Release Notes

Last edited: 23 august 2025

Version 1.67.5.0 (SEP 2022)

Feature: Uploaded certificates can now have a private root (and private intermediates)

Certificates can now have a private root certificate.
The public part of private root certificates (and intermediates) can be uploaded, per tenant, by a (hub) tenant admin.
Once the public parts are uploaded, it is possible for The Identity Hub to verify the certificate chain when uploading a tenant, app or account provider certificate based on these private certificates.

A report that lists an overview per tenant has also been added.

Note

when choosing to use certificates with private root / intermediates be sure to verify if the other party (either Service provider or Identity Provider) can handle this type of certificate also.

See Certificate Authorities on how to use this feature.

Improvement: when auditing that a user signs in for a specific app also audit the roles the user has

The hub audit logging is extended for the event when the user signs in to an app. The roles the user has when finalizing a request for an app, are now also logged.

Internal updates, optimizations and fixes

  • in the admin module the product version of The Identity Hub is now visible for all administrator levels
  • in the admin module the clientid is now visible on the app overview list
  • SAAS only a demo tenant can now be deleted without first explicitly blocking it
  • the maintenance procedure allows a more fine-grained control on what areas are purged
  • in the admin module the help section on the tenant page is now collapsible and collapsed by default
  • the accounts information has now additional metadata (Created, LastModified)
  • fix to the itsme account provider
  • additional account provider trace logs for the O365 account provider
  • optimization in the calculated etags used for the account provider uploaded image urls (applicable when The Identity Hub is hosted behind Azure Frontdoor)
  • fix in the audit logging when a user configures 2FA
  • when creating a new app the option to use the Tenant Token Signing certificate, if available, is no longer checked by default. However an admin can still choose to do so. See considerations on used certificates

Version 1.67.0.0 (JUN 2022)

Feature: Block MFA when user enters too many incorrect verification codes

The MFA flow is adjusted to block users that enter too many incorrect verification codes.
When the limit is reached a cool down period will be activated before MFA is allowed again. (Service desk) Administrators will be able to see when a cool down is applicable.

See Tenant Configuration Options on how to configure this feature.
See Identity Information on what is displayed for an identity when in cool down.

Feature: End users can choose a favorite account provider

Users can now toggle () one (or more) account provider(s) as favorite and pin it to the top of the authenticate page.

Improvement: MFA configure and verify flow

The MFA configuration and verification screens have been optimized for user friendliness. These optimizations include:

  • center the information represented and scale better for mobile devices
  • tiles to represent the different MFA options a user can pick: authenticator app, Email or sms (based on what the tenant allows)
  • users that are created by an administrator and have completed the welcome flow (to configure their password), now have a verified email

The information on the user overview is extended with additional information like:

  • type of account(s) attached to the identity
  • information on which app the user last signed in (based on logon sessions)
  • if the user has MFA credentials that can be reset

When searching a user it is now possible to indicate which fields to use for the search.
It is now possible to search on the unique Identity Identifier.

See Identity Overview for more information.

Internal updates, optimizations and fixes

  • Optimization on the authenticate page when having 1 main account provider and multiple trusts. (On premises only)
  • Optimization in the e-mail address verification flow
  • Cookies now use SameSite mode Lax where applicable. Cookie prefixes are used to better indicate the intent of the cookie.
  • Statistics: fix when working with the time part of the start and end date
  • Extending IPaddress info to cater for IPV6 addresses
  • Friends API and feature is marked obsolete
  • Office 365 account provider now uses the Microsoft Graph API
  • Optimization in purging the certificates cache
  • Identity detail page now shows the date and time when the identity was created (by an administrator or via auto-provisioning)

Version 1.66.0.0 (MAY 2022)

It is now possible to include an image in the footer of emails sent by The Identity Hub.
When none is specified at tenant level, the image configured within the hub tenant will be used as default if specified. (There is no default set in the SAAS version of TIH)

See Tenant Configuration options - Mail for more details.

Improvement: Servicedesk admins get access to read only reports and Statistics

Administrator with a Servicedesk level are now granted access to the (read only) Reports and Statistics within the admin module.

See Managing The Identity Hub for more detailed information.

Internal updates, optimizations and fixes

  • Update: several updates in the email templates (mostly dutch) sent to users
  • Optimization in the verify flow for email or phone number
  • Optimization : Client-side validation is optimized on different public (Register and Profile) pages and in the admin module
  • Fix: redirect url when tenant urlsegment is updated
  • Fix: better error handling when creating a new HAP (Username / Password) user in case the username already exists
  • Optimizations in the flow and handling of tokens for the TIH Profile and Admin apps

Version 1.65.1.0 (MAR 2022)

Feature: Apply a quarantine scope when blocking users

If an administrator which is assigned a certain admin scope blocks an identity, only other administrators part of the same scope can re-enable the blocked identity.

To assign an admin scope to an administrator a claim mapping can be configured on the account provider which the administrators use to sign in.
The admin scope claim to enable this feature has the following scheme: http://schemas.u2uconsult.com/ws/2022/03/identity/claims/adminscope

Internal updates, optimizations and fixes

  • Fix: improved validation of redirect_uri

Version 1.65.0.0 (MAR 2022)

Improvement: Used certificates overview in admin module

The Used certificates overview has been extended to allow for sorting on expiration.
New color scheme introduced for certificates that are about to expire.
See Used certificates for more information.

The Used certificates are now also available as an exportable report.
See Reports for more information.

Enhancement: Support for different key and data encryption methods for SAML Authentication Requests to apps

The app configuration has been updated to allow for configuring the Data Encryption and Key Encryption methods.
See Apps for more information.

Enhancement: Additonal info field for apps

Configured apps in the admin module now have an additonal info field that allows the administrator to provide some informational text regarding the app.
See Apps for more information.

Internal updates, optimizations and fixes

  • Optimization: custom account provider images can no longer overflow the tiles on the login screen
  • Optimization: custom account provider images are cached longer
  • Optimization: consistent error response when missing information on different endpoints
  • Optimization: prevent duplicate HSTS headers (configuration only)
  • Optimization - Admin module: improved performance when searching for users
  • Optimization - Admin module: administrator will no longer see the option to reset the authenticator app when not configured on the user

Version 1.64.2.0 (FEB 2022)

Fix: The blocked status of an identity is now also visible for administrators with a Servicedesk admin level

Servicedesk administrators have read only access to the identities.
They can now immediately see in the result list if an identity is blocked or not.

Internal updates, optimizations and fixes

  • Optimization - Admin module: lists with search functionality now have the search and filter controls disabled while loading the results
  • Optimization - Admin module: lists with search functionality now show a spinner while loading the results

Version 1.64.1.0 (JAN 2022)

Improvement: User overview in the admin module

In the Users list an administrator can now search on the UPN of an account.
In the overview list the Unique The Identity Hub Identifier is shown.

Fix and Improvement: Used Certificate overview

The certificates used by OpenID account providers are now also shown in the Used Certificates overview.
Related to apps, the overview is improved to only show the certificates used by non-blocked clients.

Internal updates, optimizations and fixes

  • Optimization: when receiving SAMLP Authentication Requests whitespaces are preserved when parsing the XML of the request
  • Optimization: the logging for the introspect endpoint have been extended for troubleshooting purposes (server side)
  • Optimization: additional audit logging when 2FA is configured by user

Version 1.64.0.0 (DEC 2021)

Enhancement: configure error Urls for an app

It is now possible to configure redirect urls on an app for the following cases:

  • Access denied
  • Error occurred
  • Authentication failed

See General configuration parameters for an app for more detailed information.

Improvement: new Servicedesk admin level introduced

The sub-levels for administrators in a tenant have been reorganized.
The sub-levels within a tenant are now:

  • Tenant Administrator
  • Identity and Access Administrator (previously: Identity Admin)
  • Servicedesk (new)

See Managing The Identity Hub for more detailed information.

In the logs feature additional information is now available when searching the apps logs.
The additional information includes errors and warning logs for SAML-P applications, and error messages when the client is blocked or can not be found.

See How to Search the logs for more detailed information.

Internal updates, optimizations and fixes

  • Internal optimization on handling the primary and secondary db encryption certificates
  • Optimization - Admin module: audit logs have been extended when viewing or regenerating client secrets
  • Optimization: extend the information in the hub audit log
  • Optimization: return HTTP Not found instead of HTTP Unauthorized where applicable
  • Optimization: on the authenticate page use the tenant contact email-address for the "Contact us" link
  • Optimization: reduce the properties in the Json Web Key Set (JWKS) returned by the Open ID Connect certs endpoint for account providers. (Returned are: Kty, Use, Kid, KeySize, X5c, X5t, N and E)
  • Fix - Admin module: tenant administrators can now access the report info help page
  • Fix - Admin module: after blocking a tenant in the admin module redirect to the correct url
  • Fix: show the map for the Geolocations page in the User Profile
  • Fix: email templates have been updated to use the tenant display name in a consistent way
  • Fix: better handling for the SAML-P flow if the session was not found

Version 1.63.0.0 (JUL 2021)

As an admin it is possible to indicate if users can edit their profile in The Identity Hub when they sign in with a specific account provider.
This will determine if the user can update their profile information: given name, surname, emailaddress and mobile phone.
When users are allowed to link more accounts to one identity all accounts should allow to edit profile.

Administrators can always update the profile via the admin module, no matter how this setting is configured.

Improvement: The warning period for the Used Certificates is now configurable

On the Used Certificates overview the certificates that are about to expire are colored in a yellow warning color.
By default this concerns certificates that will expire in the upcoming next 30 days.
The amount of days is now configurable via a system setting for On premises, default remains 30.
In the SAAS the default of 30 days still applies.

Improvement: Statistics also show app and accountprovider usage

In the admin module the logonsession count can now also be seen per (front-end) app and per account provider level.

Internal updates, optimizations and fixes

  • On premises only: Add health endpoint
  • Optimization GetLinkedAccounts endpoint: only return linkable accounts or already linked accounts
  • Fix for the oauth/revoke endpoint

Version 1.62.1.0 (JUN 2021)

Internal updates, optimizations and fixes

  • Optimization: make the sign in tiles on the authenticate page flow (responsive UI)
  • Optimization - Admin module: better handling for importing claim mappings on the account provider edit page
  • Optimization - Admin module: performance improvement for logs

Version 1.62.0.0 (JUN 2021)

Feature: Account provider images can now be uploaded

Whilst before only external links could be used to set an image on the account provider tile, it is now possible for an administrator to upload an image.

Feature: Opt to remember the last used search in the admin area

On the different overviews (tenants, account providers, apps, roles, identities) it is now possible to toggle the 'bookmark' function on to remember the last used search.
The search string is only remembered locally for the tab or session. The choice to use the 'bookmark' is stored across sessions.

Improvement: additional reports are now available

The list of reports have been extended to cover all main configuration items. Following Out-of-the-box reports are now available as CSV download:

  • Tenants (only for hub admins)
  • Identities
  • Multi-Factor Capabilities
  • Apps
  • Roles linked to Apps
  • AccountProviders linked to Apps
  • AccountProviders
  • AccountProvider ClaimMappings
  • Accounts By AccountProviders
  • Identities By Role

The report module has also been reworked to allow for on premise extensions. See Reports

Fix: correct or clear additional Identity claims due to Profile updates

When a user edits his or her profile the related fields will be saved to an identity claim next to the claims provided by the account providers of the linked account(s).
If a user edited the profile multiple times this resulted in multiple claims on each edit.
It is now possible to correct these claims so that only one claim (per field) is issued on behalf of The Identity Hub (replace vs append).
It is also possible to clear these additional claims by emptying the fields on the Profile. In this case the claims provided by the account(s) get precedence again.

Internal updates, optimizations and fixes

  • Updates: Some account providers have been revised: see O365, Paypal
  • Updates: It is no longer possible for new Microsoft account providers to use the legacy Live SDK.
  • Optimization: In the admin area the clientsecret is no longer visible by default on the app page
  • Optimization: When adding a SAMLP account provider the ServiceProvider EntityID is automatically set
  • Optimization: When entering MFA codes only digits will be accepted as input
  • Optimization: Better handling when SAMLP Signin is attempted with incorrect state
  • Optimization: Trace messages have been improved when tracking the external dependency calls for a SAMLP account provider
  • Optimization: Better tracing when using the signout for a SAMLP app using the HTTP redirect binding
  • Performance improvement for the introspect endpoint

Version 1.61.1.0 (APR 2021)

Internal updates, optimizations and fixes

  • Performance improvement for SAMLP account provider

Version 1.61.0.0 (MAR 2021)

Feature: The role claim can now be configured as required output claim for an app

While previously access to an app could be limited to identities with a certain required (custom) claim, it is now also possible to configure the role claim as required output claim.
When configuring the role claim as required output, the user signing in should have at least one of the roles linked to the app.
See Roles per App

Enhancement: "Last modification" information is shown in the admin area

Configuration changes in the admin module are audited for all main configuration items.
The last modification of a configuration item is now shown in the footer on the detail page of a tenant, app or account provider.

Internal updates, optimizations and fixes

  • Performance update: optimization of several queries
  • Performance Admin module - Logs: when configuring the log types the search is no longer automatically triggered when leaving the dropdown box
  • Performance Admin module - Logs: the default time interval can now be configured as system setting (LogSearchIntervalHours). The default is 24 hours (backwards compatible)
  • Optimization for handling the different certificates used by tenants, apps and account providers within different flows
  • Optimization in tracing
  • Fix: retrieve correct client information when The Identity Hub is hosted behind a Web Application Firewall
  • Fix: ignore favicon.ico requested by Chrome Browsers
  • Fix: issue with images not loading for jquery-ui lib

Version 1.60.3.0 (FEB 2021)

Enhancement: Store the date and time when an Identity is created

Either when an identity is created via auto-provisioning at first logon, or when a user is invited by an (Identity) administrator the date and time of creation is stored at identity level.

Enhancement: Additional System Settings (On premises only)

Following system settings have been added:

  • RootPageRedirectUrl: allows to configure a redirect url for the root page of The Identity Hub (instead of creating a custom Index view)
  • MinThreadPoolThreadCount: allows to configure the amount of Threads created within the threadpool as a minimum

Internal updates, optimizations and fixes

  • Optimization when using certificates in the SAMLP flows

Version 1.60.0.0 (FEB 2021)

Feature: an app can now easily be blocked and unblocked

When an app is set as blocked users can authenticate, however The Identity Hub will no longer redirect the user to the blocked app. Be aware that blocking an app does not influence sessions within the app to which users were already signed in before the blocking operation.

Reasons for blocking an app can be diverse. (Un)blocking an app can be done instantly. See Update an App

Feature: bulk import for Username/Password users (on premises only)

If a system setting is configured on the tenant to allow import, it is possible to create username/password accounts for a HAP provider using a CSV file.
The onboarding flow is the same as when an individual user account is created.
Each user will receive a welcome email and needs to accept the invitation.
The administrator can assign roles to all users in the uploaded batch.

Enhancement: Tenants report has been updated

For hub admins the tenants report now includes additional information.

Enhancement: Hub Audit Log has been extended

Following actions done via the admin module can now also be retrieved via the Hub Audit Log:

  • Manual configuration of roles to a user by an Identity Admin
  • Resetting the 2FA settings for a user by an Identity Admin
  • Search for Identities by an Identity Admin
  • (Bulk) Registering a username / password account by an Identity Admin
  • Tenant Admin invitations
  • Report downloads by a Tenant or Hub Admin

Logs for users signing in to an app are now also available via the Hub Audit log.

See How to search the Logs on how to retrieve these log messages.

Enhancement: System settings summary

For Hub Admins the configuration settings which apply are now visible in the Settings section of the admin module.

Internal updates, optimizations and fixes

  • Maintenance: update of 3rd party libs and .NET framework.
  • SAAS only: integration with the Azure Marketplace has been reworked.
  • Optimization: For the SAMLP / WSFed endpoints prevent an additional round-trip to The Identity Hub for the token.
  • Fix: CSP header for some views has been extended to allow particular external sources (eg recaptcha) only used by that view.
  • Fix: The links to the admin detail page of the account providers is fixed on the White-listed url overview.
  • Fix: When updating the redirect uris of an app any whitespace at the end of the redirect uri is removed.
  • Optimization: In case a WAF is applied which blocks certain actions in the admin module the Tenant Administrator will be redirected to a Forbidden page.
  • Configuration: Some system settings can now be updated via the database. For these a restart of the worker process is no longer required.

Version 1.52.1.0 (NOV 2020)

Improvement: additional (custom) output claims now also available to the OpenID UserInfo endpoint

As of this release the app configuration also allows to configure which additional custom output claims are available via the UserInfo endpoint. Claims that were previously available will remain available even if not configured for the app.

See Protocol Endpoints - OpenID Connect - UserInfo endpoint and app configuration

Improvement: managing the account providers and roles for an app is now easier

When dealing with a large list of account providers or roles, the configuration which ones are linked to an app
is now facilitated by a filter and a toggle all on/off option.

Internal updates, optimizations and fixes

  • Optimizations in the verbosity for tracing
  • Optimization: mail template to invite administrators is updated

Version 1.51.0.0 (OCT 2020)

New feature: CSP header

A Content-Security-Policy header is now applied to every response.

For on Premises installations that have applied customizations see how to update your web.config

New feature: TLS Protocol logging

By default The Identity Hub uses TLS 1.2.
Connections not using TLS 1.2 yet are now logged (as warning) to identify apps or clients that still need to update.
These warnings are part of the Hub.Audit logs (if auditing is enabled). See Use cases on Logs

Improvement: Claimmappings for Idin Account Provider and Trusted Tenant Account Provider (on premises only)

It is now possible to specify claim mappings on the Idin Account provider, as well as on the (on premises only) Trusted Tenant Account Provider

Improvement: When claim mappings allow, the Mobile Phone info of an account will be passed to the Profile

In case an account provider receives the Mobile Phone information on an account and the claim mappings of the account provider allow to pass the information -
either by accepting all incoming claims or by defining an outputclaim for it - the Mobile Phone information is set on the profile.

Internal updates, optimizations and fixes

  • Further optimization in the database tables regarding claims to reduce the required data space and optimize the logon flow performance
  • Claim mappings on the Office 365 account provider are applied only once now
  • OAuth endpoint: optimization on the Authorization Code lifetime

Version 1.50.6.0 (on premises only)

Internal updates, optimizations and fixes

  • Optimizations to allow for resource customizations
  • Fix for customized email templates when the UI Culture is determined by a Culture query parameter

Version 1.50.5.0 (SEP 2020)

New feature: Certificate roll-over for Private Key Encryption Certificate (on premises only)

It is now possible to specify a primary and secondary certificate by subject name or thumbprint. Contact U2U Consult at support@theidentityhub.com for more information and help on the roll-over process.

Internal updates, optimizations and fixes

  • Fix issue with null reference exception.
  • Optimized logon flow by restructuring database tables.

Version 1.50.0.0 (SEP 2020)

New feature: The SAAS version of The Identity Hub now allows for registration of a new Tenant using Microsoft Organizational Account.

Change: The Identity Hub now forces the use of SHA-2 where SHA-1 is selected.

In addition several views have been updated to mark SHA-1 as deprecated

Internal updates, optimizations and fixes

  • Fix issue with duplicate html element id's on authenticate pages
  • Optimized database for faster logons.
  • The views for viewing and configuring App OpenID certificates have been updated to make them more clear.

Version 1.49.0.1 (SEP 2020)

Enhancement: New logo for myID.be Account Provider

Version 1.49.0.0 (SEP 2020)

New feature: a tenant administrator can control the behavior of the public profile pages per tenant

By default a user can self-manage his or her profile. For instance: updating profile information, configure 2FA and even delete the profile.
In certain scenarios however, it might not be desirable to hand this control to the user.
For these situations it is now possible at tenant level to hide the public profile pages. When hidden, a Not found response is returned to the caller.
A tenant admin can now also decide that a user should not be able to delete the profile instantly. If the Hide Profile Delete option is set, a user can instead send a request to delete it conform GDPR regulations.

New feature: add flag on SAMLP account provider to control whether to use the MFA information in the SAML response or not

See How To: Leverage ADFS Multi-Factor Authentication

Enhancement: Email address validation has been updated

The email address input validation is enhanced:

  • Additional printable characters (!#$%&'*/?^_`{|}~+-) are allowed in the local part, whilst others have been blocked.
  • Domains can now be up to 63 characters (cfr RFC)

Internal updates, optimizations and fixes

  • Fix in the 2FA flow when user double-clicks the button to verify the code
  • Fix: When no geolocation information is collected (setting at tenant level) the empty page is no longer accessible via the profile pages
  • Fix: When profile passwords expire immediately (setting at tenant level) users can no longer generate one
  • Fix: Client-side validation is enabled on the different Register User / Register Tenant and public Profile pages
  • Fix: When a required claim can not be delivered by the account provider used during login, the list of the other account providers to sign in with is more accurate
  • Optimization: only load css classes related to the admin module when applicable
  • Optimization: Added additional SubResource Integrity checks where possible
  • Upgrade of 3rd party client-side libraries

Version 1.48.6.0 (AUG 2020)

Internal updates, optimizations and fixes

  • Fix for OAuth flow: better handling of the PKCE flow.
  • Fix: Better handling of user input.
  • Fix: Removed obsolete script.
  • Performance improvements for resource owner password credentials grant.
  • Performance improvements to the OAuth 2.0 introspect and token endpoint.

Version 1.48.5.0 (JUL 2020)

Change: TLS1.2+ required for SAAS version

The SAAS version of The Identity Hub now requires connections to be made with TLS 1.2 or higher for front-end and back-end connections.

Internal updates, optimizations and fixes

  • Fix for the SAMLP flow: Better handling of incorrect state values.
  • Fix for the SAMLP flow: Better handling of failed authentication flow.

Version 1.48.4.0 (JUL 2020)

Enhancement: The OAuth 2.0 introspection endpoint now returns additional information

When calling the introspect endpoint with an app token also the iat (Issued at) and the exp (Expires) information of the app token is returned.

Internal updates, optimizations and fixes

  • Performance improvements for generation of opaque values.

Version 1.48.3.0 (JUL 2020)

Change: Refresh Token Lifetime for OAuth 2.0 apps

The refresh token lifetime now starts immediately when it is issued.
Setting the refresh token lifetime to 0 minutes pro-actively expires it. This prevents getting a new access token.

Enhancement: The OAuth 2.0 introspection endpoint now returns additional information

When calling the introspect endpoint with an access token also the iat (Issued at) and the exp (Expires) information of the access token is returned.

Enhancement: Changing the profile password requires an additional action by the user (POST vs GET)

When a user wants a temporary profile password, generating the profile password now requires an additional user action for security reasons.

Enhancement: Empty cookies, particular to linking accounts and merging identities, are no longer set

Previously 3 unnecessary empty cookies were set, even if no action related to merging identities or linking accounts was initiated by the user.

Internal updates, optimizations and fixes

  • Fix for the introspect endpoint: also when the token is no longer active the active property is now returned as boolean type in the JSON result
  • Fix: better handling of redirect urls
  • Fix: better validation when modifying the emailaddress of a user
  • Fix in the navigation of the admin module after viewing the details of a user
  • Performance improvements particular to on premises installations
  • Performance improvements to the OAuth 2.0 introspect endpoint

Version 1.48.0.0 (JUN 2020)

New feature: Refresh Token Lifetime for OAuth 2.0 apps

It is now possible for administrators to configure the duration of the refresh token life time issued for a certain app.

See Create an App

New feature: Admin sub-levels at tenant level

It is now possible to limit the access a tenant administrator has to only some information or tasks within the admin module of The Identity Hub.

At this point there are 2 sub-levels within a Tenant:

  • Identity administrators, having access to
    • Read only: Protocol Endpoints at tenant level, Logs, Used Certificates
    • Full control: Identities
  • (Full) Tenant administrators, this level remains the same and has full control within a tenant

See Managing The Identity Hub for more information.

Warning

As of this version newly invited administrators will no longer get an admin level assigned.
After the invitation is accepted by the invitee it is possible for a Hub admin or a Tenant admin to assign the correct admin level in the Administrators list of the tenant.

Enhancement: OpenID Connect: ID Token will now be encrypted when a client certificate is specified in the App configuration

See Create an App

Enhancement: OAuth 2.0 Introspection Endpoint now allows Basic Authentication using the Authentication Header

It is now possible to pass clientid and client secret in the headers instead of posting it in the body to the introspection endpoint.

See OAuth 2.0 Introspection Endpoint

Enhancement: Easier configuration of SAML-P account providers

Parsing of (online) metadata has been enhanced for a broader range of Idp providers(eg Keycloak, Azure AD, ...). SAML-P Metadata does not need to be signed when creating the account provider.
When setting up a new SAML account provider, it is now possible to indicate the signing certificate of the Tenant can be copied as Service Provider Certificate (instead of uploading it).

Enhancements: search Apps and Account Providers

For administrators it is now possible to search within the list of apps and account providers.

As an administrator you can no longer scroll through the complete list of users within a tenant or account provider.
You need to provide a search term (at least 7 characters).
Additionally, read only access by an administrator to identity information (like viewing the details, roles of an identity) is now also audited.

Internal updates, optimizations and fixes

  • Fix for crawlers accessing the robots.txt
  • Fix in SAML-P flow for apps using the SAML-P protocol to connect to The Identity Hub
  • Fix for the introspect endpoint: the active property is now returned as boolean type in the JSON result
  • Optimization: the list of tenant urls that are prohibited has been extended
  • Optimization (On premise only): it is now possible to disable the default installed HAP provider of the hub admin
  • Optimization: better handling of redirect urls

Version 1.47.0.0 (MAY 2020)

Enhancement: Custom scheme for OAuth/OpenID Redirect URI

The Identity Hub now allows for OAuth/OpenId redirect uri to have a custom scheme when the app is set as native app (eg. iOS/Android app).

Enhancement: Claim rules for scopes no longer require a specific claim value

Previously scope rules required to specify a claim value. Eg the user should have a specified role.
Now it is also possible to test for the presence of a required claim.

Enhancement: Claim mappings for all default account providers

It is now possible to configure all kind of claim mappings on all types of standard account providers including:

  • client certificate account providers like uzi-pass
  • trusted account providers (on premises only)

Enhancement: A link is provided to a FAQ page for end users

On the authenticate, error and warning page a link is included to a (configurable) FAQ page.
This allows to document common questions and answers eg. related to supported browsers.
The default page can be found here

Enhancement: Used certificates overview - filter

For a better overview it is now possible to toggle between all certificates and only those that need attention.

Internal updates, optimizations and fixes

  • Optimization: the first line support emailaddress to request help when the authentication fails can now be configured (on premises only)
  • Fix: better validation of the rules applicable to scopes for access tokens or refresh tokens
  • Fix: when registering a tenant and choosing an existing (administrator) username the validation errors are shown better
  • Fix: it is no longer possible to configure a master account provider on an account provider which in itself does not allow linking accounts
  • Fix: introspection is allowed for clients within the same tenant
  • Fix: when uploading a self-signed token signing certificate for an app in a tenant that does not allow self-signed certificates a comprehensible error is shown
  • Fix: when uploading an invalid certificate for an app all errors are shown immediately, any previous certificate is not replaced
  • Fix: when during authentication 2FA is required a warning message is prevented in case the user has opened 2 concurrent logon sessions in the same browser
  • Fix: the Site.css returned to clients will stick to standard color in case the specified tenant color is not in a valid format
  • Internal update: Auditing has been extended on failed logonsessions

Version 1.46.4.0 (MAR 2020)

Internal updates, optimizations and fixes

  • SAAS: Fix for browsers on iOS 12
  • Optimization (for on premises installations only): easier check of installed product version
  • Optimization in the caching when changing the accent color of a Tenant
  • Optimization: Set autocomplete off in the entire Admin area
  • Optimization: also let the user send the information by mail when a warning is raised
  • Optimization when an url is validated against the whitelisted urls
  • Minor UI fixes (typos and styling)
  • Fix: Invite Admin page should not show the warning about no accountproviders if there are.
  • Fix: When editing a Tenant as Tenant Admin and making a mistake (eg omit required fields, incorrect password for the token signing certificate) the user is now presented with a validation summary

Version 1.46.0.0 (JAN 2020)

New account provider: myID.be

myID.be is a new account provider allowing Belgian citizens to sign in based on their eID, however enhancing the user experience via the myID.be mobile app.
For more information see the myID.be account provider.

SameSite cookies

As of February 2020 a new RFC will take effect as browsers start to roll-out their implementation of the new default behavior by treating cookies which do not specify SameSite by default as Lax.

In respect to this, and during the migration phase, The Identity Hub is updated to set the SameSite setting to None for all TIH cookies (for all browsers).
For more detailed information see our documentation on how to set an outbound rule for specifying SameSite None

Note

Version 1.46.0.0 is active as of February 4th 2020 for the SAAS version of The Identity Hub

Enhancement: Error page now allows to mail the information shown more easily

In case of an error the user has the option to send the information displayed on the screen to an email client, ready to be sent to the administrator.

Internal updates, optimizations and fixes

  • Several changes to improve performance and reliability.
  • Optimization: Logs feature by default no longer executes the fetch when the page is opened but now allows the user to specify the filter first
  • Optimization: Better handling when user signs in by opening the same direct link to an account provider multiple times
  • Fix: WsFed Signout no longer worked in version 1.45.0.0, this is now fixed
  • Fix: The error page did not display the message part of the error passed correctly

Version 1.45.0.0 (DEC 2019)

New feature: White-listed URLs overview

White-listed Redirect URLs are now clearly displayed in an overview. Redirect URLs are now also checked against the white-list for any (profile) related action after the authentication process.

Enhancement: User-specific Claim Mappings

It is now possible to add a claim mapping that assigns an attribute to a specific user. For this the Source name claim and its value are used as filter. For more information see Claim Mappings.

Enhancement: Claim Mappings for Hub User/Password Account Provider

Claim mappings are now also possible for this type of account provider. (Both on premises as for the SAAS)

Internal updates, optimizations and fixes

  • Several changes to improve performance and reliability.
  • Additional HTTP Response Header is set
  • Upgrade of 3rd party libs: JQuery and Bootstrap
  • Optimization: On the Account provider list page for administrators an indication is given if the account provider can not be used to sign-in with
  • Optimization: On the Account provider list page for administrators the name is used as alternative when the image is not accessible
  • Optimization: Account provider Claim Mappings are now sorted to get a better overview. New claim mappings are now on top.
  • Optimization: For a SAMLP account provider it is now possible to remove expired IDP certificates and to set the Secondary Certificate as Primary.
  • Optimization: For an OpenID account provider a clear indication will be given in case the metadata URL is not accessible
  • Optimization: On the App Detail page it is now possible to see the outputclaims if app specific
  • Fix: On the App Detail page the Sharepoint Packages are downloadable when the app uses its own Signing certificate
  • Fix: On the App Detail page the web.config files are downloadable when the app uses its own Signing certificate
  • Fix: On the Edit page for a Custom account provider the Direct link shows correctly
  • Fix: The Edit page for a Custom Account Provider correctly saves the Process Logon Result URLs
  • Fix: A Tenant with a specific Plan Type can now be edited by a Tenant Admin or Hub Tenant Admin

Version 1.44.0.0 (NOV 2019)

Enhancement: Audit on all core administration tables

All core TIH administration tables can now be audited.

Note

Audit is turned on for TIH SAAS.

Version 1.43.0.0 (OCT 2019)

New feature: Used Certificates Overview

As an administrator it is important to keep track of the certificates used for signing, encryption etc on the tenant, app or account provider level.
In order to be able to get a quick overview a (tenant) admin can now get full insight based on the Used Certificates Overview.
This overview also provides a warning indication (yellow) for certificates that are expiring within the next 30 days, or an error indication (red) for expired certificates.

For more information see Used Certificates Overview.

Enhancement: Tenant signing certificate vs App signing certificate

In previous versions the Token Signing Certificate (WSFED), aka the Identity Provider Signing certificate (SAMLP) or the JWT Signing certificate (OpenId), was uploaded per app using the aforementioned protocols; however the certificate was stored at Tenant level.
Although this certificate is most likely to be the same for all apps, especially if they are all under your control, it can be beneficial to be able to decide on the different levels or for each app separately which certificate to use.
To establish this, it is now possible to upload the Tenant Signing certificate via the Tenant Edit page. The information of the tenant certificate is added to the tenant detail page.
At app level it is now possible to decide whether to use the Signing Certificate at Tenant level or to specify one at the App level.
By default a new app will use the Tenant level if there is one available for the tenant, which is the backwards compatible way of working.

Note

For this feature the endpoints of the related protocols are now split at different levels as well. Within an app using its own certificate an app specific endpoint is provided.

For more information see Used Certificates Overview.

New feature: Display Identity Claims

As an administrator and as a user (profile page) it is now possible to see the claims linked to an identity.

Internal updates, optimizations and fixes

  • Several changes to improve performance and reliability.
  • Optimization: The logs feature will by default filter only on the last 24 hours and in non-verbose mode.
  • Fix: the SAMLP/WSFED Federation Metadata endpoint is available as soon as a Tenant signing certificate is available.
  • Fix: the casing for the namespace 'urn:oasis:names:tc:SAML:2.0:protocol' of the IDPSSODescriptor node in the SAMLP/WSFED Federation Metadata endpoint is corrected.
  • Fix: better feedback if a SAMLP login is not completed by the user within reasonable time
  • Fix: default claim mappings when adding a SAMLP, WSFED account provider

Version 1.42.6.0 (SEPT 2019)

New feature: SharePoint 2019

The Identity Hub can now be used as federated identity provider for SharePoint 2019

Version 1.42.5 (AUG 2019)

Enhancement: Claim mappings

A wizard has been added in order to easily set up claim mapping rules for account providers that work with claim mappings (SAMLP, WSFED, ...).
For these account providers it is now also possible to add output claims without requiring an incoming claim.

Version 1.42.1

Enhancement: Tenant trust App configuration (applies only to On Premises)

As TIH admin it is now possible to indicate which trusted account providers are allowed for an app.
When a tenant trust has only one account provider the account provider button is shown iso a Continue button.

Version 1.41.2.0

New feature: External AD Sync tool

Note

Applies to: On-premise and private Azure Cloud scenarios (not for SAAS www.theidentityhub.com)
This feature is on demand.

This tool allows to import users from ADFS as identities into The Identity Hub.

For more information see Active Directory Sync

Version 1.41.0.0

New Google image

The Google image has been updated to latest version.

Internal updates, optimizations and fixes

  • Several changes to improve performance and reliability.

Version 1.40.2.0

Internal updates, optimizations and fixes

  • Fix the TIH OpenId Connect JWKS endpoint to include the certificate Exponent and Modulus.
  • Upgrade the LinkedIn account provider to be compliant with LinkedIns OAuth V2 implementation.
  • Auto-refresh the OpenId well-known configuration for the OpenId account providers in order to prevent a manual (refresh) intervention of a TIH administrator.

Version 1.40.0.0

New feature: Logs

For a (tenant) administrator it is now possible to consult different types of logs either informational or for trouble-shooting reasons. See Logs

Configure claim mappings for Office365

As TIH admin it is now possible to configure a claim mapping for the email address provided by the Office365 account provider

Tenant trust configuration (applies only to On Premises)

As TIH admin it is now possible to indicate which accountproviders are part of a Tenant trust.

Internal updates, optimizations and fixes

  • Updated documentation links to point to the new documentation
  • Upgrade to FontAwesome 5.0 and added icons to the left navigation
  • The Google account provider has been updated due to the phase out of Google+
  • In case of an error when configuring token and encryption certificates for account providers like SAMLP, WS Federation or OpenId connect the error message is displayed
  • Optimizations to different delete actions
  • Optimization for the signout of a SAMLP session
  • Performance improvement when signing in with SAMLP

For on premise installations only:

  • Improvements to the customization and localization engine

Release Notes prior to 1.40.0