Release notes

Release 3.3.1, April 22nd, 2024

Fix

  1. Fixed an issue were Firely Auth running in docker was unable to connect to a SQL server user store.

Release 3.3.0, March 20th, 2024

Security

  1. Disabling 2FA authentication for a client will now require a 2FA token from the user as an additional security step

  2. Added ‘Require2fa’ to the default appsettings. This replaces the current ‘RequireMfa’ setting.

Feature

  1. Firely Auth will now warn about invalid key/value pairs submitted to the launchContext API

  2. Values in the form of ‘<resourceType>/<id>’ submitted to the launchContext API will now be automatically translate to id-only values

Release 3.3.0-rc3, February 1st, 2024

Configuration

  1. EnableLegacyFhirContext is added to switch the syntax of fhirContext between SoF v2.1 and v2.0. See Firely Auth Settings for details.

  2. ClientClaims and ClientClaimPrefix are added to help a client to define custom claims in the client credential flow. See Firely Auth Settings for details.

Feature

  1. Harmonized Serilog sinks with Firely Server. See Changing the sink for details of all supported sinks.

  2. Enabled clients to add static custom claims in the client credential flow. See Firely Auth Settings for details.

Fix

  1. Fixed the EHR launch context in case of a user login via an external identity provider.

  2. Improved the validation of setting AllowedResourceTypes. Any invalid FHIR resource types will be rejected now.

  3. Improved the validation of setting AllowFirelySpecialScopes. Firely special scopes can now only be requested if an registered client has the setting set to true.

  4. In case of the EHR launch, no System.ArgumentException is thrown if both launch and launch/patient scopes are present in the request for the access token.

Release 3.3.0-rc2, November 23nd, 2023

Feature

  1. You can restrict a client to specific FHIR resource types, using the setting AllowedResourceTypes in the Clients. If the client requests SMART scopes for other resource types, the request will be denied.

Release 3.2.0, June 20th, 2023

Configuration

Attention

To make it easier to understand, some configuration sections are renamed or reorganized. Please check the bullets below for a summary of changes. For the details, please check page Firely Auth Settings.

  1. Section KeyManagementConfig is renamed to KeyManagement.

  2. Section FhirServerConfig is renamed to FhirServer.

  3. Section ClientRegistrationConfig is renamed to ClientRegistration.

  4. Section TokenConfig is removed, the AccessTokenType for each client is moved to the registration of the specific client.

  5. Section TokenIntrospectionConfig is removed, the secret of a token introspection end point can be configured using setting IntrospectionSecret within section FhirServer.

  6. For registering a specific client, the LaunchIds setting is removed. A dynamic Smart on Fhir launch context can be requested via the LaunchContext endpoint. See LaunchContext endpoint for details about how to request launch context dynamically.

Feature

  1. Users now can change their own passwords after login.

  2. A user account will be blocked temporarily after 5 unsuccessful authentication attempts and it will be unblocked in 5 minutes.

  3. Added a setting KeySize to adjust the RSA key size generated by Firely Auth. By default, it is set to 2048.

  4. Added a setting PasswordHashIterations to adjust the password hashing iterations in case of different security considerations. By default it is set to 600000. See User store for more details.

  5. Introduced LaunchContext endpoint for requesting Smart on Fhir launch context dynamically. See LaunchContext endpoint for more details.

  6. Added security attributes to session cookies.

Fix

  1. Disabled Client Initiated Backchannel Authentication (CIBA).

Attention

The aud used in an access token is updated to the FHIR_BASE_URL instead of the name of FHIR server.

Release 3.1.0, March 9th, 2023

Feature

  1. Added a setting to configure CORS support for only a limited set of origins. See AllowedOrigins for more details.

Release 3.0.0, December 2022

This is the first public release of Firely Auth, providing support for SMART on FHIR v1 and v2 and a SQL Server user store.