The OAuth2 and OpenID Connect Extension 2.26.0 has been released.
It's mainly focusing on straitening security on tokens and authentication flow. It introduced a new token format. The old tokens which are using the old format keep working, but any new token will use the new format, and it's recommended to replace older tokens with new one.
While 2.25.3 introduced a warning log to explain that it's unsafe to use implicit flow without indicating the provider, it was decided to completely forbid this setup in 2.26.0 since it goes against specification.
So if you are relying on implicit (or hybrid) flow, and you did not configure the provider main URL, authentication might fail after you upgrade. It's therefore recommended to set the provider before upgrading.
If you rely on wiki configuration, upgraded, and are locked out because you don't have any non-OIDC admin user, you can unblock the situation by setting the provider in the xwiki.properties file (oidc.provider=https://myprovider.com ) and the wiki configuration will inherit it.
See the release note for more details.
Posted by Thomas Mortagne · Categories: Extensions, Contrib, Releases, What's New for XWiki, What's New for XWiki: Admin User, What's New for XWiki: Extension · Permalink · Comments (0)
