All work

Add attributeRecipientGroupID to profile config(s)

Possible race condition when processing login_hint or resource -parameters in authorization endpoint

Protocol trace log only display first parameter value

Multiple resource parameters cause MessageDecodingException

Add flag to block additional audiences from initial access token

Provide method for strict scope validation

Relocate and improve lookup functions for request message contents

Add ignoreScoping to OIDC.SSO properties

Error handling for missing and invalid request objects

Support for OAuth2 JWT-Secured Authorization Request (JAR)

Support for JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)

Prefix form_post response parameter keys in Velocity context

Response type parameter handling in authorization endpoint

Empty/missing scope in authorization request produces uncaught exception

Provide method to customise response message contents

Refactor support for non-URI resource indicators for Nimbus v11

Ignore scope in token endpoint with authorization code grant

Provide method to avoid Nimbus message parsing restrictions

Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)

Support for OAuth2 Pushed Authorization Requests (PAR)

UserInfo JWT access token issued by the implicit authorize flow is not signed

Allowed ResponseModes should be configurable

Enhance metadata and unregistered client policy config options

Authentification with an unregistered OIDC client fails

Make offline_access consent handling configurable

Add metadata-driven naming to attribute transcoders

Allow redirection URI validation via custom function

SetRequestObjectToResponseContext HTTP resource leak

Allow customization of request object claims validators

The default audit extractor for %fauth causes ClassCastException to be thrown

Support unregistered clients at authz endpoint

Improve Request Object handling and configuration

Allow customization for mappedErrors of OP flows

Logging of missing relying party ID is confusing

Support OAuth authorization requests

Include sid claim in id_token

Stricter-then-standard parameter checking

Support manipulating claims encoded inside authz code and tokens

Support Direct Encryption for JWE encryption / decryption

IDTokenLifetime property misspelled in metadata-backed wiring

SAML Metadata for OIDC does not support space delimiter in response_types

Support OAuth 2.0 Authorization Server Issuer Identification as per RFC9207

support C_HASH in ID_Token also for Authorization Code Flow with PKCE

Inbound and outbound interceptor flows are not wired to the OIDC flows

Honoring semantics for forceAuthn flag in the same manner as SAML

Facilitate login_hint sanitization

OIDC SSO happens even with different ACR

Claims-parameter in the authn request only affects attribute filtering

Wrong JSONObject type when decoding claims from Signed JAR Authentication request

Lack of openid scope in metadata doesn't prevent id_token issuance