IG 5.5 includes the following new features:

IG Studio

IG Studio has been updated to include the following features:

Sophisticated Throttling Policies

Grouping policies that apply a throttling rate to a single group containing all requests, or to independent groups of requests. Groups can be defined with a standard or custom grouping policy.

Mapping policies that allow custom mapping criteria, and multiple mapped rates in mapped throttling policies.

Creation of Different Filter Types

The following filter types and scripts can now be created in IG Studio: generic filters, scripts, scriptable filters, and scriptable rate policies for throttling filters.

Route Import

Routes can now be imported from external .json files into IG Studio. Routes not created in IG Studio can be viewed in the backend configuration.

Route Editing

The IG Studio editor ca nbe used to edit routes that were created in IG Studio, imported from file, or that exist your backend configuration.

Route Viewing

A route's filters can now be viewed in a chain, and reordered in the chain.

You can view a route's status to see if it is Undeployed, Deployed, Changes pending, or Out of sync.

Capture

IG Studio can now capture ForgeRock Identity Platform messages as well as messages about requests and responses that are traversing the route.

Search

IG Studio now includes a search feature to search for routes.

OAuth 2.0

OAuth 2.0 has been updated to include the following features:

OAuth 2.0 Token Introspection

IG now supports the token introspection endpoint, /oauth2/introspect to resolve OAuth2 access tokens. In previous releases, only the token info endpoint, /oauth2/tokeninfo, was supported.

Use the /oauth2/introspect endpoint to retrieve metadata about a token that is not available at the /oauth2/tokeninfo endpoint, such as the context in which the token was issued.

For information about the token introspection endpoint, see RFC-7662, OAuth 2.0 Token Introspection.

Client Authentication Through private_key_jwt

Clients can now authenticate to an OAuth 2.0 authorization server or OpenID Provider using the tokenEndpointAuthMethod method private_key_jwt.

With private_key_jwt, you can configure claims to be used for client authentication during access token retrieval.

For information, see ClientRegistration(5) in the Configuration Reference.

Scripting to Configure OAuth 2.0 Token Resolution

It is now possible to configure access token resolution by using a script. For information about all configuration options, see the accessTokenResolver property of OAuth2ResourceServerFilter(5) in the Configuration Reference.

Support for IG JBoss EAP

IG can now run in JBoss Enterprise Application Platform (JBoss EAP) version 7.

For information, see "JBoss EAP For IG" in the Gateway Guide.

Audit Event Handlers

Support has been added for the Splunk Audit Handler. For information, see SplunkAuditEvenHandler(5) in the Configuration Reference.

IG 5.5 includes the following improvements:

Default cookie name is IG_SESSIONID

Most web containers use JSESSIONID as the default cookie name. To prevent invalid session IDs when a protected application uses the same cookie name as the IG web container, IG now uses IG_SESSIONID as its default cookie name.

Support for UMA 2.0

Support for UMA 2.0 has been added in this release. Features and functionality have been upgraded to support new UMA standards. Support for earlier versions of UMA has been removed.

For information, see "Supporting UMA Resource Servers" in the Gateway Guide and UmaService(5) in the Configuration Reference.

Configuration Expressions For Header Name and Form Parameter Name of StaticRequestFilter

Configuration expressions can now be used to create the following properties of the StaticRequestFilter:

• name field of the property headers

• param field of the property form

This feature provides the flexibility to assign different header names and form parameters when using the same route in different environments. For example, the name of a cookie header can be different in a production or development environment.

For information, see StaticRequestFilter(5) in the Configuration Reference.

ClientHandler Can Declare an HTTP Web Proxy

The ClientHandler can now declare an outgoing proxy server such as Squid to submit requests to other parts of the network.

For information, see the proxy property of ClientHandler(5) in the Configuration Reference.

Runtime Expressions for baseURI of DispatchHandler

Runtime expressions can now be used to define the baseURI property of DispatchHandler.

This feature provides the flexibility to change the baseURI according to some request attributes.

For information, see DispatchHandler(5) in the Configuration Reference.

Increased Flexibility for Authentication in SingleSignOnFilter

A new property, loginEndpoint, is added to the SingleSignOnFilter to increase flexibility for authentication. Authentication can be performed through AM or an alternative application, and can include authentication parameters. For information, see the loginEndpoint property of SingleSignOnFilter(5) in the Configuration Reference.

Configuration Expressions in prefix and the Reference Configuration Object

Configuration expressions can now be used in the definition of prefix and the reference configuration object.

For information, see reference in the Configuration Reference and AdminHttpApplication(5) in the Configuration Reference.

Audit Event Fields Case-Insensitive For Filtering

A list of audit event fields can be specified to be considered as case-insensitive for filtering.

For information, see AuditService(5) in the Configuration Reference.

Support for "scope" in Dynamic Client Registration

As required by RFC 7591, OAuth 2.0 Dynamic Client Registration Protocol, the metadata property of OAuth2ClientFilter now supports scope.

Dynamic client registration with versions of AM earlier than 5.5 must use the scopes property.

Dynamic client registration with AM 5.5 can use the scopes or scope property.

For the option to dynamically register with a wider range of identity providers, you can use both scope and scopes at the same time.

The following functionality is changed in IG 5.5:

Support for Java 7

Support for Java 7 has been removed. Before you update to IG 5.5, install the latest version of Java 8.

If you are using IG on Tomcat with SSL enabled, use OpenJDK 1.8.0_121 or later versions to prevent mismatch between client side ciphers and server side ciphers.

Default cookie name is IG_SESSIONID

Most web containers use JSESSIONID as the default cookie name. To prevent invalid session IDs when a protected application uses the same cookie name as the IG web container, IG now uses IG_SESSIONID as its default cookie name.

Configuration of Jetty for HTTPS

The way to configure HTTPS for Jetty has changed in Jetty 9.4.

For information about Jetty 9.4, see "Configuring Jetty For HTTPS (Server-Side)" in the Gateway Guide. For general information about Jetty and HTTPS, see http://www.eclipse.org/jetty/documentation/current/configuring-ssl.html#configuring-sslcontextfactory.

Support for "scope" in Dynamic Client Registration

As required by RFC 7591, OAuth 2.0 Dynamic Client Registration Protocol, the metadata property of OAuth2ClientFilter now supports scope.

Dynamic client registration with versions of AM earlier than 5.5 must use the scopes property.

Dynamic client registration with AM 5.5 can use the scopes or scope property.

For the option to dynamically register with a wider range of identity providers, you can use both scope and scopes at the same time.

HeapClientRegistrationRepository

The class HeapClientRegistrationRepository is deprecated and will be removed in a future release. Declare client registrations in the registrations attribute of OAuth2ClientFilter.

Deprecated Configuration Settings

Configuration Object	Deprecated Settings	Newer Evolving Settings
OAuth2ResourceServerFilter	cacheExpiration (deprecated in IG 5.5.1, and the values of zero and unlimited are not supported)	Replaced by cache and its sub-properties enabled, defaultTimeout, and maxTimeout. If cacheExpiration is configured and cache is not configured, the cache is enabled and the value of cacheExpiration is used as maxTimeout. The following values for cacheExpiration, supported in previous releases, are not supported in this release: zero, unlimited. For more information, see OAuth2ResourceServerFilter(5) in the Configuration Reference.
OAuth2ResourceServerFilter	tokenInfoEndpoint and providerHandler	Replaced by configuration properties of OpenAmAccessTokenResolver, TokenIntrospectionAccessTokenResolver, and ScriptableAccessTokenResolver. For more information, see OAuth2ResourceServerFilter(5) in the Configuration Reference.
OAuth2ClientFilter	tokenEndpointUseBasicAuth	Replaced by tokenEndpointAuthMethod. "tokenEndpointAuthMethod": "client_secret_post" is equivalent to "tokenEndpointUseBasicAuth": false "tokenEndpointAuthMethod": "client_secret_basic" is equivalent to "tokenEndpointUseBasicAuth": true

Support for UMA 1

Support for UMA 1.x is removed in this release. Features and functionality have been upgraded to support new UMA standards.

Finalize Method Removed for HTTP messages

To reduce memory consumption, the finalize() method has been removed for HTTP messages (requests and responses). Consequently, requests are not automatically closed at garbage collection time.

Consider the following compatibility points:

• After creating a new request object, you must now explicitly close it after use. For example, the following Java code was used in the previous release:

  ThrottlingRate rate = datasource.lookup(new RootContext(), new Request()).get();

  In this release, the equivalent Java code includes a final close operation:

  ThrottlingRate rate = datasource.lookup(new RootContext(), request)
         .thenAlways(request::close)
         .get();

• In scripts, the client binding automatically closes the request that is provided as a parameter. Therefore, it is not necessary to manually close the request for scripts.

  After the request is automatically closed, the request entity is empty and can't be accessed. Response callbacks that try to access the request entity will fail.

  You can workaround this behavior in the following ways:

  • Keep the request open by using the client.sendNoClose() method instead of client.send(). This method to prevents closure of requests after send. If you use this method, remember to manually close the request.

  • Access the request entity before the request is closed, for example by including the request.entity.string assignment before calling the client.send() with the request.

Removed Configuration Settings

Configuration Object	Removed Settings	Newer Evolving Settings
UmaService	clientId and clientSecret	Not replaced. IG uses the PAT to create an UMA resource.For information, see "Supporting UMA Resource Servers" in the Gateway Guide and UmaService(5) in the Configuration Reference.

The following important limitations are included in this release:

Persists UMA Shares (OPENIG-3273)

Shared resources cannot be persisted when IG restarts. They must be shared each time that IG restarts. For more information, see "Supporting UMA Resource Servers" in the Gateway Guide.

Cannot Use Custom config.json in IG Studio (OPENIG-1557)

When a customized config.json is configured in IG Studio, IG Studio cannot deploy routes.

PolicyEnforcementFilter Cache Can Become Outdated

The PolicyEnforcementFilter can keep policy decisions in the cache after a user has logged out and the session has become invalid. Because the PolicyEnforcementFilter does not listen to AM notifications, it is not aware that a user has logged out, and is therefore not aware that the policy decision should be evicted from the cache.

Log File of Audit Events Can be Overwritten (OPENIG-813)

The log file of audit events can be overwritten when the log file is rotated.

When CsvAuditEventHandler is used to log audit events, the log file is overwritten if it is rotated before the file suffix, rotationFileSuffix, changes. By default, rotationFileSuffix is defined as a date in the format _yyyy-MM-dd.

Log files are rotated when one of the following limits is reached: maxFileSize, rotationInterval, or rotationTimes.

Set the log rotation parameters so that the log is not likely to rotate before rotationFileSuffix changes.

For Mutual Authentication in HTTPS Cannot Specify Which Certificate to Present (OPENIG-221)

IG can check server certificates for HTTPS. However, for mutual authentication, the client certificate must be the first certificate in the KeyStore.

IG Scripts Can Access Anything in Their Environment (OPENIG-3274)

IG scripts are not sandboxed, but instead have access to anything in their environment. You must make sure that the scripts that IG loads are safe.

SamlFederationHandler Doesn't Support Filtering (OPENIG-3275)

The SamlFederationHandler does not support filtering. Do not use a SamlFederationHandler as the handler for a Chain.

More generally, do not use this handler when its use depends on something in the response. The response can be handled independently of IG, and can be null when control returns to IG. For example, do not use this handler in a SequenceHandler where the postcondition depends on the response.