4.444.vd4c54f157201

🐛 Bug fixes

• pass the correct argument to create the group filed JMESPath (#492) @jtnord

4.438.v6e62f6782770

🚀 New features and improvements

• Redirect to login page if refresh token has expired (#475) @eva-mueller-coremedia

📦 Dependency updates

• Bump codecov/codecov-action from 4 to 5 (#469) @dependabot

4.421.v5422614eb_e0a_

🔒 Security

• Fix SECURITY-3473.

4.418.vccc7061f5b_6d

🚀 New features and improvements

• Use a FIPS compliant version of nimbus-jose-jwt (#440) @fcojfernandez

🐛 Bug fixes

• Resuse the original user principal to avoid crumb issues. (#426) @jtnord

📝 Documentation updates

• fix plugin documentation of plugin configuration for endSessionEndpoint (#439) @sstoffregen

4.411.v990b_9d36e74e

🐛 Bug fixes

• Filter missing non-compliant algorithms in FIPS mode (#435) @fcojfernandez

4.409.ve864b_f48b_0f3

🚀 New features and improvements

• JENKINS-73904 - Enable FIPS restrictions in the JWK signing algorithm for Token verification (#428) @fcojfernandez

🐛 Bug fixes

• JEP-237 - disable escapeHatch when Jenkins is in FIPS mode (#418) @olamy

👻 Maintenance

• JENKINS-73849 - JEP-237 - remove the ability to disable SSL and token validation in FIPS mode (#423) @PereBueno

🚦 Tests

• Switching tests to throw generic Exception (#425) @PereBueno

✍ Other changes

• JENKINS-73892 - un-inline script in config.jelly and fix existing behavior (#427) @shlomomdahan

4.388.v4f73328eb_d2c

💥 Breaking changes

Caution

The plugin now requires that the Issuer is set to enforce security and there is no option to disable this requirement as it is mandated in the Open ID Connect specification.
As such users who do not use automatic configuration via the well-known endpoint must first update to 4.355.v3a_fb_fca_b_96d4 and configure the Issuer before updating to this version.
Failure to do so will result in users unable to login, or Jenkins failing to start.

Caution

if using manual configuration and a JWKS Server URL has not been specified then either disable token validation will need to be enabled or the JWKS Server URL will need to be set before upgrading to this version.
Failure to do so will result in users unable to login.

Warning

The option to send the scopes when requesting the access token has been removed (although is still present in the UI). Users of non conformant OPs that require this functionality should remain on the previous version until the Open ID Connect Originating Party (often referred to as the iDP) fixes their implementation.

• Replace EOL Google Oauth library (#409) @jtnord

📝 Documentation updates

• document ADFS token lifetime for devs (#420) @jtnord

4.371.vc7c0c06e8a_f5

🐛 Bug fixes

• Redirect to login page in case token is expired instead of showing an error page (#395) @eva-mueller-coremedia

📝 Documentation updates

• Update CasC documentation (#417) @fcojfernandez
• Add developer docs (#410) @jtnord

4.355.v3a_fb_fca_b_96d4

🔒 Security fixes

• Fix SECURITY-3441 (1, 2).

Important

When using the "Manual entry" configuration mode, the new "Issuer" field must be populated after updating to protect from this issue. When using "Discovery via well-known endpoint", the Issuer will be set automatically.

4.354.v321ce67a_1de8

🐛 Bug fixes

• Use endSessionUrl instead of endSessionEndpoint for manual configuration in UI (#402) @eva-mueller-coremedia

👻 Maintenance

• Remove deprecated constructor (#401) @jtnord