Veröffentlichungen

New Features and Improvements

Browser PIN

FoxIDs now supports Browser PIN as a built-in additional factor in both simple two-factor mode and Advanced multi-factor. A user registers the current browser and protects it with a numeric PIN. The protected browser cookie and knowledge of the PIN complete the factor; Browser PIN cannot be used as primary authentication.

A registration is shared by the environment's Login authentication methods. Each user can register up to five browsers, while a browser holds one current registration for that user, environment and host. FoxIDs does not store the PIN, a PIN hash or other PIN verification data on the user.

Users can select Browser PIN setup while completing another available factor. If Browser PIN is the only available factor and the user has no existing Browser PIN registrations, the first registration can follow the primary sign-in directly. Later registration or replacement requires verification with a different factor, a configured Authentication Action, or administrator removal of the existing registrations.

Environment settings control the PIN length, rejection of weak PINs, sliding cookie lifetime and optional absolute lifetime. Advanced multi-factor can notify a backend when a Browser PIN is registered or updated. Control API operations support listing, removing and synchronising registrations between FoxIDs deployments. Successful Browser PIN authentication contributes the AMR value browser-pin.

Authentication Actions

FoxIDs now supports Authentication Actions, which start an action flow using a configured authentication method from a dynamic link.

The supported action types are Register authenticator app and Register Browser PIN. Authentication Actions require the user to authenticate again before the action continues. When a requested, first-factor or session user is known, FoxIDs verifies that the action resolves the same internal user.

When Advanced multi-factor is disabled, registering a new authenticator app replaces the existing registration. When Advanced multi-factor is enabled, the new registration is added if capacity is available.

Registering a Browser PIN replaces the registration represented by the current browser cookie. If the browser has no registration for the user, FoxIDs adds one if capacity is available.

Require Authentication Each Time

Authentication methods and individual profiles can now enable Require authentication each time. FoxIDs then bypasses an existing authentication-method session and requests a new authentication whenever the method or selected profile is started.

Enabling the setting on an authentication method applies it to the base method and all profiles. Enabling it on an individual profile applies it only when that profile is selected.

FoxIDs sends the corresponding authentication request to external identity providers. Login and External Login authentication methods bypass their existing authentication-method sessions. Authentication Actions always require authentication each time.

Dynamic Link Elements

Added separate URL link element, Authentication action link element, and Authentication method link element types.

Link text and destination are configured independently, allowing the visible link text to be translated. Authentication method link elements let you select an authentication method and, optionally, one of its profiles.

Authentication action and authentication method links can also be embedded in Text/Markdown, HTML, Large Text/Markdown, and Large HTML content. Authentication method destinations use one of these formats:

• foxids://authentication-method/<authentication-method-name>
• foxids://authentication-method/<authentication-method-name>+<profile-name>

URL destinations are validated as absolute http, https, or mailto: URLs. Links in HTML, Markdown, and Large content are validated when the configuration is saved.

Start Authentication Methods from Dynamic Links

A dynamic link can now start a selected authentication method during a Login authentication flow.

Following the link starts a new authentication sequence with the selected method and optional profile. After authentication is completed, the current application login continues.

Authentication method links are supported on identifier, password, passwordless-code, user-creation, and Extended UI pages owned by a Login authentication method.

Show Dynamic Elements on Selected Pages

Dynamic elements now support a Show on configuration, including the new link elements.

Elements can be shown only on selected pages, such as username, password, passwordless, user creation, MFA, authenticator app registration and recovery code, Browser PIN registration, and Extended UI pages. Authentication action and authentication method link elements offer only the pages supported by their destinations.

This makes it possible to tailor dynamic content to specific stages of the authentication flow.

Optional password change during sign-in

Login authentication methods can now show a Change password checkbox during password sign-in. Enable Show change password option to make it available.

The checkbox has its own movable Change password option element in the Login UI, making its placement fully customisable.

The option is enabled for new Login authentication methods created in the Control Client. Control API create and update requests default to false to preserve existing behaviour.

Optional MFA login during sign-in

Login authentication methods can now show a secondary Log in with MFA button during password sign-in. Enable Show MFA login button to let users request MFA for the current sign-in when MFA would otherwise be optional.

When MFA is already required by the Login authentication method or requested with urn:foxids:mfa, enabling the setting changes the primary button from Log in to Log in with MFA instead of adding a secondary button. If the setting is disabled, the normal Log in button remains visible, while MFA is still required after password validation.

The displayed buttons never depend on whether the entered account exists or has a user-specific MFA requirement. This prevents the password page from disclosing account or MFA information before authentication. The corresponding Control API property is enableMfaLoginButton and defaults to false.

Set Password Extended UI

Added a Set password Extended UI module for users who have been verified by an authentication method and need to set a password on an internal FoxIDs account.

The page shows the account's username, email address or phone number according to the identifier configuration on the Login authentication method. The user can set a password without entering the current password or select Continue without setting a password. Both choices continue the normal login flow.

Claim transforms identify exactly one active internal user through _internal:set_password_user_id, either by mapping a trusted user ID claim or by using Query internal user. FoxIDs uses the selected account for the password update and the continued login. The login is rejected if it is already associated with a different internal account.

The authentication method or selected profile must enable Require authentication each time.

Internal Claims in Claim Transforms

Added the protected _internal:* claim namespace for trusted values that need to pass between internal claim-transform sequences.

Internal and external user queries now expose the stable user ID as _local:internal_user_id and _local:external_user_id.

Protection of the reserved _local:* and _internal:* namespaces has also been strengthened. Claims in these namespaces cannot be supplied by external sources, stored on users, or returned to applications.

More Flexible Regex Map Claim Transforms

Regex map claim transforms now accept exactly one capture group, which can be unnamed or use any valid group name. The capture group no longer has to be named map.

Existing saved expressions continue to prefer the map group when present. Otherwise, the first capture group is used.

Regex syntax and capture-group count are validated when the claim transform is saved or updated, providing clear errors for invalid expressions.

Authentication Method Profiles Retained Across Sessions

Authentication method profiles are now included in session tracking.

When a valid FoxIDs session is reused, FoxIDs retains the previously selected profile if it is still allowed by the application. If the profile is no longer allowed, FoxIDs follows the application's current authentication method selection rules instead of silently selecting another profile.

This behaviour is consistent across supported authentication flows and single logout.

Improved Enum Validation in the Control API

The Control API now consistently rejects undefined enum values before they reach application logic.

Existing persisted configurations remain readable and backward compatible.

Improved Control Client Session Expiration Handling

The Control Client now checks active login sessions every 10 minutes.

If the session can no longer be renewed, the current page is blurred and a dialog prompts the user to log in again. This provides a clearer and more predictable experience when an administrative session expires.

Automatic exposure of default resource scopes

Scopes added to the default resource of an OAuth 2.0 or OpenID Connect client are now automatically exposed by the application’s resource. FoxIDs creates the resource when the first scope is added. Removing a client scope does not remove it from the resource; this must be done explicitly on the OAuth 2.0 Resource tab.

Bugs Resolved

Directory Connector Error Handling

Fixed a null reference exception that could occur when a Directory Connector API returned an empty error response.

FoxIDs now reports a clear contract error that includes the HTTP status code, making connector issues easier to diagnose.

This release improves browser error handling, Directory Connector integration, API localisation, claim processing, and platform security across FoxIDs.

User-facing error pages now keep technical diagnostics in the logs while showing clearer messages and additional troubleshooting identifiers. Directory Connector integrations can return a dedicated login_rejected response with an optional localised UI message, and selected FoxIDs culture settings are now forwarded to connected APIs.

The release also strengthens handling of claims returned by external APIs, reduces the amount of unauthenticated Control Client configuration exposed before login, tightens Content Security Policy (CSP), and improves health check responses by removing internal error details from HTTP responses while preserving diagnostics in the logs.

In addition, SAML metadata generation and Home Realm Discovery (HRD) behaviour have been corrected in specific edge cases.

New Features and Improvements

Improved Browser Error Pages

Technical diagnostics are kept in the logs while helpful user messages remain visible.

The Sequence ID, when available, is now shown alongside the Operation ID, making troubleshooting easier.

Directory Connector Login Rejection and API Localisation

Added support for login_rejected with an optional uiErrorMessage that is shown directly on the login form.

If the message is missing or blank, FoxIDs uses the existing general login error while keeping diagnostic details in the logs. Directory Connectors must verify the supplied credentials before returning login_rejected.

Directory Connector, External Password, and Extended UI now send the selected FoxIDs culture in the Accept-Language header, allowing connected APIs to return messages in the same language as the login page.

Improved Handling of Empty Claims from External APIs

FoxIDs now ignores claims with a missing, null, empty, or whitespace-only type or value in responses from:

• Claims API
• Extended UI
• External Login
• Directory Connector

When trace message logging is enabled, received claims are logged before filtering to support troubleshooting. Long trace messages are truncated.

Control Client Settings and Content Security Policy

Before login, the Control Client now returns only the configuration required to start the login process. Other settings require an authenticated session and access to the relevant tenant.

The Content Security Policy (CSP) has also been tightened to further restrict dynamic JavaScript execution and allowed content.

Improved Health Check Responses

Health check endpoints now return fixed messages and HTTP status codes without exposing internal error details.

Failed component checks continue to return HTTP 503, allowing monitoring systems to detect operational issues.

Bugs Resolved

SAML Metadata Generation After Metadata Import

Fixed an issue where SAML metadata generation could fail with SAML binding '0' not supported after metadata import.

Unspecified bindings now default to HTTP-POST, and existing zero values are normalised when configurations are loaded and saved. Explicitly configured bindings are preserved.

Correct Home Realm Discovery After Authentication Method Changes

Fixed a rare issue where an existing session could cause a local password prompt instead of the expected OpenID Connect redirect after changing an application's allowed authentication methods.

Home Realm Discovery (HRD) now resumes correctly when the previous Login session has expired or its cookie is missing.

This release improves authentication reliability, identifier flexibility, and OpenID Connect configuration management across FoxIDs.

FoxIDs can now detect and stop likely authentication loops, supports a broader set of valid usernames while retaining existing email compatibility, and keeps automatically managed CORS origins aligned when OIDC redirect URIs change. It also resolves an issue where existing users could not always be found through additional email or username identifiers.

New Features and Improvements

Authentication Loop Detection

FoxIDs now detects repeated browser-based sign-ins to the same application and stops likely authentication loops before another authentication method is started.

Detection is enabled by default for OpenID Connect, SAML 2.0, and WS-Federation applications and is tracked separately for each application registration. Only successful authentication responses are counted.

By default, the next request is blocked after 5 successful responses within 20 seconds. Both the limit and observation period can be configured per environment.

More Flexible Usernames and Email Addresses

FoxIDs now supports a broader, controlled set of characters and internal spaces in usernames, including usernames provided through Directory Connectors and Active Directory.

Existing email address formats remain supported. Email identifiers can be up to 100 characters, while usernames can be up to 60 characters.

Leading and trailing whitespace is still removed before validation and matching.

OIDC Redirect URI Changes Update CORS Origins

When an OpenID Connect application registration is created in the FoxIDs Control Client, the redirect URI origin can be added automatically as an allowed CORS origin.

Changing the redirect URI now also updates matching CORS origins that are managed automatically. CORS origins that have been edited separately are preserved.

Bugs Resolved

User Lookups Through Additional Identifiers

Fixed an issue where FoxIDs could fail to find an existing user when the supplied email address or username was stored as an additional identifier.

This could prevent an existing login session from being reused. User lookup now correctly considers additional identifiers.

This release improves SAML troubleshooting and enhances MFA assurance handling for NemLog-in.

FoxIDs now provides more useful diagnostics when SAML messages are missing required binding data, while the NemLog-in template can issue the OpenID Connect amr claim with the value mfa when NemLog-in reports a Substantial or High level of assurance.

New Features and Improvements

Improved SAML Error Diagnostics

FoxIDs now logs incoming query and POST data as message traces when SAML authentication, logout, or single logout messages fail because required binding data is missing.

If the request data cannot be read, FoxIDs logs a warning instead.

This provides better troubleshooting when message tracing is enabled, without changing SAML protocol handling or session behaviour.

NemLog-in MFA Assurance

The NemLog-in template now issues the OpenID Connect amr claim with the value mfa when NemLog-in reports a level of assurance (LOA) of Substantial or High.

These assurance levels guarantee multi-factor authentication, whether the user authenticated directly with MitID or through a trust relationship with another highly trusted identity provider. FoxIDs therefore asserts mfa without claiming a specific authentication method.

The configuration is applied when a NemLog-in authentication method is created or updated through the template.

This release improves local account linking, Access Structure enforcement, login identifier validation, and session visibility across FoxIDs.

Claim tasks that query internal or external users can now establish the local account for an authentication response when no account has already been resolved. Access Structure-disabled users are consistently excluded from query and save operations, while repeated access checks within the same request are more efficient. Login identifier handling is also more tolerant and precise, and the Control Client now shows when active sessions and refresh token grants were last updated.

New Features and Improvements

Local Account Linking for Queried Users

The Query internal user and Query external user claim tasks can now establish the local account for an authentication response when the authentication method has not already resolved one.

The first uniquely matched user is linked to active sessions and refresh token grants, including authentication flows that continue through Extended UI.

Directly authenticated internal users and connected external users take precedence, and an existing local account association is never replaced by a later query. Interactive redirects to another authentication method start a new login flow and do not carry the query-selected account. Claim transforms on application registrations do not change the local account association.

All query and save user tasks now also treat users disabled directly or through an active Access Structure membership as unavailable. Query tasks add no claims for unavailable users, and save tasks make no changes.

Improved Access Structure Enforcement and Performance

Claim transforms that query internal or external users now exclude accounts disabled through Access Structure memberships, consistent with directly disabled accounts.

Access Structure policies, claims, and hierarchy paths are also reused within each request. This reduces repeated data lookups when multiple users or access checks are processed in the same request.

Improved Login Identifier Validation

Login identifier validation has been made more tolerant and consistent.

• Leading and trailing spaces are accepted for username, email, and phone login identifiers.
• Login fields validate only the identifier types enabled for the authentication method.
• Phone or Email fields require either a valid international phone number or a valid email address.
• Identifier format validation is no longer repeated on the password step.

Last Updated Time for Sessions and Grants

The Control Client now displays the last updated timestamp in both the overview and detail views for:

• Refresh Token Grants
• Active Sessions

This makes it easier to understand recent activity and troubleshoot session and grant behaviour.

Bugs Resolved

• Fixed an issue where provisioned external users could fail to sign in with a duplicate-key database conflict when FoxIDs linked a redemption claim, such as email, to the configured link claim on first sign-in.
• The existing FoxIDs user ID and access assignments are preserved while the external user is linked.

This release expands authenticator app support with multiple registrations per user, new Control API management endpoints, and optional external registration notifications with automatic rollback on failure.

It also improves audit logs, invalid URL handling, and configurable console logging, while removing long-deprecated Control API properties and compatibility aliases.

New Features and Improvements

Multiple Authenticator Apps and API Integration

FoxIDs now supports up to five authenticator app registrations per user when Advanced multi-factor authentication is enabled. Any registered authenticator app can complete the single Authenticator app MFA step, while standard two-factor authentication continues to support one authenticator app. Recovery-code-based re-registration replaces only the matching registration.

Administrators can view and remove individual registrations in FoxIDs Control. New Control API endpoints allow trusted integrations to list, retrieve, create, update, and delete authenticator app registrations, enabling synchronisation between FoxIDs deployments.

Authenticator App Registration Notification API

Login authentication methods can notify an external Authenticator App API immediately after an interactive authenticator app registration. The notification includes a persistent registration ID and all available user identifiers.

FoxIDs continues the login flow only after receiving 200 OK. If the notification fails, a new registration is rolled back or the previous registration is restored, and the login flow stops with an error. Successful interactive registrations are recorded in the audit log.

Changes made through the Control API do not trigger notifications, preventing synchronisation loops.

Improved Invalid URL Handling

FoxIDs and FoxIDs Control now reject malformed or unsupported URL structures earlier in the request pipeline. Rejected requests return an empty HTTP 404 response and are recorded as events in the log.

Improved Audit Logs

Audit logs in FoxIDs Control now provide clearer and more complete information. The audit type is displayed directly below the event, authenticator app registration events include the RegistrationId, and login and logout events include all available user identifiers, including user ID, email address, phone number, and username.

The maximum audit log search range has also been increased from 24 hours to seven days.

Configurable JSON Console Logging

FoxIDs standard output logging now supports the standard .NET Logging:Console configuration. The console formatter and minimum log level can be configured per deployment, including JSON output using:

Logging__Console__FormatterName=json

The default minimum log level remains Trace, preserving existing behaviour unless explicitly overridden.

Removed Deprecated Compatibility Properties

The long-deprecated ExternalUserLoadedClaimTransforms property has been removed from the External Login, OpenID Connect, SAML 2.0, WS-Federation, and Track Link authentication method APIs. Integrations must use ExitClaimTransforms instead.

The DisableSetPassword property has also been removed from the Login authentication method API. Use DisableSetPasswordEmail and DisableSetPasswordSms for channel-specific configuration. The legacy DisableResetPassword property and combined password-setting aliases have likewise been removed.

The deprecated ResetPassword usage log type and its legacy aggregation support have also been removed. Use SetPassword instead. Historical usage events recorded as ResetPassword are no longer included in usage queries.

These properties were marked as obsolete in the Control API for an extended period before removal. Integrations still using the obsolete property names must migrate to the corresponding replacements. Integrations and configurations already using the current properties are unaffected.

This release delivers major improvements to password policy configuration, access revocation, session security, and certificate validity handling across FoxIDs.

Password complexity validation has been divided into independent policies, giving administrators more precise control over character variation, user identifier checks, and contextual password restrictions while retaining backwards compatibility with existing configurations.

Refresh token grants and active sessions are now linked more reliably to local accounts and access structure memberships. Access is revoked when users are disabled, deleted, or lose access through an access structure, and inactive grants and sessions are automatically removed after one year without use. The implementation also improves concurrency handling during grant rotation, migration, and revocation.

The Control Client now provides clearer certificate validity information, and a duplicate login redirect issue in FoxIDs Control has been resolved.

New Features and Improvements

Separate Password Complexity Policies

Password validation can now be configured through three independent settings at both the environment level and within password policy groups:

• CheckPasswordCharacterComplexity validates character variation and prevents excessive character repetition.
• CheckPasswordUserIdentifiers prevents passwords from containing user identifier text.
• CheckPasswordContext prevents passwords from containing URL- and service-related context text.

All three settings default to true, preserving the previous default behaviour.

Expanded User Identifier Validation

When CheckPasswordUserIdentifiers is enabled, passwords are checked against all available usernames, email addresses, and phone numbers associated with the user.

Backwards Compatibility

The legacy CheckPasswordComplexity setting and its corresponding password policy group setting remain supported.

When a legacy value is supplied, it is applied to all three new settings. New and updated configurations are persisted using only the new settings.

More Precise Validation Messages

The generic PasswordComplexity message: “Please use a mix of letters, numbers and symbols.”, has been replaced by two more precise messages:

• PasswordCharacterRepeat: “Please avoid excessive character repetition.”
• PasswordCharacterVariation: “Please use a mix of uppercase and lowercase letters, numbers and symbols.”

Directory Connector integrations can now return:

• password_character_repeat
• password_character_variation

The legacy password_complexity error code remains supported and is interpreted as password_character_variation.

Reliable Access Revocation and Inactive Session Cleanup

This release strengthens refresh token grant and active session security across FoxIDs.

Stable Local Account Relationships

Refresh token grants issued to internal users and saved external users are now linked to a stable local account.

FoxIDs revokes a user’s refresh token grants and active sessions when the user is disabled, deleted, or loses access through an access structure membership.

Access Structure Revocation Queue

Access structure changes that disable users, and deletion of an access structure, revoke affected access through a persistent background queue.

Rapid changes are combined into a single operation that starts five seconds after the most recent change, or no later than 30 seconds after the first change.

Membership-Aware Grant and Session Validation

Refresh token grants and active sessions record the user’s access membership paths at authentication time.

• Time-limited memberships are validated when affected grants or sessions are used.
• Permanent memberships require no additional online user lookup.
• Authorisation code grants are not revoked by user or access structure changes.

Inactivity Cleanup

Refresh token grants and active sessions are automatically removed after one year without use, even if they otherwise have a longer configured lifetime.

Using a grant or session renews its inactivity lifetime without extending its absolute lifetime. Grant and session activity are tracked independently.

Improved Search and Account Visibility

The Control API and Control Client now expose the stable local account relationship.

Users and their access can be found using FoxIDs user IDs and available user identifiers.

Federated grants without a saved FoxIDs user remain searchable by email, phone number, username, or sub.

Automatic Migration of Existing Grants

Existing refresh token grants using the previous lifetime model remain valid and are automatically migrated to the current database-managed inactivity model the next time they are used.

Concurrency-Safe Rotation and Revocation

Refresh token rotation, migration, and revocation now handle concurrent updates without restoring grants that have already been revoked.

If revocation occurs during migration or rotation, any newly created replacement grant is removed.

Active Session Improvements

Active sessions now indicate whether they include a local user session while retaining the authentication method information required for supported logout flows.

Environment and Tenant Cleanup

• Deleting an environment removes its refresh token grants and active sessions.
• Deleting a tenant removes its environments and all associated grants and sessions.

Improved Certificate Validity Handling

Invalid certificate validity periods are now highlighted in red across applications and authentication methods in the Control Client.

For SAML 2.0 applications:

• Signatures continue to be accepted when at least one configured validation certificate is valid.
• Configuration fails when all registered validation certificates are invalid.

Bugs Resolved

Duplicate Login Redirects

• Fixed an issue that could cause duplicate login redirects when opening FoxIDs Control without an active session.

This release introduces comprehensive WS-Federation support for Microsoft Entra ID federation, making it easier to configure and maintain federated domains directly from FoxIDs. It includes support for WS-Trust endpoints, automatic domain federation, signing certificate rollover, Microsoft Entra admin consent, and improved Control Client management.

The release also improves reliability by correcting claim logging, ensuring browser-assisted input is saved consistently in the Control Client, and extending the default login sequence lifetime to better support longer authentication and MFA journeys.

New Features and Improvements

Microsoft Entra ID WS-Federation Support

• Added WS-Federation support for Microsoft Entra ID federation.
• Exposes the required WS-Trust UsernameMixed endpoint, MEX endpoint, and WS-Federation metadata.
• Enables compatibility with Microsoft Entra ID federated domain scenarios.

Microsoft Entra ID Federation Synchronisation

• Added Microsoft Entra ID synchronisation for WS-Federation application registrations.
• Supports automatic domain federation configuration, signing certificate rollover updates, Microsoft Entra admin consent, and Control Client setup and federation status management.

Longer Login Sequence Lifetime

• New environments now default to a 4-hour login sequence lifetime (previously 2 hours).
• The master environment default has increased from 30 minutes to 2 hours.
• The maximum configurable lifetime has increased to 12 hours.

These changes reduce timeout interruptions during long-running login, federation, and multi-factor authentication (MFA) flows. Existing environments retain their configured values.

Control Client Improvements

• Fixed an issue where text fields in the Control Client did not always save values entered using browser automation tools or browser extensions.

Logging Improvements

• Corrected JWT and SAML claim logging to display the claims that are actually forwarded to applications or issued in tokens.

Bugs Resolved

• Fixed NemLog-in private sector CPR check handling when the SubjectMatchesCPR service returns BadRequest for an invalid CPR value.
• Users now see the same inline field error as other CPR mismatch cases: CPR number does not match the user.
• The NemLog-in CPR validation response is logged separately for troubleshooting instead of sending the user to a technical error page.
• Fixed mTLS certificate conversion used by NemLog-in private sector CPR matching after the ITfoxtec.Identity update. FoxIDs now uses the ITfoxtec.Identity ToX509Certificate(includePrivateKey: true) conversion path so Windows mTLS client authentication receives a certificate with a usable private key.