DuoOIDCReleaseNotes
2.3.0 (5th August 2025)
Updated Duo’s WebSDK to version 1.3.2, which now includes the Authentication Method Reference (AMR) values in the authentication response. These values were already available when using the Nimbus variant of the plugin, but are now exposed through the WebSDK implementation as well.
Added support for a new, injectable, Authentication Method Reference to Principal Strategy to simplify AMR-based principal mapping: DuoOIDCAuthnConfiguration
Also included the required translation messages directly within the plugin, which should solve any localisation issues and allow translations to work.
2.2.2 (16th Sept 2025)
Fixes a bug in the configuration of the default HTTP client of the Nimbus plugin that sets an infinite responseTimeout. It now defaults to 1 minute (PT1M) and is adjustable by either setting the IdP’s http client property idp.httpclient.responseTimeout, or by setting the DuoOIDC specific property idp.duo.oidc.responseTimeout.
2.2.1 (15th May 2025)
This release updates the native Duo WebSDK to version 1.3.1. Duo has updated several third-party dependencies for their SDK, removed those no longer needed, and added support for HTTP proxying.
In addition, the static set of ‘pinned’ root CA certificates used by both plugin variants has been updated. Noting, you can override these if required, see DuoOIDCAuthnConfiguration.
2.1.0 (20th May 2024)
This release introduces a new "passwordless" authentication feature, see DuoPasswordless for more information. In addition, the Duo authentication factor is now exposed within the Java Subject as a DuoFactorPrincipal and a Context to Principal mapping hook is customizable for each Duo integration (alongside the existing global hook).
2.0.0 (14th Sept 2023)
This release is compatible with version 5.0.0 of the Shibboleth IdP. This is the first release of the DuoOIDC plugin which includes the old Duo AuthAPI code. So anybody wanting to use the non-browser Duo features will need to install the DuoOIDC plugin.
1.4.1 (6th Sept 2023)
This release of the DuoOIDC plugin fixes a possible resource leak in the HTTP response handling of the Nimbus client version.
1.4.0 (18th May 2023)
This release of the DuoOIDC plugin supports the latest version of the OIDCCommon plugin (idp.oidc.common.3). It also includes the following change to the auditing mechanism:
The audit mechanism is now in-line with the more general authentication auditing used by the IdP.
If you previously used the audit mechanism in V1.3.0 (i.e.
idp.duo.oidc.audit.enabled=true) and are upgrading, you will also need to generally enable the authentication auditing feature of the IdP (e.g. setidp.authn.audit.enabled=truein conf/authn/authn.properties).You no longer need to specify your own
shibboleth.authn.DuoOIDC.AuditFormattingMapbean in order to adjust the audit format. Instead, a new format can be specified using the propertyidp.duo.oidc.audit.formatinside of conf/authen/duo-oidc.properties.
1.3.0 (November 17, 2022)
https://shibboleth.atlassian.net/issues/?jql=project+%3D+%22JDUO%22+AND+fixVersion+%3D+%221.3.0%22++
This is a feature release that adds the following:
The ability to turn off the Duo health check (see Advanced Topics). We have tested this works, but not in a production environment, so use caution.
The ability to turn on audit logging for the Duo 2FA authentication flow (see Advanced Topics).
There are also some small internal changes to help with the migration to IdP 4.3