News

October 18, 2023

Maintenance release – PhenixID Authentication Services (PAS) 4.7.1

This new release includes defect fixes and addition of minor functtions for the 4.7 release, and is recommended for all 4.7 installations.
 

Bug fixes

 

The 4.7.1 release includes the following fixes

  • PHX-2963 resp_attributes type 6 (Service-Type) value returned incorrectly

    Service-Type attribute in RADIUS always returned the wrong value.
    Now updated and the Service-Type attribute can now be set using PropertyAddValve

  • PHX-3030 Wrong language is show in PSS if brower is set to Swedish

    If Chromium based browser have Swedish as default language, the Password Selfservice service would show a mix of English and Swedish

  • PHX-3068 Signing, OCSP/CRL: Incorrect validation

    Validation of OSCP/CRL tokens failes since wrong value is compared

  • PHX-3110 BankID – 400 response when signing gives Java error

    BankIDSignValve and BankIDCollectValve woudl generate a java error if BankID returns a 400 response.
    The solution also includes an update where the errorcode of the 400 response is forwarded to the application

  • PHX-3122 IOS redirect to native browser when using non native browser

    Independent of which browser is used when initiating a BankID authentication, iOS devices will redirected back to default web browser

  • PHX-3170 Add loginhint to OIDC to auth-request

    Support for “login_hint” in OIDC auth-request is missing

  • PHX-3188 Clear “SAMLSignApproved” with the rest of the SAML attributes on a new SAMLRequest

    Attribute SAMLSignApproved is not cleared

  • PHX-3189 validateSchema for SAML SignMessage causes freeze/crash in some environments

    validateSchema function in SAMLAuthRequestDecoder freezes/chrashes, preventing SignMessage to be parsed

 

New/updated features

 

  • PHX-3021 Add support for basic authorization in bankid proxy module

    Support basic authorization header in BankID proxy/api

  • PHX-3102 SithsEidCollectAuthenticationStatusValve that returns Inera response intact as json

    Return the intact Inera response as json

  • PHX-3108 BankID 6.0 Phoneauth via proxy/api

    Phoneauth endpoint according to BankID 6.0 added in BankID proxy/api

  • PHX-3112 OpenID Connect Session Management 1.0

    Support for OpenID Connect Session management 1.0 implemented

  • PHX-3126 Add BankIDPhoneSignValve

    Add BankIDPhoneSignValve according to BankID 6.0

  • PHX-3127 Make it possible to expand requirement from request in BankIDAuthenticateValve and BankIDSignValve

    Add the possibility to add requirements in a request when using HTTP API with BankID valves

  • PHX-3171 BankID 6.0 Phonesign via proxy/api

    Add Phonesign endpoint according to BankID 6.0 to BankID proxy/api

  • PHX-3187 Make AssertionConsumer strict scoped attribute validation option

    Let the administrator decide by config if AssertionConsumer should use strict scoped valdiation or not

See patch release information for 4.7.1 and read the full release notes for PhenixID Authentication Services 4.7 here:

 


Show more
September 20, 2023

PhenixID – New Release: Identity Provisioning 6.3.3

PhenixID is proud to announce the new release of PhenixID Identity Provisioning (PIP) 6.3.3. The new releases improves the stability, compatibility, and security of your solution, and is recommended for all installations.
 

MAINTENANCE RELEASE

IMPROVED FUNCTIONALITY

  • PIP-721 Add a body option to the REST DELETE Handler action
    REST DELETE Handler now have the possibility to include a body to the delete requests
  • PIP-723 Add a Copy post action
    Select a post in the LDAP tree that you want to create an copy of and point to the OU where the copy should be saved
  • PIP-731 Improve SQL action to handle errors
    Any errors in a SQL write action is now also included as an attribute in the return value of the action

BUG FIXES

  • PIP-720 Syntax Attribute Validation is not emptied after a successful syntax is read
  • PIP-722 Retrieving large multivalues will eventually take the enumerating LDAP connection, causing corruption and closed LDAP connection
  • PIP-724 WriteToLDAP: Not always setting error attribute on failure
  • PIP-725 Policy Debugger: Large text attributes are slow to render
  • PIP-726 Settings multiple schedules from policy tab does not get saved
  • PIP-727 Import objects dialog: No error handling for missing icons
  • PIP-729 Import Prefix writes to Schedule reassign
  • PIP-732 Write to LDAP action sometimes does not write Binary to ldap
  • PIP-735 Session transmitter does not work

Read the full release notes for Identity Provisioning 6.3.3 here

 


Show more
August 31, 2023

New Release: PhenixID Signing Workflow 2.3.0

 

PhenixID Signing Services Workflow 2.3.0 improves the stability, compatibility and security of your solution, and is recommended for all installations.
HIGHLIGHTS

 

The highlights for the 2.3 release includes the ability to delete signing errands and the possibility to anonymize the information about a specific user (GDPR compliance)

Deleting errands

All errands are saved in the SWF database for future reference, althought the actula document can be deleted after a configured lifetime. Organizations might have policiys to delete information about digital errands after a specific time.  It could also be that errands that arent successul (maybe someone refused to sign) chould be removed right away to avide clutter. Added in 2.3 there are 3 different ways to delete an errand

  • Scheduled jobs – configure the lifetime of errands for a specific state
  • Delete signing errand via GUI
  • Delete siging errand via API

Anonymizing signer

Siging errands in SWF database include information about the people set to sign, information that could include AD usernaname,  e-mail address or social security number (“personnummer”). General Data Protection Regulation (GDPR) adopted by European Union in 2016 regulates the use and ownership of personal data. It includes the right for any person to be forgotten and have their information removed from any data storage.

To help the administrator to comply with GDRP, SWF 2.3.0 includes the possibility to anomynize a user. The administrator can execue a job to anonymize a user based on either UUID, personnummer, username or email address. At anonymization, errans including the user that has asked to be forgotten are updated and all information about this user are replaced with “anonymized”, however still present in the errand database. For example, a errand including users john.doe and jane.doe, where john.doe is anonymized will still be present but when opened it says that the signers are “jone.doe” and “anonymized”.

 

IMPROVED FUNCTIONS

In addition, several features have received minor improvement including:

  • Added additional Java arguments for Hazelcast in the startup scripts to get the best performance results
  • Set notifyUser parameter via API
  • Minor GUI improvements

 

BUG FIXES

IGA-434 Can’t change language
IGA-438 Empty defaultLanguage config value cause crash

Read the full release notes for Signing Workflow 2.3.0 here


Show more
August 29, 2023

New Release – PhenixID Authentication Services (PAS) 4.7

PhenixID is proud to announce the new release of PhenixID Authentication Services (PAS) 4.7. The new release improves the stability, compatibility, and security of your solution, and is recommended for all installations.
 

HIGHLIGHTS

 

The highlights for the 4.7 release include support for BankID RP-API v6.0, support for new Skolfedartion and multiple SAML updates.

BankID Säker Start RP-API v6.0

PAS 4.7 now have support for BankID RP-API v6.0 released mid May. This release is part of BankID “Säker Start” to improve security for BankID users by removing support of starting a BankID transaction where the user fills in their Personnummer. Services should instead use QR Code or Autostart, both already supported by PAS in earlier versions. It is strongly recommended to update to RP-API v6.0, by updating to PAS 4.7, since BankID will end support for earlier versions already May 1st 2024

PAS 4.7 supports both new v6.0 and previous version, making it possible for the administrator to migrate to v6.0 in a controlled and secure manner. PhenixID will help with guides on best-practice for migration. Don’t hesitate to contact PhenixID for more information about BankID Säker Start and what is needed on the service

Skolfederation

In March, Skolfederation together with Internetstiftelsen released a new version of Technical Profile for SAML WebSSO for Skolfederation. PAS 4.7 release complies with this new profile and are ready to be used for all entities connected to Skolfederation

SAML and EFOS

Several updates for the SAML protocol has been added to fully comply with the EFOS specification. These updates are generic and will be beneficial for all SAML installations

Improved functions

In addition, several features have received minor improvement including:

  • MyApps have been updated to comply with WCAG
  • Improved error handling using authenticators
  • Improved debug logging for HTTP valves

Miscellaneous bug fixes

Defect fixes recommended for all users, including

  • PHX-2899 Internal SAML: Entity not found
  • PHX-3029 Dispatch based on query string in OIDCToSAMLBroker
  • PHX-3047 FrejaEID login on same device does not take you back to the original app after auth
  • PHX-3083 EFOS – SAMLResponse must be signed
  • PHX-3084 EFOS – Include information on what failed to validate
  • PHX-3086 EFOS – Error in SAMLAuthSigning documentation
  • PHX-3087 EFOS – SAMLAuthForSigning error when not logged in
  • PHX-3088 EFOS – PrincipalSelection value missing in SAMLAuthForSigning
  • PHX-3089 EFOS – signMessageDigest addtribute always added – not documented
  • PHX-3090 EFOS – Encrypted signMessage doesnt work
  • PHX-3091 EFOS – PAS crash when Assertion is encryted and signed
  • PHX-3092 EFOS – Config example for solution missing
  • PHX-3094 EFOS – Requestedauthncontext missing if no dispatcher
  • PHX-3095 EFOS – Multiple AuthnContextClassRef
  • PHX-3096 EFOS – AssertionConsumerServiceURL fail for LOA4/HOK
  • PHX-3097 EFOS – Holder-of-Key generates validation error
Read the full release notes for Authentication Services here:

 


Show more
June 30, 2023

Patch Release – PhenixID Authentication Services (PAS) 4.6.2

This new release includes defect fixes for the 4.6 release, and is recommended for all 4.6 installations.
 

Bug fixes

 

The 4.6.2 release includes the following fixes

  • PHX-3037 Add PKCE support to the OIDC RP Relay authenticator

    Now supports PKCE when acting as Relying Party in OIDC. See documentation of Open ID Connect Relying Party under Authenticators for how to enable in your setup

  • PHX-3049 WCAG MyApps

    MyApps GUI now updated to align with WCAG 2.1

  • PHX-3100 XML Parser security improvments

    Updated handling of XML parsing

  • PHX-3104 OIDCToSAMLBroker  when session already available

    OIDCToSAMLBroker returns login data when an authenticated OIDC session already exists and prompt is set to “none”

See patch release information for 4.6.2 and read the full release notes for Authentication Services 4.6 here:

 


Show more
June 21, 2023

Patch Release – PhenixID Authentication Services (PAS) 4.6.1

This new release includes defect fixes for the 4.6 release, and is recommended for all 4.6 installations.
 

Bug fixes

 

The 4.6.1 release includes the following fixes

  • PHX-3010 Add success URL redirect option to SithsEID

    SithsEID now includes the possibility to configure success URL

  • PHX-3024 SithsEidSignValve is not working in PAS 4.6

    Issue resolved

  • PHX-3051 Signing broken using HSM

    Problem when using HSM for signing now resolved

  • PHX-3064 SAML Request security improvements

    Security improvements when processing SAML requests

  • PHX-3070 The OIDCToSAMLBroker does not handle prompt=none

    Issue resolved. If parameter prompt is set to value “none”, no user interaction is needed

See patch release information for 4.6.1 and read the full release notes for Authentication Services 4.6 here:

 


Show more
April 19, 2023

New Release – PhenixID Authentication Services (PAS) 4.6

PhenixID is proud to announce the new release of PhenixID Authentication Services (PAS) 4.6. The new release improves the stability, compatibility, and security of your solution, and is recommended for all installations.
 

HIGHLIGHTS

 

The highlights for the 4.6 release include updated HTTP API for BankID, Freja eID and SITHS, addition of Freja eID in “verify user” template and valves for BankID SIGN with QR code support.

  • BankID QR code support via HTTP API
  • Updated BankID logotype accorinding to BankIDs new release
  • Freja eID QR code support via HTTP API
  • Freja eID can now be used in the Verify User template
  • Use SITHS-eID as API authenticator
  • Possibility to disable appswitching in BankID authenticator scenarios

Improved functions

In addition, several features have received minor improvement including:

  • Key rollover for SAML Service Provider Authenticators
  • Secured sensitive endpoints as default
  • Added support for dynamically setting Assertion Consumer Service URL in the AuthNRequest for SAML Service Provider Authenticators
  • Disabled support for TLS versions prior TLS 1.2

Miscellaneous bug fixes

Defect fixes recommended for all users, including

  • PHX-2995 – Fixed PDF preview rendering issues while zooming and changing page
  • PHX-3003 – Resolved HSQLDB backup issues using default backup location
  • PHX-3007 – Mitigated cross-site scripting vulnerability
Read the full release notes for Authentication Services here:

 


Show more
April 5, 2023

PhenixID – New Release: Signing Workflow 2.2.0

 

PhenixID Signing Services Workflow 2.2.0 improves the stability, compatibility and security of your solution, and is recommended for all installations.
HIGHLIGHTS

 

The highlights for the 2.2 release includes the addition of Admin user role and the possibility to use Tags on errands

Admin user

In previous versions of SWF, there was two different roles for users:

  • Signers who is allowed to sign documents in errands assigned to them
  • Solicitors – apart from the same permissions as the signer – is allowed to create and manage siging errands

But what do you do if a specific Solicitor gets unavailable (for example gone on vacation or sick leave) and you need to handle a specific errand belonging to that Solicitor? The SWF 2.2 release includes a new role, admin, which can perform everything a Solicitor can do but also manage all errands created by any Solicitor. Simply put, a specific Solicitor can only see errands he/she has created while a admin user can see both errands created him/herself but also errands created by other Solicitors.

Tags

Some information might be available at creation of an errand, but isnt really applicable until the errand has finished. As an example, at create you might know that this document that is signed is a employment contract or you have information that this document should be archived in a specific archive. When the errand has been signed by all signers decisions should be made depending on that earlier information. Using the earlier examples, the employment contract should be sent to HR and the archive intended might mean that the document should be saved on a specific location.

This release introduces the use of Tags. Tags is a way to save information through the lifetime of the errand. At creationg Tags can be set and the settins of these tags can then be read until the errand is deleted. This could be specificaly benefitial when using the API to create and query errands. At completetion the script that implements the use of SWF API can querry about the tag settings and use that information to take decisions

 

IMPROVED FUNCTIONS

In addition, several features have received minor improvement including:

  • Possibility to control the format of a Swedish personnummer. If forcing the format ot 12 digits the administrator of the system can always be sure that the return value from for example BankID or Freja eID can always be matched with the solicitors input
  • Generic GUI improvments for increased usability

 

BUG FIXES

IGA-402 Setting expire date manually sets expire date one day before actual setting
IGA-412 Admin list filter and nav not visible when filtering

Read the full release notes for Signing Workflow 2.2 here


Show more
March 8, 2023

PhenixID – New Release: Identity Provisioning 6.3.2

PhenixID is proud to announce the new release of PhenixID Identity Provisioning (PIP) 6.3.2. The new releases improves the stability, compatibility, and security of your solution, and is recommended for all installations.
 

MAINTENANCE RELEASE

 

BUG FIXES

PIP-710 Three view showing incorrect states
PIP-711 Actions interface does not synch changed objects
PIP-712 Common Connection Pool unstable
PIP-713 LDAP Query: Binary attributes not working
PIP-714 Policy Runner: DEBUG logging stops snooping
PIP-715 Run Policy: Mapping parameters wrong

Read the full release notes for Identity Provisioning 6.3.2 here

 


Show more
March 1, 2023

New Release – OneTouch for iOS and Android

PhenixID is proud to announce the new release of PhenixID OneTouch for iOS and Android. The new release improves the stability, compatibility, and security of your solution, and is recommended for all users.
 

HIGHLIGHTS

The latest OneTouch release includes:

  • Dark mode support
  • Adaption to iOS and Android graphical user interface framework
  • Profile cards updates
  • Miscellaneous user interface updates

This latest version (5.1.1 for iOS and 5.2.3 for Android) are available in the on the following platforms:

  • iOS 12 or later
  • Android Lollipop (Android version 5) or later
Apps available for download here:

AppStore Google Play

 


Show more
Load more news