What’s New

streamingEnabled is a new property in admin.json for standalone mode to stream the content of HTTP requests and responses. When this property is true, the evaluation of runtime expressions that consume streamed content must be deferred.

This feature introduces changes that can impact your migration from a previous version of IG. For more information, see Incompatible Changes.

For more information, see AdminHttpApplication (admin.json) and runtime expression.

The evaluation of runtime expressions can be deferred until all of the content of the request or response is available. To prevent blocked threads, use deferred evaluation for runtime expressions that consume streamed content.

For more information, see runtime expression.

FragmentFilter is a new filter that enables URI fragments to be retained during authentication with the SingleSignOnFilter, CrossDomainSingleSignOnFilter, OAuth2ClientFilter, and PolicyEnforcementFilter. Previously, when an unauthenticated requested a resource that contained a URI fragment, the fragment was lost in the eventual redirect.

For more information, see FragmentFilter.

Some OAuth 2.0 providers allow roles, groups, and custom properties to be defined in a JWT. The customizer property, previously available in the JwtValidationFilter, has been added to the IdTokenValidationFilter. Use this property to validate customized properties for a JWT, while still validating the existing constraints in the IdTokenValidationFilter.

For more information, see IdTokenValidationFilter.

In JwtValidationFilter, the set of validation constraints for JWT claims and sub-claims now includes the following additional constraints:

For more information, see the customizer property in JwtValidationFilter.

PemPropertyFormat is a new format for secrets used in mappings in FileSystemSecretStore and SystemAndEnvSecretStore. Use PemPropertyFormat to read a Privacy-Enhanced Mail (PEM) file.

For more information, see PemPropertyFormat. For examples, see Pass Runtime Data in a JWT Signed With a PEM and Pass Runtime Data in a JWT Signed and Encrypted With a PEM.

IG can now use the Commons Secrets Service when acting as a SAML 2.0 service provider, when signing and/or encryption is enabled in the IDP or SP configuration in AM.

For more information, see SamlFederationHandler.

JwkSetHandler is a new handler that exposes cryptographic keys as JWK set. Use this handler so that a downstream application can reuse the exposed keys for their assigned purpose.

For more information and an example of use, see JwkSetHandler.

leaseExpiry is a new property for the following SecretStores, to define the time that secrets can be cached before they must be refreshed:

For more information, see Secrets.

The key ID header, kid, used to match a specific key, is now present in JWTs built by JwtBuilderFilter and JwtSession.

For information about kid, see "kid" (Key ID) Parameter.

To reduce configuration errors, and simplify configuration, AmService no longer uses the default value, iPlanetDirectoryPro, for ssoTokenHeader. If ssoTokenHeader is not provided, IG queries the AM /serverinfo/* endpoint for the header name or cookie name of the SSO token.

The ForwardedRequestFilter has been added to rebase a request URI with a computed scheme, host name, and port. Use this filter to configure redirects when the request is forwarded by an upstream application such as a TLS offloader.

For more information, see ForwardedRequestFilter.

initialConnectionAttempts is a new property in AmService to limit the number of times IG attempts to open a WebSocket connection before failing to deploy the route. Use this feature to prevent stalled requests and timeouts. For more information, see AmService.

The TimerDecorator can now record the time to process requests and responses as they pass through AccessTokenResolvers.

For more information, see TimerDecorator.

A new logger is available to log the routes for which IG evaluates a condition, and the route that matches a condition and treats a request.

For more information, see the condition property of Route.

useOriginalUri is a new property in SamlFederationHandler to prevent errors that occur when a baseUri decorator applies to the whole route. This change forces the handler to use the original URI instead of the rebased URI when validating RelayState and Assertion Consumer Location URLs.

For more information, see SamlFederationHandler.

Entity.getForm() and Entity.setForm(Form) are new methods available for use in scripts, with the content type application/x-www-form-urlencoded.

org.forgerock.json.jose.jwe.compression.max.decompressed.size.bytes is a new system property to limit the maximum size to which a compressed JWT can be decompressed. This property reduces the risk of a decompressed JWT consuming too much available memory.

For more information, see Provided Properties.

By default, the TemporaryStorage object now stores temporary files in $HOME/.openig/tmp instead of a directory defined by the system property java.io.tmpdir.

For more information, see TemporaryStorage.

redirectionMarker is a new property in SingleSignOnFilter to limit the number of authentication redirects.

When there is no SSO session due to, for example, SSO cookie name misconfiguration, an authentication request fails and is redirected back to IG. The scenario can result in infinite authentication redirects.

For more information, see SingleSignOnFilter.

When a runtime error occurs during the execution of a request to a remote server, IG retries the request until the allowed number of retries is reached or the execution succeeds. The retries are now logged by default.

For more information, see the retries property of ClientHandler.

org.forgerock.http.util.ignoreFormParamDecodingError is a new Java system property to ignore form encoding errors caused by invalid characters. Encoded values are used instead.

For more information, see Supported System Properties.