Upgrading from 10.3.X to 10.4.0#

SDK#

Kotlin upgrade#

The provided version of Kotlin was upgraded from 2.0.20 to 2.2.0. Plug-in developers are encouraged to upgrade to this version to remain aligned with the included version. We strongly recommend to recompile and thoroughly test all custom plugins written in Kotlin.

Changes to the NonceDataAccessProvider interface#

The consume(String, long) method of the NonceDataAccessProvider interface has been deprecated. A new overload is added which returns a boolean indicating whether the nonce was consumed by the current invocation.

The server still considers the old method as a fallback (i.e. the change is non-breaking), but it is recommended that data-source plugins implementing NonceDataAccessProvider are updated to the new method.

GraphQL APIs#

Limits#

The User Management GraphQL API now has more strict limits on the sizes of input strings and arrays. See User Management GraphQL documentation.

Authorization errors#

GraphQL requests that are not allowed by the configured authorization manager will result in responses with the 403 (“Forbidden”) status code, instead of the 401 (“Unauthorized”) status code used before. The same behavior also applies if no authorization manager is configured.

Note that requests that are allowed with obligations may still fail because the obligation is not fulfilled later on. These failures are unchanged and remain represented as GraphQL errors, with a 200 status codes and an non-empty errors field.

Serialization filter system property#

The se.curity:identity-server:serialFilter Java system property allows additional Java types to be deserialized, on top of the types the Curity Identity Server allows by default. In previous versions, setting this property did not work correctly: instead of only allowing the types matched by its patterns, it effectively disabled the restriction for every type not in the default allow-list. This was fixed in versions 11.4.3, 11.3.3, 11.2.4, 11.1.4, 11.0.6, 10.7.8, 10.6.6, 10.5.5, 10.4.7, 10.3.5, 10.2.6, 10.1.5 and 10.0.7.

From these versions, only the types matched by the property’s patterns are allowed in addition to the default ones, and any other type is rejected. Deployments that set this property must review its value and make sure that it matches every type that actually needs to be deserialized, as a value that is too narrow previously went unnoticed. A type rejected by the filter is logged as a warning (Type ... not allowed to be deserialized).