Skip to main content

What's new in 2024

These highlights are archived. They describe features and changes announced during 2024 and are kept for reference. For current updates, see What's new.

December 2024​

The self-service user portal is now generally available​

The redesigned self-service user portal is now available to all tenants and its feature flag has been removed. Users manage their profile, security (sign-in methods and devices), and privacy (consent management) from one place.

Restrict authentication mechanisms per workspace​

Workspace configuration now includes allowed authentication mechanisms, so you can control which mechanisms users can use when they sign in with identity pools. Pool create and update APIs validate against the workspace-level list, while tenant-level pools keep access to all methods.

Security and reliability improvements​

  • The client create and import API accepts an optional certificate field with a base64-encoded PEM certificate, which it converts to a JWKS.
  • Tenant metadata is now available in the authorization engine input.

November 2024​

Role-based administration is now generally available​

Role-based administration is now available to all tenants and the roles feature flag has been removed.

Idempotent POST APIs​

POST APIs now support idempotency so you can safely retry requests without repeating an operation. Send a unique X-Idempotency-Key header (32 to 255 characters) and retry within one minute; replayed responses are returned from the original request.

Security and reliability improvements​

  • New non-FAPI workspaces now use rsa as the default signing key instead of ecdsa.
  • The token endpoint authorization policy input now includes client certificate metadata.
  • The default SAML identity provider attribute source changed from Custom to SAML Assertion Attribute.

October 2024​

Revoke tokens with system and self-service APIs​

New APIs revoke tokens beyond the existing admin API. A system API revokes tokens for users in a pool, and a self-service API lets a user revoke their own access tokens, refresh tokens, and SSO sessions.

Prompt for sign-in when the session is too old​

When a user has an active SSO session but the client requests a max_age that has already passed, the user is now prompted to sign in again instead of seeing an authentication error page.

Security and reliability improvements​

  • Webhooks use a dedicated HTTP client with configurable timeouts and retries, plus a circuit breaker for resilience.
  • New system API to get an OAuth 2.0 client by ID.
  • Simplified default SAML identity provider attributes to email, first name, and last name.

September 2024​

Identity Pool MFA is now generally available​

Multi-factor authentication for identity pools is now available to all tenants, and the identity pool MFA and TOTP feature flags have been removed.

Redesigned self-service portal​

The self-service portal is reorganized into three views: profile, security with sign-in methods and devices, and privacy with consent management, making it easier for users to manage their own accounts.

Sign-in and SSO in the B2B portal​

The B2B portal now supports sign-in and single sign-on in the organization view for delegated administrators.

MFA friction analytics​

New MFA friction charts show how often multi-factor authentication adds friction to sign-in, so you can balance security against user experience.

Security and reliability improvements​

  • Test an identity provider with a "Try sign-in with current IDP" button, useful for hidden providers that cannot be selected on the login page.
  • Request correlation IDs now propagate to audit events and to the script execution context.
  • New claims with a scope condition now require those scopes to exist in the authorization server.

August 2024​

The redesigned administrator portal is now enabled for all tenants​

The redesigned administrator portal is now the default, and its feature flag has been removed, as part of the move to SecureAuth branding.

Set a passkey in the self-service portal​

Users can now register a passkey directly from the self-service portal.

Revoke identity pool user tokens​

A new API revokes tokens for users in an identity pool.

Security and reliability improvements​

  • Friendlier error messages when an authentication policy fails to run.
  • Choose which address receives the activation message when a user has more than one.
  • Unified the top bar appearance across the user and administrator portals.
  • Fixed the Dynamic Client Registration scope policy input to include the software statement and client attributes.

July 2024​

Risk-based authentication with the SecureAuth Risk Engine​

Configure Risk-Based Authentication (RBA) in the admin UI with the SecureAuth Risk Engine. Enable the risk engine validator for user policies, and set risk thresholds that trigger second-factor authentication in identity pools or step-up during single sign-on.

Web templates rebranded to SecureAuth​

The web templates for hosted login and other user-facing pages now use SecureAuth branding.

Security and reliability improvements​

  • Set a tenant role for a just-in-time provisioned user.
  • Import and export beta feature flags through the tenant configuration APIs.
  • New organizations now default to a non-persistent session type.
  • Return a more precise error when a deleted user attempts to use a refresh token.

June 2024​

Manage suborganizations in business admin mode​

Business administrators can now manage suborganizations within an organization, including changing parent organizations within the hierarchy, extending delegated administration for B2B customers.

Admin API to revoke tokens by subject​

A new admin API revokes access tokens, refresh tokens, authorization codes, SSO sessions, and scope grants for a given subject, or by identity provider subject when the server uses the hash subject format.

Identity Pool MFA enabled by default for new tenants​

New tenants now have multi-factor authentication enabled by default for identity pools.

Configurable scope claim format in access tokens​

Choose how scope claims appear in access tokens, using the scp array (scp_array, the default), a space-separated scope string (scope_space_separated), or both.

Security and reliability improvements​

  • Display a schema mismatch warning and allow per-user schema changes in organization workspaces.
  • Just-in-time provisioning can map to business-admin-managed metadata attributes.

May 2024​

Change the parent organization in the B2B hierarchy​

Change the parent organization for organizations within a hierarchy, including promoting an organization to the top level, with guardrails that preserve hierarchy integrity.

Custom application type for FAPI workspaces​

Create a custom application type so you can register a client in a FAPI workspace.

Token exchange for the Azure identity provider​

Added token exchange support for the Azure identity provider.

Security and reliability improvements​

  • Added an organization claim source type.
  • The delegated admin portal URL is now shown more prominently for sharing with business admins.
  • You can no longer change your own role.
  • Fixed pairwise subject type incorrectly applied to the JWT-bearer, token exchange, password, and device grant types.

April 2024​

Audit events and webhooks for organizations​

Organization lifecycle changes now emit audit events and can trigger webhooks, giving you visibility into organization management.

Fine-grained permissions in the B2B portal​

The B2B portal now enforces fine-grained permissions for delegated administration, so business admins can manage passwords, OTPs, addresses, identifiers, activation, and user metadata according to their assigned permissions.

New user identifiers in audit logs​

Audit logs now include idp_subject, idp_id, idp_method, user_id, and user_pool_id, and you can list audit logs by these new identifiers.

FAPI 2.0 workspace updates​

FAPI 2.0 workspaces now enforce redirect_uri when using the PAR endpoint, and no longer require the scope parameter or a request object at PAR.

Security and reliability improvements​

  • Configure the default user role for just-in-time provisioned users.
  • Export configuration APIs now require the read_configuration scope.
  • Added organization_id to audit event metadata.

March 2024​

SAML identity provider v2​

A new SAML identity provider implementation improves SAML-based federation.

Business metadata in users and identity pools​

Users and identity pools now support business metadata through their APIs, supporting delegated administration and B2B attribute management.

View where a script is used and migrate its runtime​

A new view shows every execution point where a script is used and how to migrate a script to a new runtime version.

Security and reliability improvements​

  • Configure automatic removal of CDR arrangements in the authorization server settings.
  • Open Banking Brazil automatic payments now reject unauthorized consents on a schedule and mark expired consents as consumed.

February 2024​

Identity Pool MFA management​

Manage multi-factor authentication settings for identity pools from the admin UI.

Manage script runtime versions​

A new scripts_runtime_versions capability and FaaS versioning UI let you manage runtime versions for scripts and extensions.

Hierarchy mode on the B2B organizations page​

The B2B organizations page adds a hierarchy mode for clearer visibility and management of organizational structure.

Security and reliability improvements​

  • Automatically attach the default post-authentication context script to an organization's identity provider when a new organization is created.
  • Improved audit logs for SAML identity provider failures and token exchange errors.
  • Added policy IDs to policy authorized and unauthorized audit events.
  • Just-in-time identifier and address mapping can use the subject or the identity provider subject.

January 2024​

OIDC back-channel logout​

The authorization server now supports OIDC back-channel logout for coordinated session termination across applications.

Authorization correlation ID for audit traceability​

Pass an authorization_correlation_id query parameter to the OAuth 2.0 authorization flow, and every audit event in that flow carries the correlation ID. If you do not provide one, the server generates it.

Configurable token exchange scopes for authorizers​

The Istio and Kong authorizers can now configure which scopes to request for a new token during authorizer-initiated token exchange, using either the original token's scopes or the token exchange client's scopes.

Security and reliability improvements​

  • Added support for RSA-OAEP as a request object encryption algorithm, with the well-known endpoint reflecting the server's actual encryption keys.
  • Fixed Kong 3.x authorizer handling of routes defined with regular expressions.