Changelog

Pushed Authorization Request (PAR) Flow Support
- Added a new section detailing the Pushed Authorization Request (PAR) Endpoint.
- This allows clients to push authorization requests directly to the server before redirecting users for authentication.
Client Authentication with Client Assertion JWT
- Introduced a dedicated section explaining JWT-based client authentication.
- Added jti (JWT ID) claim, which will be mandatory in a future major release.

esrvcID Query Parameter (Authorization Endpoint)
- Marked for deprecation. Clients should avoid relying on esrvcID as it will be removed in an upcoming release.

Authorization Endpoint: esrvcID Query Parameter
- Added an official deprecation notice for esrvcID. RPs should transition away from this parameter.

Introduction & Documentation Improvements
- Clarified the OIDC flow diagram with a focused summary.
- Improved readability in key sections.
OpenID Discovery Endpoint
- Added support for new algorithms:
  - Signing: ES256K, ES384, ES512
  - Encryption: ECDH-ES+A128KW, ECDH-ES+192KW
- Added user claims: email, email_verified
Authorization Endpoint
- Introduced a "Required" column in the request parameters table for clarity.
- Changed HTTP redirect behavior:
  - Redirects during Singpass login now return HTTP 303 (See Other) instead of 302 (Found).
- Removed outdated curl request examples.
Token Endpoint
- Client Assertion JWT Updates
  - Introduced the jti (JWT ID) claim for client authentication.
  - This will become mandatory in the next major version.
- Access Token Structure Changes
  - Updated descriptions for scope and sub.
  - Added client_id and jti claims to the access token.
- Removed curl request examples for better maintainability.
ID Token Structure
- Clarified that the order of key-value pairs in sub is not guaranteed.
- Added support for email and email_verified claims.
Authorization Info Endpoint
- Changed HTTP method from POST to GET.
- Deprecated the use of scope in request bodies.
New Sections Added
- Overview of JWS & JWE
- Scopes Overview

Authorization Endpoint Redirect Code Change
- Redirect behavior during Singpass login changed from HTTP 302 to HTTP 303 to align with best practices.
Authorization Info Endpoint
- New Claims Introduced: sub now included.
- Error Handling Enhancements: Added standardized error responses.
Token Endpoint
- Error Fields Section Added to provide more detailed error messages.
Single Sign-On (SSO) Discontinued
- Officially removed SSO support. RPs should transition to alternative authentication methods.

Face Verification AMR Claim Update
- Corrected the return value for Face Verification (AMR claim) from "fb" to "fv".

Last updated 7 months ago