Skip to main content

Release Notes

Full changelog for all Raidiam Connect versions.

⚠️

Upcoming Breaking Changes

Future changes that may require action on your end. Review and plan ahead.

"Withdrawn" status renamed to "Inactive" across Organisations, Servers, and Applications

Q3 2026

The Withdrawn status value for Organisations, Authorisation Servers, and Applications will be renamed to Inactive. This is a nomenclature change only — the behaviour and meaning of the status remain unchanged.

A transition period of approximately 3 months will be provided before the change takes effect. Any integration that reads or compares the status value as a string should be updated to handle Inactive in place of Withdrawn.

Organisation certificate update removed in favour of key-material API

v3.0.0Q3 2026↓ Download Swagger

The ability to update an organisation certificate's description has been removed. The PUT endpoint for updating organisation certificate details by type is no longer available.

Removed capability:

  • PUT /organisations/{OrganisationId}/certificates/{OrganisationCertificateType} — updating certificate description
Note: Certificate revocation remains available via PUT /organisations/{OrganisationId}/certificates/kid/{CertificateOrKeyId}.

To manage certificates going forward, use the new key-material API introduced in this release:

  • GET /organisations/{OrganisationId}/key-material — list key material
  • POST /organisations/{OrganisationId}/key-material — create new key material
  • GET /organisations/{OrganisationId}/key-material/{KeyMaterialID} — retrieve a specific item
  • PUT /organisations/{OrganisationId}/key-material/{KeyMaterialID} — update or revoke a key material item
  • GET /organisations/{OrganisationId}/key-material/{KeyMaterialID}/attachments — list attachments
  • POST /organisations/{OrganisationId}/key-material/{KeyMaterialID}/attachments — add an attachment
  • PUT /organisations/{OrganisationId}/key-material/{KeyMaterialID}/attachments/{KeyMaterialAttachmentID} — update an attachment
Note: All existing keystore endpoints will be fully preserved.
Compare versions:→

2.6.0#

Latest↓ Download Swagger▾

This release introduces new credential binding capabilities and broader ecosystem configuration support, including post-quantum signing, cross-federation trust, and passkey authentication management. It also delivers improvements to audit visibility and directory data completeness, alongside fixes addressing permission consistency, interface layout, and form error handling.

New features#

Standalone Trust Anchor for Federation Linking

New Feature

Introduces a standalone, statically configured trust anchor that enables federations to be linked without requiring a directory.

  • Allows operators to establish cross-federation trust in environments where a central directory is not present
  • The trust anchor is statically configured and does not require a running directory service

DPoP Token Binding Support

New Feature

Adds support for Demonstrating Proof of Possession (DPoP), enabling clients to cryptographically bind access tokens to a specific key pair.

  • Prevents replay attacks when tokens are obtained or intercepted by unauthorised parties
  • Only the holder of the private key used during token acquisition can present the token successfully

Audit Trail for Organisation Certificates

New Feature

Adds an audit sub-tab under the Organisations section, providing visibility into historical changes made to organisation certificates.

  • Filter the audit log by key ID and certificate type
  • Consistent with the audit experience already available for applications

Add backchannel_client_notification_endpoint to Software Statements

New Feature

Introduces the backchannel_client_notification_endpoint field to software statements to support CIBA (Client-Initiated Backchannel Authentication) flows.

  • Accepts an HTTPS URL representing the endpoint to which the OpenID Provider posts authentication notifications
  • Required by the CIBA specification when using ping or push token delivery modes
  • Optional field — existing software statements are unaffected

Add reference number and validity dates to regulatory documents

New Feature

Regulatory document entries now support three new optional fields: Document Reference Number, Start Date, and Expiry Date.

  • Fields appear in the existing Add/Edit Document wizard
  • Returned by the organisation documents API endpoints (GET, POST, PUT)
  • All new fields are optional — existing document entries and deployments are unaffected

SSA signing now supports selectable algorithm including ML-DSA

New Feature

The SSA generation endpoint accepts a new optional signingAlg parameter, allowing callers to request a specific signing algorithm per request.

  • Supported algorithms include PS256 and post-quantum ML-DSA variants (ML-DSA-44, ML-DSA-65, ML-DSA-87)
  • The SSA signing keyset now publishes both RSA and ML-DSA public keys for verification
  • Requesting an unsupported algorithm returns a structured 400 error listing enabled algorithms
  • Existing callers that omit the parameter continue to receive PS256-signed SSAs unchanged

Role metadata policy supports wallet ecosystem entity types

New Feature

Authorisation domain role metadata policies can now target wallet ecosystem entity types.

  • Newly supported types: openid_credential_issuer, openid_credential_verifier, openid_wallet_provider, and openid_credential_verifier_provider
  • Previously, any value outside the four legacy entity types was rejected with a 400 error
  • Allows directories to correctly attach and publish policy for credential issuers, verifiers, and wallet providers

Enhancements#

Updated description for software_origins_uri directory field

Enhancement

The description of the software_origins_uri field in the Directory Software Statement has been updated to clarify its use in FIDO2 ceremonies.

  • Now explicitly documents the requirement to declare both the initiator's own WebAuthn API origins and any top-level page origins used within cross-origin iframes
  • Aligned with the Enrollments v2.3.0 specification

Contact Type column now sortable in Contacts page

Enhancement

The Contact Type column on the Contacts page within an Organisation is now sortable.

  • Allows users to order contacts by type more efficiently
  • Restores previously missing sort functionality to the contacts table

Bug fixes#

Clearer Validation Errors for Invalid Issuer URL

Bug Fix

Users now see field-level error messages when an invalid Issuer URL is entered during Authorization Server creation or editing.

  • Errors are shown for scenarios including an unreachable well-known endpoint, a duplicate issuer, and a mismatch between the issuer value and the well-known URL prefix
  • A helper tooltip is displayed alongside the Issuer field to describe the validations being performed

Fix Misaligned Columns on IDP Binding List

Bug Fix

The Identity Provider binding screen previously displayed the IDP name, organisation name, and server name columns out of alignment.

  • Columns now render consistently with the intended layout

Fix Broken Organisation Listing in Group Binding

Bug Fix

The organisation listing dialog used when binding an organisation to a group was broken and failed to display correctly.

  • The dialog now renders organisation name and ID as intended

Audit filter Action dropdown now clearable

Bug Fix

The Action filter in the audit log view previously could not be cleared once a value was selected.

  • A clear filters option is now available, allowing users to reset the filter and view unfiltered audit records

Authorization Server flags now visible to all user roles

Bug Fix

The Flags section on Authorization Server detail pages was previously only visible to Super Users.

  • All permitted user roles can now view flags assigned to Authorization Servers
  • Consistent with flag visibility already available for Organisations and Applications

Fix certification modal crash on invalid start date input

Bug Fix

Entering a date value without slash separators in the Start Date field of the Add/Edit Certification modal previously caused an uncaught JavaScript error, leaving the modal blank with a permanently stuck spinner.

  • Input validation and error handling have been corrected so the modal remains usable
  • A clear error message is now displayed for invalid date formats
  • The fix applies to certification modals on both Software Statements and Authorization Servers

Fix production UI crashes in delete flow and permission checks

Bug Fix

Two production errors surfaced via monitoring have been resolved.

  • A crash in the delete-conflict error parser that occurred when an API error message lacked the expected payload separator — the parser now falls back to a generic error toast for malformed messages
  • An unhandled rejection in the permission hierarchy check that left the domain users list silently empty on lookup failure — failed permission lookups now deny access for the affected item only and allow filtering to continue

Certification type disable no longer blocked by inactive resources

Bug Fix

Disabling a certification type is no longer incorrectly blocked by certifications held on inactive software statements or authorisation servers.

  • Only certifications associated with active resources are now considered when evaluating whether a certification type can be disabled

OpenID server crash on missing interaction session fixed

Bug Fix

The OpenID server no longer crashes with an unhandled runtime error when recovery code routes are called without a valid interaction session cookie.

  • Expired or missing session errors are now caught and routed to the central error handler
  • A rendered error page is returned instead of causing request timeouts

2.5.0#

↓ Download Swagger▾

2.4.0#

▾

2.3.0#

▾

2.2.0#

▾

2.1.0#

▾

2.0.0#

▾