Release notes: SecureAuth CIAM 2.22.0

This release introduces significant advancements in B2B Organization Management, focusing on productizing features that address B2B delegated administration and Partner Managed Identity use cases. These improvements include enhanced sub-organization management, better visibility and control over organizational hierarchies, and more prominent access to the delegated admin portal, making it easier for business admins to manage complex organizational structures.

In the area of authentication security, we have added new MFA capabilities and made substantial improvements to Identity Pools, providing administrators with more control and flexibility in managing multi-factor authentication settings. These enhancements strengthen security and ensure a more robust and secure authentication process across all user interactions.

Additionally, this release brings a series of UX/UI improvements aimed at simplifying the admin portal experience. These minor but impactful changes make the product more intuitive and easier to manage, streamlining daily tasks and improving overall usability for administrators.

Use new b2b users apis in B2B Portal

New fine-grained permissions:

{
  "read_roles": true,
  "manage_user_manager_role": true,
  "get_identity_pool": true,
  "update_identity_pool": true,
  "delete_identity_pool": true,
  "read_identity_pool_users": true,
  "manage_identity_pool_users": true,
  "manage_user_passwords": true,
  "manage_user_otps": true,
  "manage_user_addresses": true,
  "manage_user_identifiers": true,
  "send_user_verification": true,
  "send_user_activation": true,
  "b2b_read_users": true,
  "b2b_manage_users": true,
  "b2b_read_business_metadata": true,
  "b2b_manage_business_metadata": true,
  "b2b_read_admin_metadata": true,
  "b2b_manage_admin_metadata": true
}

Not allowed to create/import users if admin metadata or business metadata contains required fields

Do not enable JIT by default in the created idp when a workspace has workspace pool.

Fix a bug where pairwise subject type was incorrectly applied for the following grant types:

Following this correction, given the absence of user interaction within the specified flow, the public subject type will always be utilized.

Adjust DPoP logic to the newest openid conformance tests, version: 5.1.17.

Change PAR endpoint status code and error from 401 invalid_dpop_proof to 400 invalid_request when both DPoP proof header and dpop_jkt form param are provided but they do not match

Admins can now configure IDP roles in the Admin workspace even if Just-In-Time (JIT) provisioning is disabled.

Fixed a misleading "Profile" & "PR" user label in the Admin portal top banner when the email is missing in user info.

Added missing audit events and webhooks configuration for organization management.

Ensured that obligatory fields from the pool are strictly correlated with the pool schema on the IDP provisioning page.

Added warnings for schema mismatches and allowed changes per user schema in "organization" workspaces.

Fixed an issue with missing search or pagination mechanisms when selecting pools in tenants with many pools.

Resolved issues with accessing the Admin workspace for Workspace Admins.

Fixed an issue where selecting a pool was not possible if more than one pool existed in a workspace.

Changed "None" to "Member" for tenant roles and granted tenant member roles on IDP creation in admin workspace.

Fixed the display issue with the parent workspace node for Business Admins in the B2B portal.

Resolved an issue where user roles were sometimes incorrectly displayed as "team_manager" in the B2B Edit User Profile view.

Addressed mismatches between workspace roles displayed in the user table and user details.

Fixed the issue with the empty tenant role column when the NONE role is assigned.

Hidden or grayed out role input fields when the roles feature is turned off.

Prevented logged-in admin users from changing their own tenant role.

Allowed mapping to business admin managed metadata attributes in JIT provisioning.

Used issuer_url to calculate ACS and Redirect URLs in Identity Providers.

Fixed an issue to return a more precise error when a user is deleted but attempts to use a refresh token.

Resolved the issue preventing auditors from selecting users in the pool.

Removed the code response type from the partners workspace, which only supports client credentials grant type.

Added the ability to override the debtor account for recurring payments in OBBR.