Notes on prerequisites, fixes, and known issues for the ForgeRock® Token Validation Microservice.

When elliptic curve keys are used for signing, and Bouncy Castle is installed, by default JWTs are signed with a deterministic ECDSA. In previous releases, JWTs were signed with a non-deterministic ECDSA, which is less secure.

The new system property org.forgerock.secrets.preferdeterministicecdsa is by default true. To use the less secure algorithm, set the property to false.

Cookies that arrive at TVMS with the sameSite flag set are correctly maintained.

A ping endpoint is available after TVMS startup to check whether the service is available. When TVMS is installed and running as described in "Starting and Stopping TVMS" in the User Guide, the endpoint is at http://mstokval.example.com:9090/ping.

TVMS logs a warning when the decoded value of a BASE64-encoded secret starts or ends with a non-ASCII character.

If a text editor adds a carriage return to the end of a plain string value before it is encoded, non-ASCII characters can be added to the BASE64-encoded value. When the decoded value is used as part of a username/password exchange, it can then cause an authentication error.

The functions encodeBase64url and decodeBase64url are added to facilitate URL-safe and filename-safe encoding and decoding.

To make it easier to deploy TVMS without modifying the default configuration, the global log level is now defined as a variable in the default logback.xml. To change the global log level, set an environment variable or system property.

Oracle recommends the use of PKCS12 keystores. From Java 9, Oracle has provided more support for PKCS12. From Java 11, Oracle has changed the default keystore to PKCS12.

Following this lead, the default type for KeyStore and KeyStoreSecretStore is now based on the keystore extension. If the keystore extension is not recognized, the default type is PKCS12. In previous releases, the default type was the one used by the platform.

To ensure backward-compatibility, where keys are generated using a non-PKCS12 type (for example, JKS), specify type in KeyStore or storeType in KeyStoreSecretStore.

For information, see "KeyStore" in the Configuration Reference and "KeyStoreSecretStore" in the Configuration Reference.

When gracefulStop is true, the ScheduledExecutorService now removes submitted jobs and attempts to end running jobs, after respecting the gracePeriod. In previous releases, when gracefulStop was true, it did not remove or end jobs.

The cacheTimeout property cannot be disabled in the JwkSetSecretStore. The minimum value is 10 seconds. If a lower value is set, the cacheTimeout is forced to 10 seconds.

The ClientHandler cannot stream responses from a proxied application to the user agent. Responses are processed in non-streaming mode only, after the entire entity content is available. Consequently, only the non-streaming mode is available, which does not support Server-Sent Events (SSE) or very large files.

TVMS scripts are not sandboxed, but instead have access to anything in their environment. You must make sure that the scripts that TVMS loads are safe.

The log file of audit events can be overwritten when the log file is rotated.

When CsvAuditEventHandler is used to log audit events, the log file is overwritten if it is rotated before the file suffix, rotationFileSuffix, changes. By default, rotationFileSuffix is defined as a date in the format _yyyy-MM-dd.

Log files are rotated when one of the following limits is reached: maxFileSize, rotationInterval, or rotationTimes.

Set the log rotation parameters so that the log is not likely to rotate before rotationFileSuffix changes.

TVMS can check server certificates for HTTPS. However, for mutual authentication, the client certificate must be the first certificate in the KeyStore.