Link to Main FusionAuth Website/ Docs
- Light
- Dark
- System
Open main menu
SearchCtrl K
Release Notes
For the best experience, always upgrade to the latest version of FusionAuth. For more information about upgrading, see our Upgrade FusionAuth Guide.
For a high-level overview of changes in each release, see the Release Updates topic on our Blog.
To jump to a specific version that interests you, choose a version from the dropdown:
Version 1.66.0 Version 1.65.0 (Tenant Manager SSO Tasmanian Mountain Skink) Version 1.64.1 Version 1.64.0 (Secret Shibe) Version 1.63.0 (Proof Pangolin) Version 1.62.1 Version 1.62.0 (Refined Reindeer) Version 1.61.2 Version 1.61.1 Version 1.61.0 (Flexible Fox) Version 1.60.2 Version 1.60.1 Version 1.60.0 (Prompt Param Piranha) Version 1.58.3 Version 1.59.1 Version 1.59.0 (Identity Ibex) Version 1.58.1 Version 1.58.2 Version 1.58.0 (Delegation Dolphin) Version 1.57.1 Version 1.57.0 (Webhook Wombat) Version 1.56.0 (SSO Snake) Version 1.55.1 (Holiday Hippo) Version 1.54.0 (Express Free Trial (EFT) Elephant) Version 1.53.3 Version 1.53.2 Version 1.53.1 Version 1.53.0 (Lambda Llama) Version 1.52.1 Version 1.52.0 (Passkey Platypus) Version 1.51.2 Version 1.51.1 Version 1.51.0 (Theming Toucan) Version 1.50.1 Version 1.50.0 (Scopes Salamander) Version 1.49.2 Version 1.49.1 (Bugfix Beluga) Version 1.48.3 Version 1.48.2 Version 1.48.0 (Webhook Walrus) Version 1.48.1 Version 1.47.1 Version 1.45.4 Version 1.47.0 (Performance Panther) Version 1.43.2 Version 1.46.0 (Octagonal Ocelot) Version 1.45.3 Version 1.45.2 Version 1.45.1 Version 1.45.0 (Dapper Duck) Version 1.44.0 Version 1.43.1 Version 1.43.0 Version 1.42.1 Version 1.42.0 Version 1.41.3 Version 1.41.2 Version 1.41.1 Version 1.41.0 Version 1.40.2 Version 1.40.1 Version 1.40.0 Version 1.39.0 Version 1.38.1 Version 1.38.0 Version 1.37.2 Version 1.37.1 Version 1.37.0 Version 1.36.8 Version 1.36.7 Version 1.36.6 Version 1.36.5 Version 1.36.4 Version 1.36.3 Version 1.36.1 Version 1.36.2 Version 1.36.0 Version 1.35.0 Version 1.34.1 Version 1.34.0 Version 1.33.0 Version 1.32.1 Version 1.32.0 Version 1.31.0 Version 1.30.2 Version 1.30.1 Version 1.29.4 Version 1.30.0 Version 1.29.3 Version 1.29.2 Version 1.29.1 Version 1.29.0 Version 1.28.1 Version 1.28.0 Version 1.27.2 Version 1.27.1 Version 1.27.0 Version 1.26.0 Version 1.26.1 Version 1.25.0 Version 1.24.0 Version 1.23.3 Version 1.23.2 Version 1.23.1 Version 1.23.0 Version 1.22.2 Version 1.22.1 Version 1.22.0 Version 1.21.0 Version 1.20.1 Version 1.20.0 Version 1.19.8 Version 1.19.7 Version 1.19.6 Version 1.19.5 Version 1.19.4 Version 1.19.3 Version 1.19.2 Version 1.19.1 Version 1.19.0 Version 1.18.8 Version 1.18.7 Version 1.18.6 Version 1.18.5 Version 1.18.4 Version 1.18.3 Version 1.18.2 Version 1.18.0 Version 1.18.1 Version 1.17.5 Version 1.17.4 Version 1.17.3 Version 1.17.2 Version 1.17.1 Version 1.17.0 Version 1.16.1 Version 1.16.0 Version 1.16.0 Version 1.15.8 Version 1.15.7 Version 1.15.6 Version 1.15.5 Version 1.15.4 Version 1.15.3 Version 1.15.2 Version 1.15.1 Version 1.15.0 Version 1.14.0 Version 1.13.2 Version 1.13.1 Version 1.13.0 Version 1.12.0 Version 1.11.0 Version 1.10.1 Version 1.10.0 Version 1.9.2 Version 1.9.0 Version 1.9.1 Version 1.8.1 RC1 Version 1.8.0 RC1 Version 1.7.4 Version 1.7.3 Version 1.7.2 Version 1.7.0 Version 1.7.1 Version 1.6.0 Version 1.5.0 Version 1.4.0 Version 1.3.1 Version 1.3.0 Version 1.2.2 Version 1.2.1 Version 1.2.0 Version 1.1.0 Version 1.1.1 Version 1.0.18 Version 1.0.16 Version 1.0.17 Version 1.0.15 Version 1.0.14 Version 1.0.13
To filter release notes by category, select a category or multiple categories below:
5 May 2026
Breaking Change
In 1.65.0, we hardened endpoint security by requiring global API keys for endpoints that impact a FusionAuth installation beyond the scope of a single tenant.
Unfortunately, we didn't harden our webhook endpoints this way, despite them deserving the fix. This remedies that error.
As a result, these endpoints:
- no longer accept tenant-scoped API keys
- respond with a
401error code whenever a user provides theX-FusionAuth-TenantIdheader - no longer support the top-level
tenantIdproperty in Kickstart configurations
This impacts the following endpoints:
/api/webhook/api/system/webhook-attempt-log/api/system/webhook-event-log/api/system/webhook-event-log/search/api/webhook/search
Fix
Fixed a cosmetic issue in our Lambda editor: code comments were previously rendered orange-red. Comments are now rendered as gray to de-emphasize them.
Fix
Improved advanced theme validation in the Admin UI:
- Added checks for missing messages. Previously, if a theme lacked messages, but included all required templates, it would not be flagged for requiring an update.
- The theme editor now associates error messages with template sections.
30 April 2026
Breaking Change
Made the linking strategy of an enabled identity provider immutable, to prevent users from inadvertently breaking an existing provider. To change the linking strategy for an enabled identity provider, disable the provider, make your change, then re-enable the provider.
Breaking Change
To harden security, removed access via tenant-scoped API keys to endpoints that impact a FusionAuth installation beyond the scope of a single tenant (e.g. /api/key/generate/ endpoint). To access these endpoints, you must now use a global API key.
As a result, these endpoints:
For a full list of APIs that now require a global API key, see API Endpoints Guarded by API Keys.
New Feature
Introduced self-service single-sign on (SSO) configuration from Tenant Manager. Now, tenant manager administrators can configure SSO for their tenant entirely within tenant manager.
New Feature
Added custom favicons for hosted login pages using simple themes.
New Feature
Introduced a voice option for multi-factor authentication (MFA), allowing users to receive a code via audio instead of text.
New Feature
Introduced a declarative way to reconcile identities across identity providers: attribute mappings. You must use this alternative to reconcile lambdas to use self-service SSO in Tenant Manager.
New Feature
Created a new API for testing identity provider configurations, and a UI in Tenant Manager that uses this API for visual testing. Use these tests to verify an identity provider configuration before enabling an identity provider.
Enhancement
Added a self-service option for applications that allows users to complete an existing (but incomplete) registration, but does not allow entirely new users to create a new registration.
Enhancement
Added the auditLog.tenantId field to the Audit Logs API, which provides the ability to filter audit logs by tenant using the API and in Tenant Manager.
Enhancement
In the Admin UI, added a new Help section to the left-hand nav, containing links to a new Get Started section and the FusionAuth Documentation.
Fix
Improved the performance of PATCH and PUT calls to /api/identity-provider for deployments with thousands of tenants or applications.
Additionally, this release of the Go and Java client libraries adds opt-in retry support with exponential backoff for these APIs.
Fix
Fixed a race condition where concurrent PATCH calls to /api/identity-provider/{id} could all return status code 200, but only one modification would persist. Now, only one call will succeed, and all others will return status code 409.
Since: 1.63.0
Fix
Fixed a broken link in Reactor that should have linked users to find their license key in their FusionAuth account.
Since: 1.63.0
Fix
Fixed an issue where image URLs were obscured while viewing IdP configuration.
Since: 1.62.1
Fix
Fixed an issue where GET requests to /api/jwt/issue could produce a JWT for a user without firing the JWT Populate lambda, for users registered for one application, when requesting a token for an application for which the user is not registered.
Since: 1.62.1
Fix
Fixed an issue where the Admin UI failed to display embedded maps.
Since: 1.56.0
Fix
Fixed an issue where Reactor and license data could be lost when migrating to a new version of FusionAuth.
Since: 1.60.0
Fix
Improved the performance and reliability of background jobs in multi-node clusters, reducing load by a factor of 3-9x.
Since: 1.64.1
Fix
Fixed a FreeMarker exception that previously displayed when viewing keys without an algorithm in Key Master.
Since: 1.62.0
Fix
In the FusionAuth .NET Core Client, fixed an issue where enumeration-based values like sendSetPasswordIdentityType() incorrectly defaulted to email when omitted. The client now omits the value entirely from requests instead of using a default value.
Security
Fixed an issue where global API keys could be hidden by marking them as internal.
Security
Tightened security of endpoints that should be only callable by internal API keys, to ensure they are not callable with regular API keys.
Security
Fixed a race condition that could apply the wrong FIPS mode when bootstrapping a new cluster where nodes have different FIPS settings.
Security
Fixed an issue where the /api/cache/reload endpoint was accessible to any super-admin API key, not just internal API keys.
Security
Fixed a flaw in the "Forgot password" flow to that could be used to enumerate registered email addresses using the cookies in the HTTP response.
Security
Fixed an issue where a tenant-scoped API key could be used to add an identity provider to an application in a separate tenant.
Security
Removed shell access from the fusionauth user account in the Docker install to better align with the principle of lease privilege.
Security
Fixed a potential directory traversal issue that could expose files stored outside the web root folder.
Internal
Updated the following dependencies:
Java:
com.inversoft:inversoft-api-authentication``0.32.1->0.33.0com.inversoft:inversoft-scheduler``0.3.0->0.4.0com.inversoft:restify``4.3.0->4.4.0io.fusionauth:java-http``1.4.0->1.4.1org.apache.kafka:kafka-clients``3.9.1->3.9.2org.primeframework:prime-mvc``5.9.0->5.10.0
Javascript:
@ctrl/tinycolorremoved (was4.2.0)@floating-ui/coreremoved (was1.7.4)@floating-ui/domremoved (was1.7.5)@floating-ui/utilsremoved (was0.2.10)@fusionauth/typescript-clientremoved (was1.62.0)@lit-labs/ssr-dom-shimremoved (was1.5.1)@lit/reactremoved (was1.0.8)@lit/reactive-elementremoved (was2.1.2)@shoelace-style/animationsremoved (was1.2.0)@shoelace-style/localizeremoved (was3.2.1)@shoelace-style/shoelaceremoved (was2.20.1)@types/reactremoved (was19.2.13)@types/trusted-typesremoved (was2.0.7)brace-expansion``1.1.12->1.1.13composed-offset-positionremoved (was0.0.6)csstyperemoved (was3.2.3)litremoved (was3.3.2)lit-elementremoved (was4.2.2)lit-htmlremoved (was3.3.2)lodash``4.17.23->4.18.1node-fetchremoved (was2.7.0)qr-creatorremoved (was1.0.0)tr46removed (was0.0.3)webidl-conversionsremoved (was3.0.1)whatwg-urlremoved (was5.0.0)
3 April 2026
Fix
Fixed an issue where, during a password change, FusionAuth may have failed to detect that a new password was included in a data breach.
Known Issue
You may sometimes see spurious INFO-level log messages with the following form:
io.fusionauth.api.service.system.NodeService - Node [...] with address [...] removed because it has not checked in for the last [74] seconds. Bye node.
This log message is inaccurate and does not indicate a broken connection between nodes. To remove this log (and benefit from multi-node performance improvements), upgrade to version 1.65.0.
Resolved in version 1.65.0 via
#3442
.
19 March 2026
New Feature
Introduced Lambda Secrets, secure storage for highly sensitive values like app passwords and API keys that can be accessed from lambda functions.
Known Issue
When upgrading to FusionAuth 1.62.0 or higher, when saving a theme, the Theme Editor UI cheerfully indicates that a template lacks one or more keys. Unfortunately, this error message does not indicate which template lacks the keys.
Enhancement
Added the Proof Key for Code Exchange (PKCE) signifier to the OpenID Connect (OIDC) Discovery document so clients can dynamically find FusionAuth OAuth endpoints.
Enhancement
Added the ability to use a code for passwordless email login in addition to magic links.
Enhancement
Added the ability to customize page titles when using a custom simple theme using message keys.
Enhancement
Added the UserpasswordChangeRequired field to the search index to enable Elasticsearch queries. This makes it easier to count and view users who need to perform a password reset, but have not yet reset their password.
Thanks to @rinkledink !
Deprecated
Retrieve Two-Factor Recovery Codes API
GET /api/user/two-factor/recovery-code/{userId} is deprecated and will be removed in a future version of FusionAuth. To provide access to a user's recovery codes, generate new recovery codes and deliver those.
Fix
Fixed an issue where the phone verification page displayed a label without a message.
Since: 1.62.0
Fix
Fixed an issue where long-running Admin UI requests could sometimes duplicate actions.
Since: 1.61.0
Fix
Fixed an issue where the SCIM GET /api/scim/resource/v2/Groups endpoint failed with a 500 error when one of the groups in the response contains a large number of users.
Since: 1.62.0
Fix
Standardized inconsistent title casing of headings in the Admin UI.
Fix
In the Admin UI, linked users always show an error when you view the linked account at Users -> Manage -> Linked accounts -> View .
Since: 1.62.0
Fix
Fixed an issue where, in the Admin UI, the Twilio or Generic Messenger send test message button always produced an unexpected error.
Since: 1.62.0
Fix
Fixed an issue where connectors did not allow login via username or email when the connector returned a different username or email from what the request provided.
Since: 1.59.0
Fix
The id_token_hint field of the oauth2/logout endpoint was incompatible with Id tokens generated in 1.59.x and earlier. The oauth2/logout endpoint is once again backwards-compatible with those tokens.
Since: 1.60.0
Fix
Fixed a rare issue where maintenance mode errors could appear in the FusionAuth logs while maintenance mode was not active.
Since: 1.63.0
Fix
Fixed a rare issue where a version upgrade could deactivate a configured license.
Since: 1.64.0
Fix
Fixed an issue where FusionAuth could get stuck in a Maintenance Mode Failed state when a leftover test_create_table database table already existed.
Internal
Updated the following dependencies:
Java:
com.fasterxml.jackson.core:jackson-annotations2.19.2 -> 2.21.0com.fasterxml.jackson.core:jackson-core2.19.2 -> 2.21.1com.fasterxml.jackson.core:jackson-databind2.19.2 -> 2.21.1com.fasterxml.jackson.dataformat:jackson-dataformat-cbor2.19.2 -> 2.21.1com.inversoft:inversoft-license4.10.0 -> 4.12.0com.inversoft:inversoft-maintenance-mode0.25.2 -> 0.25.3
Javascript:
cli/node_modules/minimatch3.1.2 -> 3.1.5jshint/node_modules/minimatch3.0.8 -> 3.1.5
26 February 2026
Theme Upgrade
To use the new show password toggle for password input fields, you must add new macros to your theme. See Upgrade an Advanced Theme for additional information about the upgrade process. See Advanced Theme Upgrade Notes for details on updating an existing advanced theme specific to this release.
Breaking Change
Removed the deprecated (since 1.50.0) User API JWT authentication method, retrieveUserViaJWT, from client libraries.
New Feature
Introduced support for Demonstrating Proof-of-Possession (DPoP), a method of binding access and refresh tokens to a client key pair for additional security. This protects against token theft and replay attacks.
Known Issue
Rarely, maintenance mode errors could appear in the FusionAuth logs while maintenance mode was not active.
Resolved in version 1.64.0 via
#3374
.
Known Issue
Known Issue
Reactor contains a broken link that should lead users to find their license key in their FusionAuth account.
Resolved in version 1.65.0 via
#3396
.
Known Issue
A race condition exists: concurrent PATCH calls to /api/identity-provider/{id} can all return status code 200, but only one modification persists.
Resolved in version 1.65.0 via
#3386
.
Enhancement
Added the tenantID parameter to several client requests to APIs used for fetching IdPs.
Enhancement
Added the AuthenticationType parameter to the MFA Requirement Lambda. This enables prompts for MFA based on the method the user used to login.
Enhancement
Added more relevant information to the summary tab in the setup wizard.
Thanks to @mark-robustelli !
Enhancement
In the setup wizard, added a link to the licensing agreement.
Thanks to @mark-robustelli !
Enhancement
Added an Admin UI page for Fine-Grained Authorization (FGA).
Enhancement
Added a 'show password' toggle to the default hosted login page.
Enhancement
Following NIST password guidelines, added a check that prevents users from configuring a password that matches their username.
Fix
Removed all explicit mentions of "FusionAuth" from error message text.
Fix
Fixed a bug where one application's SSO session could prevent login to another application when a user had not yet completed registration.
Fix
Fixed a bug where a reconcile lambda could fail to set a value for an IdP linking strategy when the IdP's value is null.
Fix
Fixed an issue where the SAML metadata API returned a 500 response when the configuration specified a custom Name ID.
Fix
Added validation to fix a bug where nonfunctional signing keys could be successfully created by mismatching the type label with the PEM.
Fix
Enabled the deletion of Apple IdP-assigned keys, which previously failed to delete.
Fix
Fixed a bug introduced in 1.62.1 where the Simple Theme login page displayed a Face ID login graphic over content.
Fix
Fixed a bug where hosted login pages for universal applications sometimes showed IdPs scoped to another tenant.
Fix
Fixed a longstanding bug where the monthly active user table did not display data from the month of December.
Thanks to @Robert-Janeczek !
Fix
Fixed a bug in self-service registration where a user could alter a hidden field (using browser developer tools) and cause Failed decrypt registration state errors to appear in the event log.
Fix
Fixed a bug where autocomplete did not function correctly when accessing the Admin UI over HTTP (instead of HTTPS).
Fix
In the setup wizard, the checkbox for accepting the licensing agrement was not marked as required. It is indeed required, so now it is marked with an asterisk (*).
Fix
In System Settings > UI , a form field labeled "Menu font" controlled the menu font color. Added the suffix "color" to this label to clarify the field's purpose.
Thanks to @brob !
Fix
API Key endpoint permissions didn't allow for row selection, despite text that indicated otherwise.
Thanks to @brob !
Fix
In the setup wizard, marked "tell us more" field as required with an asterisk (*) when the "Other" acquisition channel is selected.
Thanks to @brob !
Fix
Fixed backwards toggle logic when requiring encrypted SAML assertions. When creating or editing a SAMLv2 and IdP-initiated SAML IdP, under the Options tab, the Require encrypted assertions toggle should expose the decryption key selector when it's on and hide it when it's off. The logic was backwards, hiding the selector when it's on and exposing it when it's off.
Fix
Fixed a bug where the SCIM create operation returned error code 400 (instead of 409) when bothuser.email and user.username are duplicated.
Internal
Switched from MD5 hash generation to the built-in Postgres gen_random_uuid() function. This improves our FIPS support.
Internal
Cleaned up the root template for the FusionAuth instance to make it easier to reach the Admin UI.
Thanks to @brob !
Internal
Changed first-time setup links to flexible pointers that we can update without releasing a new version.
Thanks to @brob !
Internal
Updated the following dependencies:
Java:
ch.qos.logback:logback-classic1.5.19 -> 1.5.25ch.qos.logback:logback-core1.5.19 -> 1.5.25com.inversoft:inversoft-license4.9.0 -> 4.10.0io.fusionauth:fusionauth-jwt6.0.0 -> 6.1.0io.fusionauth:fusionauth-samlv21.1.3 -> 2.0.0org.primeframework:prime-mvc5.7.0 -> 5.9.0
Javascript:
@ctrl/tinycolor4.1.0 -> 4.2.0@floating-ui/core1.6.9 -> 1.7.4@floating-ui/dom1.6.13 -> 1.7.5@floating-ui/utils0.2.9 -> 0.2.10@fusionauth/typescript-client1.57.0 -> 1.62.0@lit-labs/ssr-dom-shim1.3.0 -> 1.5.1@lit/react1.0.7 -> 1.0.8@lit/reactive-element2.0.4 -> 2.1.2@tailwindplus/elements1.0.20 -> 1.0.22@types/react19.1.0 -> 19.2.13csstype3.1.3 -> 3.2.3lit3.2.1 -> 3.3.2lit-element4.1.1 -> 4.2.2lit-html3.2.1 -> 3.3.2lodash4.17.21 -> 4.17.23- added
brace-expansion1.1.12 - removed
cli/node_modules/brace-expansion(was 1.1.12) - removed
jshint/node_modules/brace-expansion(was 1.1.12)
30 December 2025
Known Issue
The Simple Theme login page displays a large Face ID login graphic over content.
Resolved in version 1.63.0 via
#3295
.
Known Issue
Hosted login pages for universal applications sometimes show IdPs scoped to another tenant.
Resolved in version 1.63.0 via
#3308
.
Known Issue
Image URLs may be obscured while viewing IdP configuration.
Resolved in version 1.65.0 via
#3324
.
Known Issue
A GET request to /api/jwt/issue can produce a JWT for a user without firing the JWT Populate lambda, for users registered for one application, when requesting a token for an application for which the user is not registered.
Resolved in version 1.65.0 via
#3327
.
Fix
The logout button was not visible on account self-service pages.
Fix
When using database search mode, user searches could fail due to FreeMarker template errors introduced in the 1.62.0 UI update.
Fix
When a custom theme was missing a template, FusionAuth could fail to render the fallback template from the default theme. In some cases this could prevent a user from completing various workflows.
Fix
The setup wizard could generate an error if the browser could not provide a timezone.
18 December 2025
Database Migration
This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.
For more information about database migrations, see Database Migrations.
Theme Upgrade
To use the new pre-verification feature in Advanced Registration Forms, you must add new templates to your theme. See Upgrade an Advanced Theme for additional information about the upgrade process. See Advanced Theme Upgrade Notes for details on updating an existing advanced theme specific to this release.
Known Issue
Known Issue
The phone verification page can display a label without a message.
Known Issue
The SCIM GET /api/scim/resource/v2/Groups endpoint may fail with a 500 error when one of the groups in the response contains a large number of users.
Resolved in version 1.64.0 via
#3307
.
Known Issue
In the Admin UI, linked users always show an error when you view the linked account at Users -> Manage -> Linked accounts -> view .
Resolved in version 1.64.0 via
#3326
.
Known Issue
In the Admin UI, the Twilio or Generic Messenger send test message button always produced an unexpected error.
Resolved in version 1.64.0 via
#3362
.
Known Issue
When viewing keys without an algorithm, Key Master displays a FreeMarker error at the top of the view menu.
Resolved in version 1.65.0 via
#3436
.
Theme Upgrade
When upgrading from older versions of FusionAuth with a customized theme, upgrade to 1.61.2 first, add missing templates to your theme, and then upgrade to 1.62.0.
Breaking Change
This release makes changes to API key requirements for the /api/identity-provider endpoint. Tenant-scoped API keys can only be used to configure identity providers belonging to the same tenant. A global API key is required to configure global identity providers.
New Feature
Introduces the MFA Requirement Lambda, which dynamically decides whether a user should receive an MFA challenge, even if trust has already been established. Used for adaptive MFA and step-up workflows.
New Feature
Added a mode that supports FIPS-compliant verified cryptographic modules. For more details, see Compliance Frameworks.
New Feature
Added pre-verification of user identities. This forces email address or phone number verification before creating a user.
Enhancement
Added the ability to create tenant-scoped instances of identity providers. Tenant-scoped identity providers can only be used for authentication workflows within that tenant and are only configurable for applications belonging to that tenant, as well as universal applications. Managed domains may be reused on identity providers belonging to different tenants. Managed domains on global identity providers remain globally unique.
Tenant-scoped identity provider configurations can be managed by tenant-scoped API keys and requests.
Tenant-scoped identity providers are especially useful if you want to restrict identity provider availability to users belonging to a specific tenant.
Enhancement
Added support for using EdDSA key pairs using the Ed25519 algorithm to sign and validate JWTs.
Enhancement
Updated the styling of the Admin UI. Does not affect custom themes, but does improve (at least, to our eyes) the default theme.
Fix
Reports on the Admin UI could load slowly or time out during high user traffic or when a large number of applications exist.
Fix
IdP (federated) logins do not work for Universal Apps. Instead, shows the error message: Invalid_Request. Missing_tenant_id.
Fix
When family settings are enabled, including requiring a parent email, the parent email does not persisted after self-service registration by a child. This prevents an email from being sent to the parent email.
Fix
When creating a new lambda, changing the lambda type does not update the lambda body to the default body for that type.
Fix
Fixed a JavaScript error on the user edit page caused by a stale reference to birthDatePicker in User.js that remained after the variable was removed.
Fix
Fixed an issue where the date picker did not work properly on iOS, preventing users from selecting a date on iOS devices.
Internal
Updated the following dependencies:
- Upgrade
io.fusionauth:fusionauth-jwt``5.3.3->6.0.0 - Upgrade
org.primeframework:prime-mvc``5.6.1->5.7.0 - Add
org.bouncycastle:bc-fips``2.1.2 - Add
org.bouncycastle:bctls-fips``2.1.22
10 December 2025
Security
Improved signature processing of encrypted SAML assertions to mitigate an identified vulnerability. If you are using using a SAML IdP that allows IdP-initiated login, you should upgrade.
Internal
Updated the following dependencies:
- Upgrade
io.fusionauth:fusionauth-samlv2``1.1.1->1.1.3
24 November 2025
Known Issue
The logout button was not visible on account self-service pages. The button is now displayed with the correct icon.
Resolved in version 1.62.1 via
#3282
.
Known Issue
When using database search mode, user searches could fail due to FreeMarker template errors introduced in the UI update. User search now works correctly in database search mode.
Resolved in version 1.62.1 via
#3285
.
Fix
When testing Email Templates in the FusionAuth admin UI, rendering some template types resulted in an error. All template types can now be tested in the admin UI.
Fix
When a Minimum Password Age is configured for the tenant, creating a user without a password resulted in an exception. You can now create users without a password in tenants with a minimum password age requirement; password age rules apply once the user sets a password.
Fix
Providing an expired Id Token to the /oauth2/logout endpoint using the id_token_hint parameter resulted in an OAuth error. The /oauth2/logout endpoint once again accepts expired Id Tokens in accordance with the specification.
13 November 2025
Theme Upgrade
Several changes are required to support multiple configurations of various identity provider types that were previously restricted to a single configuration per FusionAuth instance. References to the legacy sign with Google JavaScript library, deprecated by Google in 2023, have been removed from FusionAuth. Please migrate to the updated Sign in with Google integration to continue using the Google identity provider.
Deprecated
Identity Provider API
For /api/identity-provider PUT/PATCH/DELETE:
The variant of these APIs that resolve the identity provider by a type query string parameter are deprecated. Use the variant that provides the identityProviderId via a URL path segment instead.
Known Issue
Long-running Admin UI requests can sometimes duplicate actions.
Enhancement
You can now create multiple instances of any identity provider type, each with its own distinct configuration and reconcile lambda. This is especially useful if you have users mapped to different tenants, and want the ability to have an identity provider of the same type in each tenant, each having its own distinct config.
Enhancement
Added the ability to set maximum sizes on both the HTTP request header and body. These can be useful for blocking invalid requests before they are processed by FusionAuth's HTTP server.
Enhancement
Added support for the SAML v2.0 ForceAuthn attribute. When using FusionAuth as an IdP, this attribute will force re-authentication of the user, regardless of their SSO session state.
Fix
In version 1.59.0 we started indexing the new user.phoneNumber field for searches. IndexUser had a new field added, but the doc annotation was missing the version.
Fix
The GET /api/user/change-password endpoint does not allow a loginId type of phoneNumber. Additionally, client libraries are incorrectly passing a username parameter instead of a loginId parameter in checkChangePasswordUsingLoginId calls. This API endpoint is also lacking documentation.
Fix
When federating with a Google IdP, there are situations where a user can be re-prompted for authentication when already having valid FusionAuth and Google IdP sessions. SSO should now be honored correctly in these cases.
Fix
After establishing MFA trust on a device, a user is being re-challenged during a voluntary password reset, even during the trust period. The user should be able to change their password without completing another MFA challenge.
Fix
During startup, FusionAuth can output duplicate log entries. This was especially present with silent mode enabled. Logging should now be more efficient.
Fix
When a user first logs into a tenant configured with a connector, they will see an error when MFA is required and/or an updated and stronger password policy is in place. Subsequent logins behave normally.
Fix
Searches for users using nested searches involving registration fields may return incomplete results in some cases.
Fix
When using SCIM PATCH to add a user field, exiting fields are being removed. PATCH should now be handled as expected.
Fix
Performing a user reindex intermittently results in an email, username, or phoneNumber being omitted from Elastic/OpenSearch and not being searchable.
Fix
Some unwanted JavaScript errors are reported in the browser console on some pages, including the maintenance mode page and the application scope management page. These errors should now be handled more gracefully.
Fix
SCIM group searches are not properly honoring the eq operator. This operator should be doing an exact (but case-insensitive) search, but instead is doing a wildcard search.
Fix
Webhook user.delete events were not populating email, username, or phoneNumber fields when users were deleted under certain circumstances.
Fix
Fixed an issue where the user.update webhook event triggered by an Identity Provider login did not include the user's registrations in the original field of the event payload.
Internal
Updated the following dependencies:
- Upgrade
io.fusionauth:fusionauth-jwt``5.3.2->5.3.3 - Upgrade
io.fusionauth:java-http``0.3.7->1.4.0 - Upgrade
org.freemarker:freemarker``2.3.33->2.3.34 - Upgrade
org.primeframework:prime-email``0.21.1->0.22.0 - Upgrade
org.primeframework:prime-js``1.7.0->1.8.0 - Upgrade
org.primeframework:prime-mvc``4.36.0->5.6.1 - Upgrade
ch.qos.logback``1.5.16->1.5.19 - Upgrade
org.mybatis:mybatis``3.5.16->3.5.19 - Upgrade
com.fasterxml.jackson.*``2.17.2->2.19.2 - Upgrade
org.slf4j:slf4j-api``2.0.13->2.0.17 - Upgrade
org.postgresql:postgresql``42.7.3->42.7.7 - Upgrade
io.fusionauth:fusionauth-samlv2``1.0.0->1.1.1
26 September 2025
Fix
When using FusionAuth as a SAML Service Provider (SP), receiving a SAML Response containing an Assertion with an attribute value of null or of an unsupported type will result in a failure to parse the Response.
This issue was introduced in version 1.60.0 and has been corrected.
17 September 2025
Breaking Change
When upgrading from 1.60.0 you must revert the workaround noted on GitHub Issue #3183 before or immediately after this upgrade.
Fix
When using FusionAuth as a SAML IdP with a SAML Populate lambda that reads or modifies the SAML assertion will fail causing the login request to fail.
This issue was introduced in version 1.60.0 and has been corrected.
10 September 2025
Breaking Change
Some changes have been made to the way JWTs are produced and validated:
Moved claims
The
gtyclaim has been moved from the JWT header to the body.This claim is present in an access token or id token produced by an OAuth grant.
The
useclaim has been moved from the JWT header to the body.This claim is present in an access token produced by an OAuth client credentials grant to authenticate a FusionAuth SCIM server.
New and reserved claims
The following claims are now reserved:
auth_time- Reserved for all user tokens, excludes client credentialsgty- Reserved for all tokenstty- Reserved for all tokensuse- Reserved for the client credentials grant
We do not expect this change to impact our customers. If you are adding, removing or modifying these claims using a lambda function, you will need to plan to modify your integration.
These claims are not considered reserved for the Vend API.
Token validation
It is possible that an existing access token or id token that has not yet expired will no longer be considered valid by FusionAuth. If you are using a short lived access token with a refresh token, refreshing the access token will correct itself. These changes will not have any affect on your use of the JWTs produced by FusionAuth.
Client credentials
The aud claim will always be returned as an array.
Previously this claim may be returned as an string or an array depending upon the request. The following examples show different scope values and their prior affect on the aud claim:
scope=target-entity:1:read->aud: 1scope=target-entity:1:read target-entity:2:read->aud: [1, 2]
To simplify integration requiring an integrator to only account for a single data type this claim will now always be returned as an array. If you have only ever used a single entity in the scope parameter, it is possible your integration is not expecting an array. Please be sure to account for this change prior to upgrade.
SCIM client integrations
If you are using FusionAuth as a SCIM server and you have integrated with a third-party SCIM client by manually performing a client credentials grant please be aware that you will need to adjust your integration.
The preferred integration with a SCIM client is to use the client credentials grant. By using a single long lived token you have functionally created an API key that cannot be revoked.
If your SCIM clients authentication configuration does not offer a way to configure the scope parameter you may add this to the Token endpoint as a query string. For example the Microsoft configuration does not offer a separate scope field so you will need to append ?scope={scope} to the Token endpoint where the value of {scope} is the scope you are using to obtain an access token.
If your SCIM client authentication only allows for a token and does not directly support the client credentials grant, we would recommend that you programatically generate and rotate the access token by using an API to ensure that you are not creating very long lived access tokens for a SCIM client.
Deprecated features removed
The User API JWT authentication method which was deprecated in version 1.50.0 has now been removed.
OAuth Logout
Now that we identify an id_token using the newly added tty claim, the OAuth2 Logout endpoint will now correctly reject an access_token when sent as the id_token_hint parameter according to spec. If you have any integrations that are sending an access_token in the id_token_hint parameter instead of the id_token you will need to correct your integration prior to upgrading.
Known Issue
Reactor and license data can be lost when migrating to a new version of FusionAuth. To avoid this issue, upgrade to version 1.65.0.
Resolved in version 1.65.0 via
#3438
.
Known Issue
Rarely, version upgrades may cause a FusionAuth instance to deactivate a configured license. To work around this issue, check for your license after a version upgrade; if it is missing, re-activate the license using your license Id from account.fusionauth.io/.
Resolved in version 1.64.0 via
#3366
.
Known Issue
The id_token_hint field of the oauth2/logout endpoint is incompatible with Id tokens generated in 1.59.x and earlier. Versions 1.64.0 and later are once again backwards-compatible with those tokens.
Resolved in version 1.64.0 via
#3317
.
Known Issue
Providing an expired Id Token to the /oauth2/logout endpoint using the id_token_hint parameter results in an OAuth error.
Resolved in version 1.61.1 via
#3251
.
Known Issue
Performing a user reindex occasionally results in an email, username, or phoneNumber, for a small fraction of users, to not be searchable via Elasticsearch/OpenSearch.
Resolved in version 1.61.0 via
#3186
.
Known Issue
When using FusionAuth as a SAML Service Provider (SP), receiving a SAML Response containing an Assertion with an attribute value of null or of an unsupported type will result in a failure to parse the Response. If you have encountered this issue, please upgrade to 1.60.2 if possible.
Resolved in version 1.60.2 via
#3190
.
Known Issue
When using FusionAuth as a SAML IdP with a SAML Populate lambda that reads or modifies the SAML assertion will fail causing the login request to fail. If you have encountered this issue, please upgrade to 1.60.1 if possible, or click on the linked GitHub issue to review the temporary workaround.
Resolved in version 1.60.1 via
#3183
.
New Feature
Added support for the OIDC prompt parameter! This enables silent authentication, re-authentication requests, consent prompting, and more.
Thanks to all of the community members that have helped us define this requirement, and waited patiently for it!
Enhancement
General improvements to how we handle and process JWTs in the form of access tokens and refresh tokens:
- Adding
ttyclaim to all tokens produced to easily differentiate between an access token and id token. - Moving the
gtyclaim from the header to the body for tokens produced by an OAuth grant. - Moving the
useclaim from the header to the body for tokens produced by the client credentials grant for a SCIM server. - Better support of the
token_type_hinton the Introspect endpoint. - Allow the use of refresh tokens on the Introspect endpoint with a
token_type_hintofrefresh_token
Enhancement
Move the gty and use claims from the JWT header to the body. This should improve interoperability with various identity providers such as AWS and Microsoft.
The gty claim will be present for all tokens produced by an OAuth grant. The use claim will be present in an access token produced to authenticate the SCIM server.
Enhancement
Significantly improved performance for the bulk User Import API.
Performance will particularly be improved when you have thousands of configured applications.
Enhancement
Our release process now auto-updates the the example JSON payload for usage data on collected metrics.
This documentation will remain up to date going forward.
For example data, see Collected Metrics.
Enhancement
In version 1.59.0 the password is now optional when creating or updating a user.
When returning from a third-party login, a user may be prompted to complete registration by entering a password when self-service is enabled and is configured to require a password.
This was unintended and has been corrected.
Enhancement
During a password reset workflow, for a user that has MFA configured, the user will be prompted to complete the MFA challenge.
When the user completes the challenge, the remember this device checkbox even when checked may not be honored.
The result is that once the user completes the change password workflow by completing an MFA challenge, the user will be prompt again on next login. This can be frustrating, and has been corrected.
Enhancement
When performing the initial setup of FusionAuth outside of FusionAuth Cloud maintenance mode assists you with configuring the connecting to the database and search service.
When we cannot connect to the database, or you have not provided enough information to make these connections an error page is displayed.
This page has been enhanced to provide better messaging and links to documentation to help you out if you need to troubleshooting the setup process.
Enhancement
FusionAuth now supports multiple assertions in the SAML AuthN response.
If the AuthN response contains multiple assertions, all will be made available to the SAML reconcile lambda function.
Enhancement
We significantly improved performance of User API searches returning expanded user records, and user reindex actions as well!
Fix
When decommissioning a license in a FusionAuth cluster, the change may not be reflected in all cluster nodes immediately. This can provide intermittent and inconsistent access to licensed features, depending on which node is handling a request.
Fix
A user can be shown a rendering error while attempting to complete an email based MFA login.
The error occurs when send rate limiting has been enabled as part of Advanced Threat Detection. When the user reached the rate limit threshold for requesting emails to be sent to complete login, the intended error was not shown an instead a page rendering error was displayed.
Fix
When a user completes a forgot password workflow, the failed login count will be reset.
This should reduce frustration for a user that changed their password after exceeding the configured failed login count. In this scenario, if the user had entered the the incorrect password again they would be required to wait for the configured time period before attempting login again. This could be quite frustrating.
Now that the failed count has been reset, the user will at least be allowed to enter the wrong password a few more times before we thwart their efforts.
Fix
When running in dark mode, or using a dark theme with a FusionAuth simple theme, some QR code scanners are unable to read the QR code for setting up MFA. We have added a light border to ensure that the QR code is still readable on a dark background. The QR code should have a high-contrast border to allow these readers to work.
Fix
When previewing the Phone verification required, Complete registration, and Passwordless theme templates in an advanced theme preview window, a FreeMarker exception is displayed to the user.
This was introduced in version 1.59.0.
Fix
A race condition exists, when attempting to activate FusionAuth using an air-gapped license without any outbound network access that may cause the the request to fail and not correctly persist the license.
When this issue is encountered the system becomes un-licensed.
Fix
When regenerating Reactor's encryption key, the Breached Password Detection status may take longer than expected to return to Active.
If you were to encounter this issue, deactivating and reactivating your license will also correct the state. You can also reach out to support if you see something like this as well.
Fix
Improved MFA configuration workflow during self-service registration when configured as required.
Fix
In version 1.59.0, changes were introduced that made it impossible to set webhooks for a handful of event types as transactional.
See release notes for 1.59.1 below for additional information.
Security
FusionAuth accepts access tokens to authenticate requests and to initiate user authentication workflows.
Improvements have been made to how tokens are accepted, processed and validated to ensure they are suitable to authenticate the request. This will improve security now and will be necessary to support access tokens more extensively for authenticating requests.
Security
Improvements have been made to how FusionAuth processes signed SAML assertions to mitigate an identified vulnerability. If you are using using a SAML IdP, especially when allowing IdP initiated login, please plan to upgrade at your earliest convenience.
Internal
Updated the following dependencies:
- Upgrade
io.fusionauth:fusionauth-usage-stats:fusionauth-usage-stats-common``0.6.0->0.6.1 - Upgrade
org.primeframework:prime-mvc``4.34.0->4.35.1 - Upgrade
io.fusionauth:fusionauth-samlv2``0.11.1->1.0.0
20 August 2025
Fix
An upgrade to FusionAuth version 1.58.2 or 1.59.0 fails if the Default Admin Registration provided by FusionAuth form (shipped in 1.20.0) is renamed or deleted prior to the upgrade.
20 August 2025
Known Issue
Admins control whether users must have passwords for an application by modifying the application's advanced registration form. Basic registration forms always have a password field, so a password is always required. IdP logins (such as Login with Google) create users without passwords. If the users are using an IdP to log in to an application with a required password field, the user is forced to set a password.
Resolved in version 1.60.0 via
#3159
.
Known Issue
Updating the tenant will cause the following webhok events when enabled to be configured as non-transactional. This will only affect you if you have configured one or more of these event types as transactional:
user.identity.updateuser.identity.verifieduser.registration.createuser.registration.deleteuser.registration.updateuser.registration.verifieduser.update
Resolved in version 1.60.0 via
#3175
.
Known Issue
IdP logins do not work for Universal Apps. Instead, the error message Invalid_Request. Missing_tenant_id is displayed.
Resolved in version 1.62.0 via
#3161
.
Known Issue
Fix
14 August 2025
Database Migration
For more information about database migrations, see Database Migrations.
Theme Upgrade
This version of requires several changes to your theme to support users without passwords.
Deprecated
Registration verification is deprecated and will be removed in a future version of FusionAuth.
User API
For /api/user GET:
user.verified is now a deprecated field that only indicates whether or not the User’s primary email identity has been verified. This does NOT indicate whether phone number identity types are verified. Use user.identities[x].verified and user.identities[x].verifiedReason instead.
For /api/user POST:
sendSetPasswordEmail is deprecated. Use sendSetPasswordIdentityType instead.
For /api/user/forgot-password POST:
sendForgotPasswordEmail is deprecated. Use sendForgotPasswordMessage instead.
User Registration API
sendSetPasswordEmail is deprecated. Use sendSetPasswordIdentityType instead.
Known Issue
Connectors do not allow login via username or email when the connector returns a different username or email from what the request provided.
Resolved in version 1.64.0 via
#3287
.
Known Issue
An upgrade to FusionAuth version 1.58.2 or 1.59.0 fails if the Default Admin Registration provided by FusionAuth form (shipped in 1.20.0) is renamed or deleted prior to the upgrade. If you are planning an upgrade to version 1.59.0, it is recommended that you upgrade to version 1.59.1. If upgrading to 1.59.1 does not resolve this, please contact support.
Resolved in version 1.59.1 via
#3153
.
Known Issue
Known Issue
Previewing the phone verification required, complete registration, passwordless theme templates shows a template error.
Resolved in version 1.60.0 via
#3148
.
Known Issue
When a Minimum Password Age is configured for the tenant, creating a user without a password results in an exception.
Resolved in version 1.61.1 via
#3247
.
Known Issue
A reconcile lambda could fail to set a value for an IdP linking strategy when the IdP's value is null.
Resolved in version 1.63.0 via
#3237
.
New Feature
This release adds support for phone number as a first-class identity type. A user can now have phone number as their sole identifier, use SMS-based passwordless login, and much more. Read on for more information on related features!
New Feature
With support for phone number as a first-class identity type, phone number can now be used as the sole identity type for a user, allowing phone-only registration.
New Feature
FusionAuth now supports Passwordless Authentication through SMS. Previously, a user was only able to use an email address for passwordless authentication.
New Feature
This release adds support for phone number verification.
Enhancement
Additional usage stats are collected for the use of grace periods with application refresh tokens, and for non-retrievable and expiring api keys.
Enhancement
When a messenger fails to deliver a message, FusionAuth now adds an event log for the error. This enhancements should help with troubleshooting message delivery issues.
Enhancement
Importing a password hash longer than 255 characters no longer fails. This limit was increased to 2048 characters.
Enhancement
Update copy for the first Enable SMS step. It's using the word two instead of too.
Enhancement
The exp claim in the FusionAuth JWT can now be modified in a JWT Populate lambda, but only to a smaller value. This means you cannot extend the default lifetime of a JWT, however you can choose to shorten it. This allows for stricter JWT expirations to be applied dynamically based on user data or other information. Additionally, scope is now available to JWT Populate lambdas.
Enhancement
Passwords are now optional on users. This allows for passwordless-only and/or federated-only authentication, and simplifies the importing of users that don't currently have passwords.
Fix
When using a generic messenger in interactive workflows, no error is shown to the user if the message delivery attempt returns a non-200 response code. The user should be alerted to the fact that something went wrong.
Fix
During the slow migration of a user using a generic or LDAP connector, the known device cookie is not created. If the new device email or a new device webhook is configured, FusionAuth sends a second new device email and/or new device webhook the next time the user logs in.
Fix
There are cases where we are not returning appropriate errors for invalid inputs to APIs. Errors with appropriate and descriptive messages should be returned.
Security
Improved defenses against cross-site scripting attacks.
Security
A potential vulnerability was identified that could lead to unwanted access to protected resources via an injection attack. Addition protections were added to prevent this.
Internal
Updated the following dependencies:
- Upgrade
com.inversoft:inversoft-api-authentication``0.30.0->0.30.2 - Upgrade
com.inversoft:inversoft-config``0.9.13->0.10.0 - Upgrade
com.inversoft:inversoft-database``0.10.2->0.10.3 - Upgrade
com.inversoft:inversoft-license``4.8.0->4.8.1 - Upgrade
com.inversoft:inversoft-maintenance-mode``0.23.1->0.23.3 - Upgrade
com.inversoft:inversoft-support``0.14.1->0.14.2 - Upgrade
jakarta.mail:jakarta.mail-api``2.1.2->2.1.3 - Upgrade
jakarta.activation:jakarta.activation-api``2.1.2->2.1.3 - Upgrade
org.primeframework:prime-email``0.21.0->0.21.1
23 July 2025
Database Migration
For more information about database migrations, see Database Migrations.
Known Issue
An upgrade to FusionAuth version 1.58.2 or 1.59.0 fails if the Default Admin Registration provided by FusionAuth form (shipped in 1.20.0) is renamed or deleted prior to the upgrade. If you are planning an upgrade to version 1.58.1, it is recommended that you upgrade to version 1.58.3. If upgrading to 1.58.3 does not resolve this, please contact support.
Resolved in version 1.58.3 via
#3153
.
Fix
A race condition was identified in the 1.58.0 release that could affect a cluster of FusionAuth instances during the upgrade, preventing the upgrade from completing. This race condition has been addressed.
23 July 2025
Known Issue
An upgrade to FusionAuth version 1.58.2 or 1.59.0 fails if the Default Admin Registration provided by FusionAuth form (shipped in 1.20.0) is renamed or deleted prior to the upgrade. If you are planning an upgrade to version 1.58.2, it is recommended that you upgrade to version 1.58.3. If upgrading to 1.58.3 does not resolve this, please contact support.
Fix
The SCIM create operation returns error code 400 (instead of 409) when bothuser.email and user.username are duplicated.
Resolved in version 1.63.0 via
#3149
.
Fix
The Add Webhook page and the Login Records report can show errors in some circumstances. These error conditions should be handled more gracefully.
21 July 2025
Database Migration
For more information about database migrations, see Database Migrations.
Known Issue
After releasing FusionAuth version 1.58.0 we identified a race condition that could prevent an upgrade to version 1.58.0 from successfully completing in a clustered environment. We removed this release from distribution. If you happened to install version 1.58.0 during the brief time that it was available, it is recommended that you upgrade to version 1.58.3.
Resolved in version 1.58.1 via
#3124
.
Known Issue
An upgrade to FusionAuth version 1.58.2 or 1.59.0 fails if the Default Admin Registration provided by FusionAuth form (shipped in 1.20.0) is renamed or deleted prior to the upgrade. If you are planning an upgrade to version 1.58.0, it is recommended that you upgrade to version 1.58.3. If upgrading to 1.58.3 does not resolve this, please contact support.
New Feature
FusionAuth now includes a Tenant manager application. The Tenant Manager application is used for managing users within a single FusionAuth tenant, and you can grant access to this application to ordinary users (i.e. not FusionAuth admins). This is useful for delegating user administration to users in your, or your customers' organizations.
New Feature
FusionAuth introduces Universal Applications! Formerly, in FusionAuth an application belonged to one and only one tenant. This can be cumbersome when you want to expose your application in many tenants, as you need to create an application record in each tenant. With universal applications, a single application entry in FusionAuth can be used in all tenants.
Enhancement
FusionAuth was not handling a malformed Set-Cookie response header from another identity provider gracefully. The parsing done by FusionAuth was updated to handle this scenario better.
Thanks to @konvergence !
Fix
Searching for entities using the Entity Search API can produce results that have duplicate or missing items on response pages when a sort field isn't specified. Results should have an implicit ordering when no sort field is specified.
Fix
In certain circumstances, the FusionAuth admin UI and self-service account applications can fail to refresh an expired access token, causing a user to be logged out.
Fix
Calling the Search Reindex API while a reindex is in progress yields a 500 error. This API now returns a 400 status if a reindex operation is already running.
Fix
Using PATCH calls from HTTPConnect in a lambda fails in some cases. PATCH should be generally supported.
Fix
Interacting with a date picker can generate errors in the broswer's console. FusionAuth should handle these errors more gracefully.
Fix
A few forms in the FusionAuth admin UI are setting the input focus in nonstandard ways. These include the setup wizard, the add API key view, and the edit API key view.
Fix
When handling an HTTP request with a content type of multipart/*, FusionAuth now more accurately returns an HTTP status code of 422 if the request contains a file and a file upload was not expected for the intended HTTP request path.
Security
Enhance developer feedback when rejecting unexpected multipart/* encoded requests containing files. Added additional file management configuration to allow for a per request persistence policy.
22 April 2025
Breaking Change
Only for users who have manually installed fusionauth using the RPM or Debian packages: when upgrading from releases prior to 1.57.1, you must ensure that both the fusionauth-app and fusionauth-search services are stopped. To do this, run the following command:
sudo systemctl stop fusionauth-app fusionauth-search
The upgrade will run a usermod command to modify the fusionauth user account so both processes must be stopped in order for the upgrade to succeed.
Fix
Fixed a bug introduced in version 1.56.0 that caused FusionAuth to fail to start after being installed using RPM and Debian packages.
4 April 2025
Database Migration
For more information about database migrations, see Database Migrations.
Enhancement
Two enhancements were added to the configuration for controlling webhook event logging behavior:
- Webhook event logging can now be turned off, which is the default for new FusionAuth installations. Previously, you were only able to reduce the retention period to a very small window, however in this case the logging and log management would still occur.
- Deleting webhook event logs according to a configured retention period is now enabled by default. Previously, it was disabled by default.
Enhancement
Webhook event log searching was improved by setting a default 1-hour search window when no duration parameters are provided. Webhook event logging can create a large number of log records, and the performance of unbounded searches scaled roughly linearly with the number of log records, leading to less performant searches as the data size increased.
Enhancement
The process that applies webhook event log retention rules is getting some performance improvements. This is a background process that generally does not impact performance but could consume a disproportionate amount of system resources when under heavy load.
Enhancement
When prompted for how you heard about FusionAuth in the setup wizard, you may now supply "ChatGPT/LLMs/AI" as a standard response.
Fix
The process for deleting webhook event logs according to retention rules was formerly turned off by default, causing all webhook event log entries to be retained forever. This will now be enabled by default in new FusionAuth installations. Existing installations that are being upgraded will retain their former setting.
Fix
The client libraries were missing PATCH support for Entities. Support for this operation has been added.
Fix
Client libraries are missing full support for PUT and PATCH operations for entity types, forms, form fields, IP ACLs, webhooks, and families. This fix adds support for these.
6 March 2025
Database Migration
For more information about database migrations, see Database Migrations.
Known Issue
Very large webhook event log volumes could impact performance during log cleaning operations. If you are currently using a version of FusionAuth earlier than 1.53.0 and use webhooks, we recommend upgrading to version 1.57.0.
Resolved in version 1.57.0 via
#3037
.
Known Issue
The Admin UI may fail to display embedded maps.
Resolved in version 1.65.0 via
#3382
.
Enhancement
FusionAuth now allows you to create non-retrievable API keys. If you select this option when creating a key, the key will only be visible during creation and not thereafter. Make a copy and keep it secure!
Enhancement
Improved the execution performance of lambdas
Enhancement
Allow the post-login bootstrapping of a FusionAuth SSO session using an access token. This can be useful if you've authenticated a user outside of an OAuth workflow, or if you've lost access to the SSO session cookie.
Fix
FusionAuth returns a 500 when supplying a malformed application Id in an IdP-initiated SAML login, making it hard to troubleshoot. The error should be handled more gracefully, and a more meaningful error message should be returned.
Fix
The Application > Multi-Factor > SMS Template tooltip incorrectly referenced an email template instead of an SMS template. Updated this to reference the correct template type.
Thanks to @JCelentano !
Fix
The passwordless API returns a 500 error when a non-existent application Id is provided. This should return a correct response code and meaningful error.
Fix
When posting an invalid grant type to the /oauth2/token endpoint, the list of supported grant types in the error message is missing the device grant type
Fix
Users are being prompted to re-submit a form when first logging into a new deployment using Firefox. The request should proceed on the first attempt.
Fix
When creating an entity grant for a user using the API, some invalid payloads will yield a 500 error. A more meaningful error should be returned.
Fix
FusionAuth shows a notification for getting a free license even after a license has been installed. This notification should disappear after a FusionAuth instance has been licensed.
Fix
Executing a manual system reset in development mode with a valid kickstart file fails. This should work as expected.
Fix
Supplying a malformed license key to Reactor is producing a generic error. A specific error would be more helpful.
Fix
The Daily Active Users report is missing data from the most recent day. The report should include this data.
Fix
After setting an application-level email verification template, the tenant-level template is still being used. The application-level setting should be honored.
Fix
The standard first name field intended for use in user edit forms has an incorrect name in MySQL installations, which is preventing it from showing up in the user edit form
Fix
The webhook event log can return fewer records per page than requested with the Results per page dropdown, even when more results are available. Ensure that the number of results equals the requested number.
Fix
A nondescript error is returned when trying to save system settings via the FusionAuth admin application. It is still possible to update system settings using the API.
Fix
The simple theme editor's right-hand panel did not constrain content properly, allowing content to spill over the bottom border.
Security
Improved security around certain cross-origin requests
Internal
Updated the following dependencies:
- Upgrade
ch.qos.logback:logback-core``1.5.6->1.5.16 - Upgrade
org.primeframework:prime-mvc``4.27.0->4.29.2 - Upgrade
org.graalvm.polyglot:polyglot``22.3.3->24.1.2 - Upgrade
org.graalvm.js:js``22.3.3->24.1.2 - Upgrade
com.inversoft:inversoft-cache``0.6.0->0.6.1 - Upgrade
com.inversoft:inversoft-api-authentication``0.29.0->0.30.0
Internal
Removed duplicated storage of internal messages relating to SCIM group operations
Internal
Added instrumentation to help with the auto-generation of documentation.
21 December 2024
Database Migration
For more information about database migrations, see Database Migrations.
Breaking Change
Increased the length of the refresh token from 54 to 64 characters. If you hardcode a specific length, you must account for this change.
Known Issue
Known Issues
You can't save the System Settings in the admin UI.
Resolved in version 1.56.0 via
#2970
.
New Feature
Allow for the sending of usage stats. Enabling usage stats allow FusionAuth to better understand how our users use our product. Usage data does not contain configuration, user data or any information that can be used to identity a company or individual. This information will help us know where we need to invest in new features and enhancements.
If you are using FusionAuth Cloud, this feature will be enabled by default and cannot be disabled.
Enhancement
The rate limit error message was added to the default theme messages to make it more obvious that it is customizable. The [RateLimitedException] message key was previously supported, but not easily discoverable.
Thanks to @juansedo !
Enhancement
Add an additional refresh token revocation policy to revoke a one-time use token on reuse. This policy helps protect against token theft by revoking the token if it were to be stolen and reused.
Enhancement
FusionAuth can now accept encrypted SAML assertions when acting as a SAML service provider. Support for encrypted assertions when FusionAuth is the SAML identity provider was added in version 1.47.0.
Enhancement
API keys can now be optionally set to expire at a given date/time. An expired key will not be deleted but will cause a 401 response to be returned when used. The expiration value can be edited to allow the expiration to be extended.
Enhancement
Additional parameters are now accepted on the hosted backend /app/login and /app/registration endpoints. This means you can pass things like login_hint, idp_hint, and analytics parameters that will be available on the respective OAuth hosted pages.
Enhancement
The First-time Setup wizard was improved with more descriptive and consistent text around using a Community plan license.
Enhancement
In the new Webhook Event Log there were numerous small UX and copy improvements.
Enhancement
Improved handling of a SAML RelayState in an IdP-initiated login. Previously, FusionAuth would only look for a valid ACS URL in the RelayState. Now, if the ACS URL can be resolved via other means, the RelayState value will be preserved and passed as a parameter in the final call to the ACS URL.
Enhancement
Added support for providing connect and read timeout values when making a fetch call from a lambda.
Enhancement
You can now configure a grace period for single-use refresh tokens, during which time the previous token will remain active. This is required for various use cases, including when clustered OAuth clients employ eventual consistency when synchronizing a refresh token, and some nodes of a client can find themselves with an out-of-date refresh token.
Fix
The confirmation page shown when users are completing verification and other workflows shows a FreeMarker error when some cookies are unavailable. This could happen when cookies are deleted by a user, removed by a proxy, or when running in an iframe.
Fix
When an OAuth workflow ends in redirecting with an error to a redirect_uri that contains query parameters, the resulting URL is being built incorrectly.
Fix
The SCIM ResourceTypes endpoint is returning resource type URLs with incorrect paths. The endpoint is returning a path prefix of /api/scim/v2/ when it should be /api/scim/resource/v2/.
Thanks to @runely !
Fix
The OAuth scopes consent form has text that cannot be localized. Hosted pages should be fully localizable for users.
Fix
When viewing user data in the Manage user view, a boolean value is always shown as -, regardless of its actual value.
Thanks to @rod-martens-alida !
Fix
The JWT populate lambda is not executed when a user is logged in using the login API, but only when that user does not have a registration for the application named in the API call. This could lead to inconsistent behavior between a login using the hosted OAuth pages and a login using the login API.
Fix
The PHP client library is not handling libcurl errors gracefully, making it difficult to troubleshoot integration problems when using this library. See the client library issue for more details.
Fix
When downloading login records from System -> Login Records , the exported file format contains a place for zip code, however the zip code values are not being populated in the export.
Fix
The POST /api/user/registration call is documented as returning a refreshTokenId, but this value is not being returned on the response.
Thanks to @cezarneaga !
Fix
When editing a user's password in the FusionAuth admin UI after a new hashing scheme is set on the tenant, the password is not re-hashed using the new scheme. The re-hashing occurs as expected on a login or when the user changes their own password.
Security
Correct validation for configured authorized redirect URLs when using wild card support has been enabled.
Security
Add additional validation of an authorizing JWT when using the Issue JWT API (/api/jwt/issue).
Internal
Added tests to verify correct handing of wildcards in URLs in various places in the application. This change does not contain any functional changes.
Internal
Remove unused comments in a few theme templates.
Internal
Update dependencies.
- Upgrade
org.primeframework:prime-mvc``4.22.13->4.27.0
Internal
Better exception handling in extreme edge cases related to licensing of Breached Password Detection.
25 November 2024
Database Migration
For more information about database migrations, see Database Migrations.
Known Issue
Fix
The SCIM Groups API does not properly perform atomic updates to groups and members. This can lead to consistency issues when multiple SCIM update requests are simultaneously processed requiring membership changes.
Security
A vulnerability was discovered in the FusionAuth hosted pages. Under specific application configurations, and with insufficient authorization validation being performed on an access token, a malicious user could bypass required steps in post-authentication workflows, allowing unauthorized access to protected resources.
This vulnerability was introduced in version 1.41.0. It is recommended that you upgrade to version 1.54.0 at your earliest convenience.
25 October 2024
Database Migration
For more information about database migrations, see Database Migrations.
Theme Upgrade
A fix for FusionAuth SSO session management with external identity providers requires a change to Google IdP usage.
Known Issue
Fix
In order to better protect 3rd party logins via SAML v2, OpenID Connect, and other 3rd party identity providers, a CSRF (cross site request forgery) token was added in version 1.47.0. This token was not being used when all identity providers configured for the requested client_id were also configured to use managed domains, and the authorize request also contained the idp_hint request parameter.
In this specific configuration, because the token was not being utilized, the login workflow would fail with the error The request origin could not be verified. Unable to complete this login request.
Fix
When using the hosted login pages, the end user is generally shown a checkbox named Keep me signed in, which indicates whether the user wishes to create an SSO session after logging in.
When using an external identity provider along with an idp_hint or login_hint parameter, a user may be taken directly to the identity provider, bypassing the page with this checkbox. In this case, the user will not have the option of making a choice to establish or not establish an SSO session.
This behavior has been improved in order to provide additional control on how the SSO session should be created.
FusionAuth will now use the following order of operations in this non-interactive workflow to decide if the SSO session should be created:
- The user's previous selection, if available. This past choice will have been stored in an HTTP only cookie.
- The optionally supplied
rememberDevicequery parameter.
In the event that the user has never seen the login page, the value of the rememberDevice query parameter will be the deciding factor. A value of true indicates that an SSO session should be created and a value of false indicates that an SSO session should not be created. If this parameter is omitted, the default behavior will be to create the SSO session.
For more information on using the idp_hint and login_hint parameters, see the Identity Providers Overview documentation.
Fix
When using the login validation lambda with a 3rd party identity provider such as OpenID Connect, when the validation lambda causes the login to fail, the end user will not see the specific error returned by the lambda. Instead the user will see the following generic error (unless this message has been modified in a theme):
A validation error occurred during the login attempt. An event log was created for the administrator to review.
The reason for this generic message is that in most cases if FusionAuth cannot complete a login request to a 3rd party we do not want to show the end user the technical reason. When a login validation lambda is the cause of the login failure, we do intend to the show the end user a more specific message. This issue has been corrected and if the login validation lambda was the cause of the failure, the event log is created when the identity provider has enabled debug.
12 September 2024
Known Issue
Fix
The kickstart.success event may not fire correctly after Kickstart completes due to a timing issue when creating the webhook in your Kickstart definition.
Fix
Navigating to the System -> About page in the FusionAuth admin UI may fail to render if you start up without an internet connection.
Fix
Navigating to the System -> Webhook Log in the FusionAuth admin UI may display a general error and fail to return search results if there are any events of type user.login.failed displayed.
You may work around this issue by selecting a specific event type, or narrowing the scope of the results by using any of the additional search criteria found in the Advanced search controls.
Security
Improvements to better defend against XSS (Cross-Site Scripting) attacks.
6 September 2024
Known Issue
Fix
A user may fail to enroll a new Passkey (WebAuthn credential) used for reauthentication during a login workflow. Previously configured Passkeys should continue to work as expected. This bug was introduced in version 1.53.0.
5 September 2024
Database Migration
For more information about database migrations, see Database Migrations.
Breaking Change
This release ends support for the Docker image for the linux/arm/v7 architecture.
This deprecation was announced in version 1.52.0, and while we had planned to continue publishing this build for the next few releases, Java 21 is not being built for this architecture which means we can no longer support it. Please see thread in Adoptium support or the Adoptium release status for additional details.
Known Issue
Known Issue
A user may fail to enroll a new Passkey (WebAuthn credential) used for reauthentication during a login workflow. Previously configured Passkeys should continue to work as expected.
Resolved in version 1.53.1 via
#2861
.
Known Issue
FusionAuth's hosted login pages no longer create an SSO session when signing in using an external IdP.
Known Issue
Currently, FusionAuth's Webhook Event Log does not set a retention policy by default and may grow too large in volume which can result in an impact to performance when searching Webhook Event Logs. See issue for workaround.
New Feature
Introduced the Webhook Event Log, which contains a record of each triggered event and the corresponding attempts to deliver the event to each configured webhook. This log will be useful for monitoring events that have succeeded or failed to be received by your configured webhooks. The attempt log will provide you with timing, the status code returned by your webhook, and other metadata.
The longer term goal of this feature will be to allow events to be retried when one or more webhooks failed to receive the event, or for some reason was unable to process the event. This is the first step towards that goal. You will find this new feature in the Admin UI under System -> Webhook Log .
For more information, see the API reference.
New Feature
Introduced the Login Validation Lambda, which can prevent login based on information in a user record, an application registration, and more. This allows the notion of a valid login to be extended beyond the standard items such as credential checks and MFA.
Enhancement
Introduced dropdown menus for actions in Admin UI tables. The number of buttons on some pages grew to the point that it was becoming difficult to differentiate between the buttons, and was also visually cluttering up the view. We hope you like it!
Fix
When using the start and end times in the Advanced search criteria in the Admin UI for the Audit Log, Event Log, and Login Records the selected values were incorrectly adjusted. This bug was introduced in version 1.52.0.
Thanks to @runely !
Fix
An SSO TTL of 0 seconds or a very small number may make it impossible to complete login using hosted login pages. To work around this issue in prior versions, increase the TTL to something larger than 0, ideally at least 30 seconds.
The potential for this issue has existed for some time, but some changes made in version 1.50.0 made it more likely for this to occur.
Internal
Updated from Java 17 to Java 21 LTS.
Internal
Improved database connection resiliency under heavy load by separating interactive and non-interactive tasks into separate connection pools. This change should improve performance and scalability.
If you self-host, you may see an increase in the number of open connections to the relational database from FusionAuth. Previously each FusionAuth node would open 10 connections. Starting in this release, this number will increase to a minimum of 21, and can scale to a maximum of 50. These numbers are subject to change in future releases.
To calculate the total number of connections to the relational database, multiple these numbers by the number of nodes in your cluster. If you have a 3 node FusionAuth cluster, the minimum number of connections open to your database will be 63 with a maximum of 150.
Internal
Updated the following dependencies:
- Upgrade
js/handlebars.js``4.7.6->4.7.8
15 August 2024
Fix
The SCIM Patch operation now properly handles removing multiple array elements, such as group memberships, in a single request.
Internal
Updated the following dependencies:
- Upgrade
io.fusionauth:fusionauth-scim``2.2.1->2.2.2
8 August 2024
Breaking Change
User Registrations API
When using the User Registrations API, the data field for the FusionAuth application with Id 3c219e58-ed0e-4b18-ad48-f4f92793ae32 may now contain a preferences object. This object is reserved and should not be modified.
Breaking Change
As part of our move to the GraalVM Java distribution, we plan to discontinue publishing Docker images for the following architectures which GraalVM does not support:
linux/arm/v7linux/ppc64lelinux/s390x
We do not believe these architectures are actively being used.
We plan to stop publishing Docker images for these architectures at the end of 2024. If you are actively using any of these architectures, please let us know.
Breaking Change
Air-gapped instances of FusionAuth must complete the following steps to preserve access to premium features:
- Navigate to the Plan page in your FusionAuth account
- Pick up your license key and newly generated license text
- Navigate to
Reactorin your Admin UI on your FusionAuth instance - Decommission your license
- Reactivate FusionAuth Reactor using the license key and text
For more information about activating and deactivating your license, see the Licensing documentation.
Deprecated
Group Member API
The user field on the Group Member API responses is being deprecated.
This field was not documented, and has never been populated on the API response. However, because this field was generated and part of the domain in FusionAuth client libraries, we are providing a deprecation notice in case this may affect your integration. Client library users should remove references at your earliest convenience.
Removal of this field is targeted for the end of 2024.
Theme Upgrade
A new date picker element with enhanced styling and mobile support is now available.
Known Issue
In the Admin UI, Advanced search criteria start and end times for the Audit Log, Event Log and Login Records incorrectly adjusted the selected value.
New Feature
Play
Introduced the free Community license, which adds WebAuthn (Passkeys) to the Community plan. All Community license users will now find a license key on their FusionAuth account plan page.
Enhancement
Added the new health check endpoint (/api/health) that was added in 1.51.1 to the client libraries.
Fix
Clicking the toggle checkbox element in the admin UI quickly caused the checkbox state to be inverted. This can be easily fixed by refreshing the page. You should now be able to click as fast as you want!
Fix
Attempting to sort API keys by key value in the admin UI by clicking the key value header resulted in an error.
Fix
Attempting to create a tenant-scoped API key with an invalid tenantId failed with a 500 status code. This error has been corrected, and an appropriate validation error is now returned.
Fix
The date picker used for birthdates and custom date fields was not styled correctly based upon the selected theme. The date picker has been changed to the browser-default date picker, which should work much better on mobile devices. This picker style will now be used in themed hosted login pages, as well as the admin UI for searching a date range or selecting a birthdate. This change should not affect any existing advanced theme that may still use the older style date picker. See theme upgrade notes for details on updating an existing advanced theme to use this new option.
Fix
Adding custom message keys to theme messages using the Admin UI failed to persist these changed messages. The UI for editing messages in the simple theme editor has also been improved to make it easier to understand which messages have been modified.
Fix
When the Browser preview button was used to open a new tab for simple themes in the Admin UI, the page would render without any applied CSS when using the Firefox browser. Sorry Firefox users, we ask for your forgiveness.
Fix
The default orderBy parameter value for the Group Member Search API did not provide a consistent ordering of results because the default sort was on insertInstant ASC which may not always be unique. This API is used by the SCIM Groups Resource API which then can cause inconsistent results for the SCIM client. The default orderBy is now set to insertInstant ASC, userId ASC, groupId ASC to ensure a consistent result between API calls.
Fix
When using the simple theme editor in the admin UI, the color picker did not always render next to the input field. The color picker will now always correctly render adjacent to the input field you select.
Fix
Newlines and tabs were not rendered when viewing audit entries in the view dialog from the admin UI. If you use new lines or tabs in your audit log messages, you may now enjoy viewing them in all their intended glory!
Fix
It sometimes required two Submit button clicks to exit interactive maintenance mode to upgrade your database schema. We are sorry if you had to click the Submit button twice.
Fix
For users in FusionAuth Cloud, attempting to save a Simple theme may result in an error.
Fix
Query parameter values containing an equals sign (=) were not parsed correctly. Typically, query parameter values URL encode equals signs as %3D, but since there are legal uses of the un-encoded character, we have added support for (=).
Security
When detecting impossible travel or similarly suspicious login events, it is possible that not all device trust cookies were correctly revoked. These are now automatically revoked.
Internal
Removed an unused template from the self-service login workflow. In practice this page was never rendered and was not included in the theme configuration. This change should not impact anyone using themes.
Internal
Updated the following dependencies:
- Upgrade
org.freemarker:freemarker``2.3.32->2.3.33 - Upgrade
org.primeframework:prime-mvc``4.22.7->4.22.12 - Upgrade
org.apache.kafka:kafka-clients``3.6.1->3.7.1 - Upgrade
com.fasterxml.jackson.*``2.15.4->2.17.2 - Upgrade base docker image
ubuntu:jammy (22.04)->ubuntu:noble (24.04)
3 July 2024
Security
Fixed a XSS (Cross-Site Scripting) vulnerability in the FusionAuth admin UI.
12 June 2024
New Feature
Introduced the Health API, /api/health. Previously, the /api/status endpoint was the best option for performing health checks. The Status API may not be ideal for all use cases because it returns a JSON body and the status code is used to indicate the status of various health checks that may not be valuable by a load balancer to indicate if requests should be routed to this node. This new endpoint provides a binary indication of the healthiness or unhealthiness of a FusionAuth instance by only returning a 200 or 500 status code w/out a JSON response. This new API also runs fewer health checks and may perform better than the Status API.
Fix
An HTTP request sent to FusionAuth with non-ASCII characters in request header values caused the request to be rejected and caused the connection to be closed without a response. Generally speaking values outside of the ASCII character set are not allowed, but in practice they may be used, and so these values are now treated as opaque and ignored by the HTTP request parser.
Fix
Fixed a typo on the Tenant edit page in the description of the user.password.reset.send event.
Fix
The SCIM API did not properly handle reading, creating, and updating groups with more than one hundred memberships. Responses containing groups with more than one hundred memberships only returned the first one hundred. Create and update operations only created or updated one hundred, deleting the remainder. This defect also caused the FusionAuth event for group.member.update and group.member.update.complete to contain the same truncated list of members.
Internal
Updated the following dependencies:
- Upgrade
io.fusionauth:java-http``0.3.4to0.3.5
28 May 2024
Database Migration
For more information about database migrations, see Database Migrations.
New Feature
Introduced WYSIWYG theme editing with Simple Themes, along with a visual editor. This first version of visual theme editing allows you to change the basic styling of FusionAuth hosted pages, including logos and background images, colors, fonts, and more.
Fix
In version 1.45.0 we added a hosted OAuth backend capability, allowing a developer to write a front end-only application, but still take advantage of an authorization code grant workflow by leveraging the backend provided by FusionAuth. Multi-segment domain suffixes (e.g. .co.uk) are not handled correctly by this hosted backend when setting the domain on cookies. Cookie domains are now set properly.
Fix
A SAML login request that is missing a Content-Type header yields a cryptic error message. A more meaningful error message is now provided. Additionally, sending a binding parameter would lead to an error message, when this parameter is not one we process. We now ignore this parameter if it is provided.
Fix
A SMS two-factor messages template can be set at the Tenant level and should be overridable at the Application level. When a template is set at the Application level it is not being honored and the Tenant-level template is always used. Application overrides of SMS two-factor templates are now used correctly.
Security
Improved SAMLv2 callback handing with malformed requests.
Internal
Updated the following dependencies:
- Upgrade
org.graalvm.sdk:*:22.3.3toorg.graalvm.polyglot:*:23.1.2 - Upgrade
org.graalvm.js:js``22.3.3to23.0.3 - Upgrade
io.fusionauth:java-http``0.3.2to0.3.4
25 April 2024
Database Migration
For more information about database migrations, see Database Migrations.
Fix
Fixes usability items related to the First Time Setup wizard (introduced in 1.50.0):
- Items related to the first time setup wizard were shown after upgrades, when the intent was to only show them for new installations. These are now only being shown for unconfigured FusionAuth instances.
- The First Time Setup summary page displayed sample configuration for various quickstarts. The configuration for the React quickstart corresponded to a previous version of the quickstart and was incompatible with the current version. The React quickstart configuration is now formatted for the current quickstart version.
24 April 2024
Database Migration
For more information about database migrations, see Database Migrations.
Theme Upgrade
The new consent prompt themed page requires the scopeConsentField macro and resolveScopeMessaging function to be defined in the Helpers template in order to render scope consent form fields. These must be added to a custom theme in order for it to function.
Breaking Change
This release makes significant changes to the default behavior of new Applications with regard to scopes in OAuth workflows.
The database migration will update existing Applications to behave in a backwards compatible manner.
See the OAuth Scopes documentation for more information, in particular the Relationship, Unknown scope policy, and Scope handling policy configurations.
Breaking Change
If you are using an iframe to access the FusionAuth hosted login pages, the src must use the same domain as the FusionAuth pages.
FusionAuth uses cookies to manage user state with the SameSite attribute set to Lax or Strict. Browsers will block Set-Cookie headers on cross-domain requests.
This release introduces a new redirect into the OAuth flows to /oauth2/consent as part of the OAuth Scopes
feature. This redirect will occur during each browser-based interactive OAuth workflow. Prior to this version it was possible to complete an OAuth code grant
flow without cookies being set as long as there were no additional redirects to FusionAuth before the final redirect to the configured
redirect_url . As a result it did not matter if the Set-Cookie headers were blocked. The redirect with the code would still work.
However, in this version the browser will not be able to send the FusionAuth cookies required to maintain user state along with the redirect to
/oauth2/consent and the login flow will fail. The user will be redirected back to /oauth2/authorize and will be unable to log in.
Breaking Change
The /oauth2/userinfo endpoint now requires the aud claim to be present on the provided access token, allowing for tighter compliance with the OIDC spec. See the UserInfo endpoint for more detail.
If you are not using OAuth, and your JWT does not contain the aud claim, consider using the JWT validate API instead.
Deprecated
JWT authentication for the /api/user API
This functionality will be removed in a future release.
If you are using this API with JWT authentication, you will need to modify your integration to use the /oauth2/userinfo endpoint if you have obtained your JWT using an OAuth2 grant, or authenticate the request to the User API using an API key.
Removal of this authentication type is targeted for the end of 2024.
Known Issue
An SSO TTL of 0 seconds or a very small number may make it impossible to complete login using hosted login pages. To work around this issue, increase the TTL to something larger than 0, ideally at least 30 seconds.
Known Issue
There was the potential for an error in the setup wizard if the timezone was not set on the machine running the browser. This has been corrected.
Resolved in version 1.62.1 via
#3290
.
New Feature
Custom OAuth scopes are now supported for applications. Custom OAuth scopes come along with a number of related features, including support for third-party applications, themeable user consent, and much more.
See the API docs and OAuth Scopes documentation for more detail.
Thanks to @badaz !
New Feature
Applications may now be designated as third-party applications. In addition to the prompting for authorization that comes with the Custom OAuth Scopes feature (see above), limitations are being added to how third-party applications may interact with FusionAuth.
New Feature
Applications can now be configured to prompt users to grant consent to requested OAuth scopes using the /oauth2/consent themed page. See the OAuth Scopes for more detail.
New Feature
Introduced UserInfo Populate Lambda, which can customize the UserInfo response for an application.
Thanks to @themobi !
New Feature
Added a new, optional First Time Setup wizard, which guides a developer through the basic setup needed to integrate their first application. After installing FusionAuth, you'll be able to access this from the main admin dashboard, as well as from the top of the left hand navigation.
Enhancement
Added a maximum password length of 256 characters in the tenant password policy. This decision was made to strike a balance between allowing very secure passwords and maintaining acceptable performance when using a large number of hash iterations.
Enhancement
Added locale and timezone information to the Oauth UserInfo endpoint.
Thanks to @soullivaneuh !
Enhancement
Applications now offer an Unknown Scope Policy. This can be used to enhance security by rejected or removing unrecognized scopes during an OAuth workflow. See the application Scopes tab for more detail.
Enhancement
The Refresh Token Grant request now supports requesting a subset of the original scopes. Previously, the request responded with an invalid_scope OAuth error.
Enhancement
Applications now have a new Scope Handling Policy. The Strict option provides behaviors that are more compliant with the OIDC specification, while the Compatibility option provides backwards-compatible behavior. Specifically, Strict mode limits information in access tokens and populates Id tokens and UserInfo responses based on the requested OAuth scopes. This option also restricts the UserInfo endpoint to accepting only access tokens containing the openid scope.
New applications will default to the Strict option. If your integration requires the Compatibility policy because you need backwards compatible behavior, please specify that option when creating the application.
For more information, see the Scope handling policy documentation.
Thanks to @awoodobvio !
Enhancement
Added support for optional expansion of the application.roles and application.scopes properties on the Application Search API.
This change is backwards compatible, but you may optionally request the Search API omit these properties on the response which may improve performance. See the Application Search API for additional details on using the expand request parameter, and the expandable response value.
Enhancement
The /oauth2/device/user-code endpoint now returns the scope parameter value that should be used in the interactive portion of the Device Code Grant workflow. See Device User Code for more detail.
Fix
The bcrypt algorithm now limits passwords to 50 characters. This restriction is due to limitations in the bcrypt algorithm. This limit will be enforced even when the tenant policy allows for a maximum password length greater than 50.
Fix
There are several scenarios where implicit email verification can occur. They are, during registration verification, password change, passwordless authentication, and MFA code validation. In these cases, a configured email verification email was not being sent, and the email verification event was not being generated. The email and event will both be triggered during implicit verification now.
Thanks to @ashutoshningot and @mou !
Fix
When configuring MFA for an application, the Trust policy selector was not shown when MFA is required for the application, but only shown when MFA enabled for optional use. The selector is now shown when the On login policy is set to either Enabled or Required.
Fix
When using FusionAuth behind a proxy, a missing X-Forwarded-Proto header could incorrectly cause a warning of a missing X-Forwarded-Port header. These warnings are now reported accurately. Additionally, FusionAuth will now be smarter about determining the forwarded port, taking it from one of multiple sources including X-Forwarded-Host, X-Forwarded-Port, or inferring it from X-Forwarded-Proto. This should make FusionAuth work with more proxies out of the box without additional configuration.
Fix
When authentication with an identity provider fails due to misconfiguration, and a user falls back to logging in with a username and password, the authenticationType reported by FusionAuth is for the original identity provider despite the user having logged in with a username and password. FusionAuth now correctly reports the authentication type as PASSWORD.
Thanks to @charlesericjs !
Internal
Updated the following dependencies:
- Upgrade
ch.qos.logback:logback-*``1.4.14to1.5.6 - Upgrade
com.fasterxml.jackson.*``2.15.3to2.15.4 - Upgrade
io.fusionauth:java-http``0.2.10to0.3.2 - Upgrade
org.mybatis:mybatis``3.5.15to3.5.16 - Upgrade
org.primeframework:prime-mvc``4.22.0to4.22.7 - Upgrade
org.postgresql:postgresql``42.7.2to42.7.3 - Upgrade
org.slf4j:slf4j-api``2.0.7to2.0.13
20 March 2024
New Feature
The search index default refresh interval may now be configured. In general this should not be modified, but the configuration option has been added and will default to 1s. The new configuration is named fusionauth-app.search.default-refresh-interval. For more information, see the Configuration reference.
Enhancement
Added email and registration verification Ids to the User and Registration API responses when available for consistency and to better enable out of band management of these verification workflows.
Fix
When configured to use an email verification strategy of Form Field without setting the unverified behavior to Gated the verification strategy was always functionally using Clickable Link which means the user would receive an email with a clickable URL instead of a short code.
With this fix, you may now use an unverified behavior of Allow with a verification strategy of Form Field. When you configure FusionAuth this way, it is assumed that you will be handling the verification process in your own application.
Fix
When using the Bulk User Import API /api/user/import the search index refresh interval is modified to improve performance. Specifically the index refresh_interval is set equal to -1. When this API is called in parallel, it is possible that this index setting is not reset and will stay configured as -1. The symptom of this error is that changes to the index are not reflected by the Search API and the search results may no longer be accurate.
Fix
When Advanced Threat Detection is enabled, an IP location database will be downloaded and used for IP address resolution. For these licensed customers, it is possible that a corrupted IP location database was downloaded and not correctly discarded and as a result the IP address location data may not be available.
You may have been impacted if you were using version 1.47.0 or later, between February 1st, 2024 and February 23rd, 2024. The observable symptom would be that your license status for the Advanced Threat Detection will show Pending instead of Active.
This condition has already been corrected for FusionAuth Cloud. If you are self-hosting FusionAuth, upgrading will correct this condition. If you have a support contract and believe you are currently in this state and are not able to upgrade, please reach out to support for assistance.
6 March 2024
Database Migration
For more information about database migrations, see Database Migrations.
Enhancement
In prior versions of FusionAuth, if a new themed page was added, until you upgraded your theme by adding this new page, the end user may be shown a page indicate the page was missing. This was shown because it was assumed that a new page would only be shown for a new feature that had not been enabled, and this page would only ever been seen during development. In this release added a new page that may be shown without any additional features being enabled. For this reason, we have removed this place holder page, and we will always fall back to the default theme when a page is missing. You will still want to upgrade your theme as part of your upgrade process, but this change will ensure that we will not break any new or existing workflows when a new page is added.
Enhancement
Link checkers are great. They aim to protect end users from malicious links and phishing attacks. However, they wreak havoc and pain on identity providers using email based workflows to complete passwordless login, or email verification. And FusionAuth is one of those identity providers!
FusionAuth has employed various tactics over the years to stay ahead of the techniques used by these 3rd party tools. Their techniques continue to evolve making it difficult or impossible to know the difference between a link checker and a real human interacting with the link.
A new confirmation page has been added that is intended to protect the user, and make our email workflows immune to link checkers.
For example, when a user initiates a request such as passwordless login, and then completes the request in the same browser, the user will not observe any change. If the user completes the request on a different browser, or completes a request they did not initiate - such as clicking on an email verification link sent when a use is provisioned by an administrator, the user will be prompted to confirm they wish to complete the request.
If you are using a custom theme, you will want to upgrade your theme to include this new page. Until you complete this upgrade, the default theme will be used for this new page. In the FusionAuth admin UI, the theme page will be named Confirmation required.
Enhancement
Ensured the Login API never fails validation due to a timing issue with an Application cache. This rarely affects runtime, but this can be useful for testing where you may create an application and immediately perform a login.
Enhancement
Added a trusted proxy configuration to the System Configuration. This new configuration allows you to define one or more trusted upstream proxies using an IP address, or range of addresses using a CIDR notation.
A client IP address will be captured in a login record, sent to webhooks, and used to provide access when IP ACLs are configured. To correctly resolve the client IP address, we often will need to use the X-Forwarded-For request header.
This header is modified when it passes through a proxy. In order to trust the contents of this header and resolve the client IP address, FusionAuth must know if it can trust all proxies implicitly, or to only trust those that are explicitly configured as trusted. The change is to optionally configure FusionAuth to no longer trust any upstream proxy that is not explicitly configured as trusted.
This new configuration can be found in the FusionAuth admin UI by navigating to Settings > System > Networking, or on the System Configuration API.
Fix
Previously, an incorrectly formatted SAML request could cause excessive CPU load.
Fix
The default permissions in AWS RDS PostgreSQL version 15.2 caused the initial configuration of FusionAuth to fail to create the tables required to complete the initial configuration. The required permissions are now being explicitly granted, and the errors reported back to the user have been improved.
Fix
If a user starts a Forgot Password flow, and clicks on a change password link in an email after the link has expired, the redirect back to the original Forgot Password form will not include the locale parameter. This fix ensures that a locale parameter, when present in the change password link, is preserved through this workflow and allows for localization to remain consistent.
Fix
When setting up a Facebook IdP, an option was provided in the admin UI to select Use vendor JavaScript as a Login method. This option is not applicable and has been removed.
Fix
Fixed the SCIM filter when filtering on userName eq {username} to always return a single result.
Fix
The LinkedIn APIs have changed, and the LinkedIn IdP no longer worked for new LinkedIn applications. This update allows FusionAuth to work with new and legacy LinkedIn applications.
Fix
The FusionAuth TypeScript client library was incorrectly encoding arrays values into query parameters. This bug was preventing a few specific search queries from working correctly.
Fix
When using MySQL, the default Admin user form was missing the First name field. The field could be added to the form, but was missing in the default version.
Fix
When an invalid Tenant Id was provided on the .well-known/openid-configuration the default configuration was returned. This has been updated to return a 404 status code.
Fix
When creating a User with a group membership with a specified member Id that was already in use, the requested completed w/out a validation error and the membership was ignored. The API now correctly validates this condition and will return a 400 and a JSON response.
Fix
When retrieving all refresh tokens for a user, the response may contain the user's SSO token. The SSO token can be identified because it does not contain an applicationId and it may not be refreshed. Validation has been improved when using the Refresh Grant, or the Refresh API to ensure FusionAuth correctly fails indicating the token is invalid and may not be refreshed.
Fix
A regression was introduced in version 1.47.0 to the Change Password themed page. The issue is that the passwordValidationRules variable may be null on the first render. If you had been referencing this field in your template, the render may fail.
Fix
The Identity Provider Link API states that a token parameter can be accepted during a create. When provided, the token was not being persisted on the link.
Fix
Fixed the "Getting Started" link found in the index page in the default theme.
Fix
When viewing a User's Consents in the FusionAuth admin UI, if one or more of the consents have been granted by another user that is not a member of their family, an error is shown in the Given by column.
Fix
When you have configured the JWT signing key with the ES512 algorithm, the generated signature may be intermittently invalid. This means that JWTs may seemingly fail to validate randomly and you may think you are crazy. You are not crazy. If you are using this signing algorithm, it is recommended you use a different algorithm until you are able to upgrade.
Fix
SCIM PATCH requests may fail to parse if an op path value contains a named schema containing a . (dot). This parsing error has been corrected.
For example: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department
Fix
When an SCIM create or update request contains schemas for which no properties exist, subsequent PATCH requests to those schema namespaces may fail.
For example, if the initial request contains a schema urn:ietf:params:scim:schemas:extension:enterprise:2.0:User without any properties, the default lambda function used to map this request to FusionAuth was not persisting this schema namespace. Then a subsequent PATCH request to add a member to that namespace such as urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department would fail.
The default SCIM request converter (Lambda function) has been updated to correct this behavior.
Security
Disabled additional JNDI settings in the LDAP connector. This update is proactive, there are no known exploits.
Security
Added additional protection against cross-site attacks when FusionAuth is acting as a SAML IdP.
Security
Audit log entries added by the FusionAuth admin application may contain sensitive information. Sensitive fields will now be masked when written to the audit log. This does not affect the Audit Log API, only the use of this API by the FusionAuth admin app.
Security
Added additional protection against cross-site attacks when using the self-service account pages.
Internal
The Nashorn JavaScript engine has been removed from FusionAuth. All Lambda functions will now use the GraalJS engine which has been available since version 1.35.0. No action is required, but please note that if you had any Lambda functions still configured to use the Nashorn engine they will be migrated to use GraalJS.
Internal
Updated the following dependencies:
- Upgrade
org.postgresql:postgresqlfrom42.6.0->42.7.2 - Upgrade
com.fasterxml.jackson.*from2.15.2->2.15.3 - Upgrade
org.mybatis:mybatisfrom3.5.13->3.5.15
Internal
During a reindex operation, log the progress based upon a fixed time interval instead of every 250k records. This ensures the output is predictable regardless of the reindex performance.
6 December 2023
Fix
Updated the refresh token TTL when using the sliding window with a maximum lifetime JWT Expiration Policy. The symptom of this bug is that a refresh token will expire before the maximum configured lifetime.
21 November 2023
Fix
When paging beyond 10,000 in the FusionAuth admin UI for Users or Entities, the bottom set of pagination controls may not work. If you encounter an error when clicking on the pagination controls, use the top set of controls instead. This bug is specific to the new pagination introduced in version 1.48.0.
Fix
In some cases when using with FusionAuth-hosted pages in an non-secure context, such as accessing FusionAuth on localhost, the PublicKeyCredential JavaScript API will not be available. This may cause an error on your JavaScript console PublicKeyCredential is not defined. This error kept the form on the page from correctly submitting.
Fix
In version 1.48.0, a change was made to reject a link request from an OpenID Connect IdP when the email_verified claim is supplied with a value of false. An assumption was made that the email and email_verified claims would both be present in the Userinfo response or the id_token. Some providers may split these claims, so this assumption has been removed.
Security
Corrected the validation of the post_logout_redirect_uri parameter on the OAuth2 Logout request for relative URIs intended for use for FusionAuth applications.
Internal
Improved JWT validation for internal security schemes by failing faster on invalid tokens.
29 October 2023
Database Migration
For more information about database migrations, see Database Migrations.
Known Issue
A bug was identified in a change made in this version that may affect performance for those with > 1M users.
Resolved in version 1.48.1 via
#2535
.
Breaking Change
We are officially announcing the end of life for the Nashorn JavaScript engine used by FusionAuth Lambda functions. All new functions have defaulted to the GraalJS since version 1.35.0. The engine is not being removed in the release, but this is an official notice that we plan to remove this engine in early 2024. Please review your lambda functions and ensure the engineType is set to GraalJS.
Breaking Change
We are officially announcing the end of life for the fusionauth-search package. This is currently available in a .deb, .rpm and .zip bundle for various platforms. This package is still available, but the plan is to stop building this at the end of 2023. Please make plans to discontinue use of the fusionauth-search package if you are currently using it.
Breaking Change
When the OpenID Connect or External JWT Identity Provider is configured to Link by Email and the IdP returns a claim named email_verified and the value is false, the link request will be rejected. This change is intended to reduce the risk of linking on an un-verified email address.
Enhancement
Enhanced the User and Entity Search APIs to paginate beyond 10,000 results. The Search API response will now include a nextResults value that can be used to ask for the next set of search results which enables the API to paginate through the entire available result set.
See the Entity Search APIs and User Search APIs for API details.
Enhancement
The Webhook test action in the FusionAuth admin UI now returns additional information if the webhook returns a non-200 status code. This should make it simpler to debug your webhook integration. Prior to this change, the response would only indicate if the response was successful or not.
Enhancement
The Webhook test action in the UI, now preserves changes to the example request body. Changes will now be preserved across send requests for the browser session. This means a test can be run repeatedly without having to perform the same edits to the default event request body.
Enhancement
Added support for specifying webhook SSL certificates from Key Master. Prior to this enhancement, if you needed to specify an SSL certificate, it had to be added to the webhook in PEM format. You may now store this certificate in Key Master and then use this same certificate between webhooks.
This change is backwards compatible, but the ability to manually specify X.509 certificates in PEM format on the webhook configuration has been deprecated and may be removed in the future. See the Webhook API sslCertificateKeyId field for additional details.
Enhancement
Modal dialogs in the FusionAuth admin UI can now be closed by using the escape key or by clicking outside of the modal.
Enhancement
Added support for signing webhook events with a SHA-256 hash function. This feature will allow consumers of FusionAuth events to verify the message body has not been modified. The signature is contained in a JWT and will be sent using an HTTP request header named X-FusionAuth-Signature-JWT. You may use existing JWT verification strategies including consuming the public key from the JWKS endpoint.
See the Signing Webhooks and Webhooks APIs for signing and verification details.
Enhancement
Exposed the id_token returned by the Identity Provider to the Reconcile Lambda function when available. If the id_token is returned by the IdP and the signature can be verified it will be now be passed to the lambda function in the tokens argument. Example: tokens.id_token.
Enhancement
Added the curl command to the FusionAuth Docker image. This allows you to use the curl command for use in health checks or anytime you need to use curl!
Enhancement
Added support for optional expansion of the user.registrations and user.memberships properties on the User Search API.
This change is backwards compatible, but you may optionally request the Search API omit these properties on the response which may improve performance. See the User Search API for additional details on using the expand request parameter, and the expandable response value.
Enhancement
Enhanced the error messaging returned to the end user when using the Test SMTP button in the FusionAuth admin UI. This makes it easier to test your SMTP configuration.
Enhancement
Reduced un-necessary logging when fuzzers send parameter names containing class.
Enhancement
Updating a theme now returns a validation error if you are missing messages. Currently the error response does include the missing message keys. This error response is now enhanced to return the keys and the default values from the default theme. This allows you to optionally parse the response for the missing keys and values.
Enhancement
Exposed the access_token returned by the Identity Provider to the Reconcile Lambda function. The access_token will now be passed to the lambda function in the tokens argument. Example: tokens.access_token.
Enhancement
When the id_token is returned from the IdP and the signature can be verified it will now be used to optionally resolve the uniqueIdClaim in addition to the emailClaim and usernameClaim. This means you can configure the uniqueIdClaim to a claim that is only available in the id_token. Prior to this change, the id_token could only be verified if it was signed using the an HMAC algorithm using the client_secret. With this change, if the IdP publishes public keys using the JWKS endpoint that is resolved from the .well-known/openid-configuration FusionAuth will attempt to validate the signature.
Fix
Enhanced the widget used in multi-value select controls to accept a value when pasting. For example, you may now paste a value from the clipboard directly into the Authorized redirect URLs field. While previously the paste operation worked, the user would have to click the value to confirm. If you clicked off of the field, the value would not be saved.
Fix
Corrected the error message when a user has enabled MFA and a webhook returns a non-200 status code for the user.login.success event. The message will now correctly indicate the webhook has failed instead of the previously incorrect error indicating an invalid token was used.
Fix
When viewing an Email Template in the FusionAuth admin UI, two dialogs open instead of one. This was the result of two event handlers being bound instead of one.
Fix
When using the asynchronous tenant delete, it is possible for the delete job to fail if the system is under heavy load. When this occurs the delete job status may not be correctly updated and you are stuck in a Deleting state. The asynchronous job processor has been enhanced to account for this potential failure condition so the job can be correctly restarted if necessary.
Fix
Corrected a potential race condition that could cause a request to the /.well-known/jwks.json endpoint to exception and return a 500 status code when under heavy load.
Fix
The Lambda metrics introduced in version 1.47.0 may not always correctly increment the failed count when a lambda invocation failed. This affects the lambda.[*].failures and lambda.[{webhookId}].failures metric names.
Fix
When using the PATCH method on the Tenant API, if you previously had any explicit webhooks configured for this tenant, the association between the tenant and the webhook was lost. If you are not using webhooks, or all of your webhooks are configured for All tenants (webhook.global), this bug would not affect you.
Fix
Improved the validation for the Entity API to correctly validate the type.id value. Because this value was not being correctly validated, it means the API caller may receive a 500 status code instead of a 400 with a developer friendly JSON response body to indicate how the input can be corrected.
Fix
A critical bug was identified that caused FusionAuth to incorrectly identify users eligible for deletion based upon the tenant policy to delete users with an unverified email address. Until you have upgraded to version 1.48.0 please disable Delete unverified users if you currently have enabled Email verification, Verify email when changed and Delete unverified users.
Fix
A bug was identified that affected several APIs when using the PATCH method with fields that require custom deserializers in FusionAuth. Affected APIs included Application, Connector, Message Template and Identity Provider. The symptom you will observe is a failed request with a 500 status code.
Fix
When using PostgreSQL, under heavy load, a potential deadlock conditions exists when attempting to write login metrics to the database. MySQL database was not affected by this bug. If you were to encounter this bug you may observe some exceptions in the log related to the LoginQueue.
Fix
Fixed a JavaScript error that was preventing Audit Log searches by user from returning results.
Fix
Resolved an issue where users could not enable two-factor authentication during authentication when they were not registered for the application.
Thanks to @wproffitt-elder !
Fix
When using the Refresh Token API, un-expired SSO sessions may be incorrectly omitted from the API response. The result of this bug is that an active SSO session may not be displayed in the FusionAuth admin UI. This has now been corrected, and the FusionAuth admin UI and the Refresh Token API will correctly return all valid SSO sessions.
Fix
If the search.servers configuration value was not added to the fusionauth.properties configuration file, and you omit the SEARCH_SERVERS environment value, FusionAuth would fail to start. The correct behavior is for FusionAuth to default to http://localhost:9021.
Fix
Resolved a bug in the multipart/form-data parser that may cause elevated CPU usage in some specific cases.
Security
- When an IdP is configured to Link by Email or Link by Username and a user already exists with this email or username respectively, perform additional validation to ensure the user does not already have an existing link to the current Identity Provider. This only affects IdP that allow for one to many tenants to be accessed through a single IdP configuration. In practice this means that the IdP cannot guarantee that an email address is considered globally unique and only assigned to a single user.
Internal
Updated the following dependencies:
- Upgrade
com.google.inject:guice``5.1.0to6.0.0 - Upgrade
com.google.guava:guava``30.1.0to32.1.2 - Upgrade
io.fusionauth:java-http``0.2.0to0.2.9 - Upgrade
org.apache.kafka:kafka-clients``2.8.2to3.6.0 - Upgrade
org.primeframework:prime-mvc``4.11.0to4.17.1 - Upgrade
org.xerial.snappy:snappy-java``1.1.8.1to1.1.10.4
Internal
Upgraded to the latest Java 17 LTS. Upgraded from 17.0.3+7 to 17.0.8+1.
Internal
Updated the logging configuration when using the fusionauth-search distribution (.deb, .rpm, or .zip) to be more consistent with the fusionauth-app logging configuration. If you are using Elasticsearch or OpenSearch in Docker or other off the shelf installation of Elasticsearch or OpenSearch this change will not affect you.
Internal
Updated the FusionAuth static file resolution configuration to further limit class path resolution.
29 October 2023
Database Migration
For more information about database migrations, see Database Migrations.
Fix
A bug was identified in a change made in version 1.48.0 that may affect performance for those with > 1M users.
27 July 2023
Fix
Revert the GC (garbage collection) logging change introduced in version 1.47.0 for compatibility with the FusionAuth Docker image.
Thanks to @pigletto and @patricknwn !
25 July 2023
Fix
Fixed handling of truncated or malformed oauth_context request parameters when using the hosted login pages.
25 July 2023
Database Migration
For more information about database migrations, see Database Migrations.
Breaking Change
This version changes OAuth2 origin validation code. This change is not expected to cause any change in behavior for anyone with configured Authorized Origin URLs. The change is to inspect the port in addition to the schema and host when comparing the request and the Referer or Host header to determine if the request has originated from FusionAuth. One possible edge case that could be affected is if you using localhost in development for both FusionAuth and another application. In this example, it is possible that FusionAuth was not validating the Origin of requests from your application running on localhost correctly. If you encounter this case, you can either remove all Authorized Origin URLs from your configuration, or add the origin of your application so that it can be correctly validated.
Due to the necessary change related to adding a CSRF token when performing a federated login, a manual change may be required to your themed login pages. Please read through these details to understand if you will be affected:
If you are using any 3rd party IdP configurations such as OpenID Connect, SAML v2, Google, Facebook with a custom theme, you will need to make a modification to your template in order for federated login to continue to work correctly.
If you are not using any 3rd party IdP configurations, or you are not using a custom theme, no change will be necessary.
If you will be affected by this change, please review the following details and update to your theme as part of your upgrade process:
- Find the
alternativeLoginsmacro usage inoauth2Authorizeandoauth2Registerand addfederatedCSRFToken=federatedCSRFTokenas the last argument to this macro.
[#-- Updated macro usage. Line breaks added for readability. --]
[@helpers.alternativeLogins clientId=client_id\
identityProviders=identityProviders\
passwordlessEnabled=passwordlessEnabled\
bootstrapWebauthnEnabled=bootstrapWebauthnEnabled\
idpRedirectState=idpRedirectState\
federatedCSRFToken=federatedCSRFToken/]
```
2. Find the macro named `alternativeLogins` in `helpers` and add `federatedCSRFToken=""` as the last argument to this macro.
[#-- Updated macro in helpers. Line breaks added for readability. --]
[#macro alternativeLogins clientId\
identityProviders\
passwordlessEnabled\
bootstrapWebauthnEnabled=false\
idpRedirectState=""\
federatedCSRFToken=""]
```
- Find the element
<div class="login-button-container">in the macro namedalternativeLoginsinhelpersand addid="login-button-container"anddata-federated-csrf="${federatedCSRFToken}"attributes.
[#-- Updated div in alternativeLogins macro. Line breaks added for readability. --]
<div id="login-button-container"
class="login-button-container"
data-federated-csrf="${federatedCSRFToken}">
```
Known Issue
The garbage collection logging change introduced in version `1.47.0` was not compatible with the way the FusionAuth docker image was built. You will need to use version `1.47.1` if you will be using the FusionAuth docker image.
Resolved in version [`1.47.1`](/content/docs/release-notes#version-1-47-1/index.html) via
[#2392](https://github.com/FusionAuth/fusionauth-issues/issues/2392)
.
Known Issue
The `passwordValidationRules` variable may be `null` on the first render of the Change Password themed page. If you had been referencing this field in your template, the render may fail.
Resolved in version [`1.49.1`](/content/docs/release-notes#version-1-49-1/index.html) via
[#2616](https://github.com/FusionAuth/fusionauth-issues/issues/2616)
.
Known Issue
The CSRF token used with federated login is not being applied when all configured IdPs for an application use managed domains and an `/oauth2/authorize` request for the application includes an `idp_hint` parameter.
Resolved in version [`1.53.3`](/content/docs/release-notes#version-1-53-3/index.html) via
[#2764](https://github.com/FusionAuth/fusionauth-issues/issues/2764)
.
New Feature
Added support for SAML v2 assertion encryption when FusionAuth is acting as the SAML v2 IdP. This means FusionAuth is now compatible with a SAML v2 SP that requires encrypted assertions.
Thanks to [@annismckenzie](https://github.com/annismckenzie)
!
[#1741](https://github.com/FusionAuth/fusionauth-issues/issues/1741)
Enhancement
Added `user.preferredLanguages` to the basic self-service registration to allow a user's preferred language to be collected and then utilized to send localized emails without using advanced self-service registration.
Thanks to [@glen-84](https://github.com/glen-84)
and [@geoalexidis](https://github.com/geoalexidis)
!
[#1738](https://github.com/FusionAuth/fusionauth-issues/issues/1738)
Enhancement
Improved handling of cache reload requests under heavy load. This should improve system performance at scale when mass creating or deleting of various items such as applications and keys.
[#2318](https://github.com/FusionAuth/fusionauth-issues/issues/2318)
Enhancement
Added timers and metrics around lambda invocations and the use of HTTP Connect within a lambda function. This should help customers tune and manage lambdas by providing additional insight into the total execution time.
[#2389](https://github.com/FusionAuth/fusionauth-issues/issues/2389)
Enhancement
Added configuration to accept any named parameter as a login hint coming from the SAML v2 SP when FusionAuth is acting as the SAML v2 IdP. Prior to this change, FusionAuth would accept `login_hint` if provided on the request. However, this value can not be configured or optionally disabled.
[#2222](https://github.com/FusionAuth/fusionauth-issues/issues/2222)
Enhancement
Added `identityProviderName` to the IdP Link API response.
[#2337](https://github.com/FusionAuth/fusionauth-issues/issues/2337)
Fix
Ensure a signed AuthN request always has the `Signature` element as the next sibling after the `Issuer` element. This bug may cause some SAML v2 services provides to reject the signature of an AuthN request sent from FusionAuth.
[#2348](https://github.com/FusionAuth/fusionauth-issues/issues/2348)
Fix
Upgraded phone number validation to include the Kosovo country code of `+383` as well as various other country codes.
[#2355](https://github.com/FusionAuth/fusionauth-issues/issues/2355)
Fix
Defend against corporate link "checkers" such as Outlook Safe Links and Google Workspace during the Change Password email workflow. This fix resolves a specific symptom that may occur when a link sent to a user during a change password workflow and the user has multi-factor authentication enabled. The symptom the end user may encounter is that multiple codes may be sent to the user during this workflow. When the two-factor method is email, multiple emails may be received, and when two-factor method is SMS, multiple SMS messages may be received. The cause of this symptom is that the link is being inspected by an intermediate party prior to the user's browser loading the link which functionally means the request is made more than once.
[#2360](https://github.com/FusionAuth/fusionauth-issues/issues/2360)
Fix
Improved locale validation, and restrict the number of preferred languages per user to 20. This should not have any practical impact on users of FusionAuth, but it will better protect FusionAuth from storing erroneous values for the user's preferred languages.
[#2363](https://github.com/FusionAuth/fusionauth-issues/issues/2363)
Fix
Improved username validation. This length limitation was already enforced by the schema, but the error message was not developer friendly. This change will add a proper validation error in the API response.
[#2368](https://github.com/FusionAuth/fusionauth-issues/issues/2368)
Fix
Updated the Tenant view dialog in the admin UI to reflect the changes made to the `/.well-known/openid-configuration` endpoint in version `1.46.0`. This is a cosmetic change only, and does not include any functional fixes.
[#2333](https://github.com/FusionAuth/fusionauth-issues/issues/2333)
Fix
Fixed Tenant select control on Group index page in the admin UI when only a single tenant is configured. This is just a cosmetic fix to how the form was being rendered.
[#2338](https://github.com/FusionAuth/fusionauth-issues/issues/2338)
Fix
Reduced Kafka logging. So noisy.
[#2359](https://github.com/FusionAuth/fusionauth-issues/issues/2359)
Fix
Protected the Kafka event sender from sending events related to it's own failure. This protects us from overloading the Kafka topic.
[#2362](https://github.com/FusionAuth/fusionauth-issues/issues/2362)
Fix
Fixed the `user.registration.update.complete` event to include the updates roles if applicable.
Thanks to [@sjswami](https://github.com/sjswami)
!
[#1898](https://github.com/FusionAuth/fusionauth-issues/issues/1898)
Fix
Improved defense against truncated `oauth_context` request parameters. This parameter is passed around during various OAuth2 workflows to maintain context. This changes allows FusionAuth to fail more gracefully if this is value is intentionally or un-intentionally modified by a 3rd party.
[#2382](https://github.com/FusionAuth/fusionauth-issues/issues/2382)
Fix
Enabled queries of the `username` and `fullName` fields using the `.exact` suffix on these fields which does an exact match.
Thanks to [@patrickvalle](https://github.com/patrickvalle)
!
[#602](https://github.com/FusionAuth/fusionauth-issues/issues/602)
Security
A race condition exists when using a refresh token with a one-time-use policy where the same token value could successfully be used twice to obtain a new access token. In practice this would be very difficult to replicate outside of a scripted example.
Thanks to [@avitsrimer](https://github.com/avitsrimer)
!
[#1840](https://github.com/FusionAuth/fusionauth-issues/issues/1840)
Security
All federated login requests now use a CSRF token. This change will add additional protection when using a federated login to ensure the login is completed from the same browser that started the login workflow. This mitigates an attack vector that can be used in phishing attacks where a victim could be convinced to click on a link that would cause the user to unknowingly complete a login.
[#2238](https://github.com/FusionAuth/fusionauth-issues/issues/2238)
Internal
Added aggregate HTTP request timers and metrics that can be retrieved by the Status API and Prometheus Metrics API.
[#2369](https://github.com/FusionAuth/fusionauth-issues/issues/2369)
Internal
Updated dependencies.
[#2238](https://github.com/FusionAuth/fusionauth-issues/issues/2238) [#2384](https://github.com/FusionAuth/fusionauth-issues/issues/2384)
Internal
Enabled GC (garbage collection) logging. A new log named `fusionauth-app.gc.log` will be found in the log directory.
[#2388](https://github.com/FusionAuth/fusionauth-issues/issues/2388)
Internal
Improve performance and overhead when downloading and storing the IP location database required for resolving location meta-data for logins by IP address.
[#2195](https://github.com/FusionAuth/fusionauth-issues/issues/2195)
_9 July 2023_
Breaking Change
The User and User Registration APIs now restrict `user.preferredLanguages` and `registration.preferredLanguages` to a maximum of `20` values, and each value to a maximum length of `24` characters.
Fix
Corrected an edge case that exists where an `event-log.create` event fails to be sent to a Kafka topic, and this error causes another `event-log.create` event to be triggered.
[#2362](https://github.com/FusionAuth/fusionauth-issues/issues/2362)
Fix
Limited the length of a valid value for `user.preferredLanguages` and `registration.preferredLanguages` to a maximum of `24` characters, and restrict the total number of values to `20` or less.
[#2363](https://github.com/FusionAuth/fusionauth-issues/issues/2363)
Internal
Reduced Kafka logging to make it much less noisy at runtime
[#2359](https://github.com/FusionAuth/fusionauth-issues/issues/2359)
_19 June 2023_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
New Feature
Added the ability to complete Device Grant out of band.
- New API `/oauth2/device/approve`
- New API `/oauth2/device/user-code`
[#2218](https://github.com/FusionAuth/fusionauth-issues/issues/2218)
New Feature
Added a new API to retrieve a pending IdP link: `/api/identity-provider/link/pending`.
[#2218](https://github.com/FusionAuth/fusionauth-issues/issues/2218)
Enhancement
The OAuth2 Introspect endpoint now optionally takes a `client_secret`.
[#1100](https://github.com/FusionAuth/fusionauth-issues/issues/1100)
Enhancement
A token obtained from the Client Credentials Grant may now be used with the OAuth2 Introspect endpoint.
[#1434](https://github.com/FusionAuth/fusionauth-issues/issues/1434)
Enhancement
Added a JWT Expiration Policy to configure a sliding window with a maximum lifetime.
[#1729](https://github.com/FusionAuth/fusionauth-issues/issues/1729)
Enhancement
The OpenID Connect discovery endpoint now accepts the `tenantId` as a URL segment. This should make it easier to integrate with providers that would not otherwise allow a query parameter on this URL to specify the `tenantId`.
[#2259](https://github.com/FusionAuth/fusionauth-issues/issues/2259)
Enhancement
Provide a validation error when using the `/api/jwt/reconcile` API with any IdP type `ExternalJWT`.
[#2074](https://github.com/FusionAuth/fusionauth-issues/issues/2074)
Enhancement
Added configuration to allow unauthenticated access to `/api/status` and `/api/prometheus/metrics` APIs from localhost.
[#2310](https://github.com/FusionAuth/fusionauth-issues/issues/2310)
Enhancement
Added more support in the default theme to use Google reCAPTCHA v2 in an invisible mode w/ CAPTCHA fallback.
[#2237](https://github.com/FusionAuth/fusionauth-issues/issues/2237)
Enhancement
Allow any string value in the `metaData.device.type` property on various APIs.
Fix
Always send email verification on user email change when configured for user self-service
[#2210](https://github.com/FusionAuth/fusionauth-issues/issues/2210)
Fix
Resolved a JavaScript bug when enabling MFA during login. The bug caused an error to be written to the JavaScript console, but no functional errors occurred.
[#2296](https://github.com/FusionAuth/fusionauth-issues/issues/2296)
Fix
When the `user.login.success` is configured to be transactional and the webhook returns a non `200` status code when the event is fired during the final step of the change password workflow, the failed webhook may not fail the login attempt.
[#2288](https://github.com/FusionAuth/fusionauth-issues/issues/2288)
Fix
When enabling IdP initiated login on a SAMLv2 IdP, the base ACS URL is hidden in the view dialog
[#2146](https://github.com/FusionAuth/fusionauth-issues/issues/2146)
Fix
When an `applicationId` is provided on a Two-Factor Start or Send APIs, the application variable may not available in the email template.
[#2149](https://github.com/FusionAuth/fusionauth-issues/issues/2149)
Fix
APIs that optionally take a `sourceId` to indicate you wish to copy will now fail validation if you provide additional parameters in the body that will otherwise be ignored.
Thanks to [@Pycnomerus](https://github.com/Pycnomerus)
!
[#2004](https://github.com/FusionAuth/fusionauth-issues/issues/2004)
Fix
When adding a user to multiple Groups using the `/api/group/member` API, the request may fail. Fixed.
[#2197](https://github.com/FusionAuth/fusionauth-issues/issues/2197)
Fix
When using a wildcard for authorized origin URL, you may receive an invalid origin error. Fixed.
Thanks to [@beezerk23](https://github.com/beezerk23)
!
[#2227](https://github.com/FusionAuth/fusionauth-issues/issues/2227)
Fix
Ensured that the memory value for `fusionauth-app.memory` set in the `fusionauth.properties` file is always set correctly.
[#2284](https://github.com/FusionAuth/fusionauth-issues/issues/2284)
Fix
When using custom data with nested values such as `user.data.company.name` and `user.data.company.id` in an Advanced Registration form the nested values may not be properly persisted. Fixed.
[#2239](https://github.com/FusionAuth/fusionauth-issues/issues/2239)
Fix
Using the admin UI to update an IdP with over 6k applications the request may cause a database error. Fixed.
[#2262](https://github.com/FusionAuth/fusionauth-issues/issues/2262)
Fix
Added index `entity_user_grants` to increase `SELECT` performance
[#2245](https://github.com/FusionAuth/fusionauth-issues/issues/2245)
Fix
When using the `validateJWT` method in the FusionAuth Java REST Client, the `exp` or `iat` claims may have the incorrect precision.
[#2275](https://github.com/FusionAuth/fusionauth-issues/issues/2275)
Fix
Added missing endpoints to the OpenAPI spec.
[#2247](https://github.com/FusionAuth/fusionauth-issues/issues/2247)
Fix
A change in behavior was introduced in version `1.41.0` that may cause an error when accessing FusionAuth in Docker. The change was how the `Host` header was being parsed to pick up the local port.
Thanks to [@MarekUniq](https://github.com/MarekUniq)
and [@java-http](https://github.com/java-http)
!
[#2250](https://github.com/FusionAuth/fusionauth-issues/issues/2250)
Fix
The `user.create.complete` and `user.registration.create.complete` events may be sent before the transaction has closed during IdP Login.
[#2233](https://github.com/FusionAuth/fusionauth-issues/issues/2233)
Fix
Corrected the internal authentication to receive an internal webhook between FusionAuth service nodes. If you encounter this error, you may see errors in the event log that mention `returned response code [401] when sending [JWTRefreshTokenRevoke] event`. This error was introduced in version `1.37.0` and the error only occurs when you have more than one FusionAuth service node.
[#2257](https://github.com/FusionAuth/fusionauth-issues/issues/2257)
Fix
When you have enabled Implicit Email Verification, when completing a Multi-Factor login, a `user.email.verified` event may be sent even if the user has already verified their email address.
[#2258](https://github.com/FusionAuth/fusionauth-issues/issues/2258)
Fix
When the `user.reactivate` event is configured to be transactional and the webhook returns a non `200` status code, the transaction may not be correctly rolled back.
[#2281](https://github.com/FusionAuth/fusionauth-issues/issues/2281)
Fix
When making a request to the self-service pages, such as `/account/` ensure any additional query parameters are preserved through a login workflow.
[#2282](https://github.com/FusionAuth/fusionauth-issues/issues/2282)
Fix
When the `user.create` event is configured to be transactional, ensure the Setup Password email is not sent if a `user.create` webhook returns a non `200` status code.
[#2287](https://github.com/FusionAuth/fusionauth-issues/issues/2287)
Fix
When using the Device Grant with the `/oauth2/device` themed page, you may be shown a Logout button if an SSO session exists during this workflow. Clicking this button will log the user out of the SSO session and return to this page. This fixes the logout link so that you do not receive an error when returning to the `/oauth2/device` page. A workaround is documented in the linked GitHub issue.
[#2331](https://github.com/FusionAuth/fusionauth-issues/issues/2331)
Security
Fixed an edge case where the CAPTCHA could be bypassed when using Advanced Registration forms.
[#2221](https://github.com/FusionAuth/fusionauth-issues/issues/2221)
Security
Added more validation on the `user_code` when completing a Device Grant by way of the Authorization Code Grant, Implicit Grant, or Password Credentials Grant.
[#2228](https://github.com/FusionAuth/fusionauth-issues/issues/2228)
Security
Added more validation on self-service edit form.
[#22234](https://github.com/FusionAuth/fusionauth-issues/issues/22234)
Security
Mitigated a potential directory traversal attack. CloudFlare, AWS and similar cloud providers will generally block these requests by default. FusionAuth Cloud customers are not vulnerable to this type of attack.
[#2299](https://github.com/FusionAuth/fusionauth-issues/issues/2299)
Internal
Upgraded Apache FreeMarker from version `2.3.30` to `2.3.32`.
[#2214](https://github.com/FusionAuth/fusionauth-issues/issues/2214)
Internal
Upgraded FusionAuth Java HTTP dependency from version `0.1.13` to `0.1.14`.
[#2299](https://github.com/FusionAuth/fusionauth-issues/issues/2299)
Internal
Upgraded Prime MVC dependency from version `4.7.1` to `4.9.10`.
[#2299](https://github.com/FusionAuth/fusionauth-issues/issues/2299)
_31 May 2023_
Fix
Update `fusionauth/java-http` to the most recent version to pick up a bug fix.
This fixed a very low level HTTP server bug. In some rare cases, the HTTP response handler may not identify the end of the stream and effectively truncate the response body. It is difficult to say how may affect your integration if you were to encounter it. If you were to make an API call with a large response body, it may be possible the response would not include a valid JSON object if the response is truncated. When this error occurs, the HTTP status code will be valid, but the response will be truncated or non-existent.
[#2292](https://github.com/FusionAuth/fusionauth-issues/issues/2292)
_8 May 2023_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Fix
Access token signing keys specific to an entity type may revert to the tenant configuration after upgrading to this version.
It is recommended to upgrade to this version at a minimum if you are coming from a version prior to version `1.45.0`. For more information on this issue, see the Known Issues in the `1.45.0` release notes.
[#2249](https://github.com/FusionAuth/fusionauth-issues/issues/2249)
_14 April 2023_
Enhancement
Added more validation when adding authorized origin to the OAuth2 configuration to ensure the values do not include a path or query string. This change will only affect validation when adding or editing the application configuration. This change will not affect existing configured origins or their use at runtime.
[#2185](https://github.com/FusionAuth/fusionauth-issues/issues/2185)
Fix
Added support for wildcard configuration when using `post_logout_redirect_uri` parameter on the OAuth2 Logout request.
[#2164](https://github.com/FusionAuth/fusionauth-issues/issues/2164)
Fix
Fixed salt validation for the `phpass-md5` or `phpass-sha512`. This will allow the import of users with this password hash when the salt includes a `.` (period) character.
[#2206](https://github.com/FusionAuth/fusionauth-issues/issues/2206)
_10 April 2023_
Known Issue
When importing users using the `phpass-md5` or `phpass-sha512` schemes shipped in this release, if the salt contains a period (`.`) the import will fail validation.
Resolved in version [`1.45.1`](/content/docs/release-notes#version-1-45-1/index.html) via
[#2206](https://github.com/FusionAuth/fusionauth-issues/issues/2206)
.
Known Issue
If you configured an access token signing key specific to an entity type, the signing key configuration may revert to the tenant configuration after upgrading to this version.
If you wish to upgrade before a fix is available, please document your access token signing key configuration for each entity type that has provided a specific signing configuration. Then, once the upgrade has completed, review each entity type and confirm the correct signing key configuration. If the configuration is not correct, set the signing key to the previously documented signing key.
To verify if this issue may affect you during upgrade, confirm your signing configuration for each configured entity type.
1. Navigate to Entity Management -> Entity Types -> Edit -> JWT .
2. If you have not enabled Entity Type specific JWT signing, this section will be collapsed and this entity type will not be affected during upgrade. If the signing configuration is enabled and you have configured a key for the `Access token signing key` field, you may be affected. Please record this setting and ensure it has not changed after the upgrade has completed.
If you have not yet upgraded to version `1.45.0`, it is recommended to move to version `1.45.2` or later at a minimum and skip this version if you have confirmed you may be affected by this issue.
Resolved in version [`1.45.2`](/content/docs/release-notes#version-1-45-2/index.html) via
[#2249](https://github.com/FusionAuth/fusionauth-issues/issues/2249)
.
New Feature
Added a policy to require a user to provide their current password when changing a password on the self-service account pages. See Applications -> Edit -> Registration -> Form settings -> Require current password .
[#1578](https://github.com/FusionAuth/fusionauth-issues/issues/1578)
New Feature
Integrated the Authorization Code grant workflow into FusionAuth for use with single page web applications. This feature may be used with the FusionAuth React or Angular SDKs to support the use of the Authorization Code grant without having to write any backend code.
[#1943](https://github.com/FusionAuth/fusionauth-issues/issues/1943)
New Feature
Added new Search APIs. These new APIs provide search and pagination capability across more APIs and may increase performance when using the FusionAuth admin UI with larger numbers of Tenants and Applications. Added Search APIs include: Applications, Consents, Groups, Tenants, Themes, Keys, API keys, User Comments, Email Templates, Identity Providers, Webhooks, and Lambdas.
Resolves issues [#2055](https://github.com/FusionAuth/fusionauth-issues/issues/2055), [#2056](https://github.com/FusionAuth/fusionauth-issues/issues/2056), [#2057](https://github.com/FusionAuth/fusionauth-issues/issues/2057), [#2058](https://github.com/FusionAuth/fusionauth-issues/issues/2058), [#2059](https://github.com/FusionAuth/fusionauth-issues/issues/2059), [#2060](https://github.com/FusionAuth/fusionauth-issues/issues/2060), [#2061](https://github.com/FusionAuth/fusionauth-issues/issues/2061), [#2064](https://github.com/FusionAuth/fusionauth-issues/issues/2064), [#2065](https://github.com/FusionAuth/fusionauth-issues/issues/2065), [#2066](https://github.com/FusionAuth/fusionauth-issues/issues/2066), [#2067](https://github.com/FusionAuth/fusionauth-issues/issues/2067), and [#2068](https://github.com/FusionAuth/fusionauth-issues/issues/2068)
New Feature
Added support for Drupal MD5, SHA-512 hashes for easier import. New schemes include `phpass-md5` and `phppass-sha512`.
For more information, see the documentation for [phpass MD5](/content/docs/reference/password-hashes#phpass-md5/index.html) and [phpass SHA-512](/content/docs/reference/password-hashes#phpass-md5/index.html).
[#2165](https://github.com/FusionAuth/fusionauth-issues/issues/2165)
Enhancement
De-coupled the self-service themed account pages from SSO. You may now use the self-service account pages even if you choose not to preserve your SSO session. For example, you can un-check the "Keep me signed in" checkbox and still use the self-service pages.
Also allow the self-service account session to be bootstrapped from a mobile application using token authentication, also known as the `Bearer` authentication scheme. This mechanism provides access to the self-service themed pages even if you are unable to share cookies with the web view used to complete login.
Example request header: `Authorization: Bearer <access_token>`
Thanks to [@ansonallard](https://github.com/ansonallard)
!
[#1546](https://github.com/FusionAuth/fusionauth-issues/issues/1546) [#1860](https://github.com/FusionAuth/fusionauth-issues/issues/1860)
Fix
Added validation for the length of an entity name in order to provide a more friendly validation error message.
[#2089](https://github.com/FusionAuth/fusionauth-issues/issues/2089)
Fix
Updated to the OpenAPI spec to correct an error related to `BaseSAMLv2IdentityProvider`.
[#2103](https://github.com/FusionAuth/fusionauth-issues/issues/2103)
Fix
Reviewed and corrected tooltips in the admin UI for Application specific email templates.
[#2163](https://github.com/FusionAuth/fusionauth-issues/issues/2163)
Security
Updated usage of `verificationId` on gated email or registration verification pages when configured to use a clickable link instead of a short code.
[#2182](https://github.com/FusionAuth/fusionauth-issues/issues/2182)
Internal
Fixed JSON exclusions for ignoring foreign keys.
[#2198](https://github.com/FusionAuth/fusionauth-issues/issues/2198)
Internal
Updated 3rd party dependencies:
- Upgrade Elasticsearch client from version `7.10.2` to `7.13.4`.
- Upgrade GraalJS from version `22.3.0` to `22.3.1`.
[#2183](https://github.com/FusionAuth/fusionauth-issues/issues/2183)
_13 March 2023_
Database Migration
This migration adds an index to the `identity_provider_links` table. It is not expected to negatively impact the migration time during upgrade, but please be aware that deployments with millions of Identity Provider Links may experience additional processing time during the migration.
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Apple IdP-assigned keys may fail to delete.
Resolved in version [`1.63.0`](/content/docs/release-notes#version-1-63-0/index.html) via
[#3275](https://github.com/FusionAuth/fusionauth-issues/issues/3275)
.
Known Issue
In self-service registration, a user can alter a hidden field (using browser developer tools) and cause `Failed decrypt registration state` errors to appear in the event log.
Resolved in version [`1.63.0`](/content/docs/release-notes#version-1-63-0/index.html) via
[#3313](https://github.com/FusionAuth/fusionauth-issues/issues/3313)
.
Enhancement
Added default configuration for read and connect timeouts to the SMTP server configuration. This helps protect FusionAuth against an SMTP server that never closes a socket. From time to time we observed an SMTP server hold open a socket, and tie up a send thread which may block other senders. This includes the `mail.smtp.timeout` and `mail.smtp.connectiontimeout` settings. The default value is `2000` for each. These may be overridden by navigating to the `Advanced` tab in your tenant and adding them to the `SMTP settings` section.
[#1742](https://github.com/FusionAuth/fusionauth-issues/issues/1742)
Enhancement
Changed Link API request body to match the response. Backwards compatibility is maintained, but this provides a more consistent API feel.
[#1747](https://github.com/FusionAuth/fusionauth-issues/issues/1747)
Enhancement
Updated the Google IdP JavaScript in the themed pages. This change removes the deprecated Google JavaScript library, and adds support for One Tap.
_Thanks to [@forteilgmbh](https://github.com/forteilgmbh) for their contribution._
Thanks to [@Brunom50](https://github.com/Brunom50)
and [@harishreddy-m](https://github.com/harishreddy-m)
!
[#1939](https://github.com/FusionAuth/fusionauth-issues/issues/1939)
Enhancement
Returns a `404` with status only for anything under `/api/*` instead of rendering a `404` page with HTML. It just seems like the right thing to do. Nobody wants HTML in their APIs!
[#2109](https://github.com/FusionAuth/fusionauth-issues/issues/2109)
Enhancement
Added a new index to the `identity_provider_links` table to increase performance.
[#2122](https://github.com/FusionAuth/fusionauth-issues/issues/2122)
Enhancement
Added `apiMode: [Public|Partner]` to allow the user to select between the public or partner Steam API. The Partner API is preferred if you have access to it because it is not rate limited.
[#2127](https://github.com/FusionAuth/fusionauth-issues/issues/2127)
Fix
A Lambda invocation may incorrectly fail indicating a recursive call was attempted. This is unlikely to occur, but under heavy load, it is possible.
[#2102](https://github.com/FusionAuth/fusionauth-issues/issues/2102)
Fix
The Application API was failing to make a copy when using `sourceApplicationId` when the source Application has enabled and configured the SAML v2 IdP. This is a bug in a new feature that was added in version `1.43.0`.
[#2118](https://github.com/FusionAuth/fusionauth-issues/issues/2118)
Internal
Expanded use of `Cache-Control: no-store` in the FusionAuth admin application.
[#2097](https://github.com/FusionAuth/fusionauth-issues/issues/2097)
_6 March 2023_
Fix
Corrected a potential FreeMarker render error caused by a missing CSRF token when performing an SAML v2 IdP initiated login to the FusionAuth admin UI. This error is a side effect of the caller not requesting the `scope=offline_access` parameter. With this fix, you should no longer encounter the error, and the `offline_access` scope is now optional on the request. To work around this issue, request the `offline_access` scope.
[#2125](https://github.com/FusionAuth/fusionauth-issues/issues/2125)
_15 February 2023_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Creating a new application from another application with `sourceApplicationId` returns a `500` error when the source application has SAML v2 enabled and configured. If you have not configured SAML v2, you will not be affected by this issue. Workaround is to call Create Application API without the `sourceApplicationId` parameter and supply all the parameters copied from the source application.
Resolved in version [`1.44.0`](/content/docs/release-notes#version-1-44-0/index.html) via
[#2118](https://github.com/FusionAuth/fusionauth-issues/issues/2118)
.
New Feature
Added support for wild cards in OAuth2 Authorized Origin and Authorized Redirect URL configurations. Use with caution - but have fun with it!
_In chronological order, thank you to [@SeanStayn](https://github.com/SeanStayn), [@Jank1310](https://github.com/Jank1310), [@JuliusPC](https://github.com/JuliusPC), [@dystopiandev](https://github.com/dystopiandev), [@alessandrojcm](https://github.com/alessandrojcm), [@sjmog](https://github.com/sjmog), [@huysentruitw](https://github.com/huysentruitw) and [@mdnadm](https://github.com/mdnadm)._
[#437](https://github.com/FusionAuth/fusionauth-issues/issues/437)
New Feature
Added support for native TLS configuration in the FusionAuth HTTP server without the requirement to use a proxy with TLS termination.
[#1996](https://github.com/FusionAuth/fusionauth-issues/issues/1996)
New Feature
Added support for the `salted-pbkdf2-hmac-sha512-512` password hash algorithm.
For more information, see [Salted PBKDF2 HMAC SHA-512](/content/docs/reference/password-hashes#salted-pbkdf2-hmac-sha-512/index.html).
[#2054](https://github.com/FusionAuth/fusionauth-issues/issues/2054)
Enhancement
Added support for importing an x.509 certificate with a private key into KeyMaster in the admin UI.
[#1805](https://github.com/FusionAuth/fusionauth-issues/issues/1805)
Enhancement
Added Additional configuration for the Apple IdP to support login from Mobile and Desktop.
Thanks to [@johnmaia](https://github.com/johnmaia)
and [@Brunom50](https://github.com/Brunom50)
!
[#778](https://github.com/FusionAuth/fusionauth-issues/issues/778) [#1248](https://github.com/FusionAuth/fusionauth-issues/issues/1248)
Enhancement
Updated the System Log viewer in the FusionAuth admin UI to order logs for easier viewing pleasure.
[#1612](https://github.com/FusionAuth/fusionauth-issues/issues/1612)
Enhancement
Allow Forgot Password API usage when the Forgot Password Email template is not configured if `sendForgotPasswordEmail` is `false`.
Thanks to [@epbensimpson](https://github.com/epbensimpson)
!
[#1735](https://github.com/FusionAuth/fusionauth-issues/issues/1735)
Enhancement
Provide better developer feedback on the Change Password API when using an API key.
Thanks to [@sujkattimani](https://github.com/sujkattimani)
!
[#1897](https://github.com/FusionAuth/fusionauth-issues/issues/1897)
Enhancement
Allow the SAML v2 IdP to be used for both SP and IdP initiated login. Previously to utilize SP and IdP initiated login for the same SAML v2 IdP, you would have to create two separate configurations. It is still recommended to use the separate SAML v2 IdP initiated configuration if you will not be using an SP initiated login.
Thanks to [@leesmith110](https://github.com/leesmith110)
!
[#1900](https://github.com/FusionAuth/fusionauth-issues/issues/1900)
Enhancement
Added support for PostgreSQL 15.
[#1944](https://github.com/FusionAuth/fusionauth-issues/issues/1944) [#2015](https://github.com/FusionAuth/fusionauth-issues/issues/2015)
Enhancement
Added an option to include archived logs in gzip format on the System Log Download API. This will be the default when downloading the logs in the FusionAuth admin UI.
[#1942](https://github.com/FusionAuth/fusionauth-issues/issues/1942)
Enhancement
Allow the login hint that is passed to a 3rd Party SAML v2 IdP to be configured. Previously this was always `login_hint`, but Azure will expect `username`, this can now be configured.
[#1946](https://github.com/FusionAuth/fusionauth-issues/issues/1946)
Enhancement
Added `sourceApplicationId` to the Application API to create an app from an existing Application to copy settings. This allows you to more easily use a single Application as a template, or to just make a copy.
[#1957](https://github.com/FusionAuth/fusionauth-issues/issues/1957)
Enhancement
Created default email templates for Add and Remove Multi-Factor methods.
[#1993](https://github.com/FusionAuth/fusionauth-issues/issues/1993)
Enhancement
Added additional SAML IdP config to allow advanced assertion capabilities such as allow any destination, or alternate values. This is sort of a dangerous power user feature, but can be useful when migrating IdP configurations into FusionAuth w/out requiring each IdP to update their ACS.
[#1995](https://github.com/FusionAuth/fusionauth-issues/issues/1995)
Enhancement
Added additional detail to the edit registration form in the FusionAuth admin UI so you know which user you are editing. Seemed like a good idea.
[#2045](https://github.com/FusionAuth/fusionauth-issues/issues/2045)
Enhancement
Do not validate `Content-Type` when a payload has not been provided.
[#2085](https://github.com/FusionAuth/fusionauth-issues/issues/2085)
Fix
When using the Forgot Password workflow on the FusionAuth login page with a user without an email address, the page would refresh instead of redirecting to the success screen indicating an email had been sent.
Thanks to [@epbensimpson](https://github.com/epbensimpson)
!
[#1809](https://github.com/FusionAuth/fusionauth-issues/issues/1809)
Fix
The Change Password API was incorrectly failing, indicating a Trust Token was required, even when provided if the user has MFA enabled.
Thanks to [@timyourivh](https://github.com/timyourivh)
!
[#1909](https://github.com/FusionAuth/fusionauth-issues/issues/1909)
Fix
Ensured that we correctly terminate an SSO session when beginning a new passwordless login flow with a different user in the same browser.
[#1912](https://github.com/FusionAuth/fusionauth-issues/issues/1912)
Fix
Fixed various limitations with adding a consent to a self-service account form.
Thanks to [@epbensimpson](https://github.com/epbensimpson)
!
[#1920](https://github.com/FusionAuth/fusionauth-issues/issues/1920)
Fix
Fixed an error that may occur when logging into the FusionAuth admin UI with an IdP initiated request from a SAML v2 IdP.
Thanks to [@jon-at-advarra](https://github.com/jon-at-advarra)
!
[#1941](https://github.com/FusionAuth/fusionauth-issues/issues/1941)
Fix
Fixed an error that may occur when logging into the FusionAuth admin UI with an IdP initiated request from a SAML v2 IdP and then navigating to your own profile page.
Thanks to [@jon-at-advarra](https://github.com/jon-at-advarra)
!
[#1976](https://github.com/FusionAuth/fusionauth-issues/issues/1976)
Fix
Fixed an error where, when taking a User Action, the duration is localized for the event. The localization is only available for a fixed number of locales. When an unsupported locale, such as Serbian is requested, an exception will occur. This has been fixed to avoid the exception, and if an unsupported Locale is requested, English will be used as the default.
[#1978](https://github.com/FusionAuth/fusionauth-issues/issues/1978)
Fix
Fixed an error where, when sending a test event to verify the Kafka configuration, the topic was not being validated as required.
Thanks to [@sixhobbits](https://github.com/sixhobbits)
!
[#1985](https://github.com/FusionAuth/fusionauth-issues/issues/1985)
Fix
Fixed an error where, when completing the forgot password workflow using the FusionAuth themed pages outside of an OAuth context, you may receive an error that says `Oops. It looks like you've gotten here by accident.`.
[#1989](https://github.com/FusionAuth/fusionauth-issues/issues/1989)
Fix
Updated the Email Template preview in the view dialog to be consistent with the preview in the edit page.
Thanks to [@lancegliser](https://github.com/lancegliser)
!
[#2007](https://github.com/FusionAuth/fusionauth-issues/issues/2007)
Fix
Restricted the Two-Factor Trust during a Change Password request to be used for the workflow that started the request.
[#2010](https://github.com/FusionAuth/fusionauth-issues/issues/2010)
Fix
Fixed the edit Form Field in the FusionAuth admin UI for a consent field.
[#2026](https://github.com/FusionAuth/fusionauth-issues/issues/2026)
Fix
Using password reset to unlock account may not work when MFA is enabled for the user.
Since: [`1.42.0`](/content/docs/release-notes#version-1-42-0/index.html)
[#2032](https://github.com/FusionAuth/fusionauth-issues/issues/2032)
_8 January 2023_
Fix
A regression error in version `1.42.0` may cause a user to no longer be able to login after a successful login. In order to encounter this bug, you must have your tenant configured to re-hash passwords on login, and have a user login when their password encryption scheme or factor that does not match the configured tenant defaults. If you may have this type of configuration, please do not upgrade to version `1.42.0` and instead upgrade directly to this version.
Since: [`1.42.0`](/content/docs/release-notes#version-1-42-0/index.html)
[#2043](https://github.com/FusionAuth/fusionauth-issues/issues/2043)
_7 December 2022_
Known Issue
A regression error in version `1.42.0` may cause a user to no longer be able to login after a successful login. In order to encounter this bug, you must have your tenant configured to re-hash passwords on login, and have a user login when their password encryption scheme or factor that does not match the configured tenant defaults. If you may have this type of configuration, do not upgrade to version `1.42.0` and instead upgrade directly to `1.42.1`.
Resolved in version [`1.42.0`](/content/docs/release-notes#version-1-42-0/index.html) via
[#2043](https://github.com/FusionAuth/fusionauth-issues/issues/2043)
.
Known Issue
In this release, you may now create a policy to allow a user to unlock their account after too many failed login attempts by completing a forgot password workflow. A bug was identified in this new feature that may cause this workflow to fail if the user also has 2FA enabled.
Resolved in version [`1.43.0`](/content/docs/release-notes#version-1-43-0/index.html) via
[#2032](https://github.com/FusionAuth/fusionauth-issues/issues/2032)
.
Breaking Change
When building a WebAuthn credential, the user's current email address or username will now be used as the credential name. Previously this value was generated to be unique to help the user identify multiple credentials. However, Safari on macOS and Edge on Windows may display this value to the end user, so this will no longer be generated but set to a value the user should recognize.
[#1929](https://github.com/FusionAuth/fusionauth-issues/issues/1929)
Theme Upgrade
New themed templates for enabling two-factor authentication during login. Please review your themes to ensure the new templates and localized messages are added.
- `theme.templates.oauth2TwoFactorEnable -> /oauth2/two-factor-enable`
- `theme.templates.oauth2TwoFactorEnableComplete -> /oauth2/two-factor-enable-complete`
[#197](https://github.com/FusionAuth/fusionauth-issues/issues/197)
New Feature
Added an Multi-Factor policy option to require a user to enable multi-factor during login if not yet configured. See `Tenants > Edit > MFA > Policies > On login > Required.`. Application specific configuration can also be configured, see `Applications > Edit > MFA > Policies > On login > Required.`, using the application configuration requires an Enterprise plan.
[#197](https://github.com/FusionAuth/fusionauth-issues/issues/197)
New Feature
Allow refresh tokens to be revoked for a user when enabling two-factor authentication. See `Tenants > Edit > JWT > Refresh token settings > Refresh token revocation > On multi-factor enable`.
[#1794](https://github.com/FusionAuth/fusionauth-issues/issues/1794)
New Feature
A new lambda function can be assigned to perform custom validation for any step during a self-service registration. This feature is only available when using a custom form, and is not available when using basic self-service registration. This may be useful to perform advanced field validation, or to call a 3rd party API to perform additional identity verification.
[#1833](https://github.com/FusionAuth/fusionauth-issues/issues/1833)
Enhancement
Allow a user to unlock their account after being locked due to too many failed authentication attempts by completing a password reset workflow. See the `Cancel action on password reset` in the Tenant configuration. `Tenants > Edit > Password > Failed authentication settings`.
_Thanks [@colingm](https://github.com/colingm) for the request, and [@davidmw](https://github.com/davidmw) and [@Jlintonjr](https://github.com/Jlintonjr) for the advice and feedback!_
[#383](https://github.com/FusionAuth/fusionauth-issues/issues/383)
Enhancement
Use the existing tenant configuration for `modifyEncryptionSchemeOnLogin` to also update the hash when changed.
[#1062](https://github.com/FusionAuth/fusionauth-issues/issues/1062)
Enhancement
Added additional configuration to the `Failed authentication settings` in the tenant configuration to optionally email the user when the configured action is also configured to allow emailing.
[#1823](https://github.com/FusionAuth/fusionauth-issues/issues/1823)
Enhancement
Updated the `System > About` panel in the admin UI to report OpenSearch when using OpenSearch instead of Elasticsearch.
[#1982](https://github.com/FusionAuth/fusionauth-issues/issues/1982)
Fix
Minor WebAuthn related fixes.
[#1979](https://github.com/FusionAuth/fusionauth-issues/issues/1979) [#1986](https://github.com/FusionAuth/fusionauth-issues/issues/1986)
Fix
When providing both the `entityId` and `userId` on the Entity Search API, an exception will occur.
[#1883](https://github.com/FusionAuth/fusionauth-issues/issues/1883)
Fix
Removed SCIM endpoints from the API key configuration in the admin UI, these endpoints do not use API keys.
[#1987](https://github.com/FusionAuth/fusionauth-issues/issues/1987)
Fix
Fixed various rendering issues with the Theme preview in the admin UI
Thanks to [@Steve-MP](https://github.com/Steve-MP)
!
[#1755](https://github.com/FusionAuth/fusionauth-issues/issues/1755)
_21 November 2022_
Security
_17 November 2022_
Fix
Enabled licensed features such as SCIM or WebAuthn to be configured during kickstart.
[#1969](https://github.com/FusionAuth/fusionauth-issues/issues/1969)
_16 November 2022_
Fix
Improved synchronization of a user during a connector login. Specifically, allow previously obtained refresh tokens to be preserved during the user update procedures during a connector synchronization event.
Thanks to [@yuezhou1998](https://github.com/yuezhou1998)
!
[#1907](https://github.com/FusionAuth/fusionauth-issues/issues/1907)
Fix
Allowed for invalid language values to be provided in the `Accept-Language` HTTP request header. When an invalid language is provided, the `Accept-Language` header will be discarded.
[#1958](https://github.com/FusionAuth/fusionauth-issues/issues/1958)
Fix
Improved support for starting a forgot password workflow using the API and completing the workflow in a themed page when a user also has 2FA enabled.
[#1965](https://github.com/FusionAuth/fusionauth-issues/issues/1965)
Security
Removed app template files from the classpath.
Thanks to [@vtcdanh](https://github.com/vtcdanh)
!
[#1964](https://github.com/FusionAuth/fusionauth-issues/issues/1964)
_10 November 2022_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
A change to the FusionAuth HTTP server may cause issues with reverse proxies that default upstream connections to `HTTP/1.0`. The HTTP server we are using no longer supports `HTTP/1.0`. We have identified that `nginx` defaults all upstream connections to `HTTP/1.0`, and the HTTP server we are using no longer supports `HTTP/1.0`. For `nginx` specifically, you will need to set the proxy version by adding `proxy_http_version 1.1;` to your proxy config.
Theme Upgrade
Added new themed pages for WebAuthn. Please review your themes to ensure the new templates and localized messages are added. WebAuthn re-authentication requires a new hidden form field named `userVerifyingPlatformAuthenticatorAvailable` to detect compatible devices/browsers and prompt the user to register a passkey. You can view the default templates to determine in which form to insert this field into any customized templates. This field must be present on the following pages:
- OAuth authorize
- OAuth complete registration
- OAuth passwordless
- OAuth register
- OAuth two-factor
- OAuth WebAuthn (new)
See [Upgrade an Advanced Theme](/content/docs/customize/look-and-feel/advanced-themes/upgrade-advanced-theme/index.html) for additional information about the upgrade process. See [Advanced Theme Upgrade Notes](/content/docs/customize/look-and-feel/advanced-themes/upgrade/index.html) for details on updating an existing advanced theme specific to this release.
New Feature
Introduced WebAuthn! Passkeys, Touch ID, Face ID, Android fingerprint, Windows Hello!
[#77](https://github.com/FusionAuth/fusionauth-issues/issues/77)
New Feature
Enabled users to be provisioned into the FusionAuth app using an IdP.
[#1915](https://github.com/FusionAuth/fusionauth-issues/issues/1915)
New Feature
Added the ability for FusionAuth to initiate a SAML v2 login request to a SAML v2 Service Provider.
[#1927](https://github.com/FusionAuth/fusionauth-issues/issues/1927)
Enhancement
Support passing the Assertion Consumer Service (ACS) in the `RelayState` query parameter.
[#1785](https://github.com/FusionAuth/fusionauth-issues/issues/1785)
Enhancement
Support using an `appId` and `sessionTicket` to complete login with the Steam Identity Provider.
[#1873](https://github.com/FusionAuth/fusionauth-issues/issues/1873)
Enhancement
Restored support for some legacy HTTP Servlet Request methods for use in themed templates.
[#1904](https://github.com/FusionAuth/fusionauth-issues/issues/1904)
Fix
Corrected signature verification of a SAML v2 AuthN response after the certificate has been removed from Key Master.
[#1906](https://github.com/FusionAuth/fusionauth-issues/issues/1906)
Fix
Fixed an issue where, when requesting keys by an `applicationId`, an exception may be thrown when there are no keys to be returned from the `/api/jwt/public-key`.
[#1918](https://github.com/FusionAuth/fusionauth-issues/issues/1918)
Fix
Fixed an issue where, SSO logout in Firefox may result in downloading a zero byte file.
[#1934](https://github.com/FusionAuth/fusionauth-issues/issues/1934)
Fix
Fixed an issue where, when multiple webhooks are configured, and more than one webhook is configured to receive the `event-log.create` event, a failed webhook may cause an event loop.
[#1945](https://github.com/FusionAuth/fusionauth-issues/issues/1945)
Fix
Corrected de-serialization of the `userType` and `title` fields in a SCIM resource.
[#1954](https://github.com/FusionAuth/fusionauth-issues/issues/1954)
Security
Updated `com.fasterxml.jackson.*` dependencies to version `2.14.0`. This update is proactive, there are no known exploits. See [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) and [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004).
[#1913](https://github.com/FusionAuth/fusionauth-issues/issues/1913)
Internal
Updated the docker image to `ubuntu:jammy`.
[#1936](https://github.com/FusionAuth/fusionauth-issues/issues/1936)
Internal
Switched to a new HTTP server.
_28 September 2022_
Fix
Fixed an issue where a two-factor trust may expire early causing a user to be prompted to complete two-factor during login.
Since: [`1.37.0`](/content/docs/release-notes#version-1-37-0/index.html)
[#1905](https://github.com/FusionAuth/fusionauth-issues/issues/1905)
_26 September 2022_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Enhancement
Added support for `Content-Type` in Kickstart when using `PATCH` request to support `application/json-patch+json` and `application/merge-patch+json`.
[#1885](https://github.com/FusionAuth/fusionauth-issues/issues/1885)
Enhancement
Removed unnecessary logging when the `Content-Type` request header is invalid or unset.
[#1895](https://github.com/FusionAuth/fusionauth-issues/issues/1895)
Fix
Fixed an issue where a SAML v2 IdP Initiated login request will fail if PKCE is configured as required.
[#1800](https://github.com/FusionAuth/fusionauth-issues/issues/1800)
Fix
Fixed an issue where the path attribute in some cookies may be set to the request path instead of `/` which may affect a SAML v2 IdP initiated login request.
[#1891](https://github.com/FusionAuth/fusionauth-issues/issues/1891)
_16 September 2022_
Breaking Change
If you are using MySQL or plan to use MySQL you will need to manually download the JDBC connector to allow FusionAuth to connect to a MySQL database. If you are using PostgreSQL, this change will not affect you. See the installation guide for additional information. We apologize in advance for the inconvenience this causes you, but the Oracle GPL licensing model makes it difficult for FusionAuth to easily delivery this capability.
[#1862](https://github.com/FusionAuth/fusionauth-issues/issues/1862)
New Feature
Re-instated native Windows support. We apologize for the gap in native Windows support, for those who have been waiting to upgrade since version `1.37.0` you may now upgrade with a native installer. Thank you for all of you who have voiced your opinions with how we are support a native Windows installation.
[#1848](https://github.com/FusionAuth/fusionauth-issues/issues/1848)
Enhancement
Support changes to `user.active` for `PUT` or `PATCH` on the SCIM User or Enterprise User endpoints.
[#1871](https://github.com/FusionAuth/fusionauth-issues/issues/1871)
Enhancement
Improved the performance of SAML v2 request parsing.
[#1884](https://github.com/FusionAuth/fusionauth-issues/issues/1884)
Fix
Fixed an issue where an exception could occur when you attempt to perform a `PATCH` request on a Group using a `roleId` that does not exist.
[#1872](https://github.com/FusionAuth/fusionauth-issues/issues/1872)
Fix
Added URL escapes to the `identityProviderUser` in the admin UI to correctly build the View and Delete actions links.
Thanks to [@epbensimpson](https://github.com/epbensimpson)
!
[#1882](https://github.com/FusionAuth/fusionauth-issues/issues/1882)
_11 September 2022_
Enhancement
Improved support for JSON Patch. Now supporting RFC 7386 `application/merge-patch+json` and RFC 6902 `application/json-patch+json`. Note that you may still make a request using the `PATCH` HTTP method using `application/json` and the current behavior should not be changed. All `patch*` methods found in the FusionAuth client libraries will still be using `application/json` for backwards compatibility. However, now that support for these new content types exists, we will be working to build support into our client libraries.
[#441](https://github.com/FusionAuth/fusionauth-issues/issues/441)
Enhancement
Improved error messages when the `Content-Type` request header is missing or incorrect.
[#604](https://github.com/FusionAuth/fusionauth-issues/issues/604)
Enhancement
Extended SCIM support for the `PATCH` HTTP request method and `filter` and `excludedAttributes` request attributes. The addition of these features allow the FusionAuth SCIM server to be compatible with Azure AD SCIM client and Okta SCIM client. The Group filter support has some limitations, see the [SCIM Group](/content/docs/apis/scim/scim-group#retrieve-a-group/index.html) API doc for additional details.
[#1761](https://github.com/FusionAuth/fusionauth-issues/issues/1761) [#1791](https://github.com/FusionAuth/fusionauth-issues/issues/1791)
Enhancement
Added some missing message keys to default Theme message bundle.
[#1839](https://github.com/FusionAuth/fusionauth-issues/issues/1839)
Enhancement
Removed an unnecessary db request when validating the user security scheme for a user in the Admin UI.
[#1856](https://github.com/FusionAuth/fusionauth-issues/issues/1856)
Fix
Fixed an issue where, when appending the `locale` request parameter on the Authorize request to pre-select the user's locale, the locale could be incorrect for validation errors. For example, appending `locale=fr` will allow the initial render of the page to be localized in French when available. However, because the user did not manually modify the locale selector on the page, if the login fails due to a validation error, the error messages will be returned in the default locale which is generally English.
[#1713](https://github.com/FusionAuth/fusionauth-issues/issues/1713)
Fix
Group application roles removed during a `PATCH` request to the Group API.
Thanks to [@paul-fink-silvacom](https://github.com/paul-fink-silvacom)
!
[#1717](https://github.com/FusionAuth/fusionauth-issues/issues/1717)
Fix
Corrected the following issues with SAML v2 SP and IdP metadata:
- The HTTP scheme was missing from the `entityID`. This issue was introduced in version `1.37.0`.
- The `NameIdFormat` found in the SP meta data was always showing `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` regardless of the value configured in the SAML v2 IdP.
[#1842](https://github.com/FusionAuth/fusionauth-issues/issues/1842)
Fix
Fixed an issue that could lead to an exception in the FusionAuth system logs when the internal login record service runs. Only seen in instances with very large login volumes.
[#18854](https://github.com/FusionAuth/fusionauth-issues/issues/18854)
Fix
Fixed an issue that could cause the Elasticsearch index to drift out of sync with group memberships when deleting groups or group members.
[#1855](https://github.com/FusionAuth/fusionauth-issues/issues/1855)
Fix
Added missing support for `en_GB` time and data format support in the FusionAuth admin UI when setting your preferred locale to `en_GB`. It wasn't our intention to force our friends in the United Kingdom 🇬🇧 to painfully read dates and times in the American 🇺🇸 format. Please accept our apologies. 😎
Thanks to [@adambowen](https://github.com/adambowen)
!
[#1858](https://github.com/FusionAuth/fusionauth-issues/issues/1858)
_22 August 2022_
Fix
Fixed an issue where static resources such as CSS and JS could lack a `Content-Type` header, which may cause a proxy using `X-Content-Type-Options: nosniff` to fail to load the resource.
Since: [`1.37.0`](/content/docs/release-notes#version-1-37-0/index.html)
Thanks to [@singinc](https://github.com/singinc)
and [@Aaron-Ritter](https://github.com/Aaron-Ritter)
!
[#1831](https://github.com/FusionAuth/fusionauth-issues/issues/1831) [#1834](https://github.com/FusionAuth/fusionauth-issues/issues/1834)
Fix
Fixed a potential error issue caused by a webhook handler calling back to FusionAuth which may trigger another webhook event. This fix should also improve the performance when sending many events for webhooks.
[#1836](https://github.com/FusionAuth/fusionauth-issues/issues/1836)
Fix
Corrected behavior during login when both self-service registration and require registration features are enabled. This configuration may cause a user to be directed to the registration required page during login instead of being registered automatically. If you encounter this error, you may either upgrade or disable the require registration configuration.
Since: [`1.36.5`](/content/docs/release-notes#version-1-36-5/index.html)
[#1837](https://github.com/FusionAuth/fusionauth-issues/issues/1837)
_17 August 2022_
Fix
Removed dead Tomcat files from Docker image. No cats were harmed in the making of this fix.
Thanks to [@kevcube](https://github.com/kevcube)
!
[#1820](https://github.com/FusionAuth/fusionauth-issues/issues/1820)
New Feature
Introduced Group and Group Membership Webhooks.
_Thanks to [@JLyne](https://github.com/JLyne), [@ric-sapasap](https://github.com/ric-sapasap) and [@rabshire](https://github.com/rabshire) for the feedback!_
_Thanks to [@matthew-jump](https://github.com/matthew-jump) for making the request._
[#633](https://github.com/FusionAuth/fusionauth-issues/issues/633) [#1803](https://github.com/FusionAuth/fusionauth-issues/issues/1803)
_11 August 2022_
Enhancement
Added the ability to create a user in the Admin UI optionally performing email verification. The UI controls and messaging have been enhanced to remove potential confusion.
[#1819](https://github.com/FusionAuth/fusionauth-issues/issues/1819)
Fix
Fixed an issue that caused HTTP request headers to be malformed when being sent to a Webhook, Generic Messenger or a Generic Connector.
Since: [`1.37.0`](/content/docs/release-notes#version-1-37-0/index.html)
[#1818](https://github.com/FusionAuth/fusionauth-issues/issues/1818)
_10 August 2022_
Fix
Resolved an exception that could occur while trying to capture the debug log event during an authentication request using a Connector.
[#1799](https://github.com/FusionAuth/fusionauth-issues/issues/1799)
Fix
Fixed an issue where a User Action configured to email a user on Failed Login would not send the email as intended.
[#1801](https://github.com/FusionAuth/fusionauth-issues/issues/1801)
Fix
Fixed an issue where Kickstart failed because it does not wait for FusionAuth to complete startup.
[#1816](https://github.com/FusionAuth/fusionauth-issues/issues/1816)
Fix
Fixed an issue where creating an application in the Admin UI could fail due to a licensing error if you do not have an Enterprise license.
[#1817](https://github.com/FusionAuth/fusionauth-issues/issues/1817)
_9 August 2022_
Breaking Change
This release contains some significant internal changes to our HTTP server. While we do not expect any issues, please be aware of this change as you test and prepare for upgrades. Please also be aware of changes to our Windows bundling options.
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Kickstart fails because it does not wait for FusionAuth to complete startup.
Resolved in version [`1.37.1`](/content/docs/release-notes#version-1-37-1/index.html) via
[#1816](https://github.com/FusionAuth/fusionauth-issues/issues/1816)
.
Known Issue
Creating an application in the FusionAuth admin UI may fail due to a licensing error if you do not have an Enterprise license.
Resolved in version [`1.37.1`](/content/docs/release-notes#version-1-37-1/index.html) via
[#1817](https://github.com/FusionAuth/fusionauth-issues/issues/1817)
.
Known Issue
A regression error was introduced in version `1.37.0` that causes HTTP request headers to be malformed when being sent to a Webhook, Generic Messenger or a Generic Connector.
Resolved in version [`1.37.2`](/content/docs/release-notes#version-1-37-2/index.html) via
[#1818](https://github.com/FusionAuth/fusionauth-issues/issues/1818)
.
Known Issue
Static resources such as CSS and JS may be missing a `Content-Type` header which may cause a proxy using `X-Content-Type-Options: nosniff` to fail to load the resource.
Resolved in version [`1.38.1`](/content/docs/release-notes#version-1-38-1/index.html) via
[#1831](https://github.com/FusionAuth/fusionauth-issues/issues/1831)
.
Known Issue
A two-factor trust may expire early causing a user to be prompted to complete two-factor during login.
Resolved in version [`1.40.2`](/content/docs/release-notes#version-1-40-2/index.html) via
[#1905](https://github.com/FusionAuth/fusionauth-issues/issues/1905)
.
Known Issue
A theme issue may exist on a form action and may cause breaking changes when upgrading to this version. If you are upgrading, please verify your theme files accurately create a form action. The following themes should be updated:
- OAuth authorize -> `action="/oauth2/authorize"`
- Child registration not allowed -> `action="/oauth2/child-registration-not-allowed"`
- OAuth passwordless -> `action="/oauth2/passwordless"`
- OAuth register -> `action="/oauth2/register"`
- OAuth two-factor -> `action="/oauth2/two-factor"`
- Change password form -> `action="/password/change"`
- Forgot password -> `action="/password/forgot"`
Security
Allow deprecated XML signature algorithms that were removed in Java 17. It is still not recommended that you use any of these legacy SHA1 algorithms, but if you are unable to utilize a modern algorithm, they will be allowed.
[#1814](https://github.com/FusionAuth/fusionauth-issues/issues/1814)
Breaking Change
Windows install has been removed. Our strategy is to support Windows using WSL 2 with our provided Debian package. (Note: Due to customer feedback, a native Windows installation option was restored as of version `1.40.0`.)
Breaking Change
Webhooks are no longer configured as "All applications" or limited to a single Application. They are now scoped to one or more tenants. Filter events in your own Webhook handler by the `applicationId`.
[#1812](https://github.com/FusionAuth/fusionauth-issues/issues/1812)
Breaking Change
Deprecated Apache Tomcat specific configuration:
- `fusionauth-app.http.max-header-size` default is now `64k`.
- `fusionauth-app.http.cookie-same-site-policy` cookies will be written using `SameSite=Lax`, and cookies used by the Admin UI use `SameSite=Strict`.
- `fusionauth-app.management.port` and `fusionauth-app.ajp.port` are no longer required.
- `fusionauth-app.http.relaxed-path-chars` and `fusionauth-app.http.relaxed-query-chars` options removed.
[#1414](https://github.com/FusionAuth/fusionauth-issues/issues/1414)
Breaking Change
FastPath and normal startup commands have changed. The startup process will now use `start.sh` instead of Catalina scripts.
Breaking Change
When using the FusionAuth Docker image with MySQL, you will need to bundle the MySQL connector jar in the image, or add a layer to the stock FusionAuth image to ensure `curl` is installed.
Fix
Add the appropriate feedback to the users when attempting to change an email during a gated email verification that is already in-use.
[#1547](https://github.com/FusionAuth/fusionauth-issues/issues/1547)
Fix
Correct the validation when deleting a key from Key Master when in use by a de-activated application.
[#1676](https://github.com/FusionAuth/fusionauth-issues/issues/1676)
Fix
Perform implicit email verification when enabled and a setup password email request is completed.
[#1705](https://github.com/FusionAuth/fusionauth-issues/issues/1705)
Fix
Handle URL encoded characters in the user-information part of the URL when connecting to Elasticsearch.
[#1745](https://github.com/FusionAuth/fusionauth-issues/issues/1745)
Fix
When using the Change Password workflow in the hosted login pages for a user that has enabled 2FA, adding the OAuth2 parameters found in the `state` resolves an error when the user completes the workflow.
[#1764](https://github.com/FusionAuth/fusionauth-issues/issues/1764)
Fix
The Refresh Token retrieve API and the Session tab in admin UI will no longer show expired refresh tokens.
[#1772](https://github.com/FusionAuth/fusionauth-issues/issues/1772)
Fix
Fix Lambda JS validation when using ES6 features with the GraalJS engine.
Thanks to [@theogravity](https://github.com/theogravity)
!
[#1790](https://github.com/FusionAuth/fusionauth-issues/issues/1790)
Enhancement
Administrative Email Verification using the API or FusionAuth admin UI. You may now optionally create the user with an un-verified email.
[#1319](https://github.com/FusionAuth/fusionauth-issues/issues/1319)
Enhancement
The Oauth2 Logout does not log a user out of FusionAuth app if logging out of another application in the same default tenant.
[#1699](https://github.com/FusionAuth/fusionauth-issues/issues/1699)
Enhancement
Updates to our initial SCIM Server implementation released in version `1.36.0`. (Also resolves #1703)
[#1702](https://github.com/FusionAuth/fusionauth-issues/issues/1702)
Enhancement
Better options to capture debug information when troubleshooting an SMTP connection issue by enabling `debug` on the SMTP configuration.
[#1743](https://github.com/FusionAuth/fusionauth-issues/issues/1743)
Enhancement
Support larger email templates on MySQL using `MEDIUMTEXT` which supports up to `16M`.
Thanks to [@darkeagle1337](https://github.com/darkeagle1337)
!
[#1788](https://github.com/FusionAuth/fusionauth-issues/issues/1788)
Enhancement
Improvements to the OAuth2 Logout endpoint correctly supporting the `POST` method in addition to `GET`, and allowing an expired `id_token` in `id_token_hint`.
[#1792](https://github.com/FusionAuth/fusionauth-issues/issues/1792)
Enhancement
Webhooks are now scoped to one or more tenants.
[#1812](https://github.com/FusionAuth/fusionauth-issues/issues/1812)
Enhancement
Any API response that returns a Refresh Token will now also return a `refresh_token_id` (or `refreshTokenId`), useful for identifying a refresh token for revocation.
Enhancement
The Access Token will contain a new claim named `sid` which is the immutable identifier Refresh Token.
Enhancement
When available the Refresh Token is now returned in the `JWTRefreshTokenRevokeEvent` event in the `refreshToken` field.
Enhancement
The Login Ping API may now optionally take the request as a POST body.
New Feature
Application scoped Multi-Factor authentication allowing an application to choose to participate in MFA with a separate TTL.
[#763](https://github.com/FusionAuth/fusionauth-issues/issues/763)
New Feature
Optionally disable the IdP linking strategy for an Identity Provider.
Thanks to [@epbensimpson](https://github.com/epbensimpson)
!
[#1551](https://github.com/FusionAuth/fusionauth-issues/issues/1551)
New Feature
Added `fusionauth-app.http.read-timeout` to the configuration to optionally set the maximum read timeout.
Internal
Remove Apache Tomcat as the underlying application server, in favor of a more modern HTTP server based upon Netty.
[#1671](https://github.com/FusionAuth/fusionauth-issues/issues/1671)
_4 July 2022_
Fix
Fixed the placeholder text in the entity grants search field.
[#1774](https://github.com/FusionAuth/fusionauth-issues/issues/1774)
Fix
Corrected the SCIM HTTP response code when a new resource was created to be `201`.
[#1775](https://github.com/FusionAuth/fusionauth-issues/issues/1775)
Fix
Corrected the SCIM HTTP response code when a duplicate resource was attempted to be created to be `409`.
[#1776](https://github.com/FusionAuth/fusionauth-issues/issues/1776)
_23 June 2022_
Security
Ensured the provided `client_id` matched the Application represented by the Refresh Token when performing a Refresh grant.
Thanks to [@gnarlium](https://github.com/gnarlium)
!
[#1766](https://github.com/FusionAuth/fusionauth-issues/issues/1766)
Fix
Fixed an issue where the initial "start" phase of a user action triggered by a failed login configuration was not sent.
[#1654](https://github.com/FusionAuth/fusionauth-issues/issues/1654)
Fix
Fixed an issue where FusionAuth failed to complete the logout request when a SAML v2 SP used an HTTP redirect binding.
[#1723](https://github.com/FusionAuth/fusionauth-issues/issues/1723)
Fix
Fixed a timing issue where under the load of creating logins and deleting applications programmatically, a login record got stuck in the queue.
[#1765](https://github.com/FusionAuth/fusionauth-issues/issues/1765)
Fix
Corrected the `Content-Type` HTTP response header returned from the SCIM endpoints.
[#1769](https://github.com/FusionAuth/fusionauth-issues/issues/1769)
_16 June 2022_
Fix
Fixed an issue where a user was able to login successfully after being rate limited, but prior to the end of the configured time period.
[#1758](https://github.com/FusionAuth/fusionauth-issues/issues/1758)
Fix
Fixed an issue when using a JWT Populate lambda and modifying the default value of the `aud` claim to be an array instead of a string value.
[#1759](https://github.com/FusionAuth/fusionauth-issues/issues/1759)
_13 June 2022_
Security
Upgraded Java to get the patch for `CVE-2022-21449`.
[#1672](https://github.com/FusionAuth/fusionauth-issues/issues/1672)
Security
Fixed validation of the Oauth2 Logout endpoint when using the `post_logout_redirect` parameter.
[#1750](https://github.com/FusionAuth/fusionauth-issues/issues/1750)
Fix
Fixed a UI bug that caused the application column to show "Single sign-on" instead of the Application name in the Session tab.
[#1706](https://github.com/FusionAuth/fusionauth-issues/issues/1706)
Fix
Fixed an issue where a user was not routed to the Complete Registration step correctly after completing the Two-Factor challenge.
Thanks to [@chimericdream](https://github.com/chimericdream)
!
[#1708](https://github.com/FusionAuth/fusionauth-issues/issues/1708)
Fix
Fixed an issue where the `displayName` property on the Link a User API was ignored.
Since: [`1.36.0`](/content/docs/release-notes#version-1-36-0/index.html)
[#1728](https://github.com/FusionAuth/fusionauth-issues/issues/1728)
Fix
Fixed an issue where a 3rd party Web Application Firewall such as CloudFlare injected JavaScript into the `head` element.
Thanks to [@atakane](https://github.com/atakane)
!
[#1731](https://github.com/FusionAuth/fusionauth-issues/issues/1731)
Internal
Upgraded to the latest Java 17 LTS (from `17.0.1+12` to `17.0.3+7`).
[#1672](https://github.com/FusionAuth/fusionauth-issues/issues/1672)
_21 April 2022_
Security
Proactively patched Java `CVE-2022-21449` manually within FusionAuth until the patched release of Java became available.
[#1694](https://github.com/FusionAuth/fusionauth-issues/issues/1694)
_19 April 2022_
Fix
Identified and resolved an additional edge case regarding the `auth_time` claim precision fix.
Since: [`1.36.2`](/content/docs/release-notes#version-1-36-2/index.html)
[#1688](https://github.com/FusionAuth/fusionauth-issues/issues/1688)
_14 April 2022_
Fix
Fixed an issue where selecting an entity in a tenant other than the user's tenant caused an exception when building an entity grant in the UI.
[#1579](https://github.com/FusionAuth/fusionauth-issues/issues/1579)
Fix
Fixed an issue where creating an empty directory in the FusionAuth plugin directory caused the legitimate plugin jar to fail to load.
[#1683](https://github.com/FusionAuth/fusionauth-issues/issues/1683)
Fix
Fixed an issue where expected permissions were not returned as part of the access token claims when using the Client Credentials Grant.
[#1686](https://github.com/FusionAuth/fusionauth-issues/issues/1686)
_14 April 2022_
Fix
Fixed an issue where 3rd party libraries validating the `id_token` incorrectly identified it as expired due to `auth_time` claim precision loss.
[#1687](https://github.com/FusionAuth/fusionauth-issues/issues/1687)
_7 April 2022_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Creating an empty directory in the FusionAuth plugin directory caused the legitimate plugin jar to fail to load.
Known Issue
Permissions were omitted from the access token claims when using the Client Credentials Grant and omitting the permissions from the `target-entity:` scope.
Known Issue
Tokens produced by the `openid` scope were incorrectly identified as expired due to `auth_time` claim precision loss after a refresh token was used.
Security
Ensured that the Change Password identifier was revoked if an API was used to change a user's password after initiating a change password request.
[#1632](https://github.com/FusionAuth/fusionauth-issues/issues/1632)
Breaking Change
Removed support for the JWT authorization method when using the `GET` method on the Retrieve Refresh Tokens API (required API key instead).
[#1646](https://github.com/FusionAuth/fusionauth-issues/issues/1646)
Breaking Change
Updated reserved JWT claims by grant type, including new `amr`, `tid`, and `gty` claims.
[#1669](https://github.com/FusionAuth/fusionauth-issues/issues/1669)
New Feature
Added initial technology preview for SCIM Server (Enterprise plan feature).
[#106](https://github.com/FusionAuth/fusionauth-issues/issues/106)
New Feature
Added Nintendo Online Identity Provider support.
[#1206](https://github.com/FusionAuth/fusionauth-issues/issues/1206)
New Feature
Added new Identity Provider Link & Unlink Events.
[#1589](https://github.com/FusionAuth/fusionauth-issues/issues/1589)
New Feature
Defaulted the Event Transaction Type in the Tenant configuration to `None`.
[#1644](https://github.com/FusionAuth/fusionauth-issues/issues/1644)
Fix
Fixed an issue where the requested `AssertionConsumerServiceURL` in a SAML v2 `AuthNRequest` was ignored.
Thanks to [@pakomp](https://github.com/pakomp)
!
[#1278](https://github.com/FusionAuth/fusionauth-issues/issues/1278)
Fix
Removed the limitation where Entities did not support the use of `:` in the permission name.
Thanks to [@matthewhartstonge](https://github.com/matthewhartstonge)
!
[#1480](https://github.com/FusionAuth/fusionauth-issues/issues/1480)
Fix
Fixed an issue where an application role was not immediately available to assign to a user after initial creation.
[#1575](https://github.com/FusionAuth/fusionauth-issues/issues/1575)
Fix
Fixed an issue where the Password Grant response was missing the Two-Factor Method Ids when a Two-Factor challenge was required.
[#1585](https://github.com/FusionAuth/fusionauth-issues/issues/1585)
Fix
Fixed an issue where the Tenant edit and add panel displayed Webhook events that were not configured at the Tenant level.
[#1593](https://github.com/FusionAuth/fusionauth-issues/issues/1593)
Fix
Fixed an issue where FusionAuth failed to start on Windows when using the `startup.bat` script.
Thanks to [@James-M-Oswald](https://github.com/James-M-Oswald)
!
[#1624](https://github.com/FusionAuth/fusionauth-issues/issues/1624)
Fix
Enhanced email validation to prevent obviously incorrect emails from being used during self-service user registration.
Thanks to [@pablomadrigal](https://github.com/pablomadrigal)
!
[#1625](https://github.com/FusionAuth/fusionauth-issues/issues/1625)
Fix
Fixed an issue where ECMA 6 features such as `const` or `let` could not be used with the GraalJS Lambda engine.
[#1630](https://github.com/FusionAuth/fusionauth-issues/issues/1630)
Fix
Fixed a timing issue with Connectors that caused a login to fail.
[#1633](https://github.com/FusionAuth/fusionauth-issues/issues/1633)
Fix
Fixed an issue where the Tenant View dialog showed the incorrect Event transaction setting for a Tenant created via the API.
[#1642](https://github.com/FusionAuth/fusionauth-issues/issues/1642)
Fix
Fixed an issue where the resulting `id_token` was signed with the key configured for the `access_token` when the `openid` scope was used.
[#1643](https://github.com/FusionAuth/fusionauth-issues/issues/1643)
Fix
Ignored read-only directories inside of the configured plugin directory instead of throwing an exception.
[#1655](https://github.com/FusionAuth/fusionauth-issues/issues/1655)
Enhancement
Added a separate execute thread pool in the Apache Tomcat configuration to separate incoming requests from localhost callback requests.
[#1659](https://github.com/FusionAuth/fusionauth-issues/issues/1659)
Enhancement
Allowed for plugins that required dependent jars in their classpath.
[#1663](https://github.com/FusionAuth/fusionauth-issues/issues/1663)
Enhancement
Minimized the duration of the database Transaction during authentication to improve login performance.
[#1666](https://github.com/FusionAuth/fusionauth-issues/issues/1666)
Enhancement
Alphabetized the Applications in Select form controls in the admin UI.
[#1668](https://github.com/FusionAuth/fusionauth-issues/issues/1668)
Enhancement
Allowed a login using a 3rd party IdP such as Google to succeed even if an Elasticsearch exception occurred.
[#1673](https://github.com/FusionAuth/fusionauth-issues/issues/1673)
Internal
Updated Apache Tomcat from `8.5.72` to `8.5.77`.
[#1620](https://github.com/FusionAuth/fusionauth-issues/issues/1620)
_10 March 2022_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Fix
Fixed an issue where the FastPath install failed to download Java on Windows when using the `startup.bat` script.
Thanks to [@gkrothammer](https://github.com/gkrothammer)
!
[#1597](https://github.com/FusionAuth/fusionauth-issues/issues/1597)
Fix
Fixed an issue where using the Identity Provider Link API with multiple tenants failed unless the tenant Id was specified.
[#1609](https://github.com/FusionAuth/fusionauth-issues/issues/1609)
Fix
Fixed an issue where self-service registration failed to validate an email address beginning with `@`.
Thanks to [@pablomadrigal](https://github.com/pablomadrigal)
!
[#1617](https://github.com/FusionAuth/fusionauth-issues/issues/1617)
Fix
Fixed an issue where using the Passwordless API failed if OAuth2 state parameters were omitted and the user was not registered.
[#1623](https://github.com/FusionAuth/fusionauth-issues/issues/1623)
New Feature
Introduced the initial technology preview for HTTP requests within a lambda function (Lambda HTTP Connect), setting GraalJS as the default engine.
[#267](https://github.com/FusionAuth/fusionauth-issues/issues/267)
_23 February 2022_
Fix
Fixed an exception that caused SAML v2 Logins to FusionAuth to fail.
Thanks to [@kristianvld](https://github.com/kristianvld)
!
[#1606](https://github.com/FusionAuth/fusionauth-issues/issues/1606)
_21 February 2022_
Known Issue
SAML v2 Logins to FusionAuth failed due to an exception.
Resolved in version [`1.34.1`](/content/docs/release-notes#version-1-34-1/index.html) via
[#1606](https://github.com/FusionAuth/fusionauth-issues/issues/1606)
.
Breaking Change
Changed the OpenID Connect identity provider client authentication to strictly adhere to specifications, preventing `client_id` in the request body.
[#1595](https://github.com/FusionAuth/fusionauth-issues/issues/1595)
Breaking Change
Utilized PKCE anytime FusionAuth initiated an Authorization Code grant to FusionAuth.
[#1598](https://github.com/FusionAuth/fusionauth-issues/issues/1598)
Breaking Change
Changed the interactive Setup Wizard to check the FusionAuth newsletter sign-up box by default (opt-out instead of opt-in).
[#1577](https://github.com/FusionAuth/fusionauth-issues/issues/1577)
New Feature
Added native support for PBKDF2 using a 512-bit derived key length.
[#1604](https://github.com/FusionAuth/fusionauth-issues/issues/1604)
Security
Resolved a potential vulnerability in the IdP Link API affecting configurations using the `CreatePendingLink` linking strategy.
[#1600](https://github.com/FusionAuth/fusionauth-issues/issues/1600)
_7 February 2022_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Security
Added `-Dlog4j2.formatMsgNoLookups=true` to the `fusionauth-search` bundled version of Elasticsearch to proactively address CVE-2021-44228.
[#1520](https://github.com/FusionAuth/fusionauth-issues/issues/1520)
Security
Updated the PostgreSQL JDBC driver from version `42.2.22` to `42.3.2` to patch CVE-2022-21724.
[#1535](https://github.com/FusionAuth/fusionauth-issues/issues/1535)
Security
Proactively upgraded Logback to incorporate additional hardening added by the Logback team.
[#1530](https://github.com/FusionAuth/fusionauth-issues/issues/1530)
Security
Provided better protection against malicious actors that had access to configuring Themed templates.
[#1549](https://github.com/FusionAuth/fusionauth-issues/issues/1549)
Security
Ensured a Two-Factor challenge was enforced before changing a password using the Change Password API.
[#1591](https://github.com/FusionAuth/fusionauth-issues/issues/1591)
Breaking Change
Required obtaining a Trust Token from the Two-Factor Login API to use the Change Password API for users with Two-Factor enabled.
[#1591](https://github.com/FusionAuth/fusionauth-issues/issues/1591)
Fix
Fixed an issue where the FastPath install failed to download Java due to missing redirect support in `curl`.
[#1519](https://github.com/FusionAuth/fusionauth-issues/issues/1519)
Fix
Ensured proper handling of Login records containing more than one IP address from the `X-Forwarded-For` header.
[#1521](https://github.com/FusionAuth/fusionauth-issues/issues/1521)
Fix
Fixed an issue where the Login with Apple button failed on Safari iOS 12.
[#1526](https://github.com/FusionAuth/fusionauth-issues/issues/1526)
Fix
Fixed pagination resets in the Event Log, Audit Log, and Login Records search feature.
[#1501](https://github.com/FusionAuth/fusionauth-issues/issues/1501)
Fix
Ensured Group Membership was preserved after the first login request when using a Connector without migration.
[#1432](https://github.com/FusionAuth/fusionauth-issues/issues/1432)
Fix
Fixed an issue where the `jwt.refresh-token.revoke` event was not sent during a request to the Logout API.
Thanks to [@TimVanHerwijnen](https://github.com/TimVanHerwijnen)
!
[#1522](https://github.com/FusionAuth/fusionauth-issues/issues/1522)
Fix
Fixed display issues for consents during the complete registration step.
[#1259](https://github.com/FusionAuth/fusionauth-issues/issues/1259)
Fix
Provided better support for `user.birthDate` when using Advanced self-service registration with Family child registration.
[#1490](https://github.com/FusionAuth/fusionauth-issues/issues/1490)
Fix
Fixed an issue where the order of multiple preferred languages was not preserved.
[#1131](https://github.com/FusionAuth/fusionauth-issues/issues/1131)
Fix
Fixed a potential memory leak in the Email services.
[#1548](https://github.com/FusionAuth/fusionauth-issues/issues/1548)
Fix
Fixed an issue where the `parentEmail` field was not properly updated in the search index during a Family workflow.
[#1550](https://github.com/FusionAuth/fusionauth-issues/issues/1550)
Fix
Fixed unexpected validation errors when transitioning from Basic to Advanced Self-Service registration.
[#1560](https://github.com/FusionAuth/fusionauth-issues/issues/1560)
Fix
Fixed edge cases where a tenant got stuck in the Pending Delete state.
[#1559](https://github.com/FusionAuth/fusionauth-issues/issues/1559)
Enhancement
Added host architecture and operating system details to the About panel in the admin UI.
[#1531](https://github.com/FusionAuth/fusionauth-issues/issues/1531)
Enhancement
Added a tooltip to the Webhook Application configuration to reduce confusion.
[#1542](https://github.com/FusionAuth/fusionauth-issues/issues/1542)
Enhancement
Supported longer Refresh Tokens on the Refresh Tokens Import API (increased from 191 characters).
[#1541](https://github.com/FusionAuth/fusionauth-issues/issues/1541)
Enhancement
Used a better thread pooling strategy for Webhooks to handle large volumes of events.
[#1500](https://github.com/FusionAuth/fusionauth-issues/issues/1500)
Enhancement
Improved licensing errors to better differentiate between unlicensed installations and features requiring specific licensed plans.
[#1555](https://github.com/FusionAuth/fusionauth-issues/issues/1555)
Enhancement
Added `tokenExpirationInstant` to the Login Response.
[#1309](https://github.com/FusionAuth/fusionauth-issues/issues/1309)
Enhancement
Added User API validation in support of Family configurations with child registration restrictions.
[#1561](https://github.com/FusionAuth/fusionauth-issues/issues/1561)
Enhancement
Added support for ARM 64 architectures (Apple M1, AWS Graviton, etc.).
_Thanks to many of our community superstars for the help with this one! [@rscheuermann](https://github.com/rscheuermann), [@jerryhopper](https://github.com/jerryhopper), [@ceefour](https://github.com/ceefour), [@dmitryzan](https://github.com/dmitryzan)._
[#1532](https://github.com/FusionAuth/fusionauth-issues/issues/1532) [#49](https://github.com/FusionAuth/fusionauth-issues/issues/49)
Enhancement
Added the option to use `userId` on the Start Two-Factor API.
[#1571](https://github.com/FusionAuth/fusionauth-issues/issues/1571)
Enhancement
Moved `changePasswordId` to the request body during a POST request.
[#1214](https://github.com/FusionAuth/fusionauth-issues/issues/1214)
_13 December 2021_
Fix
Fixed an issue where Identity Provider Reconcile Lambdas were invoked more than once, potentially modifying or losing User registration data.
Thanks to [@Oceanswave](https://github.com/Oceanswave)
!
[#1517](https://github.com/FusionAuth/fusionauth-issues/issues/1517)
Fix
Fixed a missing Java module in the `1.32.0` Docker image that caused startup failures.
[#1518](https://github.com/FusionAuth/fusionauth-issues/issues/1518)
_10 December 2021_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Upgraded FusionAuth to run on Java 17, deprecating support for legacy XML signature algorithms used by older SAML v2 IdPs.
[#1202](https://github.com/FusionAuth/fusionauth-issues/issues/1202)
New Feature
Allowed optional custom SMTP headers in the Tenant email configuration.
Thanks to [@arni-inaba](https://github.com/arni-inaba)
!
[#628](https://github.com/FusionAuth/fusionauth-issues/issues/628)
Enhancement
Allowed Identity provider linking to optionally limit the number of unique links to an IdP for a particular user.
[#1310](https://github.com/FusionAuth/fusionauth-issues/issues/1310)
Enhancement
Allowed application URIs to be configured as OAuth2 Authorized request origin URLs.
Thanks to [@bonify-b2b](https://github.com/bonify-b2b)
!
[#1443](https://github.com/FusionAuth/fusionauth-issues/issues/1443)
Enhancement
Added configuration to allow implicit email verification to be disabled.
Thanks to [@lliu-20200701](https://github.com/lliu-20200701)
!
[#1467](https://github.com/FusionAuth/fusionauth-issues/issues/1467)
Enhancement
Added a notice on the Device workflow panel to allow users to optionally logout if an existing SSO session existed.
[#1495](https://github.com/FusionAuth/fusionauth-issues/issues/1495)
Fix
Fixed an issue where global and application registration count rollups failed when using PostgreSQL.
[#1498](https://github.com/FusionAuth/fusionauth-issues/issues/1498)
Fix
Fixed an issue where the Development Reset feature failed when a specific theme was configured.
[#1514](https://github.com/FusionAuth/fusionauth-issues/issues/1514)
Internal
Upgraded to Java 17 LTS.
_18 November 2021_
Known Issue
Modifying the user email or username in an Identity Provider Reconcile Lambda invoked the lambda more than once, causing data loss.
Resolved in version [`1.32.1`](/content/docs/release-notes#version-1-32-1/index.html) via
[#1517](https://github.com/FusionAuth/fusionauth-issues/issues/1517)
.
Breaking Change
Allowed modification or fabrication of an email or username in the Identity Provider Reconcile Lambda regardless of Identity Provider type.
[#1425](https://github.com/FusionAuth/fusionauth-issues/issues/1425)
Fix
Fixed an exception that occurred when requiring a birthdate and a parent email on a self-service registration form.
[#702](https://github.com/FusionAuth/fusionauth-issues/issues/702)
Fix
Improved locale handling to support locales beyond ISO 639 (e.g., `es_419`, `aghem`).
[#978](https://github.com/FusionAuth/fusionauth-issues/issues/978)
Fix
Fixed an issue where disabling webhooks from the tenant configuration table header did not work.
[#1123](https://github.com/FusionAuth/fusionauth-issues/issues/1123)
Fix
Fixed general message template issues when previewing templates or localized versions.
[#1171](https://github.com/FusionAuth/fusionauth-issues/issues/1171)
Fix
Corrected length validation for API keys created via Kickstart.
Thanks to [@miaucl](https://github.com/miaucl)
!
[#1397](https://github.com/FusionAuth/fusionauth-issues/issues/1397)
Fix
Allowed theme customization for the error message returned when a webhook failed during Self-Service Registration.
[#1446](https://github.com/FusionAuth/fusionauth-issues/issues/1446)
Fix
Fixed an issue where the Theme preview failed to render the Account Edit page for Self-Service forms.
[#1448](https://github.com/FusionAuth/fusionauth-issues/issues/1448)
Fix
Fixed the inability to delete an email template when it was not assigned to a Consent.
[#1449](https://github.com/FusionAuth/fusionauth-issues/issues/1449)
Fix
Fixed a timing issue when registering a user immediately after creating a new Application role.
Since: [`1.30.2`](/content/docs/release-notes#version-1-30-2/index.html)
Thanks to [@johnmaia](https://github.com/johnmaia)
!
[#1452](https://github.com/FusionAuth/fusionauth-issues/issues/1452)
Fix
Fixed an infinite redirect loop caused by using an expired Passwordless link.
Since: [`1.27.0`](/content/docs/release-notes#version-1-27-0/index.html)
Thanks to [@rscheuermann](https://github.com/rscheuermann)
!
[#1456](https://github.com/FusionAuth/fusionauth-issues/issues/1456)
Fix
Added missing validation to ensure the User existed by Id on the Registration API.
[#1457](https://github.com/FusionAuth/fusionauth-issues/issues/1457)
Fix
Ensured Blocked domain configurations were preserved when copying a Tenant in the admin UI.
[#1459](https://github.com/FusionAuth/fusionauth-issues/issues/1459)
Fix
Ensured the resulting JWT contained the `aud` claim when using the OAuth2 Password grant with `client_id` in the HTTP Basic Authorization header.
[#1462](https://github.com/FusionAuth/fusionauth-issues/issues/1462)
Fix
Fixed a database foreign key violation in the Registration Count aggregation service if a Tenant was deleted before the aggregator ran.
Since: [`1.30.2`](/content/docs/release-notes#version-1-30-2/index.html)
[#1466](https://github.com/FusionAuth/fusionauth-issues/issues/1466)
Fix
Fixed QR code rendering failures for Two-Factor authentication when the encoded string length was between 192 and 220 characters.
[#1470](https://github.com/FusionAuth/fusionauth-issues/issues/1470)
Fix
Ensured roles assigned by Group membership were returned when users were also explicitly assigned roles.
Since: [`1.30.2`](/content/docs/release-notes#version-1-30-2/index.html)
[#1473](https://github.com/FusionAuth/fusionauth-issues/issues/1473)
Fix
Fixed an issue where the Setup Password email template included an erroneous `client_id` when used via the User Registration API.
[#1476](https://github.com/FusionAuth/fusionauth-issues/issues/1476)
Fix
Fixed a signature validation failure when a SAML v2 SP used lower case percent encoding in the query string.
_Thanks to the engineering team at [HAProxy](https://www.haproxy.com/) for the assist!_
[#1496](https://github.com/FusionAuth/fusionauth-issues/issues/1496)
Enhancement
Allowed access to the `id_token` when available during an OpenID Connect Reconcile lambda.
Thanks to [@Thammada](https://github.com/Thammada)
!
[#323](https://github.com/FusionAuth/fusionauth-issues/issues/323)
Enhancement
Added additional support for `idp_hint` for Apple and Twitter Identity Providers.
[#1306](https://github.com/FusionAuth/fusionauth-issues/issues/1306)
Enhancement
Added example user details to the Audit Log Test event in the Webhook Tester.
[#1360](https://github.com/FusionAuth/fusionauth-issues/issues/1360)
Enhancement
Produced an Event Log when FusionAuth was unable to discover OpenID endpoints using the configured Issuer.
[#1417](https://github.com/FusionAuth/fusionauth-issues/issues/1417)
Internal
Updated the internal scheduler library.
[#1461](https://github.com/FusionAuth/fusionauth-issues/issues/1461)
_13 October 2021_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Fix
Fixed an exception occurring when logging in with an anonymous user from an IdP that had its linking strategy changed.
[#1316](https://github.com/FusionAuth/fusionauth-issues/issues/1316)
Fix
Fixed a FreeMarker exception that prevented the view dialog for a SAML v2 IdP Initiated configuration from completely rendering.
[#1324](https://github.com/FusionAuth/fusionauth-issues/issues/1324)
Fix
Fixed an issue where activating FusionAuth Reactor via Kickstart with CAPTCHA enabled prevented login until Threat Detection came online.
[#1358](https://github.com/FusionAuth/fusionauth-issues/issues/1358)
Fix
Fixed the .NET client library's handling of `exp` and other JWT timestamp values.
Thanks to [@RyanDennis2018](https://github.com/RyanDennis2018)
!
[#1362](https://github.com/FusionAuth/fusionauth-issues/issues/1362)
Fix
Fixed an exception when duplicating an Application that had SAML v2 configured but not enabled.
Since: [`1.28.0`](/content/docs/release-notes#version-1-28-0/index.html)
[#1366](https://github.com/FusionAuth/fusionauth-issues/issues/1366)
Fix
Fixed a regression where updating a connector added an additional `*` domain configuration.
[#1367](https://github.com/FusionAuth/fusionauth-issues/issues/1367)
Fix
Fixed the inability to specify a certain Id when generating an RSA Key.
[#1368](https://github.com/FusionAuth/fusionauth-issues/issues/1368)
Fix
Fixed an issue where users got stuck in the Setup Wizard if advanced threat detection was enabled via kickstart.
[#1369](https://github.com/FusionAuth/fusionauth-issues/issues/1369)
Fix
Fixed the inability to delete entries from an access control list using the admin UI.
Since: [`1.30.0`](/content/docs/release-notes#version-1-30-0/index.html)
[#1371](https://github.com/FusionAuth/fusionauth-issues/issues/1371)
Fix
Restored default lambdas in Kickstart environment variables (regression introduced in 1.30.0).
[#1373](https://github.com/FusionAuth/fusionauth-issues/issues/1373)
Fix
Ensured complete event payloads for user deactivations initiated via the admin UI.
[#1375](https://github.com/FusionAuth/fusionauth-issues/issues/1375)
Fix
Fixed a NullPointerException occurring during an upgrade if Kickstart, maintenance mode, and default tenant Id modification coincided.
[#1382](https://github.com/FusionAuth/fusionauth-issues/issues/1382)
Fix
Fixed an issue where the IP address was missing from login records in certain circumstances.
[#1391](https://github.com/FusionAuth/fusionauth-issues/issues/1391)
Fix
Fixed NumberFormatExceptions caused by IPv6 addresses.
[#1392](https://github.com/FusionAuth/fusionauth-issues/issues/1392)
Fix
Fixed CAPTCHA functionality on the email verification required page.
[#1396](https://github.com/FusionAuth/fusionauth-issues/issues/1396)
Fix
Fixed rendering of the passwordValidationRules object on the register page in theme preview.
[#1398](https://github.com/FusionAuth/fusionauth-issues/issues/1398)
Fix
Fixed an empty value in the User search widget if the user lacked a name.
[#1399](https://github.com/FusionAuth/fusionauth-issues/issues/1399)
Fix
Ensured device trust was saved after filling out a CAPTCHA.
[#1400](https://github.com/FusionAuth/fusionauth-issues/issues/1400)
Fix
Fixed the Setup Wizard displaying in a multi-node environment after it had completed.
[#1402](https://github.com/FusionAuth/fusionauth-issues/issues/1402)
Fix
Allowed setting the rate limit configuration to 1 for advanced threat detection.
[#1407](https://github.com/FusionAuth/fusionauth-issues/issues/1407)
Fix
Displayed custom data for webhooks in the admin UI.
[#1422](https://github.com/FusionAuth/fusionauth-issues/issues/1422)
Fix
Improved handling of truncated deflated SAML AuthN requests.
[#1424](https://github.com/FusionAuth/fusionauth-issues/issues/1424)
Fix
Made all key pairs capable of signing a SAML request eligible in the UI.
[#1430](https://github.com/FusionAuth/fusionauth-issues/issues/1430)
Fix
Displayed custom data for connectors in the admin UI.
[#1435](https://github.com/FusionAuth/fusionauth-issues/issues/1435)
Enhancement
Improved retrieval performance for MySQL databases with large numbers of applications and application roles.
Thanks to [@nikos](https://github.com/nikos)
!
[#480](https://github.com/FusionAuth/fusionauth-issues/issues/480)
Enhancement
Improved the performance of the Public Key API endpoint for instances with many applications and keys.
Thanks to [@nulian](https://github.com/nulian)
and [@Johpie](https://github.com/Johpie)
!
[#1145](https://github.com/FusionAuth/fusionauth-issues/issues/1145)
Enhancement
Displayed the database and Elasticsearch versions in the admin UI.
[#1390](https://github.com/FusionAuth/fusionauth-issues/issues/1390)
Enhancement
Improved User and Registration API performance at scale.
[#1415](https://github.com/FusionAuth/fusionauth-issues/issues/1415)
Enhancement
Attempted to support SAML POST bindings with SSO even when cookie `SameSite` policy was set to `SameSite=Lax`.
[#1426](https://github.com/FusionAuth/fusionauth-issues/issues/1426)
Enhancement
Added a default NameID format when one was omitted from SAML AuthN or Logout requests.
[#1428](https://github.com/FusionAuth/fusionauth-issues/issues/1428)
Internal
Updated Apache Tomcat from `8.5.63` to `8.5.72`.
[#1433](https://github.com/FusionAuth/fusionauth-issues/issues/1433)
_25 August 2021_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Registration counts failed to be rolled up into reports when using PostgreSQL.
Resolved in version [`1.30.2`](/content/docs/release-notes#version-1-30-2/index.html) via
[#1498](https://github.com/FusionAuth/fusionauth-issues/issues/1498)
.
Known Issue
A potential memory leak was introduced in this version.
Resolved in version [`1.33.0`](/content/docs/release-notes#version-1-33-0/index.html) via
[#1548](https://github.com/FusionAuth/fusionauth-issues/issues/1548)
.
Fix
Fixed an issue where the Text MIME type of an email did not render Unicode correctly if the host system lacked `UTF-8` as the default character set.
Thanks to [@soullivaneuh](https://github.com/soullivaneuh)
!
[#1122](https://github.com/FusionAuth/fusionauth-issues/issues/1122)
Fix
Fixed the inability to assign an IP ACL to an application if one was not already assigned to the tenant.
[#1349](https://github.com/FusionAuth/fusionauth-issues/issues/1349)
Fix
Fixed the inability to delete an IP ACL currently in use by a tenant.
[#1350](https://github.com/FusionAuth/fusionauth-issues/issues/1350)
Enhancement
Included general performance improvements for login, OAuth2 grants, and user create and registration processes.
Enhancement
Added User Two-Factor methods to the Elasticsearch index.
Thanks to [@flangfeldt](https://github.com/flangfeldt)
!
[#1352](https://github.com/FusionAuth/fusionauth-issues/issues/1352)
_12 August 2021_
Fix
Fixed a regression where users required to complete registration after login were unable to login without a password reset.
Since: [`1.28.0`](/content/docs/release-notes#version-1-28-0/index.html)
Thanks to [@flangfeldt](https://github.com/flangfeldt)
!
[#1344](https://github.com/FusionAuth/fusionauth-issues/issues/1344)
_12 August 2021_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Referencing Reconcile Lambda Ids using the syntax `FUSIONAUTH_LAMBDA{type}_ID` failed due to initialization changes. Workaround: modify kickstart to build a custom lambda.
Breaking Change
Added a new themed page for Unauthorized access.
Theme Upgrade
Modified the `[@helpers.input]` macro to build checkboxes, potentially requiring updates for existing custom themes.
New Feature
Introduced the JWT Vending machine to create JWTs for non-existent users with a caller-defined payload.
[#525](https://github.com/FusionAuth/fusionauth-issues/issues/525)
New Feature
Added robust Threat Detection features for enterprise customers, including:
- Rate limiting per user for the following requests:
- Failed login (only used if Failed Login configuration is not in use)
- Forgot password
- Send email verification
- Send passwordless
- Send registration verification
- Send two-factor
- IP location.
- When possible, an IP address will be resolved to include city, country, region, zip code, longitude and latitude.
- IP location will be included in login records and will be available in some email templates and webhook events
- Used to calculate impossible travel between login locations
- New transactional emails:
- Email update
- Login Id duplicate on create
- Login Id duplicate on update
- Login with new device
- Suspicious login
- Password reset success
- Password update
- Two-factor method added
- Two-factor method removed
[#933](https://github.com/FusionAuth/fusionauth-issues/issues/933)
New Feature
Added a CAPTCHA option (Google ReCaptcha v2, Google ReCaptcha v3, HCaptcha and HCaptcha Enterprise) for login and other end user forms to help ensure only humans are submitting forms.
This feature is in tech preview and is subject to change.
[#278](https://github.com/FusionAuth/fusionauth-issues/issues/278)
New Feature
Introduced the following new Webhook events:
- Audit Log Create `audit-log.create`
- Event Log Create `event-log.create`
- Kickstart Success `kickstart.success`
- User Create Complete `user.create.complete`
- User Delete Complete `user.delete.complete`
- User Update Complete `user.update.complete`
- User LoginId Duplicate On Create `user.loginId.duplicate.create`
- User LoginId Duplicate Update `user.loginId.duplicate.update`
- User Email Update `user.email.update`
- User Login New Device `user.login.new-device`
- User Login Suspicious `user.login.suspicious`
- User Password Reset Success `user.password.reset.success`
- User Password Reset Send `user.password.reset.send`
- User Password Reset Start `user.password.reset.start`
- User Password Update `user.password.update`
- User Registration Create Complete `user.registration.create.complete`
- User Registration Delete Complete `user.registration.delete.complete`
- User Registration Update Complete `user.registration.update.complete`
- User Two-Factor Method Added `user.two-factor.method.add`
- User Two-Factor Method Removed `user.two-factor.method.remove`
See the [Event Webhooks](/content/docs/extend/events-and-webhooks/index.html) documentation for additional details.
Resolves GitHub Issues [#1308](https://github.com/FusionAuth/fusionauth-issues/issues/1308), [#1178](https://github.com/FusionAuth/fusionauth-issues/issues/1178), [#1128](https://github.com/FusionAuth/fusionauth-issues/issues/1128), and [#1129](https://github.com/FusionAuth/fusionauth-issues/issues/1129).
Thanks to [@adoliver](https://github.com/adoliver)
!
[#1308](https://github.com/FusionAuth/fusionauth-issues/issues/1308)
New Feature
Added new transactional emails for events like Suspicious login, New device login, Password updates, and Two-factor method changes.
Enhancement
Allowed searching on `oldValue`, `newValue`, and `reason` within the Audit Log.
Enhancement
Made recently completed links available on the Device complete themed page via the `completedLinks` variable.
Enhancement
Exposed the currently logged in user to more themed pages using the `currentUser` variable.
Fix
Fixed the inability to enable `user.action` events at the tenant level via the UI.
[#1307](https://github.com/FusionAuth/fusionauth-issues/issues/1307)
Fix
Fixed an exception occurring when making an API request to `/api/two-factor/login` with an empty JSON body.
[#1330](https://github.com/FusionAuth/fusionauth-issues/issues/1330)
Fix
Fixed an issue where tokens were not correctly stored when using an IdP with a linking mode other than Create Pending Link.
[#1341](https://github.com/FusionAuth/fusionauth-issues/issues/1341)
Fix
Enabled the use of `idp_hint` to bypass the login page and federate to another provider when FusionAuth acted as a SAML v2 IdP.
[#1331](https://github.com/FusionAuth/fusionauth-issues/issues/1331)
_6 August 2021_
Fix
Fixed an issue where a `404` was returned when attempting to update a user via `PUT` or `PATCH` if the user had an unverified email and email verification was disabled.
[#1333](https://github.com/FusionAuth/fusionauth-issues/issues/1333)
_31 July 2021_
Fix
Fixed an exception occurring when parsing a SAML v2 IdP response that lacked a `KeyInfo` element.
[#1332](https://github.com/FusionAuth/fusionauth-issues/issues/1332)
_26 July 2021_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Fix
Fixed an issue where SSO sessions were prematurely terminated in multi-tenant configurations if one tenant had a lower TTL.
[#1262](https://github.com/FusionAuth/fusionauth-issues/issues/1262)
Fix
Corrected argument names in the `LambdaType` enum.
[#1284](https://github.com/FusionAuth/fusionauth-issues/issues/1284)
Fix
Fixed an issue where an IdP Debug event log was not produced when a unique Id could not be resolved.
[#1315](https://github.com/FusionAuth/fusionauth-issues/issues/1315)
Fix
Fixed an exception occurring when enabling the SAML v2 IdP debug log.
[#1317](https://github.com/FusionAuth/fusionauth-issues/issues/1317)
_10 July 2021_
Enhancement
Enhanced the Link API to retrieve a user by a 3rd party unique Id.
[#1277](https://github.com/FusionAuth/fusionauth-issues/issues/1277)
Enhancement
Showed an intermediate page during a device link request asking the user to sign in with an existing user or create a new one.
[#1287](https://github.com/FusionAuth/fusionauth-issues/issues/1287)
Enhancement
Allowed the IdP Login API to optionally bypass establishing a link and return a `404`.
[#1288](https://github.com/FusionAuth/fusionauth-issues/issues/1288)
Enhancement
Added configuration to support always appending a suffix to unique usernames even when the username is not in use.
[#1290](https://github.com/FusionAuth/fusionauth-issues/issues/1290)
Enhancement
Added an additional debug event log for the SAML IdP to debug the `AuthN` request sent to the IdP.
[#1293](https://github.com/FusionAuth/fusionauth-issues/issues/1293)
Enhancement
Allowed FusionAuth to accept `NameID` values if the format was returned as `unspecified` from the SAML v2 IdP.
[#1294](https://github.com/FusionAuth/fusionauth-issues/issues/1294)
Enhancement
Produced an event log instead of logging FreeMarker exceptions to the system log, improving UI error handling depending on the runtime mode.
[#1299](https://github.com/FusionAuth/fusionauth-issues/issues/1299)
Fix
Fixed an error logged when viewing the theme preview for the `oauth2/start-idp-link.ftl` template.
[#1276](https://github.com/FusionAuth/fusionauth-issues/issues/1276)
Fix
Fixed an issue where a non-themed error page displayed when a webhook transaction failed to create a user/registration.
[#1279](https://github.com/FusionAuth/fusionauth-issues/issues/1279)
Internal
Updated HikariCP to `4.0.3` and PostgreSQL JDBC driver to `42.2.22`.
[#1300](https://github.com/FusionAuth/fusionauth-issues/issues/1300)
_21 June 2021_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Fix
Allowed self-consent form fields on self-service forms.
[#1258](https://github.com/FusionAuth/fusionauth-issues/issues/1258)
Fix
Corrected validation of consent form fields during edits.
[#1260](https://github.com/FusionAuth/fusionauth-issues/issues/1260)
Fix
Fixed an issue where imported users requiring password changes failed email verification with an email verification gate.
[#1265](https://github.com/FusionAuth/fusionauth-issues/issues/1265)
Fix
Improved parsing of the `X-Forwarded-For` HTTP header to strictly preserve only the first IP address for login records.
[#1267](https://github.com/FusionAuth/fusionauth-issues/issues/1267)
Fix
Correctly displayed the Verification URL in the OAuth2 configuration when the `Device` grant was selected.
[#1268](https://github.com/FusionAuth/fusionauth-issues/issues/1268)
Fix
Used the correct FusionAuth redirect URL for the Sony PlayStation Network IdP.
[#1269](https://github.com/FusionAuth/fusionauth-issues/issues/1269)
Fix
Used the correct FusionAuth implicit callback URL for the Steam IdP.
[#1272](https://github.com/FusionAuth/fusionauth-issues/issues/1272)
Fix
Allowed the Epic Games IdP to function properly when omitting the `scope` configuration property.
[#1273](https://github.com/FusionAuth/fusionauth-issues/issues/1273)
New Feature
(Tech Preview) Permitted starting an account link when beginning a Device grant.
[#1274](https://github.com/FusionAuth/fusionauth-issues/issues/1274)
_7 June 2021_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Self-service registration users lacking required fields could get locked out post-login.
Resolved in version [`1.29.4`](/content/docs/release-notes#version-1-29-4/index.html) via
[#1344](https://github.com/FusionAuth/fusionauth-issues/issues/1344)
.
Thanks to [@flangfeldt](https://github.com/flangfeldt)
!
Known Issue
SAML v2 Populate/Reconcile Lambdas changed the `NameID` field to an array, requiring code updates.
Breaking Change
Removed the ability to build synthetic email addresses using a lambda for OpenID Connect identity providers.
Breaking Change
Accepted `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` in addition to `emailAddress` when FusionAuth acted as a SAML IdP.
Breaking Change
Stored tokens from IdPs with the IdP link instead of on the User Registration object.
New Feature
Introduced the Reindex API to rebuild the Elasticsearch index.
[#1232](https://github.com/FusionAuth/fusionauth-issues/issues/1232)
New Feature
Introduced the Account Link API to link/un-link 3rd party identity provider users with a FusionAuth user.
New Feature
Added comprehensive IdP Linking options, including linking by email, username, anonymous, or existing user links.
New Feature
Allowed the Email Send API to send to un-registered email addresses instead of only existing FusionAuth `userId`s.
[#743](https://github.com/FusionAuth/fusionauth-issues/issues/743)
New Feature
Enabled SAML Identity Providers to use any NameID format.
New Feature
(Tech Preview) Added new IdPs for EpicGames, Nintendo, Sony PlayStation Network, Steam, Twitch, and Xbox.
[#1205](https://github.com/FusionAuth/fusionauth-issues/issues/1205)
New Feature
(Tech Preview) Added Development kickstart reset capability in the System navigation menu.
New Feature
(Tech Preview) Added a JWT populate lambda for the Client Credentials grant.
[#1233](https://github.com/FusionAuth/fusionauth-issues/issues/1233)
Enhancement
Allowed FusionAuth (as SAML IdP) to send NameID formats of Email or Persistent.
[#522](https://github.com/FusionAuth/fusionauth-issues/issues/522)
Enhancement
Changed Facebook and Google IdPs to default to redirects instead of popups, and added support for the `idp_hint` parameter.
[#909](https://github.com/FusionAuth/fusionauth-issues/issues/909)
Enhancement
Added flexible PKCE configuration options (required, not required, or required for public clients).
[#1152](https://github.com/FusionAuth/fusionauth-issues/issues/1152)
Enhancement
Added the currently selected Two-Factor method object to the Themed Two-Factor page.
Thanks to [@flangfeldt](https://github.com/flangfeldt)
!
[#1237](https://github.com/FusionAuth/fusionauth-issues/issues/1237)
Enhancement
Allowed using IdP buttons on the Themed registration page.
Thanks to [@gordody](https://github.com/gordody)
!
[#554](https://github.com/FusionAuth/fusionauth-issues/issues/554)
Enhancement
Added the option to resend verification emails to users entering a gated page.
Thanks to [@lliu-20200701](https://github.com/lliu-20200701)
!
[#1247](https://github.com/FusionAuth/fusionauth-issues/issues/1247)
Fix
Removed the `NotBefore` assertion on the SAML AuthN response on the subject confirmation.
Thanks to [@pakomp](https://github.com/pakomp)
!
[#1215](https://github.com/FusionAuth/fusionauth-issues/issues/1215)
Fix
Fixed exceptions when importing users with `passwordChangeRequired=true` without specifying a change reason.
Thanks to [@lliu-20200701](https://github.com/lliu-20200701)
!
[#1245](https://github.com/FusionAuth/fusionauth-issues/issues/1245)
Fix
Fixed gating behavior for self-service registration users requiring email verification.
Thanks to [@lliu-20200701](https://github.com/lliu-20200701)
!
[#1246](https://github.com/FusionAuth/fusionauth-issues/issues/1246)
Fix
Fixed a JavaScript bug causing theme pages to render incorrectly in the view window.
Thanks to [@flangfeldt](https://github.com/flangfeldt)
!
[#1228](https://github.com/FusionAuth/fusionauth-issues/issues/1228)
_10 May 2021_
Breaking Change
Restored the ability to use `user.data.email` for Forgot Password and Passwordless login flows.
Since: [`1.26.0`](/content/docs/release-notes#version-1-26-0/index.html)
Thanks to [@mcs](https://github.com/mcs)
!
[#1204](https://github.com/FusionAuth/fusionauth-issues/issues/1204)
Fix
Fixed JavaScript errors during page render for new themes that prevented proper browser type capture.
[#1216](https://github.com/FusionAuth/fusionauth-issues/issues/1216)
_7 May 2021_
Fix
Fixed an issue where the add Tenant panel failed to render during migration from versions prior to `1.26.0`.
Since: [`1.27.0`](/content/docs/release-notes#version-1-27-0/index.html)
[#1196](https://github.com/FusionAuth/fusionauth-issues/issues/1196)
Fix
Simplified the verification flow when enabling both email and registration verification during self-service registration.
[#1198](https://github.com/FusionAuth/fusionauth-issues/issues/1198)
Fix
Fixed rendering issues for the SAML v2 IdP Initiated configuration view dialog.
[#1200](https://github.com/FusionAuth/fusionauth-issues/issues/1200)
Fix
Fixed validation failures for SAML v2 IdP Initiated configurations lacking a URL-based `issuer`.
[#1203](https://github.com/FusionAuth/fusionauth-issues/issues/1203)
_5 May 2021_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Returned a `213` status code for "Registration Not Verified" on the Login API.
Breaking Change
Allowed the Login API and User API to optionally return `emailVerificationId` or `registrationVerificationId` to assist verification workflows utilizing short codes.
Breaking Change
Updated the Verify Email and Verify Registration APIs to take the `verificationId` in the request body instead of a URL segment.
Breaking Change
Returned verification IDs during `PUT` requests to the Login API (ping) when utilizing short code strategies.
New Feature
(Tech Preview) Added Application Themes, allowing specific themes to override tenant configurations.
[#769](https://github.com/FusionAuth/fusionauth-issues/issues/769)
New Feature
(Tech Preview) Added an Email verification gate forcing users to verify emails before redirection.
[#1191](https://github.com/FusionAuth/fusionauth-issues/issues/1191)
New Feature
(Tech Preview) Added configurable verification strategies to use interactive forms instead of clickable links.
[#1191](https://github.com/FusionAuth/fusionauth-issues/issues/1191)
New Feature
(Tech Preview) Allowed unique usernames by managing a unique suffix for duplicate selections.
[#1190](https://github.com/FusionAuth/fusionauth-issues/issues/1190)
New Feature
Introduced the Product Version API to retrieve the system version.
Thanks to [@jegger](https://github.com/jegger)
!
[#1193](https://github.com/FusionAuth/fusionauth-issues/issues/1193)
Enhancement
Added support to better handle Microsoft Outlook Safe Links.
[#629](https://github.com/FusionAuth/fusionauth-issues/issues/629)
Enhancement
Supported HTTP Basic Auth using an API key for the Prometheus Metrics endpoint.
[#1189](https://github.com/FusionAuth/fusionauth-issues/issues/1189)
Fix
Fixed CleanSpeak username filtering for single-step advanced self-service registration forms.
[#1158](https://github.com/FusionAuth/fusionauth-issues/issues/1158)
Fix
Fixed the missing link to SAML v2 IdP Initiated Add in the admin UI.
[#1181](https://github.com/FusionAuth/fusionauth-issues/issues/1181)
Fix
Allowed the admin UI to upgrade and downgrade API keys for Key Manager.
[#1174](https://github.com/FusionAuth/fusionauth-issues/issues/1174)
_20 April 2021_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Using a non-default theme for the FusionAuth default tenant caused an error when trying to log in to the admin UI.
Resolved in version [`1.26.1`](/content/docs/release-notes#version-1-26-1/index.html) via
[#1175](https://github.com/FusionAuth/fusionauth-issues/issues/1175)
.
Breaking Change
Changed the Two-Factor API to allow enabling/disabling methods and sending codes.
Breaking Change
Updated the Two-Factor Login API to return a `409` for too many attempts, matching standard Login API locking capabilities.
Breaking Change
Changed the Import API and User API regarding enabling Two-Factor methods.
Breaking Change
Required a paid FusionAuth plan for Email and SMS Two-Factor methods (Authenticator/TOTP remained free).
Breaking Change
Required a two-stage upgrade process for versions older than `1.7.0`.
New Feature
(Tech Preview) Added Entity Management.
[#881](https://github.com/FusionAuth/fusionauth-issues/issues/881)
New Feature
Added a Prometheus Metrics endpoint.
[#362](https://github.com/FusionAuth/fusionauth-issues/issues/362)
New Feature
Added IdP initiated SSO.
[#566](https://github.com/FusionAuth/fusionauth-issues/issues/566)
New Feature
Introduced an API key capable of creating other API keys.
Thanks to [@Tintwo](https://github.com/Tintwo)
!
[#887](https://github.com/FusionAuth/fusionauth-issues/issues/887)
New Feature
Delivered Two-Factor step-up APIs, configurable SMS delivery methods, and Localized Message Templates.
[#960](https://github.com/FusionAuth/fusionauth-issues/issues/960)
New Feature
Added a self-service user profile page.
[#682](https://github.com/FusionAuth/fusionauth-issues/issues/682)
New Feature
Added a themeable root page.
[#378](https://github.com/FusionAuth/fusionauth-issues/issues/378)
New Feature
Added Messengers to send SMS via Twilio, Kafka, or generic JSON REST APIs.
New Feature
Supported air-gapped deployments for licensing.
New Feature
Introduced the Client Credentials grant.
[#155](https://github.com/FusionAuth/fusionauth-issues/issues/155)
Enhancement
Added IP address information to login success and failed events.
[#1162](https://github.com/FusionAuth/fusionauth-issues/issues/1162)
Fix
Allowed deleting user registrations for inactive applications.
[#1148](https://github.com/FusionAuth/fusionauth-issues/issues/1148)
Fix
Fixed spurious text `[object Object]` appearing on the admin UI due to certain Chrome extensions.
Thanks to [@NikolayMetchev](https://github.com/NikolayMetchev)
!
[#1151](https://github.com/FusionAuth/fusionauth-issues/issues/1151)
_20 April 2021_
Fix
Fixed login errors to the admin UI after upgrading for instances using non-default themes for the default tenant.
[#1175](https://github.com/FusionAuth/fusionauth-issues/issues/1175)
Known Issue
Users could not create a "SAML v2 IdP Initiated" Identity Provider in the admin UI dropdown.
_10 March 2021_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Theme Upgrade
Added the `SAMLv2 logout template` to themes in support of the SAML v2 Logout feature.
New Feature
Added full support for SAML v2 Logout.
[#1137](https://github.com/FusionAuth/fusionauth-issues/issues/1137)
Enhancement
Added a button to the Sessions tab to delete all user sessions simultaneously.
[#1094](https://github.com/FusionAuth/fusionauth-issues/issues/1094)
Enhancement
Added Debug output to OAuth grants, primarily to assist Authorization Code grant exchanges.
[#781](https://github.com/FusionAuth/fusionauth-issues/issues/781)
Enhancement
Added CORS Debug to assist in troubleshooting `403` HTTP status codes.
[#1126](https://github.com/FusionAuth/fusionauth-issues/issues/1126)
Enhancement
Improved SMTP debug context regarding tenants and templates during async connection exceptions.
[#1064](https://github.com/FusionAuth/fusionauth-issues/issues/1064)
Enhancement
Allowed the Registration API to accept the `applicationId` as a URL segment.
[#1127](https://github.com/FusionAuth/fusionauth-issues/issues/1127)
Enhancement
Allowed the Twitter IdP Login API to optionally accept an access token (`oauth_token` and `oauth_token_secret`).
[#1073](https://github.com/FusionAuth/fusionauth-issues/issues/1073)
Enhancement
Generated JWK thumbprints for Key Master `kid` identifiers when a public key was present.
[#1136](https://github.com/FusionAuth/fusionauth-issues/issues/1136)
Enhancement
Ensured pagination results reflected accurate representation of matching users when using advanced search controls in the admin UI.
Enhancement
SAML v2 Logout is now fully supported. No action should be required. If you are currently using FusionAuth as a SAML v2 IdP, please verify your configuration as you may want to provide additional configuration to take full advantage of the SAML v2 Logout configuration.
Fix
Fixed errors when using the Search API with Elasticsearch version 6 by providing the `accurateTotal=true` workaround parameter.
[#1135](https://github.com/FusionAuth/fusionauth-issues/issues/1135)
Fix
Fixed erroneous validation errors when using the HTTP `PATCH` method on the FusionAuth application.
[#1110](https://github.com/FusionAuth/fusionauth-issues/issues/1110)
Fix
Fixed issues adding Java options containing spaces in the configuration file.
Thanks to [@NikolayMetchev](https://github.com/NikolayMetchev)
!
[#1065](https://github.com/FusionAuth/fusionauth-issues/issues/1065)
Fix
Fixed a `NullPointerException` when generating login reports for applications in non-default tenants.
[#1115](https://github.com/FusionAuth/fusionauth-issues/issues/1115)
Fix
Fixed unexpected `state` parameters appearing on the `redirect_uri` when omitting them from Authorization requests.
[#1113](https://github.com/FusionAuth/fusionauth-issues/issues/1113)
Internal
Upgraded Tomcat from `8.5.57` to `8.5.63`.
[#1119](https://github.com/FusionAuth/fusionauth-issues/issues/1119)
_11 February 2021_
Known Issue
Errors occurred when using the Search API on Elasticsearch version 6.
Resolved in version [`1.25.0`](/content/docs/release-notes#version-1-25-0/index.html) via
[#1135](https://github.com/FusionAuth/fusionauth-issues/issues/1135)
.
Security
Implemented consistent usage of the `Cache-Control` HTTP response headers to limit caching of sensitive pages.
[#1103](https://github.com/FusionAuth/fusionauth-issues/issues/1103)
Security
Resolved vulnerabilities in the underlying SAML v2 library (CVE-2021-27736, CSNC-2021-004).
Breaking Change
Removed the `applicationId` and `roles` claims from the `id_token` issued via the `openid` scope to prevent authorization misuse.
[#1102](https://github.com/FusionAuth/fusionauth-issues/issues/1102)
Fix
Fixed truncated form requests for instances with over 2,000 applications by increasing maximum parameter limits.
[#1057](https://github.com/FusionAuth/fusionauth-issues/issues/1057)
Fix
Fixed the Tenant View dialog failing to render when custom password hashing plugins were registered.
[#1063](https://github.com/FusionAuth/fusionauth-issues/issues/1063)
Fix
Restored the ability to remove a User from a Group using the admin UI dialog.
[#1081](https://github.com/FusionAuth/fusionauth-issues/issues/1081)
Fix
Ensured user delete requests succeeded even if the user was missing from the Elasticsearch index.
[#1088](https://github.com/FusionAuth/fusionauth-issues/issues/1088)
Fix
Fixed missing `roles` claims when creating a User and Registration simultaneously without explicitly assigned roles.
[#1106](https://github.com/FusionAuth/fusionauth-issues/issues/1106)
Fix
Ensured users remained searchable by Group memberships immediately after updates.
[#1087](https://github.com/FusionAuth/fusionauth-issues/issues/1087)
Fix
Allowed Kafka Producer configurations containing equals signs (`=`) in property values to parse correctly.
Thanks to [@chris-bridges](https://github.com/chris-bridges)
!
[#1107](https://github.com/FusionAuth/fusionauth-issues/issues/1107)
Enhancement
Supported Kickstart files utilizing only a `licenseId` without requiring API keys.
[#1080](https://github.com/FusionAuth/fusionauth-issues/issues/1080)
Enhancement
Allowed importing RSA certificates with key bit lengths less than `2048` into Key Master.
[#1085](https://github.com/FusionAuth/fusionauth-issues/issues/1085) [#1091](https://github.com/FusionAuth/fusionauth-issues/issues/1091)
Enhancement
Added the `accurateTotal` Search API parameter to fetch exact hit counts from Elasticsearch.
[#1086](https://github.com/FusionAuth/fusionauth-issues/issues/1086)
Enhancement
Allowed users to click the 'Enabled' column header to toggle all Webhook events simultaneously.
[#1093](https://github.com/FusionAuth/fusionauth-issues/issues/1093)
Enhancement
Added item counts to the bottom of non-paginated lists in the admin UI.
[#1104](https://github.com/FusionAuth/fusionauth-issues/issues/1104)
Internal
Enhanced JavaScript event handlers to perform better on pages with thousands of applications.
[#1105](https://github.com/FusionAuth/fusionauth-issues/issues/1105)
_21 January 2021_
Fix
Fixed an issue where tenant delete requests failed.
[#1075](https://github.com/FusionAuth/fusionauth-issues/issues/1075)
_20 January 2021_
Fix
Fixed a bug in the PostgreSQL migration that caused the loss of SAML v2 IdP configurations.
[#1074](https://github.com/FusionAuth/fusionauth-issues/issues/1074)
_13 January 2021_
Fix
Corrected the SAML v2 SP metadata to properly reflect the `AuthnRequestsSigned` configuration.
[#1067](https://github.com/FusionAuth/fusionauth-issues/issues/1067)
_11 January 2021_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Using PostgreSQL with the provided LinkedIn Reconcile lambda required a manual edit to remove empty lines in the lambda body.
Known Issue
Users were unable to remove a User from a group using the admin UI dialog.
Resolved in version [`1.24.0`](/content/docs/release-notes#version-1-24-0/index.html) via
[#1081](https://github.com/FusionAuth/fusionauth-issues/issues/1081)
.
Fix
Fixed an issue where validation errors were not visible when selecting self-service registration options on unlicensed installations.
[#951](https://github.com/FusionAuth/fusionauth-issues/issues/951)
Fix
Changed the User Action API to correctly return a `404` status code instead of `200` when requesting an action by a non-existent Id.
Thanks to [@hkolbeck-streem](https://github.com/hkolbeck-streem)
!
[#991](https://github.com/FusionAuth/fusionauth-issues/issues/991)
Fix
Fixed a cosmetic issue where the About panel displayed the same IP address for each node in a multi-node instance.
[#1030](https://github.com/FusionAuth/fusionauth-issues/issues/1030)
Fix
Fixed SAML Response XML XSD validation failures regarding the `Signature` element location.
Thanks to [@MrChrisRodriguez](https://github.com/MrChrisRodriguez)
!
[#1047](https://github.com/FusionAuth/fusionauth-issues/issues/1047)
Fix
Fixed a potential NPE when making an Update request to a group in a multi-tenant environment.
Thanks to [@atrauzzi](https://github.com/atrauzzi)
!
[#1052](https://github.com/FusionAuth/fusionauth-issues/issues/1052)
Fix
Ignored requested Ids on the API when creating fixed IdPs (Google, Facebook, Twitter, HYPR) and set the correct Id instead.
[#1058](https://github.com/FusionAuth/fusionauth-issues/issues/1058)
Fix
Fixed Kickstart failures caused by using variables in the `tenantId` field for an API key.
Thanks to [@rhofland](https://github.com/rhofland)
!
[#1060](https://github.com/FusionAuth/fusionauth-issues/issues/1060)
New Feature
Added Sign in with LinkedIn as a new identity provider type.
[#34](https://github.com/FusionAuth/fusionauth-issues/issues/34)
New Feature
Added new FusionAuth roles (`user_support_viewer` and `user_support_manager`) oriented for Level 1 support personnel.
[#1027](https://github.com/FusionAuth/fusionauth-issues/issues/1027)
Enhancement
Added validation on the length of an email address on the User and Import APIs to provide better error messages.
[#900](https://github.com/FusionAuth/fusionauth-issues/issues/900)
Internal
Enhanced the .NET Core client library to better support requests in a multi-tenant environment and to use the `IDictionary` reference instead of `Dictionary`.
Thanks to [@atrauzzi](https://github.com/atrauzzi)
!
[#1049](https://github.com/FusionAuth/fusionauth-issues/issues/1049) [#1050](https://github.com/FusionAuth/fusionauth-issues/issues/1050)
_10 December 2020_
Fix
Changed connector behavior so that password constraints were validated according to the tenant policy only if the connector migrated the user.
Thanks to [@ckolbeck-streem](https://github.com/ckolbeck-streem)
!
[#1020](https://github.com/FusionAuth/fusionauth-issues/issues/1020)
Fix
Fixed an issue where Verify Email workflows on themed pages failed to send emails if the address contained a plus sign (`+`).
[#1034](https://github.com/FusionAuth/fusionauth-issues/issues/1034)
_8 December 2020_
Fix
Prevented OpenID Connect endpoint validation errors from being hidden when endpoint discovery was disabled in the UI.
[#794](https://github.com/FusionAuth/fusionauth-issues/issues/794)
Fix
Fixed an issue where the Manage User page failed to render if an action/comment was made by a user without an email address.
Thanks to [@pamcpd](https://github.com/pamcpd)
!
[#1012](https://github.com/FusionAuth/fusionauth-issues/issues/1012)
Fix
Ensured the `tenantId` parameter was preserved correctly in multi-tenant configurations during Device authorization grants.
Thanks to [@JediSquirrel](https://github.com/JediSquirrel)
and [@jerryhopper](https://github.com/jerryhopper)
!
[#1016](https://github.com/FusionAuth/fusionauth-issues/issues/1016)
Enhancement
Limited origin validation during OAuth2 grants occurring as a result of redirects from FusionAuth.
Thanks to [@eirikur-grid](https://github.com/eirikur-grid)
!
[#1018](https://github.com/FusionAuth/fusionauth-issues/issues/1018)
Enhancement
Exposed the default signing key Id as a Kickstart variable.
Thanks to [@dan-barrett](https://github.com/dan-barrett)
!
[#1026](https://github.com/FusionAuth/fusionauth-issues/issues/1026)
_1 December 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Replaced the `active` boolean on the Application object/API with a new `state` field on Application and Tenant domain objects.
New Feature
Allowed configuration of the Elasticsearch index name (`fusionauth-app.user-search-index.name`).
Thanks to [@chrishare08](https://github.com/chrishare08)
!
[#631](https://github.com/FusionAuth/fusionauth-issues/issues/631)
New Feature
Added async support for the Delete Tenant API.
[#990](https://github.com/FusionAuth/fusionauth-issues/issues/990)
Enhancement
Significantly improved Elasticsearch reindex performance.
[#918](https://github.com/FusionAuth/fusionauth-issues/issues/918)
Enhancement
Clarified the warning message regarding required CORS configurations for specific IdPs.
[#998](https://github.com/FusionAuth/fusionauth-issues/issues/998)
Enhancement
Increased the read timeout for third-party identity providers (e.g., Apple).
Thanks to [@thekoding](https://github.com/thekoding)
!
[#1010](https://github.com/FusionAuth/fusionauth-issues/issues/1010)
Fix
Fixed the required column value not being correct when viewing forms in the UI.
[#975](https://github.com/FusionAuth/fusionauth-issues/issues/975)
Fix
Fixed the inability to request a second 2FA code on the themed login page during a 2FA login request.
Thanks to [@DaviddH](https://github.com/DaviddH)
!
[#980](https://github.com/FusionAuth/fusionauth-issues/issues/980)
Fix
Fixed an exception during LDAP connector login attempts caused by a missing message.
Thanks to [@uckc](https://github.com/uckc)
!
[#981](https://github.com/FusionAuth/fusionauth-issues/issues/981)
Fix
Corrected the message shown on a registration form when no fields had been added.
[#983](https://github.com/FusionAuth/fusionauth-issues/issues/983)
Fix
Fixed the Google IdP view dialog incorrectly showing the client secret for both Client Id and Client secret fields.
[#999](https://github.com/FusionAuth/fusionauth-issues/issues/999)
Fix
Fixed an issue where selecting a preferred language during login appended values, causing duplicate locales.
Thanks to [@arni-inaba](https://github.com/arni-inaba)
!
[#1006](https://github.com/FusionAuth/fusionauth-issues/issues/1006)
Fix
Fixed validation failures when using the Import API to import users to non-default tenants.
Since: [`1.20.0`](/content/docs/release-notes#version-1-20-0/index.html)
[#1008](https://github.com/FusionAuth/fusionauth-issues/issues/1008)
Fix
Fixed an exception logged when logging out of SSO with webhooks configured to receive the Refresh Token Revoke event.
[#1017](https://github.com/FusionAuth/fusionauth-issues/issues/1017)
_10 November 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Upgrading broke the SAML v2 IdP configuration for users running PostgreSQL.
Fix
Fixed exceptions when starting a SAML v2 Login Request without additional custom data on the API request.
[#963](https://github.com/FusionAuth/fusionauth-issues/issues/963)
Fix
Fixed exceptions occurring in some circumstances when using Bcrypt as the default hashing scheme.
[#966](https://github.com/FusionAuth/fusionauth-issues/issues/966)
Fix
Added custom data to the Consent object view dialog and fixed issues where editing in the UI caused custom data loss.
Thanks to [@mgetka](https://github.com/mgetka)
!
[#970](https://github.com/FusionAuth/fusionauth-issues/issues/970)
Enhancement
Allowed configuring the location of the XML signature in the SAML response as a child of the `Assertion` or the `Response`.
Thanks to [@mikerees](https://github.com/mikerees)
!
[#365](https://github.com/FusionAuth/fusionauth-issues/issues/365)
Enhancement
Utilized the PKCE extension for OpenID Connect IdP configurations to ensure compatibility.
Thanks to [@jandillmann](https://github.com/jandillmann)
!
[#968](https://github.com/FusionAuth/fusionauth-issues/issues/968)
Enhancement
Added the `application` domain object to email templates when available.
[#976](https://github.com/FusionAuth/fusionauth-issues/issues/976)
_30 October 2020_
Fix
Ensured UI sorting preferences were preserved after a page refresh.
Thanks to [@mreschke](https://github.com/mreschke)
!
[#461](https://github.com/FusionAuth/fusionauth-issues/issues/461)
Fix
Updated a tooltip to better describe the "Require authentication" setting in OAuth configurations.
Thanks to [@JuliusPC](https://github.com/JuliusPC)
!
[#654](https://github.com/FusionAuth/fusionauth-issues/issues/654)
Fix
Fixed an exception that occurred if attempting to change a password immediately after installation before modifying Tenant configurations.
Thanks to [@srothery](https://github.com/srothery)
!
[#758](https://github.com/FusionAuth/fusionauth-issues/issues/758)
Fix
Fixed an exception caused by providing duplicate connector policies on the Tenant API.
[#917](https://github.com/FusionAuth/fusionauth-issues/issues/917)
Fix
Set the Twitter tokens in the User Registration after logging in with Twitter.
Thanks to [@LohithBlaze](https://github.com/LohithBlaze)
!
[#937](https://github.com/FusionAuth/fusionauth-issues/issues/937)
Fix
Allowed Refresh Token metadata fields to be set during the Password Grant.
Thanks to [@ShayMoshe](https://github.com/ShayMoshe)
!
[#947](https://github.com/FusionAuth/fusionauth-issues/issues/947)
Enhancement
Added additional Kickstart settings to modify default timeouts used to make API calls.
Thanks to [@seanadkinson](https://github.com/seanadkinson)
!
[#803](https://github.com/FusionAuth/fusionauth-issues/issues/803)
Enhancement
Exposed default Lambda and Form Ids to Kickstart for assignment to identity provider configurations.
Thanks to [@LohithBlaze](https://github.com/LohithBlaze)
!
[#836](https://github.com/FusionAuth/fusionauth-issues/issues/836)
Enhancement
Returned the `encryptionScheme` on the User API response when authenticated using an API key.
[#955](https://github.com/FusionAuth/fusionauth-issues/issues/955)
_23 October 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Updated the base Docker image from `alpine` to `ubuntu:focal` to use the official AdoptOpenJDK build.
This is a non-functional change, but please be aware of this change if you're building Docker images using ours as a base.
In order to run on `alpine` without including the GNU C Library (`glibc`) we had to use a custom build of OpenJDK compiled using the `musl` C library. Due to some possible performance concerns, we have moved to an official build of JDK provide by AdoptOpenJDK compiled using `glibc`. The `ubuntu:focal` base image added ~ 30 MB in size compared to our previous (compressed) image size, but until we can obtain builds from AdoptOpenJDK based upon the `musl` C library, we will not likely ship an official image on `alpine`.
- [`fusionauth-containers` / `docker` / `fusionauth` / `fusionauth-app` / `Dockerfile`](https://github.com/FusionAuth/fusionauth-containers/blob/main/docker/fusionauth/fusionauth-app/Dockerfile)
- [`hub.docker.com` / `fusionauth` / `fusionauth-app`](https://hub.docker.com/r/fusionauth/fusionauth-app/tags)
Fix
Resolved a noisy warning message about an upcoming deprecated use of reflection in a dependency.
[#721](https://github.com/FusionAuth/fusionauth-issues/issues/721)
Fix
Fixed negative counts displayed in the dashboard and reports by safely updating tracking paths during tenant deletion.
Thanks to [@gurupras](https://github.com/gurupras)
!
[#799](https://github.com/FusionAuth/fusionauth-issues/issues/799)
Fix
Improved the user experience for advanced self-service forms once a license had been de-activated.
[#861](https://github.com/FusionAuth/fusionauth-issues/issues/861)
Fix
Fixed self-service registration form validation when using custom options with `select`, `radio`, or `checkbox` types.
[#863](https://github.com/FusionAuth/fusionauth-issues/issues/863)
Fix
Fixed UI form validation when adding and removing fields from an existing self-service registration form.
[#866](https://github.com/FusionAuth/fusionauth-issues/issues/866)
Fix
Fixed developer-unfriendly error responses when `applicationId` was not validated on the Import User API.
[#915](https://github.com/FusionAuth/fusionauth-issues/issues/915)
Fix
Fixed a typo on the Activate Reactor page in the UI.
[#945](https://github.com/FusionAuth/fusionauth-issues/issues/945)
Fix
Ensured the `authenticationType` claim in the JWT accurately reflected IdP logins during self-service registration.
[#948](https://github.com/FusionAuth/fusionauth-issues/issues/948)
New Feature
Supported SAML v2 POST bindings to a third-party SAML v2 IdP when FusionAuth acted as the SP.
[#845](https://github.com/FusionAuth/fusionauth-issues/issues/845)
New Feature
Added the SAML v2 `SessionIndex` to the SAML v2 AuthN request.
[#896](https://github.com/FusionAuth/fusionauth-issues/issues/896)
New Feature
Allowed customization of the Add and Edit forms for Users and User Registrations in the admin UI (paid plan feature).
[#753](https://github.com/FusionAuth/fusionauth-issues/issues/753)
Enhancement
Allowed configuring one-to-many redirect URLs (ACS URLs) when configuring FusionAuth as a SAML v2 IdP.
[#502](https://github.com/FusionAuth/fusionauth-issues/issues/502)
Enhancement
Ensured the correct tenant was identified during logout when only the `id_token_hint` was provided.
[#925](https://github.com/FusionAuth/fusionauth-issues/issues/925)
Enhancement
Added initial base image build support for multi-arch Docker images (ARM, IBM Power, etc.).
_Thanks to a bunch of our FusionAuth MVPs including, but not limited to [@jerryhopper](https://github.com/jerryhopper), [@arslanakhtar61](https://github.com/arslanakhtar61), and [@ceefour](https://github.com/ceefour), for helping with this work through code, advice and domain knowledge that we don't have!_
[#49](https://github.com/FusionAuth/fusionauth-issues/issues/49)
_28 September 2020_
Fix
Ensured FusionAuth used the overriden local port defined by `fusionauth-app.http.port` to connect to itself.
[#891](https://github.com/FusionAuth/fusionauth-issues/issues/891)
Fix
Fixed PostgreSQL exceptions occurring when importing users with a wide distribution of `insertInstant` values via the Import API.
[#892](https://github.com/FusionAuth/fusionauth-issues/issues/892)
Fix
Disabled the Elasticsearch Sniffer by default to prevent issues in cloud managed or containerized environments.
[#893](https://github.com/FusionAuth/fusionauth-issues/issues/893)
Enhancement
Added a `referrer` meta tag to ensure secure default browser policies.
[#894](https://github.com/FusionAuth/fusionauth-issues/issues/894)
_23 September 2020_
Fix
Added an exception handler to the Elasticsearch REST client to prevent underlying HTTP exceptions from causing failures.
[#868](https://github.com/FusionAuth/fusionauth-issues/issues/868)
Fix
Fixed PostgreSQL exceptions caused by embedded `null` characters in LDAP exception messages.
[#879](https://github.com/FusionAuth/fusionauth-issues/issues/879)
Fix
Fixed an issue where users were stuck in a password change loop when both "Re-validate password on login" and "restrict previous passwords" were selected.
[#880](https://github.com/FusionAuth/fusionauth-issues/issues/880)
Fix
Fixed a duplicate key issue in the MySQL migration script due to a poor random Id generator for refresh tokens.
[#890](https://github.com/FusionAuth/fusionauth-issues/issues/890)
Enhancement
Added a helper for Active Directory LDAP to handle the conversion of base64-encoded Microsoft `objectGuid` to a Java UUID.
[#822](https://github.com/FusionAuth/fusionauth-issues/issues/822)
_16 September 2020_
Fix
Fixed startup failures on version `1.19.5` of the Docker image caused by an invalid variable name in `setenv.sh`.
[#870](https://github.com/FusionAuth/fusionauth-issues/issues/870)
_15 September 2020_
Fix
Fixed an exception occurring when deleting an application role that was in use by a Group.
[#831](https://github.com/FusionAuth/fusionauth-issues/issues/831)
Fix
Fixed possible errors when upgrading to version `1.19.0` on managed MySQL services like Google Cloud SQL.
[#859](https://github.com/FusionAuth/fusionauth-issues/issues/859)
Enhancement
Made URL path and query parsing more forgiving of un-escaped characters.
[#635](https://github.com/FusionAuth/fusionauth-issues/issues/635)
_12 September 2020_
Fix
Fixed an issue where the `registration` or `roles` arguments were missing in the JWT Populate lambda during a combined User + Registration API request.
[#856](https://github.com/FusionAuth/fusionauth-issues/issues/856)
Fix
Fixed an `IllegalStateException` or missing driver error occurring when using MySQL and Silent Mode database configurations.
[#857](https://github.com/FusionAuth/fusionauth-issues/issues/857)
_10 September 2020_
Security
Proactively upgraded Apache Commons File Upload to `1.4.0` (CVE-2016-1000031).
Breaking Change
Upgraded Kafka client to `2.6.0`, MySQL connector to `8.0.21`, and PostgreSQL connector to `42.2.14`.
Fix
Corrected the clock skew calculation used when verifying a SAML AuthN response from a SAML v2 IdP to prevent incorrect validation errors.
Enhancement
Implemented better email address validation to ensure addresses were deliverable.
_6 September 2020_
Fix
Fixed an issue where using the External JWT Identity Provider with the Lookup API failed to validate a JWT.
[#850](https://github.com/FusionAuth/fusionauth-issues/issues/850)
_4 September 2020_
Fix
Fixed an issue where FusionAuth failed to start up correctly if using the database search engine.
Thanks to [@motzel](https://github.com/motzel)
!
[#846](https://github.com/FusionAuth/fusionauth-issues/issues/846)
Fix
Ensured the legacy environment variable `FUSIONAUTH_SEARCH_SERVERS` was honored appropriately.
Thanks to [@soullivaneuh](https://github.com/soullivaneuh)
!
[#847](https://github.com/FusionAuth/fusionauth-issues/issues/847)
_3 September 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
MySQL users encountered an issue logging into the admin console, resulting in an empty page.
Known Issue
FusionAuth failed to start up correctly when using the database search engine.
Known Issue
The legacy environment variable `FUSIONAUTH_SEARCH_SERVERS` was ignored.
Breaking Change
Required the use of the Start Identity Provider API prior to sending SAML v2 AuthN requests for custom integrations.
Breaking Change
Made the FusionAuth SSO and admin UI stateless, removing the requirement for session pinning.
Breaking Change
Allowed Silent Mode while in `production` runtime mode to upgrade database schemas.
Breaking Change
Changed the Status API to no longer return full JSON responses unless authenticated by an API key or admin.
Breaking Change
Updated customized field error message formats for custom Registration forms (e.g., from `[missing]` to `[blank]`).
Breaking Change
Shipped a `systemd` service definition for Linux Debian and RPM packages instead of legacy Sys V init scripts.
Breaking Change
Flipped `client_id` and `redirect_uri` parameter positions in the Python client library for consistency.
New Feature
Made FusionAuth admin UI and FusionAuth pages stateless.
[#358](https://github.com/FusionAuth/fusionauth-issues/issues/358)
New Feature
Introduced Multi-tenant SSO allowing users to utilize SSO across different tenants simultaneously.
Thanks to [@unkis](https://github.com/unkis)
!
[#355](https://github.com/FusionAuth/fusionauth-issues/issues/355)
New Feature
Added IdP and Email hinting for FusionAuth login pages to bypass the login page directly to a third-party IdP.
Thanks to [@davidmw](https://github.com/davidmw)
!
[#178](https://github.com/FusionAuth/fusionauth-issues/issues/178)
New Feature
Introduced a new API to import Refresh Tokens.
[#835](https://github.com/FusionAuth/fusionauth-issues/issues/835)
New Feature
Allowed application-specific email templates for Passwordless, Email Verification, Setup Password, and Change Password.
[#834](https://github.com/FusionAuth/fusionauth-issues/issues/834)
Enhancement
Enhanced Maintenance Mode support for initial DB schema setups on third-party cloud managed database services.
[#95](https://github.com/FusionAuth/fusionauth-issues/issues/95)
Enhancement
Shipped a log rotation strategy for `fusionauth-app.log`.
Thanks to [@oottinger](https://github.com/oottinger)
!
[#575](https://github.com/FusionAuth/fusionauth-issues/issues/575)
Enhancement
Exposed all configurations via `fusionauth.properties`, environment variables, or Java System Properties.
[#752](https://github.com/FusionAuth/fusionauth-issues/issues/752)
Enhancement
Restricted the response body on the Status API unless authenticated and provided granular HTTP response codes.
[#473](https://github.com/FusionAuth/fusionauth-issues/issues/473)
Fix
Fixed the missing `Control` type display on the View dialog for custom form fields.
[#828](https://github.com/FusionAuth/fusionauth-issues/issues/828) [#827](https://github.com/FusionAuth/fusionauth-issues/issues/827)
Fix
Fixed validation errors occurring when submitting custom Registration Forms with non-required fields of type `number`, `date`, or `bool`.
[#827](https://github.com/FusionAuth/fusionauth-issues/issues/827)
Fix
Allowed `database.mysql.enforce-utf8mb4` to be configured via environment variables for Docker.
[#798](https://github.com/FusionAuth/fusionauth-issues/issues/798)
Fix
Fixed a `404` status code returned from the Start Passwordless API in multi-tenant instances.
Thanks to [@atrauzzi](https://github.com/atrauzzi)
!
[#833](https://github.com/FusionAuth/fusionauth-issues/issues/833)
Fix
Normalized the use of the `aud` claim between OAuth2 grants, ensuring it was consistently populated.
Thanks to [@motzel](https://github.com/motzel)
!
[#832](https://github.com/FusionAuth/fusionauth-issues/issues/832)
Fix
Fixed an issue where both Login Success and Login Failed events triggered during failed attempts.
[#838](https://github.com/FusionAuth/fusionauth-issues/issues/838)
Fix
Fixed Custom Form validation errors.
_Resolves GitHub Issues [#827](https://github.com/FusionAuth/fusionauth-issues/issues/827), [#810](https://github.com/FusionAuth/fusionauth-issues/issues/810), [#828](https://github.com/FusionAuth/fusionauth-issues/issues/828), and [#829](https://github.com/FusionAuth/fusionauth-issues/issues/829)._
Fix
Fixed an issue where both the Login Success and Login Failed events are triggered during a failed login attempt.
Since: [`1.18.0`](/content/docs/release-notes#version-1-18-0/index.html)
[#838](https://github.com/FusionAuth/fusionauth-issues/issues/838)
_25 August 2020_
Security
Improved SAML AuthN Response validation.
_12 August 2020_
Fix
Ensured the `loginId` was properly validated to exist in FusionAuth when initiating the HYPR authentication workflow.
[#808](https://github.com/FusionAuth/fusionauth-issues/issues/808)
_10 August 2020_
Fix
Fixed an issue where the `registration` parameter to the JWT Populate lambda was `null` during self-service registration and Implicit Grant.
[#802](https://github.com/FusionAuth/fusionauth-issues/issues/802)
_3 August 2020_
Fix
Fixed a JavaScript bug that caused some reports not to render correctly in the admin UI.
[#783](https://github.com/FusionAuth/fusionauth-issues/issues/783)
Fix
Resolved a poor performing SQL query occurring in MySQL when rendering dashboard charts with millions of login records.
[#786](https://github.com/FusionAuth/fusionauth-issues/issues/786)
Enhancement
Added localized number formatting on the y-axis of charts in the admin UI.
[#788](https://github.com/FusionAuth/fusionauth-issues/issues/788)
_30 July 2020_
Fix
Fixed an exception occurring when attempting to use a refresh token from one tenant with another tenant.
Thanks to [@ulybu](https://github.com/ulybu)
!
[#716](https://github.com/FusionAuth/fusionauth-issues/issues/716)
Fix
Fixed an exception that disrupted the user registration workflow during self-service registration.
[#776](https://github.com/FusionAuth/fusionauth-issues/issues/776)
Fix
Fixed an issue where the registration object was `null` in the JWT Populate function when used with self-service registration.
[#780](https://github.com/FusionAuth/fusionauth-issues/issues/780)
Fix
Fixed an exception caused by SAML responses containing an attribute element with `xsi:nil="true"`.
_24 July 2020_
Fix
Fixed an exception when attempting to add a registration for an user in the admin UI if no available registrations existed.
[#630](https://github.com/FusionAuth/fusionauth-issues/issues/630)
Fix
Ensured a verification email was sent when updating a previously undefined email address with "verify email on change" enabled.
Thanks to [@EddieWhi](https://github.com/EddieWhi)
!
[#749](https://github.com/FusionAuth/fusionauth-issues/issues/749)
Fix
Ensured the search index correctly reflected registration removals before the next user index event.
Thanks to [@brennan-karrer](https://github.com/brennan-karrer)
!
[#750](https://github.com/FusionAuth/fusionauth-issues/issues/750)
Fix
Fixed form field name validation to limit spaces and other special characters.
[#761](https://github.com/FusionAuth/fusionauth-issues/issues/761)
Fix
Fixed Form and field issues including JavaScript errors and complete registration workflows using custom forms.
[#762](https://github.com/FusionAuth/fusionauth-issues/issues/762)
Fix
Relaxed email template validation to allow `${tenant.issuer}` references to be saved despite preview warnings.
Thanks to [@seanadkinson](https://github.com/seanadkinson)
!
[#770](https://github.com/FusionAuth/fusionauth-issues/issues/770)
Enhancement
Email template validation has been relaxed to allow the Preview API and UI action to report errors and warnings but still allow the changes to be saved. Due to the complexity of validating the email template without the exact data to be used at runtime, validation has been relaxed to ensure we do not prohibit a valid template from being saved. When using the UI to manage your templates, you will now find a test button which will allow you to send a template to an end user to test the rendering and delivery with a real user.
_20 July 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Fix
Fixed a table sequence issue in PostgreSQL preventing new user creation during migrations.
[#759](https://github.com/FusionAuth/fusionauth-issues/issues/759)
_19 July 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Editing an application in the admin UI resulted in a `500 Internal Server Error`.
Resolved in version [`1.18.1`](/content/docs/release-notes#version-1-18-1/index.html) via
[#760](https://github.com/FusionAuth/fusionauth-issues/issues/760)
.
Known Issue
PostgreSQL database sequences were not set correctly, causing a `500` status code when creating new users.
Known Issue
An exception occurred when using self service registration that disrupted the user registration workflow.
Known Issue
A JWT populate lambda using the `registration` parameter failed when using self service registration.
Breaking Change
Moved Users, Groups, Applications, and Tenants to the top level of the left navigation sidebar.
New Feature
Introduced Advanced Forms allowing custom multi-step registration forms for self-service registration.
[#680](https://github.com/FusionAuth/fusionauth-issues/issues/680)
New Feature
Introduced the Initial Tech Preview of Connectors to authenticate against external systems (e.g., LDAP).
[#219](https://github.com/FusionAuth/fusionauth-issues/issues/219)
Enhancement
Added the `Registration URL` property to the Application view dialog.
Thanks to [@ashokgelal](https://github.com/ashokgelal)
!
[#686](https://github.com/FusionAuth/fusionauth-issues/issues/686)
Enhancement
Reported the node IP address on the About panel in the administrative UI.
[#754](https://github.com/FusionAuth/fusionauth-issues/issues/754)
Enhancement
Included the `jti` claim in JSON Web Tokens issued by FusionAuth.
[#409](https://github.com/FusionAuth/fusionauth-issues/issues/409)
Enhancement
Added `insertInstant` and `lastUpdateInstant` properties to all objects in the JSON API response.
[#755](https://github.com/FusionAuth/fusionauth-issues/issues/755)
Enhancement
Provided the `x5t` property in the JSON Web Key Set response for public keys stored with a certificate.
[#715](https://github.com/FusionAuth/fusionauth-issues/issues/715)
Fix
Fixed an issue where the user registration event missed the `registration` property.
Thanks to [@joydeb28](https://github.com/joydeb28)
!
[#714](https://github.com/FusionAuth/fusionauth-issues/issues/714)
Fix
Fixed failures when deleting a user with one or more granted consents.
Thanks to [@mgetka](https://github.com/mgetka)
!
[#719](https://github.com/FusionAuth/fusionauth-issues/issues/719)
Fix
Fixed an issue where the second email was not sent to the parent when using COPPA consent with Email+.
[#724](https://github.com/FusionAuth/fusionauth-issues/issues/724)
Fix
Fixed an issue where the Refresh Token cookie lacked a `Max-Age` attribute on the JWT Refresh API response.
Thanks to [@satazor](https://github.com/satazor)
!
[#726](https://github.com/FusionAuth/fusionauth-issues/issues/726)
_19 July 2020_
Fix
Fixed a `500` error occurring when using the edit Application action in the admin UI.
[#760](https://github.com/FusionAuth/fusionauth-issues/issues/760)
_3 July 2020_
Fix
Fixed API validation failures on the Audit Log API when a JSON body was omitted.
[#605](https://github.com/FusionAuth/fusionauth-issues/issues/605)
Fix
Fixed a bug preventing the Kafka integration from working correctly.
Thanks to [@joydeb28](https://github.com/joydeb28)
!
[#649](https://github.com/FusionAuth/fusionauth-issues/issues/649)
Fix
Fixed an error caused by invalid Elasticsearch queries generated when selecting an Application in the user search UI on Elasticsearch 7.7.0.
[#710](https://github.com/FusionAuth/fusionauth-issues/issues/710)
Enhancement
Added a return to login link to default templates for Passwordless, Register, Forgot, and Password Sent workflows.
Thanks to [@soullivaneuh](https://github.com/soullivaneuh)
!
[#666](https://github.com/FusionAuth/fusionauth-issues/issues/666)
_25 June 2020_
Fix
Fixed a cosmetic JavaScript bug causing the device verification URL field to toggle when grants were enabled/disabled.
[#692](https://github.com/FusionAuth/fusionauth-issues/issues/692)
Fix
Included Elasticsearch explanation details in Search API error messages when `valid: false` was returned.
[#697](https://github.com/FusionAuth/fusionauth-issues/issues/697)
Fix
Ensured the Apple Service Id override provided per application was correctly utilized instead of the global value.
Thanks to [@ulybu](https://github.com/ulybu)
!
[#703](https://github.com/FusionAuth/fusionauth-issues/issues/703)
_23 June 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Enhancement
Allowed modification of the OpenID Connect Identity Provider email claim to support non-standard providers like LinkedIn.
_17 June 2020_
Fix
Fixed validation failures for `parent`, `child`, and other references in email templates requiring null-safe usage.
[#685](https://github.com/FusionAuth/fusionauth-issues/issues/685)
_15 June 2020_
Fix
Fixed an error occurring when importing a standalone RSA private key via the Key Master UI.
Thanks to [@mgetka](https://github.com/mgetka)
!
[#665](https://github.com/FusionAuth/fusionauth-issues/issues/665)
Fix
Fixed an unexpected error displaying for expired Forgot Password links omitting the `client_id` in the URL.
Thanks to [@maurobennici](https://github.com/maurobennici)
!
[#671](https://github.com/FusionAuth/fusionauth-issues/issues/671)
_2 June 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Migrated Identity Provider configurations lacking reconcile lambdas to utilize lambdas, granting full control over claim extraction.
Breaking Change
Moved claim mapping functionality into user-modifiable OpenID Connect and SAML v2 reconcile lambdas.
New Feature
Added Sign in with Apple as a new Identity Provider.
[#336](https://github.com/FusionAuth/fusionauth-issues/issues/336)
New Feature
Introduced One time Use Refresh Tokens, configured at the tenant or application level.
[#394](https://github.com/FusionAuth/fusionauth-issues/issues/394)
New Feature
Introduced Sliding Window Refresh Token Expiration based on last usage.
New Feature
Allowed assigning User Reconcile Lambdas to Facebook, Google, HYPR, and Twitter Identity Providers.
Enhancement
Localized development and runtime errors for external logins.
[#535](https://github.com/FusionAuth/fusionauth-issues/issues/535)
Enhancement
Made maximum header sizes configurable to prevent `400` errors caused by large cookies.
[#608](https://github.com/FusionAuth/fusionauth-issues/issues/608)
Enhancement
Stopped returning refresh tokens upon user registration, making the API response consistent with the User Create API.
[#626](https://github.com/FusionAuth/fusionauth-issues/issues/626)
Enhancement
Added a warning for SAML v2 Identity Providers regarding CORS filter configurations to assist integration testing.
[#641](https://github.com/FusionAuth/fusionauth-issues/issues/641)
Fix
Displayed errors when attempting to import a key with an invalid length in the Key Master UI.
[#587](https://github.com/FusionAuth/fusionauth-issues/issues/587)
Fix
Fixed OAuth errors occurring when changing locales on subsequent themed pages after the initial login panel.
Thanks to [@flangfeldt](https://github.com/flangfeldt)
!
[#623](https://github.com/FusionAuth/fusionauth-issues/issues/623)
Fix
Fixed a startup failure on Ubuntu caused by a non-POSIX compliant function definition in `setenv.sh`.
Thanks to [@s-vlade](https://github.com/s-vlade)
!
[#645](https://github.com/FusionAuth/fusionauth-issues/issues/645)
Fix
Fixed User reconcile process failures when specifying `picture` as a requested field in the Facebook IdP configuration.
Thanks to [@thekoding](https://github.com/thekoding)
!
[#648](https://github.com/FusionAuth/fusionauth-issues/issues/648)
_18 May 2020_
Fix
Fixed an issue where attempting to use silent configurations to set up the database schema without Elasticsearch forced Maintenance Mode.
Thanks to [@mgetka](https://github.com/mgetka)
!
[#618](https://github.com/FusionAuth/fusionauth-issues/issues/618)
_8 May 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Security
Resolved vulnerabilities in the underlying SAML v2 library (CVE-2020-12676, CSNC-2020-002).
Breaking Change
Updated the favicon configuration in the default theme.
New Feature
Returned a list of `applicationIds` from the Identity Provider Lookup API.
New Feature
Returned the SAML v2 `idpEndpoint` from the Identity Provider Lookup API.
Fix
Allowed Elasticsearch URLs containing basic auth credentials to function properly.
Thanks to [@joshuaavalon](https://github.com/joshuaavalon)
!
[#531](https://github.com/FusionAuth/fusionauth-issues/issues/531)
Fix
Fixed validation errors to correctly return a `400` status code with JSON when using the Import User API with an empty list.
Thanks to [@smcoll](https://github.com/smcoll)
!
[#520](https://github.com/FusionAuth/fusionauth-issues/issues/520)
Fix
Fixed JavaScript failing on Internet Explorer 11 via the `Helper.js` during external logins.
Thanks to [@downagain](https://github.com/downagain)
!
[#423](https://github.com/FusionAuth/fusionauth-issues/issues/423)
Fix
Ensured the OAuth2 Token endpoint returned the appropriate validation error instead of a general error.
Thanks to [@mgetka](https://github.com/mgetka)
!
[#546](https://github.com/FusionAuth/fusionauth-issues/issues/546)
Fix
Prevented login failures by handling Facebook `/me/picture` URLs that exceeded 255 characters.
_Thanks to our friends at [famous.co](https://famous.co/) and [frontdoorhome.com](https://www.frontdoorhome.com/) for letting us know!_
[#583](https://github.com/FusionAuth/fusionauth-issues/issues/583)
Fix
Fixed validation exceptions caused by email templates referencing values stored in user data.
[#598](https://github.com/FusionAuth/fusionauth-issues/issues/598)
Fix
Synchronized the Elasticsearch index properly when a webhook failed due to transaction settings.
Thanks to [@arni-inaba](https://github.com/arni-inaba)
!
[#600](https://github.com/FusionAuth/fusionauth-issues/issues/600)
Fix
Fixed SQL migration failures in PostgreSQL due to an extra curly bracket when upgrading without modifying the default tenant.
Thanks to [@nscarlson](https://github.com/nscarlson)
!
[#606](https://github.com/FusionAuth/fusionauth-issues/issues/606)
_21 April 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Email Send API no longer requires a from email or a default from name, defaults may be taken from the tenant. See the [Emails API](/content/docs/apis/emails/index.html) documentation for reference.
Breaking Change
The OpenID Connect [JSON Web Key Set](/content/docs/lifecycle/authenticate-users/oauth/endpoints#json-web-key-set-jwks/index.html) API endpoint returns only public keys generated by FusionAuth. This endpoint previously also returned imported public keys, for which we do not hold the private key.
Breaking Change
Next time a release candidate is built, the `latest` tag will be preserved to always be the latest stable release. This way if you are always using the `latest` tag you will not automatically upgrade to a release candidate.
Thanks to [@ceefour](https://github.com/ceefour)
!
[#596](https://github.com/FusionAuth/fusionauth-issues/issues/596)
Breaking Change
The reference `docker-compose.yml` provided by the [fusionauth-containers](https://github.com/FusionAuth/fusionauth-containers) GitHub repo has been modified to install leveraging database as the User search engine. You will need to include the reference `docker-compose.override.yml` in order to install and configure Elasticsearch as the User search engine. See the [Docker installation guide](/content/docs/get-started/download-and-install/docker/index.html) for reference.
New Feature
Support for Elasticsearch version 7
- FusionAuth maintains backward-compatibility with Elasticsearch 6.3.x clusters and indexes.
- `fusionauth-app.search-engine-type` configuration property and `FUSIONAUTH_SEARCH_ENGINE_TYPE` environment variable exposed for configuring the search engine, see the [Configuration](/content/docs/reference/configuration/index.html) documentation for reference.
- A reindex may be necessary depending on how you have upgraded your Elasticsearch cluster. You may issue a reindex in the FusionAuth admin UI under System -> Reindex .
[#199](https://github.com/FusionAuth/fusionauth-issues/issues/199)
New Feature
Support for using the database as the user search engine. This is now the default configuration. See the [Core Concepts - Users](/content/docs/get-started/core-concepts/users#user-search/index.html) documentation for details.
- Use of the database search engine provides limited search capabilities, and has limitations for the Users API, see the [Bulk Delete Users API](/content/docs/apis/users#bulk-delete-users/index.html) and [Search for Users API](/content/docs/apis/users#search-for-users/index.html) documentation for details.
[#427](https://github.com/FusionAuth/fusionauth-issues/issues/427)
New Feature
The Registration API returns an access token within the `token` field of responses to `POST` requests. See the [Registrations API](/content/docs/apis/registrations/index.html) documentation for reference.
- Application registration records a login and will be reflected in the Login, Daily Active User, and Monthly Active User reports within the FusionAuth admin UI.
New Feature
The `applicationId` is now optional for `PUT` requests (update login instants) to the Login API. See the [Login API](/content/docs/apis/login#update-login-instant/index.html) documentation for reference.
- `PUT` requests to the Login API records a login and will be reflected in the Login, Daily Active User, and Monthly Active User reports within the FusionAuth admin UI.
New Feature
The User API returns an access token within the `token` field of responses to `POST` requests creating a user. See the [User API](/content/docs/apis/users#create-a-user/index.html) documentation for reference.
- User creation records a login and will be reflected in the Login, Daily Active User, and Monthly Active User reports within the FusionAuth admin UI.
New Feature
System logs can be viewed from the Admin interface. Navigate to System -> Log to view and download the system logs.
- This feature is available in the UI and via a new API.
[#540](https://github.com/FusionAuth/fusionauth-issues/issues/540)
New Feature
System log export API has been added for retrieving a node's system logs as a compressed zip file. See the [System Logs API](/content/docs/apis/system/index.html) documentation for reference.
New Feature
There is a Test SMTP button that you can utilize during an Edit or Add Tenant operation to ensure the correct SMTP configuration.
[#539](https://github.com/FusionAuth/fusionauth-issues/issues/539)
New Feature
Production runtime mode disables maintenance mode, database migrations must be applied manually in this runtime mode. See the [FusionAuth App Installation Guide](/content/docs/get-started/download-and-install/fusionauth-app#runtime-modes/index.html) documentation for reference.
New Feature
Advanced configuration exposed for search engine type, runtime mode, and Same-Site cookie policy. See the [Configuration](/content/docs/reference/configuration/index.html) documentation for reference.
New Feature
JWT Refresh webhook event, issued when an access token is refreshed by refresh token, see the [Events](/content/docs/extend/events-and-webhooks/events/jwt/jwt-refresh/index.html) documentation for reference.
New Feature
Tenant email configuration provides a default from email and a default from name. See the [Tenants API](/content/docs/apis/tenants#create-a-tenant/index.html) documentation for reference.
Thanks to [@engineertdog](https://github.com/engineertdog)
!
[#262](https://github.com/FusionAuth/fusionauth-issues/issues/262)
Enhancement
The OpenID Connect and SAML v2 Reconcile Lambda may now modify the assigned user roles. Prior to this version any changes to the roles were intentionally not preserved. This restriction has been lifted.
Thanks to [@sedough](https://github.com/sedough)
!
[#536](https://github.com/FusionAuth/fusionauth-issues/issues/536)
Enhancement
In some cases the `state` parameter returning from external SAML v2 & OpenID Connect identity providers is decoded incorrectly. We are now Base64 encoding this value to preserve it's integrity.
Security
Updated default CORS configuration for clean installs, see the [CORS Reference](/content/docs/operate/secure/cors#default-configuration/index.html) for details. It is highly recommended you modify your CORS configuration to match our new default values unless you have a technical requirement for your existing CORS configuration.
Security
Upgrade Handlebars to version `4.7.6` due to a known vulnerability. There is no known exploit of this vulnerability in FusionAuth, this is a pro-active upgrade. FusionAuth uses this JavaScript library in the administrative UI to build dynamic table roles.
- [https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534988](https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534988)
Thanks to [@michael-burt](https://github.com/michael-burt)
!
[#564](https://github.com/FusionAuth/fusionauth-issues/issues/564)
Internal
Java 14. Upgrade from Java 8. The FusionAuth Java runtime has been upgraded to version 14. All external Java packages such as the Java REST client and the Plugin interface are all still compiled against Java 8 so this upgrade should not impact any users.
[#481](https://github.com/FusionAuth/fusionauth-issues/issues/481)
Internal
Upgrade Apache Tomcat to the latest patch version `8.5.53`.
Internal
Much smaller Docker images based upon Alpine Linux! Compressed size changed from ~ 150 MB to 76 MB. More features, less size? Yeah, that's right.
- Check it out for yourself. See the [fusionauth/fusionauth-app](https://hub.docker.com/repository/docker/fusionauth/fusionauth-app/tags?page=1) repo.
_10 April 2020_
Fix
When more than one tenant is defined, the redirect to `/oauth2/callback` which is used for 3rd Party SAML v2 or OpenID Connect identity providers will fail unless the corresponding application is in the default tenant. This issue was introduced in `1.15.6` which means it only affects version `1.15.6`. If you encounter this issue you may be shown an error on the login page indicating `A validation error occurred during the login attempt. An event log was created for the administrator to review.`.
Thanks to [@lamuertepeluda](https://github.com/lamuertepeluda)
!
[#548](https://github.com/FusionAuth/fusionauth-issues/issues/548)
Fix
A callback from a Social IdP configuration may fail to complete the login workflow. This issue was introduced in `1.15.6` which means it only affects version `1.15.6` and `1.15.7`.
Thanks to [@ulybu](https://github.com/ulybu)
!
[#553](https://github.com/FusionAuth/fusionauth-issues/issues/553)
Enhancement
When a user attempts to utilize an expired Passwordless or Forgot Password link, FusionAuth will now still be able to allow the user to restart the login workflow.
- In order to take advantage of this enhancement, you will need to upgrade your email template for one or both of these workflows. See the [Email Templates](/content/docs/customize/email-and-messages/email-templates/index.html) documentation for a reference usage.
Thanks to [@davidmw](https://github.com/davidmw)
!
[#468](https://github.com/FusionAuth/fusionauth-issues/issues/468)
_30 March 2020_
Fix
Due to a change in how FusionAuth encodes the `RelayState` value when redirecting to a 3rd party SAML v2 identity providers, the authentication request will fail with an OAuth2 error. This issue was introduced in `1.15.6` which means it only affects version `1.15.6`.
_27 March 2020_
Fix
Handle tabs and other control characters in an included text file when parsing the Kickstart configuration files.
Thanks to [@mgetka](https://github.com/mgetka)
!
[#524](https://github.com/FusionAuth/fusionauth-issues/issues/524)
Fix
When the FusionAuth Reactor is enabled, a breach detection is incorrectly requested during a user update when the password is not being modified. You may see errors in the Event Log indicating Reactor returned a status code of `400`, this error is just noise and it did not affect the requested action.
[#533](https://github.com/FusionAuth/fusionauth-issues/issues/533)
Fix
When running FusionAuth on an un-secured connection during development, newer versions of the Chrome browser will reject the `Set-Cookie` request in the HTTP response because the `SameSite` attribute is not set.
[#537](https://github.com/FusionAuth/fusionauth-issues/issues/537)
Enhancement
When integrating with 3rd Party Identity Providers FusionAuth will build a `state` parameter in order to complete the FusionAuth OAuth2 or SAML v2 request on the callback from the 3rd Party IdP. There are times when a 3rd Party IdP may un-intentionally modify the `state` parameter by decoding the value. When the `state` parameter is not returned to FusionAuth the way it was sent the integration breaks. FusionAuth will now Bas64 encode the `state` value to better defend against 3rd Party IdP integrations.
[#538](https://github.com/FusionAuth/fusionauth-issues/issues/538)
_16 March 2020_
Fix
Adding a Consent to a User that does not have a First or Last Name. This was causing an error in the UI where the Add Consent dialog was not rendering and instead displaying a stack trace.
Thanks to [@mgetka](https://github.com/mgetka)
!
[#512](https://github.com/FusionAuth/fusionauth-issues/issues/512)
Fix
When Reactor is enabled and more than one user requires action due to a breached password the Reactor index page will fail to render.
- Thanks to our friends at Frontdoor for reporting the issue.
[#514](https://github.com/FusionAuth/fusionauth-issues/issues/514)
Fix
When adding a new Tenant in the UI you may encounter a `500` status code with a `FusionAuth encountered an unexpected error.` message. If you encounter this error, edit the default tenant, click save and then retry the add operation.
Thanks to [@vburghelea](https://github.com/vburghelea)
!
[#517](https://github.com/FusionAuth/fusionauth-issues/issues/517)
Fix
A JavaScript exception was causing the ExternalJWT identity mapping dialog to fail. A work around is to use the API to add these claim mappings.
Since: [`1.15.3`](/content/docs/release-notes#version-1-15-3/index.html)
Thanks to [@irzhywau](https://github.com/irzhywau)
!
[#518](https://github.com/FusionAuth/fusionauth-issues/issues/518)
_10 March 2020_
Fix
When using PostgreSQL and using the Import User API with a large amount of roles assigned to user FusionAuth may exceed the maximum allowed parameterized values in a prepared statement causing a SQL exception. If you encounter this issue you may work around the issue by reducing the size of your import request to 200-500 users per request.
Thanks to [@leafknode](https://github.com/leafknode)
!
[#505](https://github.com/FusionAuth/fusionauth-issues/issues/505)
Fix
When creating a user through Kickstart with `passwordChangeRequired` set to `true` and exception will occur during the next login request. This issue was introduced in version 1.15.0.
Thanks to [@mgetka](https://github.com/mgetka)
!
[#509](https://github.com/FusionAuth/fusionauth-issues/issues/509)
Fix
When a Kickstart file contains multi-byte characters the string value may not be encoded properly if the default file encoding is not UTF-8. This has now been resolved by explicitly requesting UTF-8 encoding during file I/O.
Thanks to [@mgetka](https://github.com/mgetka)
!
[#510](https://github.com/FusionAuth/fusionauth-issues/issues/510)
Fix
When using the SAML IdP configuration where FusionAuth is the SAML service provider if the base64 encoded SAML response from the IdP contains line returns FusionAuth will fail to parse the request and the login request will fail.
[#511](https://github.com/FusionAuth/fusionauth-issues/issues/511)
_27 February 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
The External JWT Identity Provider now manages keys used for token verification in the Key Master. All keys have been migrated to Key Master, and going forward all keys can be managed through the Key Master.
Breaking Change
Prior to this version the OpenID Connect IdP would send the client secret using the `client_secret_basic` and the `client_secret_post` method. This was done for compatibility with providers that did not utilize the `client_secret_basic` method. Now this configuration is now provided and only the configured client authentication method will be used.
Fix
Using the JWT Refresh API with a JWT issued from one tenant for a user in another tenant. This error was causing an exception instead of the proper validation error being returned to the caller. A `404` will now properly be returned when this scenario occurs.
Thanks to [@johnmaia](https://github.com/johnmaia)
!
[#399](https://github.com/FusionAuth/fusionauth-issues/issues/399)
Fix
Missing API validation on the `/oauth2/passwordless` endpoint. A `500` was returned instead of the correct validation errors.
Thanks to [@GraafG](https://github.com/GraafG)
!
[#450](https://github.com/FusionAuth/fusionauth-issues/issues/450)
Fix
On systems running MySQL, the SQL migration for `1.15.0` on the `DELIMITER` command and causes the instance table to have a null `license_id`. If you have previously connected your support contract Id with your instance and upgraded to a previous `1.15.x` version, you will need to reconnect your license Id in the Reactor tab. This issue was introduced in version 1.15.0.
Thanks to [@nulian](https://github.com/nulian)
!
[#482](https://github.com/FusionAuth/fusionauth-issues/issues/482)
Fix
The `CancelAction` method in the .NET Core client returning field error due to incorrect method definition.
Thanks to [@minjup](https://github.com/minjup)
!
[#11](https://github.com/FusionAuth/fusionauth-issues/issues/11)
Fix
The OpenID Connect IdP client authentication method is now configurable as `client_secret_basic`, `client_secret_post`, or `none` and will authenticate solely with the configured method. See the [OIDC spec concerning Client Authentication](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication) for more information.
- The `1.15.3` database migration configures the client authentication method to `client_secret_basic` for identity provider configurations with a client secret defined, and `none` for those without a client secret defined. If your OpenID Connect provider requires `client_secret_post` you will need to update your configuration to ensure the integration continues to function properly. Discord is one of the known IdPs that requires the `client_secret_post` client authentication method.
- See the [OpenID Connect Identity Providers](/content/docs/apis/identity-providers/openid-connect/index.html) APIs, the [OpenID Connect Identity Provider Overview](/content/docs/lifecycle/authenticate-users/identity-providers/index.html) and the [Discord OIDC integration tutorial](/content/docs/lifecycle/authenticate-users/identity-providers/gaming/discord/index.html) for more detail.
Since: [`1.15.3`](/content/docs/release-notes#version-1-15-3/index.html)
Thanks to [@ovrdoz](https://github.com/ovrdoz)
!
[#445](https://github.com/FusionAuth/fusionauth-issues/issues/445)
Fix
When you have enabled Self Service Registration and Registration Verification FusionAuth will fail to send the email to the end user during this workflow.
[#496](https://github.com/FusionAuth/fusionauth-issues/issues/496)
Fix
If a Two-Factor Trust has been established with a particular browser through the user of a cookie, it was not being honored during the Passwordless Email workflow and the user would be prompted for the Two-Factor challenge during each login attempt.
[#495](https://github.com/FusionAuth/fusionauth-issues/issues/495)
Fix
When using managed domains with the OpenID Connect or SAML v2 Identity Provider configurations the callback to FusionAuth may fail with an error.
Thanks to [@sedough](https://github.com/sedough)
!
[#488](https://github.com/FusionAuth/fusionauth-issues/issues/488)
Fix
When a stylesheet in your theme contains `>` the new HTML escaping strategy introduced in version X causes this value in the CSS to be incorrectly escaped. If you encounter this problem in your current them, update the usage of the stylesheet to `${theme.stylesheet()?no_esc}` instead of the previous usage of `${theme.stylesheet()}`.
Thanks to [@snmed](https://github.com/snmed)
!
[#489](https://github.com/FusionAuth/fusionauth-issues/issues/489)
Fix
Fix a Kickstart bug, when a variable is used in the very first API key the replacement was not honored.
Thanks to [@tst-dhudlow](https://github.com/tst-dhudlow)
!
[#493](https://github.com/FusionAuth/fusionauth-issues/issues/493)
Enhancement
When the External JWT Identity Provider does not have any managed domains defined, allow a JWT from any domain to be reconciled. This change makes this IdP configuration more consistent with our IdP configurations that allow for managed domains.
[#491](https://github.com/FusionAuth/fusionauth-issues/issues/491)
_19 February 2020_
Known Issue
On systems running MySQL, the `1.15.0` migration fails on a `DELIMITER` command and causes the instance table to have a null `license_id`. If you upgraded to `1.15.1`, have connected our instance to a support contract, and ran the `1.15.0` migration using maintenance mode, you will need to reconnect your license Id in the Reactor tab.
- A workaround for this issue is to download the `fusionauth-database-schema-1.15.0.zip` from [our direct download page](/content/direct-download/index.html), unzip and manually apply the `migrations/mysql/1.15.0.sql` migration. You may also wait to upgrade until `1.15.3` is available and allow maintenance mode to run the fixed migration.
Fix
Password breached fixes. On some systems running PostgreSQL a portion of the breach detections features may not function properly. If you are running MySQL this will not affect you, and only certain PostgreSQL versions are affected. If you are not using FusionAuth Reactor this issue will not affect you.
_18 February 2020_
Known Issue
Fix
A SQL statement in PostgreSQL may cause some `9.x` versions to fail to store breach metrics once FusionAuth Reactor has been enabled. If you are running MySQL this will not affect you, and only certain PostgreSQL versions are affected. If you are not using FusionAuth Reactor this issue will not affect you.
_17 February 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Known Issue
Some versions of PostgreSQL may cause an exception when storing breach metrics after enabling FusionAuth Reactor. If you are not using FusionAuth Reactor or you are using MySQL instead of PostgreSQL this issue will not affect you.
Known Issue
On systems running MySQL, the `1.15.0` migration fails on a `DELIMITER` command and causes the instance table to have a null `license_id`. If you upgraded to `1.15.0`, have connected our instance to a support contract, and ran the `1.15.0` migration using maintenance mode, you will need to reconnect your license Id in the Reactor tab.
Breaking Change
In the FusionAuth admin UI you will notice that User, Groups, Applications and Tenants are all now at the top level of the left navigation sidebar. This change has been done to provide quicker access to these frequently accessed menus.
New Feature
FusionAuth Reactor ™. FusionAuth Reactor is available with all paid plans of FusionAuth. The first feature in the Reactor suite will be breached password detection. All passwords will be checked against a breached list during all password change events, and optionally during login based upon your configuration.
New Feature
New webhook event for use with FusionAuth Reactor breached password detection. This event when enabled will be fired during login if the user is using a vulnerable password.
- User Password Breach (`user.password.breach`), see [Webhook Events](/content/docs/extend/events-and-webhooks/events/index.html) for additional information.
New Feature
New Tenant configuration in support of FusionAuth Reactor and additional password validation rules. This configuration can be found in the Password tab of the Tenant configuration on the [Tenant](/content/docs/apis/tenants/index.html) API.
- `tenant.passwordValidationRules.validateOnLogin` \- When enabled the user's password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password. Prior to this release password validation was only ever performed during a change event, you may now optionally enforce your password policy during login.
- `tenant.passwordValidationRules.breachDetection` \- A new object to provide configuration per tenant for password breach detection.
New Feature
During login, if the user is required to change their password, the Login API, Authorization Code Grant, Implicit Grant and Password Grant will now also return a change reason. This additional value in the response will indicate why the user is being required to change their password.
- See the [Login](/content/docs/apis/login/index.html) API, and corresponding [OAuth endpoints](/content/docs/lifecycle/authenticate-users/oauth/endpoints/index.html) for more detail.
Security
A small window exists after a Refresh Token has expired when this token can still be used under specific circumstances. This symptom only occurs when using the `/api/jwt/refresh` API, and not when using the Refresh Grant using the `/oauth/token` endpoint. In a worst case scenario the Refresh Token may be honored up to 5 hours after the expiration date, in most circumstances it will be much less. This only applies to expired Refresh Tokens, revoking a Refresh Token is not affected.
Thanks to [@johnmaia](https://github.com/johnmaia)
!
[#454](https://github.com/FusionAuth/fusionauth-issues/issues/454)
Fix
Editing a Group in a Tenant that does not yet have any Applications created causes and exception when you attempt to save the edit form in the FusionAuth admin UI.
Thanks to [@dhait](https://github.com/dhait)
!
[#471](https://github.com/FusionAuth/fusionauth-issues/issues/471)
Fix
When Self Service Registration, if Registration Verification is enabled and Email Verification is disabled the user will not receive a Registration Verification email.
[#472](https://github.com/FusionAuth/fusionauth-issues/issues/472)
Fix
An exception may occur when using the Import User API if you are missing the `applicationId` property in a User Registration. This error should have been found as a validation error and instead an exception occurred.
- Thanks to our friends at Integra Financial Services for reporting the error.
[#479](https://github.com/FusionAuth/fusionauth-issues/issues/479)
Enhancement
Allow Kickstart to better handle varying startup times and delays. A few users reported scenarios where Kickstart would begin before FusionAuth was ready causing Kickstart to fail.
[#477](https://github.com/FusionAuth/fusionauth-issues/issues/477)
_22 January 2020_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Theme Upgrade
Made a change to themes that only impacts advanced HTML escaping in themed templates. Removed any usage of `?html` in themed templates; FusionAuth now handles this automatically.
Breaking Change
A JWT Populate Lambda now has fewer reserved claims. All claims can now be removed or modified except for `exp`, `iat` and the `sub` claims by the JWT Populate Lambda. You remove or modify claims added by FusionAuth at your own peril.
- See [JWT Populate](/content/docs/extend/code/lambdas/jwt-populate/index.html) for additional details.
[#387](https://github.com/FusionAuth/fusionauth-issues/issues/387)
Breaking Change
Added additional fields that can be merged by the `PATCH` HTTP method. The following fields were not being merge, but replaced. The limitation of this change is that it is difficult to remove fields from values from arrays. A future enhancement may be to support the [JSON Patch](https://github.com/FusionAuth/fusionauth-issues/issues/441) specification which provides semantics for add, replace and remove.
- `User.preferredLanguages`
- `User.memberships`
- `User.registrations`
- `User.data`
- `UserRegistration.data`
- `UserRegistration.preferredLanguages`
- `UserRegistration.roles`
- `Application.data`
[#424](https://github.com/FusionAuth/fusionauth-issues/issues/424)
New Feature
[Kickstart](/content/docs/get-started/download-and-install/development/kickstart/index.html) ™ allows you bypass the Setup Wizard in order to FusionAuth up and running quickly. Deploy development or production instances of FusionAuth using a pre-defined configuration of Users, Groups, Applications, Tenants, Templates, API keys, etc.
- This feature is in _Tech Preview_ which means if we find shortcomings with the design as we gather feedback from end users it is possible we will make breaking changes to the feature to correct or enhance the functionality. Any such changes will be documented in future release notes as appropriate.
[#170](https://github.com/FusionAuth/fusionauth-issues/issues/170)
New Feature
The Tenant API can optionally take a new `sourceTenantId` parameter to allow you to create a new Tenant using the values from an existing Tenant. Using the `sourceTenantId` limits the required parameters to the Tenant name.
[#311](https://github.com/FusionAuth/fusionauth-issues/issues/311)
New Feature
Add a View action to a Group Membership in the Membership tab of the Manage User panel in the UI.
[#413](https://github.com/FusionAuth/fusionauth-issues/issues/413)
Fix
A memory leak in the Nashorn JavaScript engine used to execute FusionAuth Lambdas has been resolved.
Fix
The OAuth2 Authorization Code grant was required to complete a SAMLv2 login, this grant is no longer required to be enabled.
[#432](https://github.com/FusionAuth/fusionauth-issues/issues/432)
Fix
Added missing `theme_manager` role to the FusionAuth application
_30 December 2019_
Fix
Displayed the status properly on every node during a reindex operation when viewing the User Search or the Reindex pages in the UI.
Fix
Improved Kafka configuration validation when using the Test button in the UI.
Thanks to [@nikos](https://github.com/nikos)
!
[#318](https://github.com/FusionAuth/fusionauth-issues/issues/318)
Fix
Resolved an exception that occurred when using ReactNative with FusionAuth when an HTTP Origin header was sent with a value of `file://`.
Thanks to [@karice](https://github.com/karice)
!
[#414](https://github.com/FusionAuth/fusionauth-issues/issues/414)
Fix
Resolved an exception that occurred when an invalid or expired code was used on a Passwordless login request.
Thanks to [@downagain](https://github.com/downagain)
!
[#416](https://github.com/FusionAuth/fusionauth-issues/issues/416)
Fix
Sent the `user.verified` event when a user email was verified implicitly due to a change password action that originated via an email request.
Thanks to [@JonasDoe](https://github.com/JonasDoe)
!
[#418](https://github.com/FusionAuth/fusionauth-issues/issues/418)
_19 December 2019_
Breaking Change
Rebuilt the Elasticsearch index as part of the upgrade due to a modification supporting searches on nested collections.
Fix
Kicked off an Elasticsearch reindex operation to correct the search index state caused by the 1.13.0 migration not running as intended.
Since: [`1.13.0`](/content/docs/release-notes#version-1-13-0/index.html)
_18 December 2019_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Required a manual search index rebuild if it was not automatically started during the upgrade.
New Feature
Deleted users who had not verified their email address after a specified duration.
[#360](https://github.com/FusionAuth/fusionauth-issues/issues/360)
New Feature
Deleted application registrations of users who had not verified their registration after a specified duration.
[#360](https://github.com/FusionAuth/fusionauth-issues/issues/360)
New Feature
Supported deleting Users by Search Query in the Bulk Delete Users API.
[#361](https://github.com/FusionAuth/fusionauth-issues/issues/361)
Fix
Allowed the newly supported `PATCH` HTTP method to be selected from the API key endpoint security settings.
Thanks to [@radicaljohan](https://github.com/radicaljohan)
!
[#402](https://github.com/FusionAuth/fusionauth-issues/issues/402)
Fix
Made the newly supported `PATCH` HTTP method configurable in the CORS filter.
Fix
Resolved an issue where an empty salt value recommended in an error message was failing validation during Import.
Thanks to [@TanguyGiton](https://github.com/TanguyGiton)
!
[#410](https://github.com/FusionAuth/fusionauth-issues/issues/410)
Fix
Resolved an exception that occurred when using the `PATCH` method on the User API when more than one tenant existed.
Thanks to [@JesperWe](https://github.com/JesperWe)
!
[#400](https://github.com/FusionAuth/fusionauth-issues/issues/400)
Enhancement
Allowed `DELETE /api/user/bulk` to take `queryString` and `query` parameters to search for users to delete by Elasticsearch.
[#361](https://github.com/FusionAuth/fusionauth-issues/issues/361)
Enhancement
Allowed `POST /api/user/search` and `GET /api/user/search` to take a `query` parameter for raw JSON queries.
[#361](https://github.com/FusionAuth/fusionauth-issues/issues/361)
Enhancement
Added new `sortFields` parameter to `/api/user/search` for sorting results.
Enhancement
Removed the 191-character constraint on Webhook URLs as they are no longer required to be unique.
Thanks to [@davidmw](https://github.com/davidmw)
!
[#386](https://github.com/FusionAuth/fusionauth-issues/issues/386)
_8 December 2019_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Added `OAuth device complete` and `OAuth2 wait` templates, requiring existing themes to be upgraded instead of auto-migrating templates.
Breaking Change
Added new theme messages for external authentication waiting states.
Breaking Change
Changed how events are sent to Webhooks when the Transaction configuration does not require any webhooks to succeed, processing them asynchronously to increase performance.
New Feature
Supported HYPR IdP native integration to bring passwordless and biometric options.
New Feature
Added "Send password reset" administrative action to the Manage Users panel.
Thanks to [@nicholasbutlin](https://github.com/nicholasbutlin)
!
[#351](https://github.com/FusionAuth/fusionauth-issues/issues/351)
New Feature
Added "Resend email verification" and "Resend verification" administrative actions.
Fix
Resolved a missing tenant error when modifying user actions with multi-tenants.
Thanks to [@AlvMF1](https://github.com/AlvMF1)
!
[#328](https://github.com/FusionAuth/fusionauth-issues/issues/328)
Fix
Resolved an issue where the JWT Validate endpoint returned the wrong precision for `iat` and `exp` claims.
Thanks to [@uncledent](https://github.com/uncledent)
!
[#347](https://github.com/FusionAuth/fusionauth-issues/issues/347)
Fix
Resolved an issue where a Refresh Token was not returned from the Login API when using the OTP from the Change Password API.
Thanks to [@colingm](https://github.com/colingm)
!
[#382](https://github.com/FusionAuth/fusionauth-issues/issues/382)
Fix
Handled "null" Origin headers to prevent exceptions when validating authorized origins.
Thanks to [@karice](https://github.com/karice)
!
[#379](https://github.com/FusionAuth/fusionauth-issues/issues/379)
Fix
Improved handling on the Start Passwordless API when a user does not exist.
Thanks to [@smoorsausje](https://github.com/smoorsausje)
!
[#377](https://github.com/FusionAuth/fusionauth-issues/issues/377)
Enhancement
Disassociated UserActions instead of deleting them when a user is deleted via the User Delete API.
Enhancement
Supported taking a User Action on a user in a different tenant via the admin UI.
Enhancement
Supported the `PATCH` HTTP method across multiple APIs and FusionAuth client libraries.
[#121](https://github.com/FusionAuth/fusionauth-issues/issues/121)
Enhancement
Accepted encoded JWTs in the Authorization header under both `Bearer` and `JWT` schemas.
Enhancement
Added an in-progress indicator to the login panel during external logins.
Thanks to [@davidmw](https://github.com/davidmw)
!
[#331](https://github.com/FusionAuth/fusionauth-issues/issues/331)
_29 October 2019_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Security
Removed the possibility of malicious code execution through a FreeMarker template (CVE-2020-7799).
Breaking Change
Removed the `sid` and `iss` request parameters from the URL provided by `post_logout_redirect_uri`.
Thanks to [@davidmw](https://github.com/davidmw)
!
[#332](https://github.com/FusionAuth/fusionauth-issues/issues/332)
Breaking Change
Added the `OAuth device` themed template and associated theme messages to support the OAuth Device Grant feature.
Breaking Change
Added `response_mode` and `user_code` hidden fields to `_helpers.ftl` for device grant support.
New Feature
Added support for the OAuth2 Device Authorization Grant.
[#320](https://github.com/FusionAuth/fusionauth-issues/issues/320)
New Feature
Supported the `response_mode` request parameter during the Authorization Code grant and Implicit grant workflows.
Thanks to [@bertiehub](https://github.com/bertiehub)
!
[#159](https://github.com/FusionAuth/fusionauth-issues/issues/159)
New Feature
Added an additional API in support of Passwordless Login (Start, Send, Complete workflow).
[#175](https://github.com/FusionAuth/fusionauth-issues/issues/175)
New Feature
Provided a developer preview of the `PATCH` HTTP method on select APIs.
[#121](https://github.com/FusionAuth/fusionauth-issues/issues/121)
Fix
Returned a `400` status code on the Import API when a foreign key constraint caused the import to fail.
Thanks to [@AlvMF1](https://github.com/AlvMF1)
!
[#317](https://github.com/FusionAuth/fusionauth-issues/issues/317)
Fix
Returned a `401` status code on the `Userinfo` endpoint for invalid tokens.
[#321](https://github.com/FusionAuth/fusionauth-issues/issues/321)
Fix
Fixed Passwordless login external identifier complexity settings.
Thanks to [@pawpro](https://github.com/pawpro)
!
[#322](https://github.com/FusionAuth/fusionauth-issues/issues/322)
Fix
Resolved an error incorrectly displayed on the Forgot Password form when the code was valid.
Thanks to [@JesperWe](https://github.com/JesperWe)
!
[#330](https://github.com/FusionAuth/fusionauth-issues/issues/330)
Fix
Resolved an exception thrown during a key cache reload request when a large number of tenants existed.
Thanks to [@johnmaia](https://github.com/johnmaia)
!
[#326](https://github.com/FusionAuth/fusionauth-issues/issues/326)
Fix
Resolved logout issues by adopting an alternative strategy for resolving `client_id` when using `id_token_hint`.
Thanks to [@paulspencerwilliams](https://github.com/paulspencerwilliams)
!
[#350](https://github.com/FusionAuth/fusionauth-issues/issues/350)
Fix
Supported SAML SPs that do not send the `<samlp:NameIDPolicy />` constraint, defaulting to email address format.
Enhancement
Added a new `Logout behavior` attribute to make front-channel logout more flexible.
[#324](https://github.com/FusionAuth/fusionauth-issues/issues/324)
Enhancement
Defaulted `fields` and `permissions` parameters to `email` on create for the Facebook IdP configuration.
Enhancement
Allowed the Passwordless Send API to accept an optional `code` parameter generated by the Passwordless Start API.
_1 October 2019_
Fix
Resolved an issue where logging into Google or other external IdPs for an Application outside the default tenant failed.
Since: [`1.9.0`](/content/docs/release-notes#version-1-9-0/index.html)
Fix
Resolved a `500` status code error during the processing of the SAML v2 response from a SAML v2 IdP.
Thanks to [@Raghavsalotra](https://github.com/Raghavsalotra)
!
[#314](https://github.com/FusionAuth/fusionauth-issues/issues/314)
_30 September 2019_
Breaking Change
Added an `OAuth logout` themed template and associated messages to support the OpenID Connect Front Channel logout feature.
New Feature
Added support for the OpenID Connect Front Channel logout draft specification.
[#256](https://github.com/FusionAuth/fusionauth-issues/issues/256)
Fix
Resolved an issue where the Send email API could fail with a `500`.
Since: [`1.9.0`](/content/docs/release-notes#version-1-9-0/index.html)
Fix
Fixed a SAML v2 Invalid Redirect issue.
Thanks to [@prasanna10021991](https://github.com/prasanna10021991)
!
[#287](https://github.com/FusionAuth/fusionauth-issues/issues/287)
Enhancement
Allowed request parameters on the Authorization endpoint in the OIDC relying party configuration to integrate with Twitch.
Thanks to [@tauinger-de](https://github.com/tauinger-de)
!
[#309](https://github.com/FusionAuth/fusionauth-issues/issues/309)
_24 September 2019_
Fix
Resolved an inability to login if one or more themes were defined prior to the upgrade.
Thanks to [@flangfeldt](https://github.com/flangfeldt)
!
[#306](https://github.com/FusionAuth/fusionauth-issues/issues/306)
_23 September 2019_
New Feature
Added full theme localization support for errors and all other text.
Fix
Resolved a template validation failure when editing an email template containing `${user.tenantId}`.
Thanks to [@tauinger-de](https://github.com/tauinger-de)
!
[#294](https://github.com/FusionAuth/fusionauth-issues/issues/294)
Fix
Prevented soft-locked accounts from logging in via Google or other external identity providers by returning a `423` status code.
Thanks to [@jerryhopper](https://github.com/jerryhopper)
!
[#301](https://github.com/FusionAuth/fusionauth-issues/issues/301)
_23 September 2019_
Fix
Resolved an exception that occurred when attempting to edit and save the name of the default FusionAuth theme.
_10 September 2019_
Fix
Resolved a SQL migration issue present in `1.8.0-RC.1` related to `null` values in the `applications_id` column.
Fix
Resolved an issue where performing a clean install of `1.8.0-RC.1` failed in some cases.
Fix
Resolved an issue where external IdP logins redirected users to an invalid `/password/change` state when a password change was required.
_8 September 2019_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Noted a known SQL issue that may cause migration to fail if `user_external_ids` contained null `applications_id` values.
Breaking Change
Moved previously global configurations (SMTP, Events, Passwords, JWT, Themes) to the Tenant configuration for multi-tenant flexibility.
Breaking Change
Required `tenantId` to be provided on requests using an HTTP request parameter when utilizing themes to ensure correct rendering.
Breaking Change
Changed themed stylesheet access from `${loginTheme.stylesheet}` to `${theme.stylesheet()}`.
New Feature
Added a top-level theme menu in the FusionAuth UI for managing and previewing themes per tenant.
New Feature
Exposed a user-modifiable CORS configuration.
[#180](https://github.com/FusionAuth/fusionauth-issues/issues/180)
New Feature
Allowed public keys to be retrieved by `kid` in addition to `applicationId`.
[#227](https://github.com/FusionAuth/fusionauth-issues/issues/227)
New Feature
Added PKCE support for use during the Implicit Grant.
New Feature
Added new User Email Verified and User Registration Verified events.
Thanks to [@unkis](https://github.com/unkis)
!
[#163](https://github.com/FusionAuth/fusionauth-issues/issues/163)
New Feature
Allowed verification and passwordless codes to optionally use digits instead of long strings.
Thanks to [@zbruhnke](https://github.com/zbruhnke)
!
[#269](https://github.com/FusionAuth/fusionauth-issues/issues/269)
Fix
Resolved an issue where an Id Token signed by FusionAuth could not be verified if sent back to FusionAuth.
Since: [`1.6.0`](/content/docs/release-notes#version-1-6-0/index.html)
Fix
Resolved subject text rendering issues for multi-byte characters when the host OS was not configured for `UTF-8`.
Thanks to [@Lechu67](https://github.com/Lechu67)
!
[#231](https://github.com/FusionAuth/fusionauth-issues/issues/231)
Fix
Resolved a toggle rendering issue in Firefox.
Thanks to [@snmed](https://github.com/snmed)
!
[#260](https://github.com/FusionAuth/fusionauth-issues/issues/260)
Fix
Resolved unexpected "Application does not exist" errors caused by timing issues during programmatic creation.
Thanks to [@johnmaia](https://github.com/johnmaia)
!
[#252](https://github.com/FusionAuth/fusionauth-issues/issues/252)
Fix
Resolved exceptions during Google login when the returned `picture` claim was not a valid URI.
Thanks to [@damienherve](https://github.com/damienherve)
!
[#249](https://github.com/FusionAuth/fusionauth-issues/issues/249)
Fix
Resolved an issue where deleting a tenant failed if the search index was not updated first.
Thanks to [@johnmaia](https://github.com/johnmaia)
!
[#221](https://github.com/FusionAuth/fusionauth-issues/issues/221)
Fix
Fixed the broken relative link to restart the Forgot Password workflow on the Change Password themed template.
Thanks to [@flangfeldt](https://github.com/flangfeldt)
!
[#280](https://github.com/FusionAuth/fusionauth-issues/issues/280)
Fix
Resolved Import API failures caused by false positives during password salt validation.
Thanks to [@tombeany](https://github.com/tombeany)
!
[#272](https://github.com/FusionAuth/fusionauth-issues/issues/272)
Fix
Resolved UI errors when modifying an Identity Provider configuration if an Application was disabled.
Thanks to [@fabiojvalente](https://github.com/fabiojvalente)
!
[#245](https://github.com/FusionAuth/fusionauth-issues/issues/245)
Fix
Corrected PostgreSQL schema detection logic during database maintenance mode reconnections.
Thanks to [@whiskerch](https://github.com/whiskerch)
!
[#237](https://github.com/FusionAuth/fusionauth-issues/issues/237)
Fix
Fixed a typo in the Java client that failed the `generateEmailVerificationId` request.
Thanks to [@petechungtuyco](https://github.com/petechungtuyco)
!
[#282](https://github.com/FusionAuth/fusionauth-issues/issues/282)
Enhancement
Included a User object in the JWT Refresh Token Revoke event when available.
Thanks to [@AlvMF1](https://github.com/AlvMF1)
!
[#255](https://github.com/FusionAuth/fusionauth-issues/issues/255)
Enhancement
Made `passwordValidationRules` always available in themed templates when choosing to display them.
Thanks to [@AlvMF1](https://github.com/AlvMF1)
!
[#263](https://github.com/FusionAuth/fusionauth-issues/issues/263)
Enhancement
Updated PostgresSQL connector to support `SCRAM-SHA-256`.
Thanks to [@colundrum](https://github.com/colundrum)
!
[#209](https://github.com/FusionAuth/fusionauth-issues/issues/209)
Enhancement
Accepted optional `tenantId` request parameter on the OpenID Connect discovery endpoint.
_22 August 2019_
Fix
Resolved an issue where configured ACS endpoints may not work properly when setting up a SAML v2 IdP relying party.
Thanks to [@johan](https://github.com/johan)
!
_15 August 2019_
New Feature
Added a debug flag to IdP configurations to assist in logging and debugging integration issues.
New Feature
Added SAML v2 Service Provider (Relaying Party) Metadata URL.
Fix
Corrected URLs in the OpenID Configuration discovery document when running behind a proxy without `X-Forwarded-Port`.
Fix
Resolved SAML v2 issues when using transient or persistent Name Id formats.
Thanks to [@mikerees](https://github.com/mikerees)
!
[#205](https://github.com/FusionAuth/fusionauth-issues/issues/205)
Fix
Added missing `protocolSupportEnumeration` to the `IDPSSODescriptor` in SAML v2 IdP Metadata.
[#235](https://github.com/FusionAuth/fusionauth-issues/issues/235)
Fix
Ensured the `issuer` attribute value matched the `entityId` in SAML v2 IdP Metadata.
[#240](https://github.com/FusionAuth/fusionauth-issues/issues/240)
Fix
Ensured audit log entries were created for FusionAuth admins without an email address modifying configuration in the UI.
[#268](https://github.com/FusionAuth/fusionauth-issues/issues/268)
Enhancement
Moved integration details to a view dialog for each Identity Provider configuration.
_19 June 2019_
Fix
Resolved an issue preventing the deletion of a user with recent failed logins when tracking is enabled.
Thanks to [@gmpreussner](https://github.com/gmpreussner)
!
[#184](https://github.com/FusionAuth/fusionauth-issues/issues/184)
Fix
Resolved login failures to third-party SAML IdPs.
Thanks to [@davidmw](https://github.com/davidmw)
!
[#181](https://github.com/FusionAuth/fusionauth-issues/issues/181)
Fix
Fixed the uptime calculation for nodes displayed in the System -> About panel.
_13 June 2019_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Enforced that the `timezone` field in User and UserRegistration must be a valid IANA time zone.
New Feature
Introduced Family and relationship modeling, including concepts and Family APIs.
New Feature
Introduced Consent management (COPPA VPC, COPPA Email+) and Consent APIs.
New Feature
Allowed exporting Audit Logs to a zipped CSV in the UI and via the Export API.
New Feature
Allowed exporting Login Records to a zipped CSV in the UI and via the Export API.
New Feature
Added a Login Record view with limited search and pagination capabilities.
New Feature
Added an optional retention policy to retain a configured number of days worth of Audit Logs.
New Feature
Added an optional retention policy to retain a configured number of days worth of Login Records.
Fix
Corrected handling of timezones that were incorrectly discovered as `undefined` during login.
Fix
Supported importing Bcrypt hashes that contain a `.` (dot) in the Base64 encoding.
Fix
Improved support for third-party 2FA devices by accepting secrets in Base32 or Base64 encoded formats.
Fix
Correctly returned managed domains for SAML v2 IdP configurations.
Enhancement
Made the User Registration object available as a top-level object `registration` in the Verify Registration email template.
Enhancement
Supported arbitrary URIs for OAuth redirects.
[#58](https://github.com/FusionAuth/fusionauth-issues/issues/58)
Enhancement
Added `user.mobilePhone` to the search index.
Thanks to [@petechungtuyco](https://github.com/petechungtuyco)
!
[#165](https://github.com/FusionAuth/fusionauth-issues/issues/165)
_13 June 2019_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Fix
Resolved a possible migration error for PostgreSQL users.
_28 April 2019_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Deprecated JWT-related properties in `SystemConfiguration` and `Application` domains in favor of Key Master.
Breaking Change
Deprecated `SystemConfiguration.jwtConfiguration.issuer`, moving it to `SystemConfiguration.issuer`.
Breaking Change
Added a new macro to `_helpers.ftl`. Existing themes need to merge this update to render properly.
New Feature
Added support for SAMLv2 IdP.
[#3](https://github.com/FusionAuth/fusionauth-issues/issues/3)
New Feature
Added support for SAMLv2 Service Provider to federate authentication.
[#104](https://github.com/FusionAuth/fusionauth-issues/issues/104)
New Feature
Introduced Lambda support for user-defined JavaScript functions to customize claims and reconcile IdP responses.
New Feature
Introduced the Event Log to assist developers in debugging integrations.
New Feature
Introduced Key Master to manage HMAC, Elliptic, and RSA keys.
New Feature
Added new events for user logins and registrations.
New Feature
Added the ability to duplicate email templates using the Duplicate action.
[#142](https://github.com/FusionAuth/fusionauth-issues/issues/142)
New Feature
Separated the management of Access Token and Id Token signing.
Enhancement
Reflected the insert instant provided on the Import API in historical registration reports.
[#144](https://github.com/FusionAuth/fusionauth-issues/issues/144)
Enhancement
Displayed additional node information on the About panel in clustered environments.
Fix
Gracefully handled disabled Passwordless login attempts by displaying a proper error to the user.
Fix
Fixed an issue where combining Implicit Grant with Self Service Registration assumed the Authorization Code grant.
Thanks to [@whiskerch](https://github.com/whiskerch)
!
[#102](https://github.com/FusionAuth/fusionauth-issues/issues/102)
Fix
Fixed OpenID Connect federated login exceptions caused by the removal of the `device` field from OAuth.
Fix
Ensured `id_token` is included when using the Refresh Grant with a token obtained via the `openid` scope.
Thanks to [@fabiosimeoni](https://github.com/fabiosimeoni)
!
[#110](https://github.com/FusionAuth/fusionauth-issues/issues/110)
Fix
Resolved failures with OpenID Connect Identity Providers that require client authentication.
[#118](https://github.com/FusionAuth/fusionauth-issues/issues/118)
_25 March 2019_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Removed `/oauth2/token` from the CORS configuration, preventing OAuth2 Password grants directly from JavaScript.
Breaking Change
Ignored the `device` parameter on the Login API or Authorized endpoint, as it is no longer required for Refresh Tokens.
Breaking Change
Corrected the Refresh API JSON response body to match the documentation.
New Feature
Added support for Passwordless login via email.
New Feature
Added support for the OAuth2 Implicit Grant.
New Feature
Allowed specific OAuth grants to be enabled or disabled per application.
New Feature
Supported calling the Change Password API using a JWT for SPA workflows.
New Feature
Returned a One Time Password (OTP) from the Change Password API that can be exchanged for new tokens.
New Feature
Allowed the Login API to optionally require an API key and restrict Refresh Token returns.
New Feature
Added `c_hash`, `at_hash`, and `nonce` claims to the `id_token` payload.
New Feature
Added support for the `client_secret_post` Client Authentication method.
Enhancement
Improved ECDSA private and public key validation.
Enhancement
Automatically logged in users upon completing a required change password workflow in OAuth2 grants.
Enhancement
Returned the `twoFactorTrustId` as an HTTP Only secure cookie from the Two-Factor Login API.
Fix
Resolved an error when searching the Login Report by user across multiple tenants.
Fix
Displayed validation errors correctly in the Add Claim dialog.
Fix
Returned a `400` status code instead of `500` for empty `POST` or `PUT` bodies on the Tenant API.
Fix
Corrected date formatting for administrators using the English locale without a set preference.
Fix
Fixed form validation errors during self-registration.
Fix
Opened the correct Action user dialog from the Manage User panel.
Fix
Ensured 2FA occurred before the change password workflow during login.
Fix
Fixed the Forgot Password link on the login page in multi-tenant environments.
Fix
Ensured the Logout API reliably deleted the `access_token` and `refresh_token` cookies.
Fix
Signed the `id_token` with the `client_secret` when an HMAC algorithm is selected.
Thanks to [@anbraten](https://github.com/anbraten)
!
[#57](https://github.com/FusionAuth/fusionauth-issues/issues/57)
Fix
Returned a `400` error from the Login API when an invalid `applicationId` was provided.
Fix
Reduced the overall `fusionauth-app` Docker image size by ~200 MB via permissions changes.
_4 February 2019_
Breaking Change
Renamed `Type` enum in `DeviceInfo` class to `DeviceType` (affects Java and C# clients).
Breaking Change
Allowed multiple authorization codes to exist for a single user simultaneously.
New Feature
Added Self-service registration forms per application.
New Feature
Added JSON Web Key set support endpoint at `/.well-known/jwks.json`.
New Feature
Added Elliptic Curve signature support for JSON Web Tokens (ES256, ES384, ES512).
New Feature
Released the Typescript client library.
New Feature
Added filtering by `loginId` or `userId` in the Login Report UI and API.
Fix
Ensured silent configuration executed database schema updates properly during Docker Compose upgrades.
Fix
Prevented tenants from being deleted with API keys assigned to another tenant.
Fix
Updated Maintenance Mode to correctly handle public keys for MySQL 8.0.13 and above.
Fix
Resolved an issue where Social Logins caused users to become unable to login with native credentials.
Fix
Correctly saved the `given_name` claim into `firstName` instead of `fullName` for OpenID Connect IdPs.
Fix
Invalidated SSO sessions immediately when users were soft deleted, actioned, or changed passwords.
[#59](https://github.com/FusionAuth/fusionauth-issues/issues/59)
_19 December 2018_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
Breaking Change
Preferred API keys over JWTs if both were provided on a request, ensuring the API key retrieved the correct user data.
[#43](https://github.com/FusionAuth/fusionauth-issues/issues/43)
Breaking Change
Removed the requirement for the `client_id` on the OAuth Token endpoint when client authentication was provided via Basic Auth.
[#54](https://github.com/FusionAuth/fusionauth-issues/issues/54)
Fix
Resolved a JavaScript error in the UI that prevented JWT settings from rendering properly.
Since: [`1.3.0`](/content/docs/release-notes#version-1-3-0/index.html)
Fix
Added missing properties to the Application view dialog in the FusionAuth UI.
Fix
Honored the `openid` scope during login when a user had Two-Factor authentication enabled.
[#53](https://github.com/FusionAuth/fusionauth-issues/issues/53)
Fix
Returned a `400` status code instead of `500` when the `client_id` request body parameter was omitted.
[#54](https://github.com/FusionAuth/fusionauth-issues/issues/54)
Fix
Correctly built OAuth2 redirect URIs when they were registered with existing query parameters.
[#55](https://github.com/FusionAuth/fusionauth-issues/issues/55)
Fix
Resolved an issue where FusionAuth stayed in maintenance mode when connecting to AWS Elasticsearch clusters.
_5 December 2018_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
New Feature
Allowed applications to disable the issuance of refresh tokens through configuration.
New Feature
Allowed the OAuth2 client secret to be optionally regenerated via the UI.
New Feature
Supported OAuth2 confidential clients by optionally requiring client authentication.
Fix
Included the `aud` claim in tokens to resolve Introspect endpoint failures.
Fix
Replaced `random_bytes` in the MySQL schema to ensure MariaDB compatibility.
Thanks to [@anbraten](https://github.com/anbraten)
!
[#48](https://github.com/FusionAuth/fusionauth-issues/issues/48)
Fix
Resolved a JavaScript error that autofilled the `Birthdate` field unexpectedly.
[#41](https://github.com/FusionAuth/fusionauth-issues/issues/41)
_27 November 2018_
Fix
Added `X-FusionAuth-TenantId` to allowed CORS headers.
[#44](https://github.com/FusionAuth/fusionauth-issues/issues/44)
Fix
Corrected redirect URI resolution when running FusionAuth behind a proxy like an AWS ALB/ELB.
Fix
Resolved minor usability issues in the Identity Provider configuration UI.
_16 November 2018_
Enhancement
Consistently returned a `400` status code with a descriptive JSON body for invalid JSON payloads.
[#17](https://github.com/FusionAuth/fusionauth-issues/issues/17)
Enhancement
Allowed Identity Providers to be globally enabled or disabled from the UI.
Fix
Preserved Application Identity Provider configuration for disabled Applications when editing from the UI.
_15 November 2018_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
New Feature
Added TTL configuration for Refresh Tokens at the Application level.
Fix
Resolved an error in the Twitter OAuth v1 workflow.
_13 November 2018_
Database Migration
For more information about database migrations, see [Database Migrations](/content/docs/operate/deploy/upgrade#downtime-and-database-migrations/index.html).
New Feature
Added Social login support for Facebook, Google, Twitter, and OpenID Connect.
New Feature
Introduced full theme support for customizing the login experience.
New Feature
Added localization support in the UI for preferred language formatting (e.g., date formats).
Enhancement
Displayed start and expiration times for sessions (refresh tokens) on the Manage User panel.
_13 November 2018_
Fix
Resolved a database migration failure for instances with existing Identity Providers for federated JWTs prior to `1.1.0`.
_29 October 2018_
Fix
Resolved an issue where FusionAuth became stuck in maintenance mode if left idle for extended periods.
_5 October 2018_
Enhancement
Made silent configuration for database and search engine bootstrap more resilient in Docker Compose.
Fix
Prevented custom data loss when editing Application, Group, or Tenant objects in the UI.
_5 October 2018_
Fix
Resolved an issue where FusionAuth could not connect to the search service when exiting the setup wizard in Docker Compose.
_1 October 2018_
New Feature
Allowed configurations to be overridden using environment variables in Docker.
Fix
Ensured a JSON response body was returned correctly the first time a user reached the failed login threshold.
_17 September 2018_
Fix
Resolved an exception that occurred during internal cache reloads when using PostgreSQL.
_12 September 2018_
New Feature
First made FusionAuth generally available!
Ask AI