Added:

• Added an Opt-in setting for existing configurations to create an entry on the platform's "General Log" to register successful logins. This allows the logs to be available using the Log Streaming add-on.
  • This setting can be toggled per "app configuration"
  • The log will have "OIDC_Audit" as the "source" for easy search in Service Center.
  • The log format will be: 
    • Login from UserId: X | OIDCAppName: AppName | RedirectTo: "/OIDCTest/Home"

Changed:

• There is now a feedback message when an invalid or unreachable OIDC discovery endpoint is used to help guide the users to fix it instead of allowing the configuration to be saved incorrectly
• The purge timers were changed to no longer be multi-tenant. This will result in less executions overall for the purge logic.

Fixed:

• Fixed an issue on the Timer_PurgeSessions that could be stuck trying to purge mobile sessions when it shouldn't. Now mobile sessions are properly ignored as intended.
• Fixed an issue where the Timer_PurgeSessions would not call itself if the logical timeout had been reached and instead was calling the Timer_PurgeState. Now the Timer_PurgeSessions will be properly recalled upon reaching it's timeout. The timer Timer_PurgeState will only be called when the timer Timer_PurgeSessions has cleared all the sessions it needs to. 

Changed: 

• Scope merge will no longer lowercase the scope name to avoid issues with case sensitive scopes.
• Updated the RSAtoJKS extension with the latest version of the referenced libraries

Fixed: 

• Fixed the usage of the custom error page configuration. In certain scenarios the error page would not be properly propagated, resulting in the usage of the default error page.

Security: 

• Improved the URL redirect validation to prevent open-redirect attacks during login and logout

Changed:

• Changed the way that the endpoints of the external identity provider were being fetched to reduce the number of requests needed.

Fixed:

• Changed the token validation logic to prevent some errors when the response code was to large to be stored on a temporary cookie.
  This fix should solve authentication errors when the Code sent by the external identity provider was larger than 4096 bytes.