> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/release-notes.md). # Release Notes *** ### 2.1.0-r.3 — June 13, 2026 #### Authentication Features **Authenticate into Microsoft Entra via 1Kosmos Browser Extension** 1Kosmos now extends Passkey + LiveID authentication for Microsoft Entra to desktop browsers. Previously available only through the 1Kosmos mobile app on Intune-managed iOS devices, this capability is now delivered through a browser extension on Google Chrome and Microsoft Edge. On first use, users complete a one-time activation flow through AdminX. Subsequent logins automatically redirect users to the authentication workflow, where identity is verified via LiveID biometric before accessing Entra. The extension is available through the Chrome Web Store. For more information, see here. **Restricting Multi-Device Enrollment for Application Access** 1Kosmos now introduces device restriction policies enabling administrators to precisely control over how many authentication devices per device type users can enroll, applied by group or individual username. Enrollment limits are enforced automatically, users who reach their limit can continue using existing devices but cannot register new ones until an existing device is removed. For more information, see Configure Device Restriction Policy. Benefits * Set different enrollment limits for different user groups. * Support privileged access needs without relaxing controls for everyone. * Reduce unauthorized device sprawl from a single, centralized interface. **Enhanced IdP-Initiated SSO with Direct Application Access** Building on IdP-initiated SAML SSO support introduced in the previous release, 1Kosmos now provides a static Access URL for applications configured with IdP-initiated SSO. Administrators can view and copy this auto-generated URL from the application configuration and share it with users or embed it in portals, bookmarks, and launch pages, eliminating the need to navigate to My Apps each time. When a user opens the URL, they are prompted to authenticate if not already signed in and are then redirected directly to the application. If a Relay State is configured, users land at the configured destination after login. If IdP-initiated SSO is disabled or the application is removed, users are redirected to their AdminX profile page. **Filter Admin Activity Reports by Event** Community administrators can now filter and download the Admin Activity Report by event name, making it faster to locate and investigate specific activity across the platform. **Exclude Specific Users from Adaptive Authentication Rules** Adaptive Authentication now supports an is not one of operator for the Username condition. Administrators can define authentication rules by excluding a specific set of users rather than listing every individual the rule should cover, simplifying policy management at scale. For more information, see Configure Adaptive Authentication Journey. **Configure LiveID as an Authentication Factor in Windows MFA** The Adaptive Authentication journey for Windows MFA now supports LiveID-based authentication methods. Administrators can configure LiveID Selfie and LiveID Selfie with Push Notification as authentication factors under MFA Required, enabling stronger biometric-based verification in Windows authentication flows. For more information, see LiveID Selfie. **Detect and Investigate SAML Certificate Failures Faster** 1Kosmos now generates an E\_ACCESS\_DENIED audit event when SAML authentication fails due to an expired or invalid certificate. Previously, these failures occurred silently with no audit trail. Audit logging now covers expired IdP signing certificates, SP request signing certificates, and SP encryption certificates, with a deny\_reason field providing details on the specific failure. **Track Device Fingerprint Across Login Events** The device\_fingerprint parameter is now included in E\_LOGIN\_VISITED, E\_LOGIN\_SUCCEEDED, and E\_LOGIN\_FAILED events, providing richer device-level context for login activity monitoring and investigation. **Prevent Log Disk Exhaustion with Auth Proxy Log Rotation** AuthProxy now supports automatic log rotation, preventing uncontrolled log growth and disk exhaustion in high-volume authentication environments. **Update 1Kosmos Branding Across Default Templates** Default SMS and email templates have been updated to replace legacy BlockID references with current 1Kosmos branding. Updates include verification code messages, enrollment invitation emails, mobile app references, and email signatures. Customized templates are not affected. Newly provisioned communities will also inherit the latest default templates with refreshed logos and updated content. #### API Enhancements **Filter Event Reports via API** A new optional eventName filter has been added to the Reports API, enabling retrieval of records for a specific event type. **Retrieve Authentication Phrases in the User's Native Language** A new optional language parameter has been added to the Random Phrase Fetch API. Phrases for the 1Kosmos Credential Provider UI and Behavioral Authentication are now returned in the user's native language, automatically determined from the Windows OS locale. Supported languages are English, Spanish, Portuguese, French, and German. #### Bugs Fixed * Fixed an issue where analytics timed out when event volume exceeded 4 million records. *** ### 1.13.00 — May 15, 2026 #### Authentication Features **IDP-Initiated SAML SSO Support** 1Kosmos now supports IDP-initiated SAML SSO, enabling users to launch applications directly from the 1Kosmos platform without requiring a service provider-initiated login flow. A new My Apps section is now available under the user profile, where users can view and access all SAML applications enabled for IDP-initiated login. Users can log in to these applications with a single click, delivering a portal-based SSO experience. Administrators can enable this capability through the SAML configuration by turning on the IDP-initiated login option. An optional Relay State can also be configured to control the post-login redirection experience. If no Relay State is specified, users are redirected to the default landing page of the application. This enhancement simplifies application access while maintaining full compatibility with existing configurations. > Note: This is an opt-in feature and is disabled by default. **External MFA Support for Microsoft Entra ID** 1Kosmos can now be configured as an external authentication method for Microsoft Entra ID, enabling organizations to enforce multi-factor authentication without federating their applications. Users authenticate with their primary credentials in Entra ID and are redirected to 1Kosmos as a secondary authentication step. Based on configurable authentication journeys, users can complete additional verification factors — including OTP, push notification, QR code, or FIDO — before being redirected back to Entra ID to access their application. This enables flexible, policy-driven MFA enforcement while preserving the existing Entra ID authentication flow. Community administrators can now configure Microsoft Entra External Authentication Methods (EAM) in a single guided flow — creating an OIDC application and setting up an Adaptive Auth Journey without switching between screens. A new Entra EAM card, identifiable by the Microsoft logo and a Beta tag, has been added to the Add Application section. **Improved Session Handling for Push and QR Authentication** The login experience for Push Notification and QR Code authentication on the AdminX interface has been enhanced to handle explicit user rejection. When a user cancels a sign-in request on their mobile device, the login session is terminated immediately. The user is shown the message "Your login request was cancelled" and redirected appropriately — without waiting for session timeout. An E\_AUTH\_REQUEST\_DENIED event is generated for these scenarios, ensuring accurate audit logging. **Behavioral Authentication for Web Applications** 1Kosmos has extended Behavioral Authentication — previously available only in the Windows Credential Provider — to web applications. When enabled, users can select Behavioral Authentication during login and verify their identity based on their enrolled typing pattern, evaluating how they type rather than what they type. This factor is combined with a PIN to complete authentication; the Behavioral Auth + PIN option is available in Adaptive Authentication, eliminating the need for passwords or external devices. The feature provides a consistent authentication experience across platforms, with retry limits enforced and appropriate events (E\_LOGIN\_SUCCEEDED, E\_LOGIN\_FAILED) generated. > Note: This is an opt-in feature. **1Key Fingerprint Consent Enforcement** 1Kosmos now enforces user consent for fingerprint biometric (1Key) during both enrollment and authentication. When consent enforcement is enabled at the community level, users are mandatorily prompted with a consent screen in the following situations: * No consent record exists for the user. * The user has previously declined consent. * The stored consent version does not match the latest consent document. Consent is version-controlled, and any update to the consent document requires users to re-consent. The following events are generated to support audit and compliance tracking: E\_FINGERPRINT\_CONSENT\_ACCEPTED and E\_FINGERPRINT\_CONSENT\_DECLINED. **Passkey Support for Microsoft Entra Authentication** 1Kosmos now enables users to authenticate into Microsoft Entra using a passkey verified through LiveID biometric, delivering a seamless and secure passwordless login experience. User identity is confirmed through a real-time selfie, ensuring that access is granted only to the verified individual not just a trusted device or stored credential. The 1Kosmos app is deployed through Microsoft Intune MDM and launches directly into the Entra login flow on managed iOS devices, simplifying enterprise rollout. Administrators can configure the complete experience from passkey registration to authentication without making changes to existing Entra infrastructure. **Enhanced OTP Limit Configuration** The OTP limit configuration has been updated with clearer labeling and expanded controls. The setting previously labeled "Limit OTP Requests" has been renamed to "Limit applies to OTP requests generated in the platform", and administrators can now configure both the limit value and the time interval. This update applies to OTP under Authentication > Multi-factor Authentication and to push notifications under Authentication > Passwordless Login > Push Notification Rate Limiting. When rate limiting is triggered, warning messages are displayed with accurate cooldown timers. Retry actions are disabled during the cooldown period and are automatically re-enabled once the cooldown expires. **Device Fingerprint Support in Login Events** Browser-based device fingerprinting is now supported in web applications. The E\_LOGIN\_SUCCEEDED event now includes a device\_fingerprint parameter, enabling enhanced device tracking and supporting adaptive authentication decisions. **Extended OTP Validity Window** The OTP validity window has been increased from 30 seconds to 60 seconds, giving users more time to complete authentication without encountering expired OTP errors. **Login Failure Fallback Redirect** 1Kosmos has introduced an intelligent login fallback experience on the web login page. After a configurable number of consecutive failures on a given authentication method, the interface automatically redirects users to the next available login method. The default failure threshold is 3 consecutive failures. **LiveID as an Authentication Factor in Adaptive Authentication** The Adaptive Authentication journey has been enhanced to include LiveID-based authentication as an additional MFA option. Administrators can now configure the following methods under the MFA Required step of an Adaptive Authentication journey: * LiveID Selfie * LiveID Selfie & Push Notification **Gateway Settings Audit Events** Audit events are now generated when gateway settings are created, updated, or deleted via Settings → Gateway Settings. The events E\_GATEWAY\_CREATED, E\_GATEWAY\_MODIFIED, and E\_GATEWAY\_REMOVED are logged accordingly. For modification events, both the old and new values are captured, excluding sensitive fields such as passwords and authentication client secrets. #### API Enhancements **Passkey Management APIs** New PUT and POST endpoints have been added to store and retrieve FIDO2 passkey data per user. These endpoints support the Azure Passkey Extension integration with Microsoft Entra ID, enabling 1Kosmos to manage passkeys and embed passkey data into OIDC id\_tokens during authentication. *** ### 1.12.08.03 — April 11, 2026 #### What's New **Biometric Consent Enforcement for LiveID Authentication** Introduced a consent framework for biometric authentication (LiveID and fingerprint) to support compliance and user control. Users are prompted for consent during enrollment and login if not previously captured or when consent content is updated. Admins can enable enforcement and manage consent documents from the Consent Management page in AdminX. Key capabilities: * Enable/disable consent enforcement * Create, preview, and update consent documents * View active consent details * Event tracking **Per-User Rate Limiting for OTP and Push Notifications** Per-user rate limits can now be configured for OTP and push notification requests to prevent misuse. New configuration options are available in the AdminX UI for both OTP and push notifications. See Configuring OTP Rate Limiting and Configuring Push Notification Rate Limiting. **Custom Login Page Hyperlink Configuration** Admins can configure a custom hyperlink on the AdminX login page via Branding settings, replacing default mobile app download links. Supports custom display text and optional URL. Falls back to default behavior if invalid or disabled. See Branding. **Auth Proxy Support for Capturing Client IP in VPN Authentication Events** VPN authentication events (E\_LOGIN\_SUCCEEDED, E\_LOGIN\_FAILED) now include the end-user client IP instead of only the Auth Proxy server IP. Community administrators can configure the RADIUS attribute (e.g., Calling-Station-Id) to capture the client IP. > Note: Supported version: goauthproxy\_1.00.08 **Multi-App Push Notification Support** Push authentication now supports multiple mobile apps per community. Users can approve requests from any enabled app, enabling seamless app migration and improved flexibility. **Passkey Manager Branding Enhancements** Passkey Manager now displays application branding for improved usability and trust: * Shows organization logo * Displays usernames instead of IDs * Displays application name instead of server/tenant URL #### API Enhancements * The /assertion/options API now supports optional dguid fallback when username lookup fails, ensuring compatibility with older SDKs. #### Bug Fixes * Fixed missing error message when saving Reset Password settings fails * Fixed duplicate loading of branding images * Fixed email template image duplication and layout issues * Fixed admin-api security vulnerabilities (including RCE) * Fixed RD Gateway authentication failure after PUSH approval * Fixed transformation script execution across services * Fixed an issue where the E\_CA\_STATUSCHANGE event was not triggered when caStatusChangeNotificationsEnabled was set to false, even though the CA status changed * Fixed OIDC invalid\_grant issue for valid codes * Fixed magic link failure due to missing URL shortener config * Fixed application logout issue with custom domains > Note: Customers using IP-based adaptive authentication policies should validate configurations. *** ### 1.12.04.01 — March 14, 2026 #### What's New **Helpdesk Passcode Fallback for Workstation Lockouts** Users who fail Behavioral Authentication + PIN after a configurable number of attempts can now access a fallback authentication journey to regain access to their Windows workstation. Users can contact the Helpdesk to obtain a temporary passcode to log in or reset an enrolled authentication factor (Behavioral Auth or PIN) if enabled. Community administrators must configure the fallback authentication journey and ensure a primary authentication method is set. See Fallback Authentication. > Note: Supported CP Version: 2.2.0.0 **Automatic Push & IVR MFA Triggers for RADIUS Auth Proxy Apps** Previously, users had to manually type keywords like "push" or "ivr" to select their MFA method. The system now automatically triggers Push notifications or IVR phone calls based on pre-configured settings. Community administrators can set a default authentication method in AdminX, eliminating the need for manual input during each authentication attempt. See Auth Proxy for RADIUS Server. > Note: Requires: goauthproxy\_1.00.07 **New Behavior Authentication Events** Two new events added to Event Logs for filtering behavior authentication outcomes: * E\_BEHAVIOR\_AUTH\_SUCCESS — triggered on successful behavior authentication * E\_BEHAVIOR\_AUTH\_FAILED — triggered on failed behavior authentication **Password History Enforcement for Self-Service Password Reset** Community administrators can now enforce password history directly from AdminX, preventing users from reusing previously used passwords during self-service password reset. See Enabling Password History Enforcement Functionality. > Note: Default setting is false. Requires gobroker version 1.09.02 or later. **Improved Camera Messaging During LiveID Login** Camera messaging during LiveID login has been improved to provide clearer guidance when camera-related issues occur: **Enhanced Visibility into Passkey Authentication Activities** Administrators can now monitor these passkey-related events in the AdminX Event dropdown: * E\_PASSKEY\_REGISTRATION\_FAIL * E\_PASSKEY\_VERIFICATION\_FAIL * E\_PASSKEY\_VERIFICATION\_SUCCESS **UI/UX Enhancements** The Adaptive Auth Journey form now includes checkboxes for each authentication method option. Updates are reflected across: Adaptive Authentication → Create New Journey, Add Applications Modal, Linux PAM / Windows MFA pages, and Admin Role Assignment Report. #### Bug Fixes * Fixed an issue where the SAML consent screen displayed incorrect grammar * Fixed an issue where updating an OIDC Service Provider configuration using the PATCH /serviceprovider API temporarily cleared the defined scopes and grant type values in the UI *** ### 1.12.01.01 — February 14, 2026 #### What's New **Certificate Authority Failover Support** Administrators can now configure alternate Certificate Authorities (CAs) for certificate issuance and renewal. If the primary CA is unavailable, certificate generation requests automatically fail over to an alternate CA. See AD Broker. > Note: Requires Go-Broker version gobroker\_1.09.01 or later. **Password History Enforcement During Reset** Password history enforcement is now supported during password reset across all methods — mobile-based, AdminX-initiated, and identity verification resets. See Enforcing Password History. **Password History Enforcement with Minimum Password Age Support** Password history enforcement during password reset and change has been enhanced to support environments with a configured minimum password age in Active Directory. Password changes are no longer blocked by AD minimum password age policies while password history enforcement remains intact. **Android Push Notification Delivery Enhancement** Android push notifications are now sent with high priority for faster delivery, including when devices are in Doze mode. Firebase SDK upgraded to version 9.7.0. **Configurable Messaging Gateway** Admin Console now supports a configurable messaging gateway, enabling customers to use their own SMS, Voice, Email, or IVR service providers by configuring an endpoint in the Admin Console without requiring provider-specific integrations. *** ### 1.12.00.01 — January 10, 2026 #### What's New **Login Page Customization — Hide Username Tab on Desktops** A new branding configuration, Hide username tab on desktops, is now available under Settings > Branding. This allows administrators to disable the Username tab on login screens for desktop devices (screen widths greater than 992px). The Username tab continues to display on mobile and tablet devices. > Note: If Username is set as the default branding method, the login method priority will follow: QR → LiveID Selfie. **Auth Proxy Hostname Failover Support** Admins can now configure Auth Proxy failover with multiple Domain Controllers, including timeout-based fallback, inactive host suppression with auto-reactivation, and forced retries when all hosts are inactive. Auth Proxy generates an E\_HOSTNAME\_STATUSCHANGE event and sends email notifications when host availability changes. See Auth Proxy for LDAP Server. **LiveID Performance Optimization** Improved performance of LiveID capture and authentication on the AdminX login page, reducing the time required to complete the login process. #### API Enhancements * The Create User API now returns descriptive error messages (e.g., "username or email ID already exists") instead of a generic 500 error #### Miscellaneous * The factsSubmitted data in downloaded reports is now flattened instead of appearing as a JSON object * E\_LOGIN\_SUCCEEDED and E\_ACCESS\_DENIED events now display the distance between the user's trusted locations and the actual location during geo-based authentication via a new distanceUserTrustedToMobileMeters attribute #### Bug Fixes * Fixed an issue where the Live ID panel would turn blank after a successful face scan, causing a delay before displaying an error * Fixed an issue where the QR code in the Admin UI fails to render when the qr\_code\_logo branding setting contains an invalid URL format * Fixed an issue where, during LiveID login with a username, the camera would activate but the video feed failed to display on the screen *** ### 1.11.09.01 — December 13, 2025 #### What's New **Password Login Support for Shared Accounts** Users who decline biometric consent on Shared Workstations can now sign in using their primary account password instead of FIDO. A new authentication method, Password for Shared Account Login, has been added under Windows MFA in AdminX. #### Security Fixes * Fixed a vulnerability where certain regex replacements could cause unexpected performance degradation * Enhanced Web LiveID security with a new injection-attack detection module capable of identifying virtual camera feeds, screen captures, and synthetic video sources #### Bug Fixes * Fixed an issue where the UI fails to validate email address format during reset password flow * Fixed an issue where OTPs generated via the generate endpoint did not expire after the configured validity period * Fixed an issue where OTPs for Singapore users were processed with a US (+1) ISD code instead of Singapore (+65) * Fixed an issue where bootstrapping a new community created multiple databases for the default community on repeated requests * Fixed an issue where secondary email and/or phone were not deleted after removing from the user's profile *** ### 1.11.08 — November 15, 2025 #### What's New **PIN Lockout Notifications During LiveID Authentication** The Login page now clearly notifies users when their PIN is temporarily locked after multiple incorrect attempts: "Your PIN has been locked due to multiple incorrect PIN attempts. You can attempt using your PIN in x minutes." The PIN automatically unlocks after the lockout period. Events triggered: * E\_FACTOR\_LOCKED — triggered when the PIN is locked after multiple failed attempts * E\_LOGIN\_FAILED — triggered when a user attempts to log in with a PIN-locked account (reason: "Factor Locked - User PIN") * E\_FACTOR\_UNLOCKED — triggered when the PIN is manually unlocked **New Error Message for Virtual Camera Detection** When a user attempts to authenticate using a virtual camera or injection attack, the system now displays: * Title: Suspicious Activity Detected * Message: You cannot use LiveID for login. Please try another method. **Passkey Events Visible in AdminX** Community administrators can now view Passkey-related events from mobile devices in AdminX Event Logs: * E\_PASSKEY\_REGISTRATION\_FAIL * E\_PASSKEY\_VERIFICATION\_SUCCESS * E\_PASSKEY\_VERIFICATION\_FAIL **Enhanced Forgot Password Experience** The password reset flow now dynamically displays either the Username or Email field on the Forgot Password page based on configuration set under Authentication > Reset Password > Password Reset Identifier. See Resetting Account Passwords. > Note: Changes may take up to 10 minutes to reflect. **New Error Messages for LiveID Enrollment and Authentication Failures** * When LiveID enrollment fails due to a low-risk confidence score: "Suspicious Activity Detected. You cannot register LiveID." * When a user tries to log in using an unenrolled LiveID: "Suspicious Activity Detected. You cannot use LiveID for login. Please try another method." #### API Enhancements * New {{client\_api}}/api/r3/otp/verify API added to verify one-time passcodes with standardized success and error responses #### Bug Fixes * Fixed event log columns not having fixed widths, causing layout issues with long usernames * Fixed the Send Invite button being unresponsive in the AdminX Invites tab * Fixed incorrect error messages when LiveID enrollment failed due to a low-risk confidence score * Fixed push notifications not being received for AdminX login when configurations were added to the internal database * Fixed SSPR password reset flow failing when run in parallel on same or different browser instances * Fixed user token for SSPR session not expiring after 5 minutes as expected *** ### 1.11.06.01 — October 10, 2025 #### What's New **Trigger Password Reset Verification Link from Workday** Users now receive the verification link using email addresses and phone numbers from Workday when Workday is configured as the data source. The UI displays available contact options retrieved from Workday. **Login Screen Customizations** Community Administrators can now customize the login screen's appearance using the Branding page in AdminX: * Background image layout * Sign-in heading text * App download message See Branding. **Updated Alert Prompts During PIN/Typing Pattern Deletion** * When removing a typing pattern: "Are you sure you want to remove \'s typing pattern? \ will no longer be able to use this method for authentication." * When removing a PIN: "Are you sure you want to remove the PIN? \ will no longer be able to use this method for authentication." **New Error Messages for PIN/Typing Pattern Deletion** * PIN deletion fails: "Error removing PIN, try again." * Typing pattern deletion fails: "Error removing typing pattern, try again." #### Bug Fixes * Fixed inconsistent messages for deleting PIN/Pattern * Fixed backend error messages showing in UI during PIN/Pattern deletion * Fixed idvaapi endpoints accepting partially authenticated JWTs (now correctly returns 401) * Fixed oversized banner image in default Admin Onboard email template on mobile devices * Fixed IVR calls triggered via RADIUS authentication ending prematurely * Fixed missing "initiated\_by":"administrator" parameter in E\_BEHAVIOR\_AUTH\_UNENROLLED and E\_USER\_PIN\_UNENROLLED events *** ### 1.11.04 — September 5, 2025 #### What's New **Workday as Source of Truth in SSPR** Community administrators can configure Workday as the source of truth for retrieving employee details during Self-Service Password Reset (SSPR). See Resetting Account Passwords. **Typing Behavior Authentication** 1Kosmos introduces Typing Behavior Authentication — behavioral biometrics that analyzes typing patterns on a keyboard, mouse movements, screen swipes, and device handling to verify identity against the user's unique behavioral profile. Particularly useful in environments requiring PCI DSS-compliant passwords (14–16 characters). Capabilities include: * Secure workstation access * Real-time user validation * Fraud mitigation across digital interactions See Behavior Authentication. **Machine ID Support for Orion in Adaptive Authentication** Machine ID from the Orion Authenticator is now available as a condition in adaptive authentication. Machine IDs can be uploaded manually or in bulk via CSV. An E\_ADAPTIVEAUTH\_CREATED event is triggered as part of this flow. See Adaptive Authentication. **Orion Detection Wait Time** A new setting Orion Detection Wait Time (default: 1500ms, range: 0–60,000ms) is available under Authentication > Orion Authenticator. See Orion Authenticator. **Duplicate Event Insertion Mitigation** A unique index has been added on the combination of event\_name and eventData.event\_id to prevent duplicate event records. Duplicates are logged as "Duplicate record being inserted event\_id and event\_name" every 100 occurrences. **Renamed Devices Tab to Login Options** The Devices tab under My Profile has been renamed to Login Options. **New Parameter in E\_PWDRESET\_FAILED Events** The mode parameter is now included in E\_PWDRESET\_FAILED events. Supported values: email link with otp, email link, idp. **Configurable Profile OTP and TOTP Transition Handling** Support added for separating the profile passcode from the account passcode via a configurable profile\_otp service name in CaaS. > Note: With the latest mobile app update, TOTP has been deprecated. The app now displays only the account OTP. Both types are currently supported during transition. In E\_OTP\_VERIFIED events: totp = time-based OTP, user-generated = account OTP. **New Permission — user.unlink.login\_options** Added to admin permission bootstrap for community\_admin and helpdesk\_admin roles. **HOTP Fix for Fortigate VPN** If multiple OTP validation requests are received with the same request ID within 40 seconds, the system now treats the OTP as valid to avoid unnecessary rejection during closely timed authentication attempts. #### API Enhancements * adminapi updated to include the mode parameter in password reset requests (values: Email link, ID proofing, Mobile app) * /api/v3/rest/{community}/pwdreset updated to include event data when calling the Users Management API #### Security Fixes * Updated OTP behavior for app and app\_ext license keys: API no longer returns OTP in the response; OTP is now sent via Email, SMS, or Voice to verified contact methods * Security check added to verify whether the user exists before generating or sending an OTP * LiveID Selfie service cryptographic enhancements: SHA-512 with salted key derivation, AES-256 with dynamic IVs, PIN hashing upgraded from MD5 to SHA-512 * Google Captcha Added to Invite Resend Actions: Google Captcha has been introduced on the User Profile > Invites and Users > Invites pages to prevent automation attacks. #### Bug Fixes * Resolved an issue where the login page delayed unnecessarily after detecting Orion * Addressed an issue where HOTP user reports were generated without data *** ### 1.11.02 — August 9, 2025 #### What's New **Self-Service Password Reset Using Identity Documents** End users can now reset their passwords by verifying their identity with a valid ID document. This feature is disabled by default. A new fuzzy matching configuration has been introduced in DVCID via maxRetries and matchCommonAliases parameters. See Resetting Account Passwords. **Removed Encrypted Error Code from Unauthorized Error Message** When an account is locked, only the message "You are not authorized" is shown. The encrypted error code has been removed. **Enhanced Hardware Token Syncing Mechanism** First-time token use now prompts users to enter three consecutive passcodes to sync the token. Syncing is required only once per token, even when shared across multiple users. A new Hardware Token Sync Window setting has been added to AdminX. See HOTP Tokens. **Password Reset Support for LDAP v3 Compliant Directories** 1Kosmos now supports generic password reset operations for users in LDAP directories. #### Security Fixes * AdminAPI excludes Access-Control-Allow-Origin: \* in responses * signature\_token added to response body using decrypted request\_id as salt to prevent response tampering #### API Enhancement * The /password\_reset API has been enhanced with code and otp parameters now being optional. #### Miscellaneous * The LDAP Auth Proxy downloaded from AdminX now uses the service\_ext license key. #### Bug Fixes * Fixed "User not Found" error after clicking Edit Profile from the Users page and navigating back * Fixed UI not sending module ID into fetch profile API when username contains an underscore * Fixed user\_id displaying as uid in report events * Fixed alert emails being sent from the initiating user's email address when downloading event reports * Fixed AdminAPI failing to reject CORS preflight OPTIONS requests * Fixed 401 error on Internet Explorer for /nonce/sign API call * Fixed CORS error when importing IDP configuration for 1Kosmos domains * Fixed inability to open user profile when username contains underscore in Entra ID * Fixed Admin Role Assignment Report not including user details in downloaded file * Fixed incomplete Azure AD user list retrieval * Fixed duplicate IDP entity ID returning 200 success instead of an error *** ### 1.11.00 — July 12, 2025 #### What's New **Export and Download Token Data from Hardware Tokens Dashboard** Community administrators or users with the authentication.hardware-tokens.export permission can now use the Export Data button on the Tokens or Users tab to export token data. See HOTP Tokens. > Note: If errors are detected in records during CSV upload or manual text input, no tokens will be added. **FIDO Renamed to Passkeys** The security key has been renamed to Passkeys in the AdminX interface under Adaptive Authentication and Sign In screens. **BlockID Renamed to 1Kosmos** The term "BlockID" has been updated to "1Kosmos" across the AdminX interface and messaging templates. **Enhanced Audit Log Labels on Admin Activity Page** User-friendly names now display for specific audit log events: * E\_ADAPTIVEAUTH\_CREATED → Adaptive Auth Journey was created * E\_ADAPTIVEAUTH\_DELETED → Adaptive Auth Journey was deleted * E\_ADAPTIVEAUTH\_MODIFIED → Adaptive Auth Journey was modified * E\_SESSIONS\_TERMINATED → User Sessions were terminated * E\_TOKEN\_LIST\_EXPORTED → Token list was exported * E\_TOKEN\_ASSIGNMENT\_EXPORTED → Token assignment list was exported #### Security Fixes * AdminAPI no longer returns wildcard (\*) in Access-Control-Allow-Origin HTTP header * Generic error messages now shown on UI to prevent disclosure of sensitive internal information #### Miscellaneous * E\_ROLE\_CHANGED event now displays the role\_changed\_to parameter when a user's role is changed * Session expiry events now logged at INFO level instead of ERROR * User's unique object SID is now included in the certificate subject name for certificate requests #### Bug Fixes * Fixed issue where multiple users assigned a token bypassed validation for subsequent entries * Fixed users with Custom Role unable to access Authentication and Reports menu items * Fixed the dguid field returning actual dguid instead of mapped email ID in fetch users API response *** ### 1.10.19 — June 14, 2025 #### What's New **HOTP-Based Hardware Token Authentication** 1Kosmos now supports HOTP-based authentication with hardware tokens. Unlike time-based methods, HOTP is event-driven — generating a new OTP only when triggered by the user's action. Each OTP is unique and valid until used, making it reliable in offline or unsynchronized environments. See HOTP Tokens. **SAML Assertion Encryption** A new Encryption for SAML Assertion section has been introduced under the Advanced Options tab when configuring SAML applications. Supported algorithms: * Encryption Algorithm: RSA and AES 256 CBC * Key Transport Algorithm: RSA OAEP See SAML Application Integrations. **Security Fix — Anti-Automation on Invite Pages** To prevent brute-force and enumeration attacks, reCAPTCHA has been integrated on the Invite User (Passwordless) page. > Note: The following wildcard characters are not supported when fetching user details using the fetch\_single\_user\_by\_username API: ?, %, \*, \[], {}, #, !, ,, , /, ^, $ #### Miscellaneous * E\_USER\_CONSENT event now displays Consent status regardless of whether the user accepts or rejects consent * When OTP template is configured in a non-English language, users receive SMS in that specified language * ECDSA has been disabled for the following APIs when request includes noecdsa=true: Generate OTP, Verify OTP, Generate ACR, Redeem ACR #### Bug Fixes * Fixed application allowing mobile TOTP authentication despite journey configured as Password + Profile OTP * Fixed E\_OTP\_VERIFIED success event being triggered even when an invalid OTP type (e.g., TOTP) is entered *** ### 1.10.18.01 — May 12, 2025 #### What's New **Reset Account Passwords Through AdminX** Community administrators can now define how end users reset forgotten passwords via the new Authentication > Reset Password menu. Options available: * Enable users to reset passwords through AdminX * Enable users to reset passwords through Mobile App See Resetting Account Passwords. > Note: The Enable users to reset passwords through Mobile App setting must be explicitly enabled for mobile resets to function, even if they were previously working. **Terminate Users' Active Sessions via AdminX** Community administrators with the user.revoke-sessions permission can now revoke active sessions — their own or others' — to enhance security. See Terminating User's Active Sessions. **New Authentication Journey — Password + Profile OTP** A new Password + Profile OTP authentication method has been added to the Adaptive Authentication Journey page. Users are first prompted for their password, followed by a verification code (Profile OTP). > Note: The Profile Passcode option appears on the Choose an authentication method screen only when multiple OTP options are enabled for the user journey. #### Bug Fixes * Fixed user authentication failures via password or OTP when Kafka pods were down * Fixed error message "allowed is not allowed" when administrator creates or updates transformation script * Fixed license.json file not containing licenseKey details when a new broker is added using the same licenseKey as an existing broker * Fixed typo in message shown upon clicking Download for Login Activity Report *** ### 1.10.17 — April 12, 2025 #### What's New **Geo-Based Access Restriction** 1Kosmos now offers the ability to restrict user access if they are not within the allowed radius of their trusted locations. Community administrators can configure this geo-based restriction rule under Authentication > Adaptive Authentication using the Add New Adaptive Authentication Journey drop-down. Applicable only when end users authenticate via QR codes or push notifications. > Note: Community administrators must ensure the users' AD attribute carrying the trusted location is mapped to the trustedLocation BlockID attribute. See Restricting Access Based on Geolocation. **Forced Re-Authentication for Service Provider Applications** Community administrators can now force re-authentication when accessing specified SAML/OIDC Service Provider applications. The new Force Re-authentication setting is available under Applications. Disabled by default. See SAML Application Integrations. #### Bug Fixes * Fixed an issue where users received an 'Access Denied' message when accessing SAML SSO applications, despite the SAMLResponse being marked as Success. *** ### 1.10.16.01 — March 15, 2025 #### What's New **Bypassing Authentication for Specific Applications (Grant Access)** A new Grant access action has been added under the Decision section when creating adaptive authentication journeys. If selected, choosing an application is mandatory. Recommended for low-risk applications within a corporate network. > Note: Authentication cannot be bypassed for AdminX. See Adaptive Authentication. **Missing Email Error Message for Report Downloads** When a user attempts to download a report without an email address on their profile, the UI now validates and displays an appropriate error. **Standardized Error Responses for User Access** To prevent user enumeration, all user-state error messages now display a generic response with an encrypted ECDSA error code: *** ### 1.10.15 — February 21, 2025 #### What's New **Configuring Authentication Journeys for Windows Workstation MFA Agent** Administrators can now create, edit, or delete adaptive authentication journeys for Windows Workstation MFA Agent through AdminX under Authentication > Adaptive Authentication. Supported journey types: Password only, Push, QR, FIDO, Any OTP, Password + Push, Password + Any OTP, Password + FIDO, FIDO + Shared Account. Events captured: * E\_ADAPTIVEAUTH\_MODIFIED * E\_ADAPTIVEAUTH\_CREATED * E\_ADAPTIVEAUTH\_DELETED See Windows Workstation MFA Agent. **Customizing QR Code Design** The Branding page now allows administrators to upload a custom QR code logo (PNG or JPG, less than 10KB, recommended size 35px x 35px). See Branding. #### Bug Fixes * Fixed an invalid Orion authenticator icon displaying on other users' profiles. *** ### 1.10.14.01 — January 16, 2025 #### What's New **Kerberos Authentication** Community administrators can now specify which users can authenticate using Kerberos. Configure Kerberos Single Sign On under Directory > Directory Integrations > Advanced Configuration. New authentication journey options: * Kerberos * Kerberos + Push * Kerberos + Any OTP See Kerberos Authentication. *** ### 1.10.14 — January 10, 2025 #### What's New **Login Using Passcodes from Other Channels (Already Have a Passcode?)** When the adaptive journey is configured as Password & any OTP, a new Already have a passcode? link appears on the Sign In — Choose an authentication method page. This allows users to bypass generating a new OTP and use a passcode from another channel such as Orion Authenticator. > Note: The username must be configured in the adaptive authentication journey for this link to appear. *** ### 1.10.13.01 — December 14, 2024 #### What's New **End Users Can Manage Phone Numbers** End users can now add or remove their phone numbers directly through the AdminX interface. Community administrators must enable the new Allow users to enroll mobile / landline number setting under Authentication > Multi-factor Authentication > Enroll Phone Number. See Managing My Profile. **Onboard First-Time Login Users Through BlockID App** Upon first-time login with a password, users are prompted to enroll for passwordless access through the BlockID app. Prerequisite: Enable Passwordless Access on BlockID App in Initial Sign in MFA Enrollment policy under Authentication > Enrollment Preferences. See Enrollment Preferences Policy. **Generate Onboarding Invite on Behalf of Another User** Community administrators or helpdesk administrators with the user.generate.qr permission can generate a QR code on behalf of another user to onboard devices in their presence. Required additional permissions for helpdesk admins: users.all-users, users.view-user, users.edit. See User Management. **Skip MFA for LDAP Service Accounts in Auth Proxy** A new Skip MFA for Service Accounts section in Auth Proxy allows community administrators to specify which LDAP service accounts can bypass MFA with just a username and password. See Auth Proxy for LDAP Server. **Enhanced QR Code Design** QR code design has been enhanced for better UX on: Login Page, Enrollment on first time login, Onboarding from My Devices page, and Self-registration. **Onboarding Accounts via Orion Authenticator for Windows** Windows end users can now seamlessly onboard their accounts and generate passcodes through the new Orion Authenticator for Windows agent. See Orion Authenticator. #### What's Deprecated * The Edit Template button in the Preview Invitation section has been removed when sending passwordless invitations * The hyperlink with 1Kosmos has been removed from the footer of the login page *** ### 1.10.12 — November 8, 2024 #### What's New **Helpdesk Admins Can Unlink a Device** Community and Helpdesk administrators can now unlink a user's device when a device is lost, the BlockID app was accidentally uninstalled, or the user has been offboarded. A new user.unlink.device permission is required for Helpdesk administrators. See User Management. **Number Challenge for Push Notification Authentication** To protect against MFA bombing attacks, the Number Challenge feature adds an extra layer of verification during push notification authentication. When enabled, users must select the matching number displayed on their mobile app from the number shown on the login screen. See Passwordless Login. **Removal of QR Code Tab on iOS Devices** On iOS devices, passwordless users now log in with username and push notification. The previous "Login with BlockID" deeplink option has been removed due to inconsistent behavior across apps like Office 365. **Removal of 1Kosmos Hyperlink from Login Page Footer** The @2024 1Kosmos Inc. hyperlink reference has been removed from the login page footer on both UI and mobile browsers. *** ### 1.10.10 — September 27, 2024 #### What's New **Device Details from Orion Agent in Event Logs** The AdminX interface now shows device information where the Orion agent is installed in E\_LOGIN\_SUCCEEDED and E\_LOGIN\_FAILED events: * machine\_name * machine\_id * machine\_domain * machine\_os * machine\_os\_version * machine\_mac\_addr * agent\_version *** ### 1.10.09.02 — August 30, 2024 #### What's New **Orion Authenticator for Mac** A new Orion Authenticator, a desktop-based agent, has been introduced for Mac machines to perform multi-factor authentication. This allows organizations with restrictions on mobile device usage to support smooth account onboarding and passcode generation. **Account OTP on My Profile Page** A new Passcode tab has been introduced under Dashboard > My Profile for displaying the account OTP. The OTP is identical to the Account OTP displayed on the mobile app and is valid for 30 seconds. **Template ID on SMS Gateway** A new whitelistedTemplateId parameter has been added to admin APIs managing messaging templates. Required by specific providers like Sandeshwala & Karix to comply with SMS communications. *** ### 1.10.08.01 — July 30, 2024 #### What's New **Adaptive Authentication Journey for Linux PAM** A new Linux PAM adaptive authentication journey has been introduced in AdminX under the Applications menu. Supports creating custom authentication journeys for specific groups or users logging into Linux servers. Default journey applies to all users. See Linux SSH MFA. **Auth Proxy for RADIUS and LDAP** The go-radius component has been renamed to go-authproxy. Existing RADIUS configurations are replaced by the new Auth Proxy configuration under Applications. Supports Push, IVR, and passcodes for Windows. See Auth Proxy for RADIUS Server and Auth Proxy for LDAP Server. **Enhanced User Experience on Login and My Profile Pages** Skeleton loading images have been added to both Login and My Profile pages for improved visual feedback during page load. *** ### 1.10.07 — July 5, 2024 #### What's New **Enrollment Policies for First-Time Login Users** The new Enrollment Preferences tab under Authentication allows first-time login users to enroll their mobile or landline number for MFA methods such as SMS OTP or voice OTP. See Enrollment Preferences. **Username Aliases** Community administrators can now add up to eight username aliases for users using the Manage Username Aliases button on the Profile Information page. Aliases can be used to log into: AdminX, Linux/Mac/Windows Credential Provider, Radius Applications, and Step-up OIDC. > Note: 1Kosmos supports aliases as {aliases: {alias1-8}} during SAML/OIDC claim mapping. See User Management. **Disclaimer Message on AdminX Login Page** Community administrators can configure a disclaimer message to display at the bottom of the AdminX sign in page via Settings > Branding. See Branding. **Reserved Attributes Section in BlockID Attributes** A new Reserved Attributes section has been added to Settings > BlockID Attributes. *** ### 1.10.04 — May 9, 2024 #### What's New **Multiple Hostname/IP Support for LDAP/AD Connections** 1Kosmos now supports multiple hostnames/IP addresses for each LDAP/AD connection, with configurable failover. When the primary host becomes unavailable, BlockID automatically fails over to another hostname/IP. A new Failover Support section has been introduced when creating a directory connection. Administrators receive email notifications when host status changes via the Hostname status change notifications setting under Advanced Configuration. *** ### 1.10.03 — April 25, 2024 #### What's New **Admin Role Assignment Report** Community administrators can generate a report of all users with privileged roles (community administrator and helpdesk administrator). The downloaded CSV contains a list of all users with a particular role. See Admin Role Assignment Report. **Detect Password Expiry at Login** AD users with expired passwords now see the error: "Your password has expired. Please contact your administrator." Requires AD broker version 1.08.02. **Authentication Policies for Devices (Health Agent)** The 1Kosmos health agent transmits device information at login. Administrators can define policies based on machine domain and machine name to allow or deny access from specific devices. *** ### 1.10.01 — March 1, 2024 #### What's New **External Identity Provider (IdP) Support** 1Kosmos now allows configuring a third-party Identity Provider (Ping, Okta, Azure, ADFS) for specific users based on a routing policy. Setup steps: * Set up 1Kosmos as a SAML Service Provider with the IdP * Create a new Identity Provider configuration within 1Kosmos * Upload the federation metadata file from the IdP * Set up users in the IdP user store or connect to an existing directory * Configure a routing policy for which users authenticate with the IdP New features include: * Manage new IDP: create or edit external IDP configuration * Delete an External IDP: removes configuration and any users in the IDP user store * Create users in the IDP user store * Manage routing policy: based on usernames, groups, or route all IDP user store users * Login experience: user is redirected to the IDP SSO URL when conditions are matched #### Improvements * Users with userAccountControl 1049088 (Enabled and Not Delegated) and userAccountControl 520 (HOMEDIR\_REQUIRED and NORMAL\_ACCOUNT) status are now recognized as active and allowed to authenticate. #### Bug Fixes * Fixed a bug that caused the website not to render when local storage is restricted. *** ### 1.10.00 — February 10, 2024 #### What's New **Email Template Personalization — Last Name Variable** Email Templates for self-invitation passwordless onboarding now support {{Lastname}} as a variable. **Font Update — Work Sans** Switched from Adobe fonts (cloud-hosted) to Work Sans (hosted within 1Kosmos CDN) to avoid whitelisting requirements for customers. *** ### 1.09.16 — January 27, 2024 #### What's New **Adaptive Authentication Journeys** Adaptive Auth Journeys allow administrators to build authentication journeys based on the following conditions: Supported decisions: Rules: * If a user matches multiple journeys, all matching methods are presented * If any matching journey contains Deny Access, access is automatically denied * If no journey matches, the default policy's methods are presented **New .wellknown Endpoint for Machine Information** When machine information is available via the health agent, a new .wellknown endpoint collects machine information on the AdminX login page. The E\_LOGIN\_SUCCEEDED event now contains a list of all facts evaluated at time of authentication. #### Improvements * Resolved an issue on IE that prevented the Help Button from rendering on the login page. *** ### 1.09.15 — January 13, 2024 #### What's New **New E\_ROLE\_CHANGED Event** A new event E\_ROLE\_CHANGED has been introduced to capture an audit log whenever a user's role is elevated or downgraded. #### Improvements * Minor updates to the license.json file produced by the Directory broker to include the tenant DNS. *** ### 1.09.14 — December 9, 2023 #### Improvements and Bug Fixes * The analytics dashboard now allows downloading a Unique Users report. Hover over the Unique users count on the analytics dashboard to download. * Customization of messaging templates for emails/text messages is now available for: User onboarding, Email verification, delivering passcodes, and more. *** ### 1.09.14.01 — December 7, 2023 #### Security Fixes and Bug Fixes * Injection of malicious scripts into email templates is now blocked, reducing XSS attack risk * POST/users/find API now limited to returning a maximum of 2 users to prevent data overexposure * The escapeXSS function upgraded with stricter measures to prevent XSS injection in messaging templates *** ### 1.09.13 — October 19, 2023 #### What's New **User Lockout** Community Administrators and Help Desk Administrators can now lock a user indefinitely or for a defined period. Locked users cannot authenticate into AdminX or web applications. Locked users can also be unlocked immediately. **RADIUS Server Configuration** Administrators can now manage RADIUS server configuration within AdminX. Allowed authentication methods: * Login with Push * Login with Password & OTP * Login with OTP & Password * Login with OTP The RADIUS Server is available for Windows, Linux, and Darwin as a command-line tool, preconfigured with the appropriate license keys and community ID. #### Improvements and Bug Fixes * Updated UX during authenticator onboarding from the user profile * Added ability to request user invites to a secondary email * Get user authorizations from the user token instead of making additional API calls *** ### 1.09.12 — September 21, 2023 #### What's New **New SMS Gateway — Coalesce** Introduced support for Coalesce to send text messages when delivering OTPs or invites for passwordless onboarding. **OneSpan Hardware Token Support** Introduced support to configure OneSpan Server within the AdminX control plane. Administrators can allow or disallow OneSpan authentication tokens as a login method and test their OneSpan server configuration. **Manage AdminX Session Time** Support added to manage the AdminX session time from within the control plane. #### Improvements and Bug Fixes * When an IDP certificate is uploaded, the key size and algorithm from the signing certificate is now used to sign the SAML response * Fixed an issue on Internet Explorer 11 where the login page was caching GET requests, causing authentication to fail * Fixed the recorded number of devices linked to an account * Added support for two additional attributes when configuring Gupshup as an SMS Provider *** ### 1.09.11.01 — September 7, 2023 #### What's New **Enable or Disable FIDO Logins** Community Administrators can now enable or disable FIDO logins for all users within their community, including whether to allow security keys or platform authenticators (Mac TouchID, Windows Hello). **Allowed Security Keys** Administrators can upload the metadata file of any desired security key brand. Once uploaded and enabled, end users can enroll keys from that brand for authentication. **Reset Password on Next Login** Enforces password resets for Active Directory users mandated to change their password on next login. Users provide their current and new password, followed by an OTP. #### Improvements and Bug Fixes * Support for generating SHA1 and SHA256 self-signed certificates; fixed signing algorithm detection from uploaded certificates * Updated Salesforce SOAP API to latest version and fixed XML parser compatibility * Resolved error codes A00006 and A00008 appearing on the login page *** ### 1.09.10.01 — August 31, 2023 #### Bug Fixes * Improved security around the access code sent to users for onboarding their device for passwordless logins. *** ### 1.09.10 — August 17, 2023 #### What's New **Gupshup Gateway Support** Added support for Gupshup gateway to send text messages to users. #### Improvements and Bug Fixes * Fixed a bug allowing QR code to render appropriately on a Cisco AnyConnect embedded browser * Last Login Report now displays the number of active users per directory (active = at least one authentication in the last 30 days) * Fixed logging to ensure journey ID and request ID are consistently available for troubleshooting * Widespread use of caching to improve API throughput *** ### 1.09.09 — July 27, 2023 #### What's New **New Passwordless Login Options** * Administrators can define how many devices a single user can onboard for passwordless authentication * When the maximum is reached, administrators can choose to allow the new device while deleting the oldest linked device, or reject the new device **Disable Passwordless Login Options** Administrators can now disable passwordless login options entirely. When disabled, users are no longer presented with passwordless login options. **QR Code Refresh When Idle** QR codes on the login page no longer auto-refresh after 5 minutes of inactivity. Users see a Refresh button to manually generate a new QR code. **API Failure on Login Page** When required APIs fail to load, the interface now displays a refresh button with error codes instead of an indefinite loading message. #### Improvements * Helpdesk Administrators now have additional permissions to download reports * SMS Gateway Settings updated for Infobip to support an additional smstemplateid parameter * Last Login Report now displays the time of last login in the browser's local timezone * Updated design for Active Directory Advanced Configuration tab, Multi-factor Authentication page, and a new Passwordless Login page *** ### 1.09.08 — June 29, 2023 #### What's New **Twilio Support for Voice Gateways** Administrators can leverage Twilio to configure SMS and Voice gateways. The Voice gateway delivers spoken one-time passcodes via phone call. **Last Login Report** Administrators can now view a report combining information about all users in a directory, including last login date. The report helps identify inactive users over 30, 60, or 90 days. **Windows Broker — X.509 Certificates** The new Windows broker for Active Directory can issue X.509 certificates for the user at the time of enrollment. Certificates are stored on the user's device and used for passwordless workstation login. #### Improvements and Bug Fixes * Adjusted login page to display QR code without scrolling (tested on Zscaler) * Fixed a bug preventing changes to password policy in the internal DB * Fixed a bug preventing users on Pixel 6 devices from completing phone verification *** ### 1.09.07 — June 22, 2023 #### What's New **Login Passcode via Voice** Administrators can now enable users to receive one-time passcodes through a phone call. *** ### 1.09.06 — June 8, 2023 #### What's New **Windows Broker for Active Directory** Administrators can now deploy the Windows broker on-premise to connect the 1Kosmos platform with Active Directory. Designed as a long-running Windows service, it can be managed from the control plane. #### Improvements * Administrators can now modify OIDC applications including logo, scopes, redirect URLs, and more. *** ### 1.09.05 — June 1, 2023 #### What's New **Broker Log File Settings** The control plane now provides settings for fine-grained control of: * Broker Log File Size: Maximum size before rotation (default: 10MB) * Broker Log File Rotation Count: Maximum number of log files retained (default: 10) **Track Off-Boarded Devices** AdminX now produces the E\_DEVICE\_DELINKED event when a user removes their device from their Profile page or the mobile app. *** ### 1.09.04 — May 18, 2023 #### What's New **Self-Service Passwordless Onboarding from User Profile** Administrators can now enable or disable the ability for end users to pair their devices as authenticators from the My Profile page. #### Improvements and Bug Fixes * Branding settings now allow administrators to customize the footer color on the login page. *** ### 1.09.03 — May 11, 2023 #### What's New **Help Button on Login Page** Administrators can add a help button on the login page to present phone numbers, FAQs, or troubleshooting tips. Help content is authorable using HTML templates in branding settings. **Account Lockout for Incorrect OTP Attempts** Administrators can configure the number of incorrect one-time passcodes allowed before an account is locked. Accounts auto-unlock after a configurable lockout duration. #### Improvements and Bug Fixes * Removed links to expired reports on the Report Downloads page * Fixed phone number verification on Safari browser * Clicking on the New Devices graph now shows a summary of all new devices enrolled * Added E\_REPORT\_REQUESTED and E\_REPORT\_GENERATED events for audit *** ### 1.09.02 — April 13, 2023 #### What's New **Passwordless Onboarding Configurability** Community administrators can now allow or disallow users to self-onboard using the Request an Invite self-service page. #### Improvements and Bug Fixes * Resolved form submission errors when blank spaces were included in form entries *** ### 1.09.01 — March 23, 2023 #### What's New **Analytics Dashboard** Community administrators can now see a summarized report of usage across the community: * Counts: Successful Logins, Unique Logins, Devices Enrolled, Failed Logins * Visualizations: Successful Authentications (by method), Devices Enrolled, Applications Usage, Failed Logins (by reason) **Reports Download** Downloading reports as CSV files is now supported for all Login Activity Reports and Event Logs. Downloaded reports remain pending until records are compiled, then an email with download link is sent. Links are available for 7 days. #### Improvements and Bug Fixes * Administrators can now receive email notifications when AD or LDAP brokers disconnect from the tenant. *** ### 1.09.00 — February 27, 2023 #### What's New **Step-Up with TOTP** Authentication policies now support Step-Up with Trusted One Time Passcodes (TOTP) using the BlockID Mobile App, triggered by user geolocation or IP address. #### Improvements and Bug Fixes Password Reset Events * E\_PWDRESET\_SUCCEEDED: Captured any time a user successfully resets their password * E\_PWDRESET\_FAILED: Captured any time a user fails to reset their password, with reasons included Worldwide Geolocation Support * Geolocation Authentication Rules now support all countries worldwide. *** ### 1.08.00 — February 2, 2023 #### Early Access **Geolocation Authentication Rules** Administrators can define authentication policies based on geolocation. Depending on location, access can be denied, allowed with all MFA options, or restricted to LiveID only. Multiple geolocation rules can be set simultaneously. Initially supported for USA and India users. #### What's New **Access Denied Reports** Access-denied reports are now available in the Reports section in AdminX, showing IP addresses and location data for denied users. #### Improvements and Bug Fixes * Updated reporting service to ensure no service interruption occurs when errors are encountered while generating events. *** ### 1.07.06.01 — January 5, 2023 #### What's New **Configurable OTP Authentication** Administrators can enable or disable OTP authentication and define which channels (email, SMS, or both) can be used. **Administrator Activity Event Logs** New events added: E\_DIRECTORY\_ADDED, E\_DIRECTORY\_MODIFIED, E\_DIRECTORY\_REMOVED, E\_DIRECTORY\_BROKER\_ENABLED, E\_DIRECTORY\_BROKER\_DISABLED, E\_DIRECTORY\_BROKER\_DELETED, E\_DIRECTORY\_BROKER\_MODIFIED, E\_DIRECTORY\_ATTRIBUTE\_MODIFIED, E\_DIRECTORY\_ATTRIBUTE\_DELETED, E\_DIRECTORY\_ADVANCED\_CONFIGURATION\_MODIFIED, E\_IDP\_CONFIGURATION\_MODIFIED. #### Improvements and Bug Fixes * The SMS gateway Sender Name field now supports alphanumeric values * Email verification is performed before allowing account creation when an email already exists *** ### 1.07.04 and v1.07.05 — December 16, 2022 #### Early Access **IP Address Rules** Administrators can define and manage policies that allow or deny user access based on IP address. **Password Reset** Administrators can allow users to reset their account password from the BlockID Mobile App. Requires the latest version of the AD broker and BlockID Mobile App. **Login Activity Report** A new Login Activity Report is available under Reports, displaying all applications users logged into and the 2FA method used. #### Security Fixes * Fixed an issue that would have allowed identification of the underlying technology stack * Obfuscated all references to user email or phone number in authenticated API queries * Locked down a potential XSS attack vector *** ### 1.07.03 and v1.07.04 — November 17, 2022 #### Early Access **Primary Authentication Factors for BlockID Mobile App** Administrators can choose which authentication factor is supported during authentication approval: Touch ID/Face ID, PIN, or LiveID. **Fallback Authentication Factors** In scenarios where devices do not support LiveID or Touch ID/Face ID, a fallback mechanism can be enabled. **Web SDK for Step-Up Authentication** Third-party websites can use the 1Kosmos Web SDK to trigger OIDC-based step-up authentication with Email OTP, SMS OTP, or LiveID. #### What's New **Roles — Helpdesk Admin** A new Helpdesk Admin role has been introduced. Ideal for users who need insight into community activity and troubleshooting user onboarding errors. **Community Administrator Access Using Corporate Credentials** Users from AD, LDAP, and Azure AD can now be promoted to community administrators without a separate account. *** ### 1.07.02 and v1.07.03.02 — October 20, 2022 #### What's New **Forgot Password** End users can now reset their password via a magic link sent to their verified email address, followed by a one-time code sent to their verified phone number. **Save and Retrieve Consent** User consent for information sharing with Service Providers is now recorded and reused on subsequent sign-ins to avoid repeated consent prompts. #### Improvements * Sessions now capture the authentication methods used: password, otp, uwl, fido, phone\_verified, email\_verified. AAL is determined from these session tokens. *** ### 1.07.01 and v1.07.00 — September 12, 2022 #### Early Access **IP Address-Based Authentication** * Allowed IPs list: authentication allowed only from listed IPs * Restricted IPs list: authentication denied from listed IPs * Only one rule can be active at a time to avoid conflicts **Access Denied Reports** Reports now show a list of all IPs denied access with details including user agent, IP address, and time of access. #### Improvements * AD and LDAP integrations now support LDAP Query Filtering via regex expression * New LDAP filters added to Reports: E\_PUSH\_REQUESTED, E\_OTP\_GENERATED, E\_OTP\_VERIFIED, E\_OTP\_REQUESTED, E\_USER\_CONSENT *** ### 1.07.00 and v1.06.05 — August 18, 2022 #### What's New **Session Revalidation for Enhanced Security** Session revalidation logic added to verify that the current application session remains valid for active users who close and re-open their browser window. **User URN Identifier** User URNs introduced to uniquely identify users across multiple tenants, communities, and directories. #### Early Access **Kerberos Single Sign-On** When Kerberos is enabled, the AD broker allows users on domain-joined machines within the corporate network to authenticate to all web apps without a username or password after initial domain sign-on. Separate communities within the tenant can have Kerberos enabled for different AD instances. #### Improvements * Performance improvements to stop polling when user switches to the "Login with Username" tab * Signing certificate validation updated to verify .pem format and certificate headers * Session expiration message removed when forced authentication is enabled #### Bug Fixes * AD Broker download page now displays the version of the broker being downloaded. #### Deprecated * Encryption Certificate and Encryption Algorithm fields removed from Service Providers App Configuration. *** ### 1.06.05, v1.06.05.01, and v1.06.04.02 — July 23, 2022 #### What's New **Azure AD User Stores** Added support for connecting to Azure AD as a user store. **Phone Number Verification** User phone numbers are now required to be verified during enrollment. **FIDO Authentication During Enrollment** Users can now set up FIDO authentication during enrollment. #### Early Access **OIDC Application Support** OIDC/OAuth applications are now supported for SSO flows, scope selection, and using information from the Authorization Provider to configure the relying party. #### Version Changes * NodeJS upgraded from version 12.20.1 to version 16.15.0 LTS. #### Bug Fixes * Fixed rendering of the IdP metadata URL. *** ### 1.06.03.05 and v1.06.04.02 — June 22, 2022 #### What's New **Customizable Username Field on Login Pages** Tenant and community administrators can configure the label text for the username field on the login page. **Specify Primary Login Method** Administrators can configure which default login screen users land on — QR code for passwordless login, or a username and password. *** ### 1.06.04 — May 26, 2022 #### What's New **Session Invalidation Logic** Added proper session invalidation and purging of user attributes after user logout. *** ### 1.06.03 — April 14, 2022 #### What's New **Passwordless Login for Mac and Windows** Support for Passwordless Login for Mac and Windows Workstations to Active Directory via Smart Card Certificate enrollment. **New Active Directory Configuration Settings** * Allow AD users to turn on/off passwordless sign-in to workstation using BlockID mobile app * Allow AD users to turn on/off SCEP Configuration for the AD Broker *** ### 1.06.02 — March 17, 2022 #### What's New **Super Admin Role** Super admins within a tenant can now enable Self Registration for Customer/Citizen Product lines. *** ### 1.06.00 and v1.06.01 — February 24, 2022 #### What's New **Preferred User Stores** Administrators can define which directory users should be discovered from. Up to three directories can be set as preferred user stores. **IPFS Image Store** Every community is provided an IPFS location to store images for email templates and login pages. **IdP Metadata Download** Support added to download SAML metadata of the configured IdP and access it via a dedicated URL. **Auto-Generate Signing and Encryption Certificates** Ability to auto-generate signing and encryption certificates for SAML IdP. (Recommended for lower environments only.) **Signing Algorithm Support for SAML Certificates** Support for RSA-SHA1 and RSA-SHA256 signing algorithms for SAML certificates. *** ### 1.05.01.01 — January 24, 2022 #### Improvements **Customizable User Invite Expiration Time** Community administrators can now set the invitation expiration time when a user requests a passwordless login invite. *** ### 1.05.01 — January 6, 2022 #### What's New **HTTP POST Support for SAML Integration** Enhanced application integration capability to support SAML using HTTP-POST, including end-to-end testing with Office 365 Desktop Client, Android, and iOS native apps. **Email and SMS Gateway Management** * Configure SMTP gateways for outgoing emails * Configure SMS gateways (Karix, Twilio, Infobip) for outgoing text messages * Configure backup gateways with round-robin support #### Early Access **FIDO2 Registration and Authentication** * Register multiple security keys and platform authenticators (device biometrics) * Rename and unlink FIDO keys * Authenticate using Windows Hello, Mac TouchID, and Security Keys on Edge, Chrome, Safari, and Firefox #### Bug Fixes * Fixed issues ensuring proper disabling of users to remove linked accounts and devices. *** ### 1.04.02 — November 3, 2021 #### What's New **Secondary Email Support for Onboarding Invites** Passwordless onboarding invites can now be sent to secondary email or text messages. **Login Page Branding** Introduced login page branding with support for uploading logos and modifying background and text colors. **CAPTCHA for Invite Request Pages** Introduced CAPTCHA to protect against DDOS attacks. **Active Directory and LDAP Brokers** Introduced connections to on-premise Active Directory and LDAP user stores via AD and LDAP brokers. Capabilities include: viewing all connected brokers, renaming brokers, downloading the latest broker, and refreshing broker status every 10 seconds. #### Improvements * Ability to edit the profiles of existing AdminX users. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.1kosmos.com/authentication/release-notes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.