2.1.0 (20th May 2024)

This release introduces a new "passwordless" authentication feature, see DuoPasswordless for more information. In addition, the Duo authentication factor is now exposed within the Java Subject as a DuoFactorPrincipal and a Context to Principal mapping hook is customizable for each Duo integration (alongside the existing global hook).

2.0.0 (14th Sept 2023)

This release is compatible with version 5.0.0 of the Shibboleth IdP. This is the first release of the DuoOIDC plugin which includes the old Duo AuthAPI code. So anybody wanting to use the non-browser Duo features will need to install the DuoOIDC plugin.

1.4.1 (6th Sept 2023)

This release of the DuoOIDC plugin fixes a possible resource leak in the HTTP response handling of the Nimbus client version.

1.4.0 (18th May 2023)

This release of the DuoOIDC plugin supports the latest version of the OIDCCommon plugin (idp.oidc.common.3). It also includes the following change to the auditing mechanism:

• The audit mechanism is now in-line with the more general authentication auditing used by the IdP.

  • If you previously used the audit mechanism in V1.3.0 (i.e. idp.duo.oidc.audit.enabled=true ) and are upgrading, you will also need to generally enable the authentication auditing feature of the IdP (e.g. set idp.authn.audit.enabled=true in conf/authn/authn.properties).

  • You no longer need to specify your own shibboleth.authn.DuoOIDC.AuditFormattingMap bean in order to adjust the audit format. Instead, a new format can be specified using the property idp.duo.oidc.audit.format inside of conf/authen/duo-oidc.properties.

1.3.0 (November 17, 2022)

This is a feature release that adds the following:

• The ability to turn off the Duo health check (see Advanced Topics). We have tested this works, but not in a production environment, so use caution.

• The ability to turn on audit logging for the Duo 2FA authentication flow (see Advanced Topics).

There are also some small internal changes to help with the migration to IdP 4.3