuthN response.
211
+
212
+
If the AuthN response contains multiple assertions, all will be made available to the SAML reconcile lambda function.
213
+
</Issue>
214
+
215
+
* <Issueissue="3173">
216
+
We significantly improved performance of User API searches returning expanded user records, and user reindex actions as well!
* <KnownIssueissue="3159">Admins control whether users must have passwords for an application by modifying the application's advanced registration form. Basic registration forms always have a password field, so a password is always required. IdP logins (such as Login with Google) create users without passwords. If the users are using an IdP to log in to an application with a required password field, the user is forced to set a password.</KnownIssue>
Admins control whether users must have passwords for an application by modifying the application's advanced registration form. Basic registration forms always have a password field, so a password is always required. IdP logins (such as Login with Google) create users without passwords. If the users are using an IdP to log in to an application with a required password field, the user is forced to set a password.
Updating the tenant will cause the following webhook events when enabled to be configured as non-transactional. This will only affect you if you have configured one or more of these event types as transactional.
237
+
238
+
-`user.identity.update`
239
+
-`user.identity.verified`
240
+
-`user.registration.create`
241
+
-`user.registration.delete`
242
+
-`user.registration.update`
243
+
-`user.registration.verified`
244
+
-`user.update`
245
+
</IssueResolvedVia>
55
246
* <KnownIssueissue="3161">IdP logins do not work for Universal Apps. Instead, the error message `Invalid_Request. Missing_tenant_id` is displayed.</KnownIssue>
56
247
57
248
### Fixed
@@ -253,7 +444,7 @@ Looking for release notes older than 1.44.0? Look in the [release notes archive]
253
444
A few forms in the FusionAuth admin UI are setting the input focus in nonstandard ways. These include the setup wizard, the add API key view, and the edit API key view.
0 commit comments