New features added in this version:

Mobile applications

• Full integration of mobile applications through OAuth2
• adAS SSO notification engine. It asks confirmation of the user of the mobile application in order to access their information
• Better management of the mobile-user pairings through adAS SSO management tool and the REST API. This allows to manage the devices registered by the user and its permissions

User’s Interface

• Improvement of the adAS SSO theme: now it is responsive
• Optional Virtual keyboard when filling in the password of the user
• Attributes consent module. If configured, the user will have to confirm the transfer of information from adAS SSO to the Service Provider

Data Sources

• Improvement of the extraction of digital certificate attributes. In any moment of the authentication, attribution or authorization it will be possible to obtain the information that the user’s certificate contains.
• Optimization of the execution time when obtaining attributes from a database
• New implementation of the PDO Oracle connector. It is used in the data sources and in the Stats database.

Protocols

• Implementation of the Implicit and Resource Owner OAuth2 grants
• Addition of the OpenID v1.1, OpenID v2.0 and OpenIDConnect protocols
• Implementation of the SAML2 ECP Profile, allowing a full integration with Microsoft Live365 without the need of using ADFS
• SAML2 and PAPI Passive authentication
• Better compliance of the SAML 2 standard. Now adAS SSO is stricter validating the messages.

Authentication

• Added new delegated authentication methods: Cl@ve y Facade @Firma
• Also, the parameters used to configure delegated authentications have been increased: format of the received attributes, actions to process them, etc.
• Improvements to the x509 authentication. Now its configuration and performance is simpler, more accurate and more comprehensive.

Authorization

• Optional use of Candao 2.0 in the Service Provider’s authorization policy

REST API

The REST API has been completed to encapsulate all the available adAS SSO resources:

• Attributes
• Candao 2.0
• Configurations
• Stats
• Events
• Data Sources
• Management of OAuth 2 and OpenID Connect
• Logs
• Metadata
• Monitoring
• Pairing of applications and devices

Logs

• Optional configuration of the name of the log file, based on the instance where the system is running. This makes easier that several nodes write their own logs without conflicts.
• Optional events configuration that allows to send the log messages to the events registry

Stats

• Added to the stats registry, user’s data such as the authentication device and IP.

Management of the Service Providers in Single Sign-On

• Optional disablement of an SP for a period of time. It is possible, also, to have the disablement date preset for a specific day.
• Contact information visualization
• New field: “Observations”
• New user-agent intelligent detection engine
• Optional delivery of critical events to a previously specified email

We are working on the following new features:

• Two factor authentication. Supported types: QR, TOTP y HOTP
• Full compatibility with Cl@ve 1 service providers and identity providers
• Full compatibility with VÀLid and OAuth2 Authorization Code identity providers
• SAML 2 Artifact profile
• EduGAIN compatibility
• CAS logout
• Audit improvements in adAS SSO management tool
• Global authorization policy
• Adaptation to advanced PHP deployments: PHP-FPM, PHP 7.3 and cluster REDIS, among others
• Full compatibility with adAS User, the component of adAS Suite which is a digital identity self-service portal
• adAS SSO theme evolution: fulfillment of Content Security Policy (CSP) Level 3 and full responsive design, among others

We are working on the following new features:

• Full compatibility with Cl@ve 2 service providers and identity providers. Includes Key Roll Over and full logout, among others
• Monitoring of the status of: SSO certificates, stats and cache system, session management, log generation and connections with other identity providers
• Compatibility of the OpenIDConnect protocol with the Implicit flow, JWT tokens, RS256 signatures and the standard attribute policy