Releases

This release expands authenticator app support with multiple registrations per user, new Control API management endpoints, and optional external registration notifications with automatic rollback on failure.

It also improves audit logs, invalid URL handling, and configurable console logging, while removing long-deprecated Control API properties and compatibility aliases.

New Features and Improvements

Multiple Authenticator Apps and API Integration

FoxIDs now supports up to five authenticator app registrations per user when Advanced multi-factor authentication is enabled. Any registered authenticator app can complete the single Authenticator app MFA step, while standard two-factor authentication continues to support one authenticator app. Recovery-code-based re-registration replaces only the matching registration.

Administrators can view and remove individual registrations in FoxIDs Control. New Control API endpoints allow trusted integrations to list, retrieve, create, update, and delete authenticator app registrations, enabling synchronisation between FoxIDs deployments.

Authenticator App Registration Notification API

Login authentication methods can notify an external Authenticator App API immediately after an interactive authenticator app registration. The notification includes a persistent registration ID and all available user identifiers.

FoxIDs continues the login flow only after receiving 200 OK. If the notification fails, a new registration is rolled back or the previous registration is restored, and the login flow stops with an error. Successful interactive registrations are recorded in the audit log.

Changes made through the Control API do not trigger notifications, preventing synchronisation loops.

Improved Invalid URL Handling

FoxIDs and FoxIDs Control now reject malformed or unsupported URL structures earlier in the request pipeline. Rejected requests return an empty HTTP 404 response and are recorded as events in the log.

Improved Audit Logs

Audit logs in FoxIDs Control now provide clearer and more complete information. The audit type is displayed directly below the event, authenticator app registration events include the RegistrationId, and login and logout events include all available user identifiers, including user ID, email address, phone number, and username.

The maximum audit log search range has also been increased from 24 hours to seven days.

Configurable JSON Console Logging

FoxIDs standard output logging now supports the standard .NET Logging:Console configuration. The console formatter and minimum log level can be configured per deployment, including JSON output using:

Logging__Console__FormatterName=json

The default minimum log level remains Trace, preserving existing behaviour unless explicitly overridden.

Removed Deprecated Compatibility Properties

The long-deprecated ExternalUserLoadedClaimTransforms property has been removed from the External Login, OpenID Connect, SAML 2.0, WS-Federation, and Track Link authentication method APIs. Integrations must use ExitClaimTransforms instead.

The DisableSetPassword property has also been removed from the Login authentication method API. Use DisableSetPasswordEmail and DisableSetPasswordSms for channel-specific configuration. The legacy DisableResetPassword property and combined password-setting aliases have likewise been removed.

The deprecated ResetPassword usage log type and its legacy aggregation support have also been removed. Use SetPassword instead. Historical usage events recorded as ResetPassword are no longer included in usage queries.

These properties were marked as obsolete in the Control API for an extended period before removal. Integrations still using the obsolete property names must migrate to the corresponding replacements. Integrations and configurations already using the current properties are unaffected.

This release delivers major improvements to password policy configuration, access revocation, session security, and certificate validity handling across FoxIDs.

Password complexity validation has been divided into independent policies, giving administrators more precise control over character variation, user identifier checks, and contextual password restrictions while retaining backwards compatibility with existing configurations.

Refresh token grants and active sessions are now linked more reliably to local accounts and access structure memberships. Access is revoked when users are disabled, deleted, or lose access through an access structure, and inactive grants and sessions are automatically removed after one year without use. The implementation also improves concurrency handling during grant rotation, migration, and revocation.

The Control Client now provides clearer certificate validity information, and a duplicate login redirect issue in FoxIDs Control has been resolved.

New Features and Improvements

Separate Password Complexity Policies

Password validation can now be configured through three independent settings at both the environment level and within password policy groups:

• CheckPasswordCharacterComplexity validates character variation and prevents excessive character repetition.
• CheckPasswordUserIdentifiers prevents passwords from containing user identifier text.
• CheckPasswordContext prevents passwords from containing URL- and service-related context text.

All three settings default to true, preserving the previous default behaviour.

Expanded User Identifier Validation

When CheckPasswordUserIdentifiers is enabled, passwords are checked against all available usernames, email addresses, and phone numbers associated with the user.

Backwards Compatibility

The legacy CheckPasswordComplexity setting and its corresponding password policy group setting remain supported.

When a legacy value is supplied, it is applied to all three new settings. New and updated configurations are persisted using only the new settings.

More Precise Validation Messages

The generic PasswordComplexity message: “Please use a mix of letters, numbers and symbols.”, has been replaced by two more precise messages:

• PasswordCharacterRepeat: “Please avoid excessive character repetition.”
• PasswordCharacterVariation: “Please use a mix of uppercase and lowercase letters, numbers and symbols.”

Directory Connector integrations can now return:

• password_character_repeat
• password_character_variation

The legacy password_complexity error code remains supported and is interpreted as password_character_variation.

Reliable Access Revocation and Inactive Session Cleanup

This release strengthens refresh token grant and active session security across FoxIDs.

Stable Local Account Relationships

Refresh token grants issued to internal users and saved external users are now linked to a stable local account.

FoxIDs revokes a user’s refresh token grants and active sessions when the user is disabled, deleted, or loses access through an access structure membership.

Access Structure Revocation Queue

Access structure changes that disable users, and deletion of an access structure, revoke affected access through a persistent background queue.

Rapid changes are combined into a single operation that starts five seconds after the most recent change, or no later than 30 seconds after the first change.

Membership-Aware Grant and Session Validation

Refresh token grants and active sessions record the user’s access membership paths at authentication time.

• Time-limited memberships are validated when affected grants or sessions are used.
• Permanent memberships require no additional online user lookup.
• Authorisation code grants are not revoked by user or access structure changes.

Inactivity Cleanup

Refresh token grants and active sessions are automatically removed after one year without use, even if they otherwise have a longer configured lifetime.

Using a grant or session renews its inactivity lifetime without extending its absolute lifetime. Grant and session activity are tracked independently.

Improved Search and Account Visibility

The Control API and Control Client now expose the stable local account relationship.

Users and their access can be found using FoxIDs user IDs and available user identifiers.

Federated grants without a saved FoxIDs user remain searchable by email, phone number, username, or sub.

Automatic Migration of Existing Grants

Existing refresh token grants using the previous lifetime model remain valid and are automatically migrated to the current database-managed inactivity model the next time they are used.

Concurrency-Safe Rotation and Revocation

Refresh token rotation, migration, and revocation now handle concurrent updates without restoring grants that have already been revoked.

If revocation occurs during migration or rotation, any newly created replacement grant is removed.

Active Session Improvements

Active sessions now indicate whether they include a local user session while retaining the authentication method information required for supported logout flows.

Environment and Tenant Cleanup

• Deleting an environment removes its refresh token grants and active sessions.
• Deleting a tenant removes its environments and all associated grants and sessions.

Improved Certificate Validity Handling

Invalid certificate validity periods are now highlighted in red across applications and authentication methods in the Control Client.

For SAML 2.0 applications:

• Signatures continue to be accepted when at least one configured validation certificate is valid.
• Configuration fails when all registered validation certificates are invalid.

Bugs Resolved

Duplicate Login Redirects

• Fixed an issue that could cause duplicate login redirects when opening FoxIDs Control without an active session.

This release introduces comprehensive WS-Federation support for Microsoft Entra ID federation, making it easier to configure and maintain federated domains directly from FoxIDs. It includes support for WS-Trust endpoints, automatic domain federation, signing certificate rollover, Microsoft Entra admin consent, and improved Control Client management.

The release also improves reliability by correcting claim logging, ensuring browser-assisted input is saved consistently in the Control Client, and extending the default login sequence lifetime to better support longer authentication and MFA journeys.

New Features and Improvements

Microsoft Entra ID WS-Federation Support

• Added WS-Federation support for Microsoft Entra ID federation.
• Exposes the required WS-Trust UsernameMixed endpoint, MEX endpoint, and WS-Federation metadata.
• Enables compatibility with Microsoft Entra ID federated domain scenarios.

Microsoft Entra ID Federation Synchronisation

• Added Microsoft Entra ID synchronisation for WS-Federation application registrations.
• Supports automatic domain federation configuration, signing certificate rollover updates, Microsoft Entra admin consent, and Control Client setup and federation status management.

Longer Login Sequence Lifetime

• New environments now default to a 4-hour login sequence lifetime (previously 2 hours).
• The master environment default has increased from 30 minutes to 2 hours.
• The maximum configurable lifetime has increased to 12 hours.

These changes reduce timeout interruptions during long-running login, federation, and multi-factor authentication (MFA) flows. Existing environments retain their configured values.

Control Client Improvements

• Fixed an issue where text fields in the Control Client did not always save values entered using browser automation tools or browser extensions.

Logging Improvements

• Corrected JWT and SAML claim logging to display the claims that are actually forwarded to applications or issued in tokens.

Bugs Resolved

• Fixed NemLog-in private sector CPR check handling when the SubjectMatchesCPR service returns BadRequest for an invalid CPR value.
• Users now see the same inline field error as other CPR mismatch cases: CPR number does not match the user.
• The NemLog-in CPR validation response is logged separately for troubleshooting instead of sending the user to a technical error page.
• Fixed mTLS certificate conversion used by NemLog-in private sector CPR matching after the ITfoxtec.Identity update. FoxIDs now uses the ITfoxtec.Identity ToX509Certificate(includePrivateKey: true) conversion path so Windows mTLS client authentication receives a certificate with a usable private key.

This release introduces enhanced user sign-up controls, expanded SAML 2.0 encryption configuration, and updated cryptographic and database components.

Administrators can now restrict self-service user registration to specific email domains, providing greater control over who can create accounts. SAML 2.0 applications now support configurable assertion and key encryption algorithms, improving interoperability with a wider range of identity providers and service providers.

The release also improves configuration consistency by automatically updating authentication method references, cleans up related Environment Links when configurations are deleted, strengthens certificate resource handling, updates the certificate-to-JWK conversion to use the shared ECDSA implementation in ITfoxtec.Identity and includes the latest PgKeyValueDB driver.

New Features and Improvements

User Sign-up Restrictions

• Added support for restricting user sign-up in Login authentication methods to specific email domains.
• Administrators can configure a list of allowed domains for Create User.
• When domain restrictions are enabled, the sign-up flow requires the user identifier to be an email address.

Configurable SAML 2.0 Response Encryption

Added support for configurable response encryption algorithms for SAML 2.0 applications.

• Authentication response encryption now supports separate:
  • EncryptionAlgorithm
  • KeyEncryptionAlgorithm
• This enables FoxIDs to interoperate with SAML implementations that require explicit configuration of both assertion data encryption and key encryption algorithms.

Supported algorithms include:

• AES-CBC
• AES-GCM
• RSA-OAEP
• XML Encryption 1.1 RSA-OAEP

Existing configurations remain fully compatible by continuing to use the current defaults:

• AES-256-CBC for assertion data encryption
• RSA-OAEP for key encryption

Configuration Improvements

• When an authentication method is renamed, the new name is automatically updated in claim transforms, claim transform tasks, and applications that reference it in Allowed Authentication Methods.

• Environment Link cleanup

  • Related Environment Links are removed automatically.
  • Deleting an environment removes all associated Environment Link connections.
  • Deleting either the application side or the authentication method side of an Environment Link also removes the corresponding linked configuration.

Cryptography Improvements

• Updated certificate-to-JWK conversion to use the shared ECDSA implementation provided by ITfoxtec.Identity.
• Improved certificate resource handling by consistently disposing temporary certificate instances after use, reducing the risk of native handle and resource leaks during certificate validation, metadata generation, and token processing.

Dependency Updates

• Updated the PostgreSQL driver PgKeyValueDB to version 3.4.4.

Bugs Resolved

Create User

• Fixed an issue where the phone country code could be used during user creation when a phone number was not required in the Create User UI.

Summary

This release enhances SAML 2.0 security validation and interoperability by introducing configurable validation allowlists for signature algorithms and XML canonicalisation methods. These improvements provide greater flexibility when integrating with identity providers that use different signing technologies, while maintaining backward compatibility through secure default settings.

The release also resolves an issue that prevented ECDSA certificates from being used consistently across SAML 2.0 integrations, bringing SAML 2.0 certificate support in line with OpenID Connect capabilities.

New Features and Improvements

SAML 2.0 Validation Allowlists

SAML 2.0 now supports configurable validation allowlists, providing more flexible control over accepted signature and XML processing methods.

• Multiple signature validation algorithms

  • SignatureValidationAlgorithms can now contain multiple accepted signature algorithms.
  • For example, both RSA and ECDSA algorithms can be accepted simultaneously.

• Multiple XML canonicalisation methods

  • XmlCanonicalizationValidationMethods can now contain multiple accepted XML canonicalisation methods.
  • This simplifies interoperability with identity providers that use different canonicalisation standards.

• Backward compatibility

  • If no allowlist is configured, FoxIDs automatically applies secure default values.
  • Existing configurations continue to work without modification.

Bugs Resolved

ECDSA Certificate Support in SAML 2.0

• Fixed an issue that prevented externally used ECDSA certificates from being supported correctly in SAML 2.0 integrations.

This release improves the reliability and usability of logging and diagnostics in FoxIDs.

The update enhances log search behaviour for values containing hyphens, making searches more accurate and predictable. It also resolves an Application Insights log parsing issue where truncated trace messages could prevent logs from being displayed correctly. FoxIDs now handles truncated trace data gracefully, ensuring that available log entries remain accessible.

New Features and Improvements

Improved Log Search Accuracy

• Correct handling of hyphenated values
  Fixed log search behaviour for values containing hyphens, such as usernames and identifiers.

• Phrase-based matching
  Searches for values such as xxxx-yyy are now treated as a single phrase rather than separate terms, preventing unintended matches on partial values such as xxxx.

Bugs Resolved

Application Insights Log Parsing

• Graceful handling of truncated trace messages
  Fixed an issue where large trace messages stored in Application Insights could be truncated by Azure.

• Improved log viewer reliability
  Previously, truncated trace data could cause the track log view to fail. FoxIDs now handles truncated log data gracefully and displays all available log entries whenever possible.

This release improves the reliability of Environment Link logout flows and strengthens the consistency of Home Realm Discovery (HRD) configuration handling across applications and authentication methods.

The update ensures that front-channel logout requests are handled gracefully, even when the associated authentication method session has already been removed. It also resolves an issue where HRD auto-selection based on IP addresses, IP ranges, and regular expressions could stop working for applications linked to authentication methods.

Bugs Resolved

Environment Link Front-Channel Logout Reliability

• Idempotent logout handling
  Fixed a crash that could occur during Environment Link front-channel logout when the logout callback arrived after the authentication method session had already been removed.

• Improved session cleanup behaviour
  Logout requests are now handled idempotently, ensuring that delayed or repeated callbacks are processed safely without causing errors.

Home Realm Discovery (HRD) Configuration Synchronisation

• Fixed HRD auto-selection in linked applications
  Resolved an issue where HRD auto-selection based on IP addresses and IP ranges could stop working in applications linked to an authentication method.

• Complete HRD rule propagation
  Applications linked to an authentication method now correctly inherit all HRD rules when they are created or updated, including:

  • IP addresses
  • IP ranges
  • Regular expression (regex) rules

This ensures consistent Home Realm Discovery behaviour across linked configurations and prevents missing or outdated HRD settings.

Summary

This release delivers significant enhancements across federation protocols, claim transforms, authentication token handling, logging, and the Control Client user experience.

The headline feature is the addition of WS-Federation support for both authentication methods and application registrations, including interoperability with AD FS and Microsoft Entra ID. The release also improves claim transform usability and diagnostics, adds support for issuing refresh tokens from authentication methods to applications, and introduces more detailed Home Realm Discovery (HRD) trace logging.

Additional improvements ensure that the Control Client test applications remain reliable for long-term use, while NuGet package updates address known vulnerabilities and strengthen overall platform security.

New Features and Improvements

WS-Federation Support

• Added WS-Federation support for authentication methods and application registrations.
• Supports metadata import and export, SAML 1.1 and SAML 2.0 tokens, sign-in and sign-out flows, token encryption, and claims mapping.
• Compatible with AD FS and Microsoft Entra ID.

Claim Transform Enhancements

• Claim transforms now support querying users by User ID using the sub lookup claim.
• Updated descriptions and help text throughout the claim transform UI.
• Added colours, summaries, and default-expanded sections to improve usability and troubleshooting.

Authentication and Token Improvements

• Added support for exposing a refresh token from an authentication method in a refresh_token claim.
• The refresh_token claim can now be issued alongside an access_token claim to applications.

Home Realm Discovery (HRD)

• Added more detailed Home Realm Discovery trace logging to simplify troubleshooting.

SAML 2.0 Improvements

• New SAML 2.0 application configurations now include phone and email claims by default.

Control Client Improvements

• Improved the Control Client test applications to ensure reliable operation and compatibility over the long term.

Security and Dependency Updates

• Updated NuGet packages to address known vulnerabilities and improve overall platform security.

User Experience Improvements

• Updated email templates to include more detailed and meaningful text.

Bugs Resolved

SAML 2.0 Certificate Management

• Fixed an issue where removing a SAML 2.0 certificate did not immediately update the UI.
• The same certificate can now be re-added immediately after removal, either by file selection or drag-and-drop.

SAML 2.0 NameID Handling

• Resolved an issue where an external SAML 2.0 NameID could be overridden by a claim transform, resulting in incorrect logout requests.
• Fixed an issue where SAML 2.0 did not correctly select an alternative identifier claim when the NameIdentifier claim was unavailable. FoxIDs now correctly falls back to UPN, Email, or Name.

This release improves logging behaviour for external API integrations, with a particular focus on SMS provider and external service diagnostics.
Instead of globally limiting all log messages to 4 KB, FoxIDs now applies response-size limits only when logging responses from external APIs, such as SMS providers.

This approach preserves detailed internal logging while still protecting the system from excessively large external API responses.

Improvements

Improved External API Response Logging

• Selective response-size limiting
  Log message size limits are no longer applied globally across all logging.

• External API response protection
  Response-size limits are now applied only when logging responses from external APIs, such as:

  • SMS providers
  • External HTTP integrations
  • Third-party services