All work

Add attributeRecipientGroupID to profile config(s)

Release 4.2.1

IllegalStateException in view-state CallFrontChannelLogoutUriView

Audit logging for OAuth2Client login flow

AdministrativeLogoutConfiguration for OIDC

Possible race condition when processing login_hint or resource -parameters in authorization endpoint

Release 4.2.0

Protocol trace log only display first parameter value

Multiple resource parameters cause MessageDecodingException

Add flag to block additional audiences from initial access token

Provide method for strict scope validation

Exclude end-session flow from the IdP response header filter coverage

OIDC RP-init Logout vm Uncaught runtime exception

Autoconfigure CORS for public OIDC clients

Relocate and improve lookup functions for request message contents

Openid-scope with client credentials grant may cause wrong error

IDP Session (cookies) not created after OIDC Login in IDP Version 5.1.3

Support for OpenID Federation

Migrate to dedicated audit formatting strings

Outbound interceptor flows are not executed before error responses

Add ignoreScoping to OIDC.SSO properties

Error handling for missing and invalid request objects

Support for OAuth2 JWT-Secured Authorization Request (JAR)

Support for JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)

Prefix form_post response parameter keys in Velocity context

Response type parameter handling in authorization endpoint

Make scope nullable in TokenClaimsSet and its subclasses

Empty/missing scope in authorization request produces uncaught exception

Provide method to customise response message contents

Refactor support for non-URI resource indicators for Nimbus v11

upgrade json-smart 2.4.8

Ignore scope in token endpoint with authorization code grant

Need to add links to javadoc from profile config pages

Provide method to avoid Nimbus message parsing restrictions

Add link back to Nimbus and JOSE javadocs

Support for OAuth2 Attestation-Based Client Authentication

Support for OAuth 2.0 Device Authorization Grant

Release 4.1.0

Support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)

Support for OAuth2 Pushed Authorization Requests (PAR)

UserInfo JWT access token issued by the implicit authorize flow is not signed

Fix incorrect NonNull annotations in API

Allowed ResponseModes should be configurable

Enhance metadata and unregistered client policy config options

Suggest changing the support level for Versions 3.0.4

Logging improvements for message tracing

Flow cleanup to leverage ensureContext and of legacy classes

Remove dashes from subject claim examples

Harmonise the use of identifier generation strategies

Module should notate Windows and non-Windows files