Release Notes
Stay current with the latest 1Kosmos updates, new features, improvements, and bug fixes across AdminX, authentication, and identity verification.
2.1.0-r.3 — June 13, 2026
Authentication Features
Authenticate into Microsoft Entra via 1Kosmos Browser Extension
1Kosmos now extends Passkey + LiveID authentication for Microsoft Entra to desktop browsers. Previously available only through the 1Kosmos mobile app on Intune-managed iOS devices, this capability is now delivered through a browser extension on Google Chrome and Microsoft Edge. On first use, users complete a one-time activation flow through AdminX. Subsequent logins automatically redirect users to the authentication workflow, where identity is verified via LiveID biometric before accessing Entra. The extension is available through the Chrome Web Store. For more information, see here.
Restricting Multi-Device Enrollment for Application Access
1Kosmos now introduces device restriction policies enabling administrators to precisely control over how many authentication devices per device type users can enroll, applied by group or individual username. Enrollment limits are enforced automatically, users who reach their limit can continue using existing devices but cannot register new ones until an existing device is removed. For more information, see Configure Device Restriction Policy.
Benefits
Set different enrollment limits for different user groups.
Support privileged access needs without relaxing controls for everyone.
Reduce unauthorized device sprawl from a single, centralized interface.
Enhanced IdP-Initiated SSO with Direct Application Access
Building on IdP-initiated SAML SSO support introduced in the previous release, 1Kosmos now provides a static Access URL for applications configured with IdP-initiated SSO. Administrators can view and copy this auto-generated URL from the application configuration and share it with users or embed it in portals, bookmarks, and launch pages, eliminating the need to navigate to My Apps each time. When a user opens the URL, they are prompted to authenticate if not already signed in and are then redirected directly to the application. If a Relay State is configured, users land at the configured destination after login. If IdP-initiated SSO is disabled or the application is removed, users are redirected to their AdminX profile page.
Filter Admin Activity Reports by Event
Community administrators can now filter and download the Admin Activity Report by event name, making it faster to locate and investigate specific activity across the platform.
Exclude Specific Users from Adaptive Authentication Rules
Adaptive Authentication now supports an is not one of operator for the Username condition. Administrators can define authentication rules by excluding a specific set of users rather than listing every individual the rule should cover, simplifying policy management at scale. For more information, see Configure Adaptive Authentication Journey.
Configure LiveID as an Authentication Factor in Windows MFA
The Adaptive Authentication journey for Windows MFA now supports LiveID-based authentication methods. Administrators can configure LiveID Selfie and LiveID Selfie with Push Notification as authentication factors under MFA Required, enabling stronger biometric-based verification in Windows authentication flows. For more information, see LiveID Selfie.
Detect and Investigate SAML Certificate Failures Faster
1Kosmos now generates an E_ACCESS_DENIED audit event when SAML authentication fails due to an expired or invalid certificate. Previously, these failures occurred silently with no audit trail. Audit logging now covers expired IdP signing certificates, SP request signing certificates, and SP encryption certificates, with a deny_reason field providing details on the specific failure.
Track Device Fingerprint Across Login Events
The device_fingerprint parameter is now included in E_LOGIN_VISITED, E_LOGIN_SUCCEEDED, and E_LOGIN_FAILED events, providing richer device-level context for login activity monitoring and investigation.
Prevent Log Disk Exhaustion with Auth Proxy Log Rotation
AuthProxy now supports automatic log rotation, preventing uncontrolled log growth and disk exhaustion in high-volume authentication environments.
Update 1Kosmos Branding Across Default Templates
Default SMS and email templates have been updated to replace legacy BlockID references with current 1Kosmos branding. Updates include verification code messages, enrollment invitation emails, mobile app references, and email signatures. Customized templates are not affected. Newly provisioned communities will also inherit the latest default templates with refreshed logos and updated content.
API Enhancements
Filter Event Reports via API
A new optional eventName filter has been added to the Reports API, enabling retrieval of records for a specific event type.
Retrieve Authentication Phrases in the User's Native Language
A new optional language parameter has been added to the Random Phrase Fetch API. Phrases for the 1Kosmos Credential Provider UI and Behavioral Authentication are now returned in the user's native language, automatically determined from the Windows OS locale. Supported languages are English, Spanish, Portuguese, French, and German.
Bugs Fixed
Fixed an issue where analytics timed out when event volume exceeded 4 million records.
1.13.00 — May 15, 2026
Authentication Features
IDP-Initiated SAML SSO Support
1Kosmos now supports IDP-initiated SAML SSO, enabling users to launch applications directly from the 1Kosmos platform without requiring a service provider-initiated login flow. A new My Apps section is now available under the user profile, where users can view and access all SAML applications enabled for IDP-initiated login. Users can log in to these applications with a single click, delivering a portal-based SSO experience. Administrators can enable this capability through the SAML configuration by turning on the IDP-initiated login option. An optional Relay State can also be configured to control the post-login redirection experience. If no Relay State is specified, users are redirected to the default landing page of the application. This enhancement simplifies application access while maintaining full compatibility with existing configurations.
Note: This is an opt-in feature and is disabled by default.
External MFA Support for Microsoft Entra ID
1Kosmos can now be configured as an external authentication method for Microsoft Entra ID, enabling organizations to enforce multi-factor authentication without federating their applications. Users authenticate with their primary credentials in Entra ID and are redirected to 1Kosmos as a secondary authentication step. Based on configurable authentication journeys, users can complete additional verification factors — including OTP, push notification, QR code, or FIDO — before being redirected back to Entra ID to access their application. This enables flexible, policy-driven MFA enforcement while preserving the existing Entra ID authentication flow. Community administrators can now configure Microsoft Entra External Authentication Methods (EAM) in a single guided flow — creating an OIDC application and setting up an Adaptive Auth Journey without switching between screens. A new Entra EAM card, identifiable by the Microsoft logo and a Beta tag, has been added to the Add Application section.
Improved Session Handling for Push and QR Authentication
The login experience for Push Notification and QR Code authentication on the AdminX interface has been enhanced to handle explicit user rejection. When a user cancels a sign-in request on their mobile device, the login session is terminated immediately. The user is shown the message "Your login request was cancelled" and redirected appropriately — without waiting for session timeout. An E_AUTH_REQUEST_DENIED event is generated for these scenarios, ensuring accurate audit logging.
Behavioral Authentication for Web Applications
1Kosmos has extended Behavioral Authentication — previously available only in the Windows Credential Provider — to web applications. When enabled, users can select Behavioral Authentication during login and verify their identity based on their enrolled typing pattern, evaluating how they type rather than what they type. This factor is combined with a PIN to complete authentication; the Behavioral Auth + PIN option is available in Adaptive Authentication, eliminating the need for passwords or external devices. The feature provides a consistent authentication experience across platforms, with retry limits enforced and appropriate events (E_LOGIN_SUCCEEDED, E_LOGIN_FAILED) generated.
Note: This is an opt-in feature.
1Key Fingerprint Consent Enforcement
1Kosmos now enforces user consent for fingerprint biometric (1Key) during both enrollment and authentication. When consent enforcement is enabled at the community level, users are mandatorily prompted with a consent screen in the following situations:
No consent record exists for the user.
The user has previously declined consent.
The stored consent version does not match the latest consent document.
Consent is version-controlled, and any update to the consent document requires users to re-consent. The following events are generated to support audit and compliance tracking: E_FINGERPRINT_CONSENT_ACCEPTED and E_FINGERPRINT_CONSENT_DECLINED.
Passkey Support for Microsoft Entra Authentication
1Kosmos now enables users to authenticate into Microsoft Entra using a passkey verified through LiveID biometric, delivering a seamless and secure passwordless login experience. User identity is confirmed through a real-time selfie, ensuring that access is granted only to the verified individual not just a trusted device or stored credential. The 1Kosmos app is deployed through Microsoft Intune MDM and launches directly into the Entra login flow on managed iOS devices, simplifying enterprise rollout. Administrators can configure the complete experience from passkey registration to authentication without making changes to existing Entra infrastructure.
Enhanced OTP Limit Configuration
The OTP limit configuration has been updated with clearer labeling and expanded controls. The setting previously labeled "Limit OTP Requests" has been renamed to "Limit applies to OTP requests generated in the platform", and administrators can now configure both the limit value and the time interval. This update applies to OTP under Authentication > Multi-factor Authentication and to push notifications under Authentication > Passwordless Login > Push Notification Rate Limiting. When rate limiting is triggered, warning messages are displayed with accurate cooldown timers. Retry actions are disabled during the cooldown period and are automatically re-enabled once the cooldown expires.
Device Fingerprint Support in Login Events
Browser-based device fingerprinting is now supported in web applications. The E_LOGIN_SUCCEEDED event now includes a device_fingerprint parameter, enabling enhanced device tracking and supporting adaptive authentication decisions.
Extended OTP Validity Window
The OTP validity window has been increased from 30 seconds to 60 seconds, giving users more time to complete authentication without encountering expired OTP errors.
Login Failure Fallback Redirect
1Kosmos has introduced an intelligent login fallback experience on the web login page. After a configurable number of consecutive failures on a given authentication method, the interface automatically redirects users to the next available login method. The default failure threshold is 3 consecutive failures.
LiveID as an Authentication Factor in Adaptive Authentication
The Adaptive Authentication journey has been enhanced to include LiveID-based authentication as an additional MFA option. Administrators can now configure the following methods under the MFA Required step of an Adaptive Authentication journey:
LiveID Selfie
LiveID Selfie & Push Notification
Gateway Settings Audit Events
Audit events are now generated when gateway settings are created, updated, or deleted via Settings → Gateway Settings. The events E_GATEWAY_CREATED, E_GATEWAY_MODIFIED, and E_GATEWAY_REMOVED are logged accordingly. For modification events, both the old and new values are captured, excluding sensitive fields such as passwords and authentication client secrets.
API Enhancements
Passkey Management APIs
New PUT and POST endpoints have been added to store and retrieve FIDO2 passkey data per user. These endpoints support the Azure Passkey Extension integration with Microsoft Entra ID, enabling 1Kosmos to manage passkeys and embed passkey data into OIDC id_tokens during authentication.
1.12.08.03 — April 11, 2026
What's New
Biometric Consent Enforcement for LiveID Authentication
Introduced a consent framework for biometric authentication (LiveID and fingerprint) to support compliance and user control. Users are prompted for consent during enrollment and login if not previously captured or when consent content is updated. Admins can enable enforcement and manage consent documents from the Consent Management page in AdminX. Key capabilities:
Enable/disable consent enforcement
Create, preview, and update consent documents
View active consent details
Event tracking
Per-User Rate Limiting for OTP and Push Notifications
Per-user rate limits can now be configured for OTP and push notification requests to prevent misuse. New configuration options are available in the AdminX UI for both OTP and push notifications. See Configuring OTP Rate Limiting and Configuring Push Notification Rate Limiting.
Custom Login Page Hyperlink Configuration
Admins can configure a custom hyperlink on the AdminX login page via Branding settings, replacing default mobile app download links. Supports custom display text and optional URL. Falls back to default behavior if invalid or disabled. See Branding.
Auth Proxy Support for Capturing Client IP in VPN Authentication Events
VPN authentication events (E_LOGIN_SUCCEEDED, E_LOGIN_FAILED) now include the end-user client IP instead of only the Auth Proxy server IP. Community administrators can configure the RADIUS attribute (e.g., Calling-Station-Id) to capture the client IP.
Note: Supported version: goauthproxy_1.00.08
Multi-App Push Notification Support
Push authentication now supports multiple mobile apps per community. Users can approve requests from any enabled app, enabling seamless app migration and improved flexibility.
Passkey Manager Branding Enhancements
Passkey Manager now displays application branding for improved usability and trust:
Shows organization logo
Displays usernames instead of IDs
Displays application name instead of server/tenant URL
API Enhancements
The /assertion/options API now supports optional dguid fallback when username lookup fails, ensuring compatibility with older SDKs.
Bug Fixes
Fixed missing error message when saving Reset Password settings fails
Fixed duplicate loading of branding images
Fixed email template image duplication and layout issues
Fixed admin-api security vulnerabilities (including RCE)
Fixed RD Gateway authentication failure after PUSH approval
Fixed transformation script execution across services
Fixed an issue where the E_CA_STATUSCHANGE event was not triggered when caStatusChangeNotificationsEnabled was set to false, even though the CA status changed
Fixed OIDC invalid_grant issue for valid codes
Fixed magic link failure due to missing URL shortener config
Fixed application logout issue with custom domains
Note: Customers using IP-based adaptive authentication policies should validate configurations.
1.12.04.01 — March 14, 2026
What's New
Helpdesk Passcode Fallback for Workstation Lockouts
Users who fail Behavioral Authentication + PIN after a configurable number of attempts can now access a fallback authentication journey to regain access to their Windows workstation. Users can contact the Helpdesk to obtain a temporary passcode to log in or reset an enrolled authentication factor (Behavioral Auth or PIN) if enabled. Community administrators must configure the fallback authentication journey and ensure a primary authentication method is set. See Fallback Authentication.
Note: Supported CP Version: 2.2.0.0
Automatic Push & IVR MFA Triggers for RADIUS Auth Proxy Apps
Previously, users had to manually type keywords like "push" or "ivr" to select their MFA method. The system now automatically triggers Push notifications or IVR phone calls based on pre-configured settings. Community administrators can set a default authentication method in AdminX, eliminating the need for manual input during each authentication attempt. See Auth Proxy for RADIUS Server.
Note: Requires: goauthproxy_1.00.07
New Behavior Authentication Events
Two new events added to Event Logs for filtering behavior authentication outcomes:
E_BEHAVIOR_AUTH_SUCCESS — triggered on successful behavior authentication
E_BEHAVIOR_AUTH_FAILED — triggered on failed behavior authentication
Password History Enforcement for Self-Service Password Reset
Community administrators can now enforce password history directly from AdminX, preventing users from reusing previously used passwords during self-service password reset. See Enabling Password History Enforcement Functionality.
Note: Default setting is false. Requires gobroker version 1.09.02 or later.
Improved Camera Messaging During LiveID Login
Camera messaging during LiveID login has been improved to provide clearer guidance when camera-related issues occur:
Enhanced Visibility into Passkey Authentication Activities
Administrators can now monitor these passkey-related events in the AdminX Event dropdown:
E_PASSKEY_REGISTRATION_FAIL
E_PASSKEY_VERIFICATION_FAIL
E_PASSKEY_VERIFICATION_SUCCESS
UI/UX Enhancements
The Adaptive Auth Journey form now includes checkboxes for each authentication method option. Updates are reflected across: Adaptive Authentication → Create New Journey, Add Applications Modal, Linux PAM / Windows MFA pages, and Admin Role Assignment Report.
Bug Fixes
Fixed an issue where the SAML consent screen displayed incorrect grammar
Fixed an issue where updating an OIDC Service Provider configuration using the PATCH /serviceprovider API temporarily cleared the defined scopes and grant type values in the UI
1.12.01.01 — February 14, 2026
What's New
Certificate Authority Failover Support
Administrators can now configure alternate Certificate Authorities (CAs) for certificate issuance and renewal. If the primary CA is unavailable, certificate generation requests automatically fail over to an alternate CA. See AD Broker.
Note: Requires Go-Broker version gobroker_1.09.01 or later.
Password History Enforcement During Reset
Password history enforcement is now supported during password reset across all methods — mobile-based, AdminX-initiated, and identity verification resets. See Enforcing Password History.
Password History Enforcement with Minimum Password Age Support
Password history enforcement during password reset and change has been enhanced to support environments with a configured minimum password age in Active Directory. Password changes are no longer blocked by AD minimum password age policies while password history enforcement remains intact.
Android Push Notification Delivery Enhancement
Android push notifications are now sent with high priority for faster delivery, including when devices are in Doze mode. Firebase SDK upgraded to version 9.7.0.
Configurable Messaging Gateway
Admin Console now supports a configurable messaging gateway, enabling customers to use their own SMS, Voice, Email, or IVR service providers by configuring an endpoint in the Admin Console without requiring provider-specific integrations.
1.12.00.01 — January 10, 2026
What's New
Login Page Customization — Hide Username Tab on Desktops
A new branding configuration, Hide username tab on desktops, is now available under Settings > Branding. This allows administrators to disable the Username tab on login screens for desktop devices (screen widths greater than 992px). The Username tab continues to display on mobile and tablet devices.
Note: If Username is set as the default branding method, the login method priority will follow: QR → LiveID Selfie.
Auth Proxy Hostname Failover Support
Admins can now configure Auth Proxy failover with multiple Domain Controllers, including timeout-based fallback, inactive host suppression with auto-reactivation, and forced retries when all hosts are inactive. Auth Proxy generates an E_HOSTNAME_STATUSCHANGE event and sends email notifications when host availability changes. See Auth Proxy for LDAP Server.
LiveID Performance Optimization
Improved performance of LiveID capture and authentication on the AdminX login page, reducing the time required to complete the login process.
API Enhancements
The Create User API now returns descriptive error messages (e.g., "username or email ID already exists") instead of a generic 500 error
Miscellaneous
The factsSubmitted data in downloaded reports is now flattened instead of appearing as a JSON object
E_LOGIN_SUCCEEDED and E_ACCESS_DENIED events now display the distance between the user's trusted locations and the actual location during geo-based authentication via a new distanceUserTrustedToMobileMeters attribute
Bug Fixes
Fixed an issue where the Live ID panel would turn blank after a successful face scan, causing a delay before displaying an error
Fixed an issue where the QR code in the Admin UI fails to render when the qr_code_logo branding setting contains an invalid URL format
Fixed an issue where, during LiveID login with a username, the camera would activate but the video feed failed to display on the screen
1.11.09.01 — December 13, 2025
What's New
Password Login Support for Shared Accounts
Users who decline biometric consent on Shared Workstations can now sign in using their primary account password instead of FIDO. A new authentication method, Password for Shared Account Login, has been added under Windows MFA in AdminX.
Security Fixes
Fixed a vulnerability where certain regex replacements could cause unexpected performance degradation
Enhanced Web LiveID security with a new injection-attack detection module capable of identifying virtual camera feeds, screen captures, and synthetic video sources
Bug Fixes
Fixed an issue where the UI fails to validate email address format during reset password flow
Fixed an issue where OTPs generated via the generate endpoint did not expire after the configured validity period
Fixed an issue where OTPs for Singapore users were processed with a US (+1) ISD code instead of Singapore (+65)
Fixed an issue where bootstrapping a new community created multiple databases for the default community on repeated requests
Fixed an issue where secondary email and/or phone were not deleted after removing from the user's profile
1.11.08 — November 15, 2025
What's New
PIN Lockout Notifications During LiveID Authentication
The Login page now clearly notifies users when their PIN is temporarily locked after multiple incorrect attempts: "Your PIN has been locked due to multiple incorrect PIN attempts. You can attempt using your PIN in x minutes." The PIN automatically unlocks after the lockout period. Events triggered:
E_FACTOR_LOCKED — triggered when the PIN is locked after multiple failed attempts
E_LOGIN_FAILED — triggered when a user attempts to log in with a PIN-locked account (reason: "Factor Locked - User PIN")
E_FACTOR_UNLOCKED — triggered when the PIN is manually unlocked
New Error Message for Virtual Camera Detection
When a user attempts to authenticate using a virtual camera or injection attack, the system now displays:
Title: Suspicious Activity Detected
Message: You cannot use LiveID for login. Please try another method.
Passkey Events Visible in AdminX
Community administrators can now view Passkey-related events from mobile devices in AdminX Event Logs:
E_PASSKEY_REGISTRATION_FAIL
E_PASSKEY_VERIFICATION_SUCCESS
E_PASSKEY_VERIFICATION_FAIL
Enhanced Forgot Password Experience
The password reset flow now dynamically displays either the Username or Email field on the Forgot Password page based on configuration set under Authentication > Reset Password > Password Reset Identifier. See Resetting Account Passwords.
Note: Changes may take up to 10 minutes to reflect.
New Error Messages for LiveID Enrollment and Authentication Failures
When LiveID enrollment fails due to a low-risk confidence score: "Suspicious Activity Detected. You cannot register LiveID."
When a user tries to log in using an unenrolled LiveID: "Suspicious Activity Detected. You cannot use LiveID for login. Please try another method."
API Enhancements
New {{client_api}}/api/r3/otp/verify API added to verify one-time passcodes with standardized success and error responses
Bug Fixes
Fixed event log columns not having fixed widths, causing layout issues with long usernames
Fixed the Send Invite button being unresponsive in the AdminX Invites tab
Fixed incorrect error messages when LiveID enrollment failed due to a low-risk confidence score
Fixed push notifications not being received for AdminX login when configurations were added to the internal database
Fixed SSPR password reset flow failing when run in parallel on same or different browser instances
Fixed user token for SSPR session not expiring after 5 minutes as expected
1.11.06.01 — October 10, 2025
What's New
Trigger Password Reset Verification Link from Workday
Users now receive the verification link using email addresses and phone numbers from Workday when Workday is configured as the data source. The UI displays available contact options retrieved from Workday.
Login Screen Customizations
Community Administrators can now customize the login screen's appearance using the Branding page in AdminX:
Background image layout
Sign-in heading text
App download message
See Branding.
Updated Alert Prompts During PIN/Typing Pattern Deletion
When removing a typing pattern: "Are you sure you want to remove <user>'s typing pattern? <user> will no longer be able to use this method for authentication."
When removing a PIN: "Are you sure you want to remove the PIN? <user> will no longer be able to use this method for authentication."
New Error Messages for PIN/Typing Pattern Deletion
PIN deletion fails: "Error removing PIN, try again."
Typing pattern deletion fails: "Error removing typing pattern, try again."
Bug Fixes
Fixed inconsistent messages for deleting PIN/Pattern
Fixed backend error messages showing in UI during PIN/Pattern deletion
Fixed idvaapi endpoints accepting partially authenticated JWTs (now correctly returns 401)
Fixed oversized banner image in default Admin Onboard email template on mobile devices
Fixed IVR calls triggered via RADIUS authentication ending prematurely
Fixed missing "initiated_by":"administrator" parameter in E_BEHAVIOR_AUTH_UNENROLLED and E_USER_PIN_UNENROLLED events
1.11.04 — September 5, 2025
What's New
Workday as Source of Truth in SSPR
Community administrators can configure Workday as the source of truth for retrieving employee details during Self-Service Password Reset (SSPR). See Resetting Account Passwords.
Typing Behavior Authentication
1Kosmos introduces Typing Behavior Authentication — behavioral biometrics that analyzes typing patterns on a keyboard, mouse movements, screen swipes, and device handling to verify identity against the user's unique behavioral profile. Particularly useful in environments requiring PCI DSS-compliant passwords (14–16 characters). Capabilities include:
Secure workstation access
Real-time user validation
Fraud mitigation across digital interactions
See Behavior Authentication.
Machine ID Support for Orion in Adaptive Authentication
Machine ID from the Orion Authenticator is now available as a condition in adaptive authentication. Machine IDs can be uploaded manually or in bulk via CSV. An E_ADAPTIVEAUTH_CREATED event is triggered as part of this flow. See Adaptive Authentication.
Orion Detection Wait Time
A new setting Orion Detection Wait Time (default: 1500ms, range: 0–60,000ms) is available under Authentication > Orion Authenticator. See Orion Authenticator.
Duplicate Event Insertion Mitigation
A unique index has been added on the combination of event_name and eventData.event_id to prevent duplicate event records. Duplicates are logged as "Duplicate record being inserted event_id and event_name" every 100 occurrences.
Renamed Devices Tab to Login Options
The Devices tab under My Profile has been renamed to Login Options.
New Parameter in E_PWDRESET_FAILED Events
The mode parameter is now included in E_PWDRESET_FAILED events. Supported values: email link with otp, email link, idp.
Configurable Profile OTP and TOTP Transition Handling
Support added for separating the profile passcode from the account passcode via a configurable profile_otp service name in CaaS.
Note: With the latest mobile app update, TOTP has been deprecated. The app now displays only the account OTP. Both types are currently supported during transition. In E_OTP_VERIFIED events: totp = time-based OTP, user-generated = account OTP.
New Permission — user.unlink.login_options
Added to admin permission bootstrap for community_admin and helpdesk_admin roles.
HOTP Fix for Fortigate VPN
If multiple OTP validation requests are received with the same request ID within 40 seconds, the system now treats the OTP as valid to avoid unnecessary rejection during closely timed authentication attempts.
API Enhancements
adminapi updated to include the mode parameter in password reset requests (values: Email link, ID proofing, Mobile app)
/api/v3/rest/{community}/pwdreset updated to include event data when calling the Users Management API
Security Fixes
Updated OTP behavior for app and app_ext license keys: API no longer returns OTP in the response; OTP is now sent via Email, SMS, or Voice to verified contact methods
Security check added to verify whether the user exists before generating or sending an OTP
LiveID Selfie service cryptographic enhancements: SHA-512 with salted key derivation, AES-256 with dynamic IVs, PIN hashing upgraded from MD5 to SHA-512
Google Captcha Added to Invite Resend Actions: Google Captcha has been introduced on the User Profile > Invites and Users > Invites pages to prevent automation attacks.
Bug Fixes
Resolved an issue where the login page delayed unnecessarily after detecting Orion
Addressed an issue where HOTP user reports were generated without data
1.11.02 — August 9, 2025
What's New
Self-Service Password Reset Using Identity Documents
End users can now reset their passwords by verifying their identity with a valid ID document. This feature is disabled by default. A new fuzzy matching configuration has been introduced in DVCID via maxRetries and matchCommonAliases parameters. See Resetting Account Passwords.
Removed Encrypted Error Code from Unauthorized Error Message
When an account is locked, only the message "You are not authorized" is shown. The encrypted error code has been removed.
Enhanced Hardware Token Syncing Mechanism
First-time token use now prompts users to enter three consecutive passcodes to sync the token. Syncing is required only once per token, even when shared across multiple users. A new Hardware Token Sync Window setting has been added to AdminX. See HOTP Tokens.
Password Reset Support for LDAP v3 Compliant Directories
1Kosmos now supports generic password reset operations for users in LDAP directories.
Security Fixes
AdminAPI excludes Access-Control-Allow-Origin: * in responses
signature_token added to response body using decrypted request_id as salt to prevent response tampering
API Enhancement
The /password_reset API has been enhanced with code and otp parameters now being optional.
Miscellaneous
The LDAP Auth Proxy downloaded from AdminX now uses the service_ext license key.
Bug Fixes
Fixed "User not Found" error after clicking Edit Profile from the Users page and navigating back
Fixed UI not sending module ID into fetch profile API when username contains an underscore
Fixed user_id displaying as uid in report events
Fixed alert emails being sent from the initiating user's email address when downloading event reports
Fixed AdminAPI failing to reject CORS preflight OPTIONS requests
Fixed 401 error on Internet Explorer for /nonce/sign API call
Fixed CORS error when importing IDP configuration for 1Kosmos domains
Fixed inability to open user profile when username contains underscore in Entra ID
Fixed Admin Role Assignment Report not including user details in downloaded file
Fixed incomplete Azure AD user list retrieval
Fixed duplicate IDP entity ID returning 200 success instead of an error
1.11.00 — July 12, 2025
What's New
Export and Download Token Data from Hardware Tokens Dashboard
Community administrators or users with the authentication.hardware-tokens.export permission can now use the Export Data button on the Tokens or Users tab to export token data. See HOTP Tokens.
Note: If errors are detected in records during CSV upload or manual text input, no tokens will be added.
FIDO Renamed to Passkeys
The security key has been renamed to Passkeys in the AdminX interface under Adaptive Authentication and Sign In screens.
BlockID Renamed to 1Kosmos
The term "BlockID" has been updated to "1Kosmos" across the AdminX interface and messaging templates.
Enhanced Audit Log Labels on Admin Activity Page
User-friendly names now display for specific audit log events:
E_ADAPTIVEAUTH_CREATED → Adaptive Auth Journey was created
E_ADAPTIVEAUTH_DELETED → Adaptive Auth Journey was deleted
E_ADAPTIVEAUTH_MODIFIED → Adaptive Auth Journey was modified
E_SESSIONS_TERMINATED → User Sessions were terminated
E_TOKEN_LIST_EXPORTED → Token list was exported
E_TOKEN_ASSIGNMENT_EXPORTED → Token assignment list was exported
Security Fixes
AdminAPI no longer returns wildcard (*) in Access-Control-Allow-Origin HTTP header
Generic error messages now shown on UI to prevent disclosure of sensitive internal information
Miscellaneous
E_ROLE_CHANGED event now displays the role_changed_to parameter when a user's role is changed
Session expiry events now logged at INFO level instead of ERROR
User's unique object SID is now included in the certificate subject name for certificate requests
Bug Fixes
Fixed issue where multiple users assigned a token bypassed validation for subsequent entries
Fixed users with Custom Role unable to access Authentication and Reports menu items
Fixed the dguid field returning actual dguid instead of mapped email ID in fetch users API response
1.10.19 — June 14, 2025
What's New
HOTP-Based Hardware Token Authentication
1Kosmos now supports HOTP-based authentication with hardware tokens. Unlike time-based methods, HOTP is event-driven — generating a new OTP only when triggered by the user's action. Each OTP is unique and valid until used, making it reliable in offline or unsynchronized environments. See HOTP Tokens.
SAML Assertion Encryption
A new Encryption for SAML Assertion section has been introduced under the Advanced Options tab when configuring SAML applications. Supported algorithms:
Encryption Algorithm: RSA and AES 256 CBC
Key Transport Algorithm: RSA OAEP
See SAML Application Integrations.
Security Fix — Anti-Automation on Invite Pages
To prevent brute-force and enumeration attacks, reCAPTCHA has been integrated on the Invite User (Passwordless) page.
Note: The following wildcard characters are not supported when fetching user details using the fetch_single_user_by_username API: ?, %, *, [], {}, #, !, ,, , /, ^, $
Miscellaneous
E_USER_CONSENT event now displays Consent status regardless of whether the user accepts or rejects consent
When OTP template is configured in a non-English language, users receive SMS in that specified language
ECDSA has been disabled for the following APIs when request includes noecdsa=true: Generate OTP, Verify OTP, Generate ACR, Redeem ACR
Bug Fixes
Fixed application allowing mobile TOTP authentication despite journey configured as Password + Profile OTP
Fixed E_OTP_VERIFIED success event being triggered even when an invalid OTP type (e.g., TOTP) is entered
1.10.18.01 — May 12, 2025
What's New
Reset Account Passwords Through AdminX
Community administrators can now define how end users reset forgotten passwords via the new Authentication > Reset Password menu. Options available:
Enable users to reset passwords through AdminX
Enable users to reset passwords through Mobile App
See Resetting Account Passwords.
Note: The Enable users to reset passwords through Mobile App setting must be explicitly enabled for mobile resets to function, even if they were previously working.
Terminate Users' Active Sessions via AdminX
Community administrators with the user.revoke-sessions permission can now revoke active sessions — their own or others' — to enhance security. See Terminating User's Active Sessions.
New Authentication Journey — Password + Profile OTP
A new Password + Profile OTP authentication method has been added to the Adaptive Authentication Journey page. Users are first prompted for their password, followed by a verification code (Profile OTP).
Note: The Profile Passcode option appears on the Choose an authentication method screen only when multiple OTP options are enabled for the user journey.
Bug Fixes
Fixed user authentication failures via password or OTP when Kafka pods were down
Fixed error message "allowed is not allowed" when administrator creates or updates transformation script
Fixed license.json file not containing licenseKey details when a new broker is added using the same licenseKey as an existing broker
Fixed typo in message shown upon clicking Download for Login Activity Report
1.10.17 — April 12, 2025
What's New
Geo-Based Access Restriction
1Kosmos now offers the ability to restrict user access if they are not within the allowed radius of their trusted locations. Community administrators can configure this geo-based restriction rule under Authentication > Adaptive Authentication using the Add New Adaptive Authentication Journey drop-down. Applicable only when end users authenticate via QR codes or push notifications.
Note: Community administrators must ensure the users' AD attribute carrying the trusted location is mapped to the trustedLocation BlockID attribute.
See Restricting Access Based on Geolocation.
Forced Re-Authentication for Service Provider Applications
Community administrators can now force re-authentication when accessing specified SAML/OIDC Service Provider applications. The new Force Re-authentication setting is available under Applications. Disabled by default. See SAML Application Integrations.
Bug Fixes
Fixed an issue where users received an 'Access Denied' message when accessing SAML SSO applications, despite the SAMLResponse being marked as Success.
1.10.16.01 — March 15, 2025
What's New
Bypassing Authentication for Specific Applications (Grant Access)
A new Grant access action has been added under the Decision section when creating adaptive authentication journeys. If selected, choosing an application is mandatory. Recommended for low-risk applications within a corporate network.
Note: Authentication cannot be bypassed for AdminX.
See Adaptive Authentication.
Missing Email Error Message for Report Downloads
When a user attempts to download a report without an email address on their profile, the UI now validates and displays an appropriate error.
Standardized Error Responses for User Access
To prevent user enumeration, all user-state error messages now display a generic response with an encrypted ECDSA error code:
1.10.15 — February 21, 2025
What's New
Configuring Authentication Journeys for Windows Workstation MFA Agent
Administrators can now create, edit, or delete adaptive authentication journeys for Windows Workstation MFA Agent through AdminX under Authentication > Adaptive Authentication. Supported journey types: Password only, Push, QR, FIDO, Any OTP, Password + Push, Password + Any OTP, Password + FIDO, FIDO + Shared Account. Events captured:
E_ADAPTIVEAUTH_MODIFIED
E_ADAPTIVEAUTH_CREATED
E_ADAPTIVEAUTH_DELETED
See Windows Workstation MFA Agent.
Customizing QR Code Design
The Branding page now allows administrators to upload a custom QR code logo (PNG or JPG, less than 10KB, recommended size 35px x 35px). See Branding.
Bug Fixes
Fixed an invalid Orion authenticator icon displaying on other users' profiles.
1.10.14.01 — January 16, 2025
What's New
Kerberos Authentication
Community administrators can now specify which users can authenticate using Kerberos. Configure Kerberos Single Sign On under Directory > Directory Integrations > Advanced Configuration. New authentication journey options:
Kerberos
Kerberos + Push
Kerberos + Any OTP
See Kerberos Authentication.
1.10.14 — January 10, 2025
What's New
Login Using Passcodes from Other Channels (Already Have a Passcode?)
When the adaptive journey is configured as Password & any OTP, a new Already have a passcode? link appears on the Sign In — Choose an authentication method page. This allows users to bypass generating a new OTP and use a passcode from another channel such as Orion Authenticator.
Note: The username must be configured in the adaptive authentication journey for this link to appear.
1.10.13.01 — December 14, 2024
What's New
End Users Can Manage Phone Numbers
End users can now add or remove their phone numbers directly through the AdminX interface. Community administrators must enable the new Allow users to enroll mobile / landline number setting under Authentication > Multi-factor Authentication > Enroll Phone Number. See Managing My Profile.
Onboard First-Time Login Users Through BlockID App
Upon first-time login with a password, users are prompted to enroll for passwordless access through the BlockID app. Prerequisite: Enable Passwordless Access on BlockID App in Initial Sign in MFA Enrollment policy under Authentication > Enrollment Preferences. See Enrollment Preferences Policy.
Generate Onboarding Invite on Behalf of Another User
Community administrators or helpdesk administrators with the user.generate.qr permission can generate a QR code on behalf of another user to onboard devices in their presence. Required additional permissions for helpdesk admins: users.all-users, users.view-user, users.edit. See User Management.
Skip MFA for LDAP Service Accounts in Auth Proxy
A new Skip MFA for Service Accounts section in Auth Proxy allows community administrators to specify which LDAP service accounts can bypass MFA with just a username and password. See Auth Proxy for LDAP Server.
Enhanced QR Code Design
QR code design has been enhanced for better UX on: Login Page, Enrollment on first time login, Onboarding from My Devices page, and Self-registration.
Onboarding Accounts via Orion Authenticator for Windows
Windows end users can now seamlessly onboard their accounts and generate passcodes through the new Orion Authenticator for Windows agent. See Orion Authenticator.
What's Deprecated
The Edit Template button in the Preview Invitation section has been removed when sending passwordless invitations
The hyperlink with 1Kosmos has been removed from the footer of the login page
1.10.12 — November 8, 2024
What's New
Helpdesk Admins Can Unlink a Device
Community and Helpdesk administrators can now unlink a user's device when a device is lost, the BlockID app was accidentally uninstalled, or the user has been offboarded. A new user.unlink.device permission is required for Helpdesk administrators. See User Management.
Number Challenge for Push Notification Authentication
To protect against MFA bombing attacks, the Number Challenge feature adds an extra layer of verification during push notification authentication. When enabled, users must select the matching number displayed on their mobile app from the number shown on the login screen. See Passwordless Login.
Removal of QR Code Tab on iOS Devices
On iOS devices, passwordless users now log in with username and push notification. The previous "Login with BlockID" deeplink option has been removed due to inconsistent behavior across apps like Office 365.
Removal of 1Kosmos Hyperlink from Login Page Footer
The @2024 1Kosmos Inc. hyperlink reference has been removed from the login page footer on both UI and mobile browsers.
1.10.10 — September 27, 2024
What's New
Device Details from Orion Agent in Event Logs
The AdminX interface now shows device information where the Orion agent is installed in E_LOGIN_SUCCEEDED and E_LOGIN_FAILED events:
machine_name
machine_id
machine_domain
machine_os
machine_os_version
machine_mac_addr
agent_version
1.10.09.02 — August 30, 2024
What's New
Orion Authenticator for Mac
A new Orion Authenticator, a desktop-based agent, has been introduced for Mac machines to perform multi-factor authentication. This allows organizations with restrictions on mobile device usage to support smooth account onboarding and passcode generation.
Account OTP on My Profile Page
A new Passcode tab has been introduced under Dashboard > My Profile for displaying the account OTP. The OTP is identical to the Account OTP displayed on the mobile app and is valid for 30 seconds.
Template ID on SMS Gateway
A new whitelistedTemplateId parameter has been added to admin APIs managing messaging templates. Required by specific providers like Sandeshwala & Karix to comply with SMS communications.
1.10.08.01 — July 30, 2024
What's New
Adaptive Authentication Journey for Linux PAM
A new Linux PAM adaptive authentication journey has been introduced in AdminX under the Applications menu. Supports creating custom authentication journeys for specific groups or users logging into Linux servers. Default journey applies to all users. See Linux SSH MFA.
Auth Proxy for RADIUS and LDAP
The go-radius component has been renamed to go-authproxy. Existing RADIUS configurations are replaced by the new Auth Proxy configuration under Applications. Supports Push, IVR, and passcodes for Windows. See Auth Proxy for RADIUS Server and Auth Proxy for LDAP Server.
Enhanced User Experience on Login and My Profile Pages
Skeleton loading images have been added to both Login and My Profile pages for improved visual feedback during page load.
1.10.07 — July 5, 2024
What's New
Enrollment Policies for First-Time Login Users
The new Enrollment Preferences tab under Authentication allows first-time login users to enroll their mobile or landline number for MFA methods such as SMS OTP or voice OTP. See Enrollment Preferences.
Username Aliases
Community administrators can now add up to eight username aliases for users using the Manage Username Aliases button on the Profile Information page. Aliases can be used to log into: AdminX, Linux/Mac/Windows Credential Provider, Radius Applications, and Step-up OIDC.
Note: 1Kosmos supports aliases as {aliases: {alias1-8}} during SAML/OIDC claim mapping.
See User Management.
Disclaimer Message on AdminX Login Page
Community administrators can configure a disclaimer message to display at the bottom of the AdminX sign in page via Settings > Branding. See Branding.
Reserved Attributes Section in BlockID Attributes
A new Reserved Attributes section has been added to Settings > BlockID Attributes.
1.10.04 — May 9, 2024
What's New
Multiple Hostname/IP Support for LDAP/AD Connections
1Kosmos now supports multiple hostnames/IP addresses for each LDAP/AD connection, with configurable failover. When the primary host becomes unavailable, BlockID automatically fails over to another hostname/IP. A new Failover Support section has been introduced when creating a directory connection. Administrators receive email notifications when host status changes via the Hostname status change notifications setting under Advanced Configuration.
1.10.03 — April 25, 2024
What's New
Admin Role Assignment Report
Community administrators can generate a report of all users with privileged roles (community administrator and helpdesk administrator). The downloaded CSV contains a list of all users with a particular role. See Admin Role Assignment Report.
Detect Password Expiry at Login
AD users with expired passwords now see the error: "Your password has expired. Please contact your administrator." Requires AD broker version 1.08.02.
Authentication Policies for Devices (Health Agent)
The 1Kosmos health agent transmits device information at login. Administrators can define policies based on machine domain and machine name to allow or deny access from specific devices.
1.10.01 — March 1, 2024
What's New
External Identity Provider (IdP) Support
1Kosmos now allows configuring a third-party Identity Provider (Ping, Okta, Azure, ADFS) for specific users based on a routing policy. Setup steps:
Set up 1Kosmos as a SAML Service Provider with the IdP
Create a new Identity Provider configuration within 1Kosmos
Upload the federation metadata file from the IdP
Set up users in the IdP user store or connect to an existing directory
Configure a routing policy for which users authenticate with the IdP
New features include:
Manage new IDP: create or edit external IDP configuration
Delete an External IDP: removes configuration and any users in the IDP user store
Create users in the IDP user store
Manage routing policy: based on usernames, groups, or route all IDP user store users
Login experience: user is redirected to the IDP SSO URL when conditions are matched
Improvements
Users with userAccountControl 1049088 (Enabled and Not Delegated) and userAccountControl 520 (HOMEDIR_REQUIRED and NORMAL_ACCOUNT) status are now recognized as active and allowed to authenticate.
Bug Fixes
Fixed a bug that caused the website not to render when local storage is restricted.
1.10.00 — February 10, 2024
What's New
Email Template Personalization — Last Name Variable
Email Templates for self-invitation passwordless onboarding now support {{Lastname}} as a variable.
Font Update — Work Sans
Switched from Adobe fonts (cloud-hosted) to Work Sans (hosted within 1Kosmos CDN) to avoid whitelisting requirements for customers.
1.09.16 — January 27, 2024
What's New
Adaptive Authentication Journeys
Adaptive Auth Journeys allow administrators to build authentication journeys based on the following conditions:
Supported decisions:
Rules:
If a user matches multiple journeys, all matching methods are presented
If any matching journey contains Deny Access, access is automatically denied
If no journey matches, the default policy's methods are presented
New .wellknown Endpoint for Machine Information
When machine information is available via the health agent, a new .wellknown endpoint collects machine information on the AdminX login page. The E_LOGIN_SUCCEEDED event now contains a list of all facts evaluated at time of authentication.
Improvements
Resolved an issue on IE that prevented the Help Button from rendering on the login page.
1.09.15 — January 13, 2024
What's New
New E_ROLE_CHANGED Event
A new event E_ROLE_CHANGED has been introduced to capture an audit log whenever a user's role is elevated or downgraded.
Improvements
Minor updates to the license.json file produced by the Directory broker to include the tenant DNS.
1.09.14 — December 9, 2023
Improvements and Bug Fixes
The analytics dashboard now allows downloading a Unique Users report. Hover over the Unique users count on the analytics dashboard to download.
Customization of messaging templates for emails/text messages is now available for: User onboarding, Email verification, delivering passcodes, and more.
1.09.14.01 — December 7, 2023
Security Fixes and Bug Fixes
Injection of malicious scripts into email templates is now blocked, reducing XSS attack risk
POST/users/find API now limited to returning a maximum of 2 users to prevent data overexposure
The escapeXSS function upgraded with stricter measures to prevent XSS injection in messaging templates
1.09.13 — October 19, 2023
What's New
User Lockout
Community Administrators and Help Desk Administrators can now lock a user indefinitely or for a defined period. Locked users cannot authenticate into AdminX or web applications. Locked users can also be unlocked immediately.
RADIUS Server Configuration
Administrators can now manage RADIUS server configuration within AdminX. Allowed authentication methods:
Login with Push
Login with Password & OTP
Login with OTP & Password
Login with OTP
The RADIUS Server is available for Windows, Linux, and Darwin as a command-line tool, preconfigured with the appropriate license keys and community ID.
Improvements and Bug Fixes
Updated UX during authenticator onboarding from the user profile
Added ability to request user invites to a secondary email
Get user authorizations from the user token instead of making additional API calls
1.09.12 — September 21, 2023
What's New
New SMS Gateway — Coalesce
Introduced support for Coalesce to send text messages when delivering OTPs or invites for passwordless onboarding.
OneSpan Hardware Token Support
Introduced support to configure OneSpan Server within the AdminX control plane. Administrators can allow or disallow OneSpan authentication tokens as a login method and test their OneSpan server configuration.
Manage AdminX Session Time
Support added to manage the AdminX session time from within the control plane.
Improvements and Bug Fixes
When an IDP certificate is uploaded, the key size and algorithm from the signing certificate is now used to sign the SAML response
Fixed an issue on Internet Explorer 11 where the login page was caching GET requests, causing authentication to fail
Fixed the recorded number of devices linked to an account
Added support for two additional attributes when configuring Gupshup as an SMS Provider
1.09.11.01 — September 7, 2023
What's New
Enable or Disable FIDO Logins
Community Administrators can now enable or disable FIDO logins for all users within their community, including whether to allow security keys or platform authenticators (Mac TouchID, Windows Hello).
Allowed Security Keys
Administrators can upload the metadata file of any desired security key brand. Once uploaded and enabled, end users can enroll keys from that brand for authentication.
Reset Password on Next Login
Enforces password resets for Active Directory users mandated to change their password on next login. Users provide their current and new password, followed by an OTP.
Improvements and Bug Fixes
Support for generating SHA1 and SHA256 self-signed certificates; fixed signing algorithm detection from uploaded certificates
Updated Salesforce SOAP API to latest version and fixed XML parser compatibility
Resolved error codes A00006 and A00008 appearing on the login page
1.09.10.01 — August 31, 2023
Bug Fixes
Improved security around the access code sent to users for onboarding their device for passwordless logins.
1.09.10 — August 17, 2023
What's New
Gupshup Gateway Support
Added support for Gupshup gateway to send text messages to users.
Improvements and Bug Fixes
Fixed a bug allowing QR code to render appropriately on a Cisco AnyConnect embedded browser
Last Login Report now displays the number of active users per directory (active = at least one authentication in the last 30 days)
Fixed logging to ensure journey ID and request ID are consistently available for troubleshooting
Widespread use of caching to improve API throughput
1.09.09 — July 27, 2023
What's New
New Passwordless Login Options
Administrators can define how many devices a single user can onboard for passwordless authentication
When the maximum is reached, administrators can choose to allow the new device while deleting the oldest linked device, or reject the new device
Disable Passwordless Login Options
Administrators can now disable passwordless login options entirely. When disabled, users are no longer presented with passwordless login options.
QR Code Refresh When Idle
QR codes on the login page no longer auto-refresh after 5 minutes of inactivity. Users see a Refresh button to manually generate a new QR code.
API Failure on Login Page
When required APIs fail to load, the interface now displays a refresh button with error codes instead of an indefinite loading message.
Improvements
Helpdesk Administrators now have additional permissions to download reports
SMS Gateway Settings updated for Infobip to support an additional smstemplateid parameter
Last Login Report now displays the time of last login in the browser's local timezone
Updated design for Active Directory Advanced Configuration tab, Multi-factor Authentication page, and a new Passwordless Login page
1.09.08 — June 29, 2023
What's New
Twilio Support for Voice Gateways
Administrators can leverage Twilio to configure SMS and Voice gateways. The Voice gateway delivers spoken one-time passcodes via phone call.
Last Login Report
Administrators can now view a report combining information about all users in a directory, including last login date. The report helps identify inactive users over 30, 60, or 90 days.
Windows Broker — X.509 Certificates
The new Windows broker for Active Directory can issue X.509 certificates for the user at the time of enrollment. Certificates are stored on the user's device and used for passwordless workstation login.
Improvements and Bug Fixes
Adjusted login page to display QR code without scrolling (tested on Zscaler)
Fixed a bug preventing changes to password policy in the internal DB
Fixed a bug preventing users on Pixel 6 devices from completing phone verification
1.09.07 — June 22, 2023
What's New
Login Passcode via Voice
Administrators can now enable users to receive one-time passcodes through a phone call.
1.09.06 — June 8, 2023
What's New
Windows Broker for Active Directory
Administrators can now deploy the Windows broker on-premise to connect the 1Kosmos platform with Active Directory. Designed as a long-running Windows service, it can be managed from the control plane.
Improvements
Administrators can now modify OIDC applications including logo, scopes, redirect URLs, and more.
1.09.05 — June 1, 2023
What's New
Broker Log File Settings
The control plane now provides settings for fine-grained control of:
Broker Log File Size: Maximum size before rotation (default: 10MB)
Broker Log File Rotation Count: Maximum number of log files retained (default: 10)
Track Off-Boarded Devices
AdminX now produces the E_DEVICE_DELINKED event when a user removes their device from their Profile page or the mobile app.
1.09.04 — May 18, 2023
What's New
Self-Service Passwordless Onboarding from User Profile
Administrators can now enable or disable the ability for end users to pair their devices as authenticators from the My Profile page.
Improvements and Bug Fixes
Branding settings now allow administrators to customize the footer color on the login page.
1.09.03 — May 11, 2023
What's New
Help Button on Login Page
Administrators can add a help button on the login page to present phone numbers, FAQs, or troubleshooting tips. Help content is authorable using HTML templates in branding settings.
Account Lockout for Incorrect OTP Attempts
Administrators can configure the number of incorrect one-time passcodes allowed before an account is locked. Accounts auto-unlock after a configurable lockout duration.
Improvements and Bug Fixes
Removed links to expired reports on the Report Downloads page
Fixed phone number verification on Safari browser
Clicking on the New Devices graph now shows a summary of all new devices enrolled
Added E_REPORT_REQUESTED and E_REPORT_GENERATED events for audit
1.09.02 — April 13, 2023
What's New
Passwordless Onboarding Configurability
Community administrators can now allow or disallow users to self-onboard using the Request an Invite self-service page.
Improvements and Bug Fixes
Resolved form submission errors when blank spaces were included in form entries
1.09.01 — March 23, 2023
What's New
Analytics Dashboard
Community administrators can now see a summarized report of usage across the community:
Counts: Successful Logins, Unique Logins, Devices Enrolled, Failed Logins
Visualizations: Successful Authentications (by method), Devices Enrolled, Applications Usage, Failed Logins (by reason)
Reports Download
Downloading reports as CSV files is now supported for all Login Activity Reports and Event Logs. Downloaded reports remain pending until records are compiled, then an email with download link is sent. Links are available for 7 days.
Improvements and Bug Fixes
Administrators can now receive email notifications when AD or LDAP brokers disconnect from the tenant.
1.09.00 — February 27, 2023
What's New
Step-Up with TOTP
Authentication policies now support Step-Up with Trusted One Time Passcodes (TOTP) using the BlockID Mobile App, triggered by user geolocation or IP address.
Improvements and Bug Fixes
Password Reset Events
E_PWDRESET_SUCCEEDED: Captured any time a user successfully resets their password
E_PWDRESET_FAILED: Captured any time a user fails to reset their password, with reasons included
Worldwide Geolocation Support
Geolocation Authentication Rules now support all countries worldwide.
1.08.00 — February 2, 2023
Early Access
Geolocation Authentication Rules
Administrators can define authentication policies based on geolocation. Depending on location, access can be denied, allowed with all MFA options, or restricted to LiveID only. Multiple geolocation rules can be set simultaneously. Initially supported for USA and India users.
What's New
Access Denied Reports
Access-denied reports are now available in the Reports section in AdminX, showing IP addresses and location data for denied users.
Improvements and Bug Fixes
Updated reporting service to ensure no service interruption occurs when errors are encountered while generating events.
1.07.06.01 — January 5, 2023
What's New
Configurable OTP Authentication
Administrators can enable or disable OTP authentication and define which channels (email, SMS, or both) can be used.
Administrator Activity Event Logs
New events added: E_DIRECTORY_ADDED, E_DIRECTORY_MODIFIED, E_DIRECTORY_REMOVED, E_DIRECTORY_BROKER_ENABLED, E_DIRECTORY_BROKER_DISABLED, E_DIRECTORY_BROKER_DELETED, E_DIRECTORY_BROKER_MODIFIED, E_DIRECTORY_ATTRIBUTE_MODIFIED, E_DIRECTORY_ATTRIBUTE_DELETED, E_DIRECTORY_ADVANCED_CONFIGURATION_MODIFIED, E_IDP_CONFIGURATION_MODIFIED.
Improvements and Bug Fixes
The SMS gateway Sender Name field now supports alphanumeric values
Email verification is performed before allowing account creation when an email already exists
1.07.04 and v1.07.05 — December 16, 2022
Early Access
IP Address Rules
Administrators can define and manage policies that allow or deny user access based on IP address.
Password Reset
Administrators can allow users to reset their account password from the BlockID Mobile App. Requires the latest version of the AD broker and BlockID Mobile App.
Login Activity Report
A new Login Activity Report is available under Reports, displaying all applications users logged into and the 2FA method used.
Security Fixes
Fixed an issue that would have allowed identification of the underlying technology stack
Obfuscated all references to user email or phone number in authenticated API queries
Locked down a potential XSS attack vector
1.07.03 and v1.07.04 — November 17, 2022
Early Access
Primary Authentication Factors for BlockID Mobile App
Administrators can choose which authentication factor is supported during authentication approval: Touch ID/Face ID, PIN, or LiveID.
Fallback Authentication Factors
In scenarios where devices do not support LiveID or Touch ID/Face ID, a fallback mechanism can be enabled.
Web SDK for Step-Up Authentication
Third-party websites can use the 1Kosmos Web SDK to trigger OIDC-based step-up authentication with Email OTP, SMS OTP, or LiveID.
What's New
Roles — Helpdesk Admin
A new Helpdesk Admin role has been introduced. Ideal for users who need insight into community activity and troubleshooting user onboarding errors.
Community Administrator Access Using Corporate Credentials
Users from AD, LDAP, and Azure AD can now be promoted to community administrators without a separate account.
1.07.02 and v1.07.03.02 — October 20, 2022
What's New
Forgot Password
End users can now reset their password via a magic link sent to their verified email address, followed by a one-time code sent to their verified phone number.
Save and Retrieve Consent
User consent for information sharing with Service Providers is now recorded and reused on subsequent sign-ins to avoid repeated consent prompts.
Improvements
Sessions now capture the authentication methods used: password, otp, uwl, fido, phone_verified, email_verified. AAL is determined from these session tokens.
1.07.01 and v1.07.00 — September 12, 2022
Early Access
IP Address-Based Authentication
Allowed IPs list: authentication allowed only from listed IPs
Restricted IPs list: authentication denied from listed IPs
Only one rule can be active at a time to avoid conflicts
Access Denied Reports
Reports now show a list of all IPs denied access with details including user agent, IP address, and time of access.
Improvements
AD and LDAP integrations now support LDAP Query Filtering via regex expression
New LDAP filters added to Reports: E_PUSH_REQUESTED, E_OTP_GENERATED, E_OTP_VERIFIED, E_OTP_REQUESTED, E_USER_CONSENT
1.07.00 and v1.06.05 — August 18, 2022
What's New
Session Revalidation for Enhanced Security
Session revalidation logic added to verify that the current application session remains valid for active users who close and re-open their browser window.
User URN Identifier
User URNs introduced to uniquely identify users across multiple tenants, communities, and directories.
Early Access
Kerberos Single Sign-On
When Kerberos is enabled, the AD broker allows users on domain-joined machines within the corporate network to authenticate to all web apps without a username or password after initial domain sign-on. Separate communities within the tenant can have Kerberos enabled for different AD instances.
Improvements
Performance improvements to stop polling when user switches to the "Login with Username" tab
Signing certificate validation updated to verify .pem format and certificate headers
Session expiration message removed when forced authentication is enabled
Bug Fixes
AD Broker download page now displays the version of the broker being downloaded.
Deprecated
Encryption Certificate and Encryption Algorithm fields removed from Service Providers App Configuration.
1.06.05, v1.06.05.01, and v1.06.04.02 — July 23, 2022
What's New
Azure AD User Stores
Added support for connecting to Azure AD as a user store.
Phone Number Verification
User phone numbers are now required to be verified during enrollment.
FIDO Authentication During Enrollment
Users can now set up FIDO authentication during enrollment.
Early Access
OIDC Application Support
OIDC/OAuth applications are now supported for SSO flows, scope selection, and using information from the Authorization Provider to configure the relying party.
Version Changes
NodeJS upgraded from version 12.20.1 to version 16.15.0 LTS.
Bug Fixes
Fixed rendering of the IdP metadata URL.
1.06.03.05 and v1.06.04.02 — June 22, 2022
What's New
Customizable Username Field on Login Pages
Tenant and community administrators can configure the label text for the username field on the login page.
Specify Primary Login Method
Administrators can configure which default login screen users land on — QR code for passwordless login, or a username and password.
1.06.04 — May 26, 2022
What's New
Session Invalidation Logic
Added proper session invalidation and purging of user attributes after user logout.
1.06.03 — April 14, 2022
What's New
Passwordless Login for Mac and Windows
Support for Passwordless Login for Mac and Windows Workstations to Active Directory via Smart Card Certificate enrollment.
New Active Directory Configuration Settings
Allow AD users to turn on/off passwordless sign-in to workstation using BlockID mobile app
Allow AD users to turn on/off SCEP Configuration for the AD Broker
1.06.02 — March 17, 2022
What's New
Super Admin Role
Super admins within a tenant can now enable Self Registration for Customer/Citizen Product lines.
1.06.00 and v1.06.01 — February 24, 2022
What's New
Preferred User Stores
Administrators can define which directory users should be discovered from. Up to three directories can be set as preferred user stores.
IPFS Image Store
Every community is provided an IPFS location to store images for email templates and login pages.
IdP Metadata Download
Support added to download SAML metadata of the configured IdP and access it via a dedicated URL.
Auto-Generate Signing and Encryption Certificates
Ability to auto-generate signing and encryption certificates for SAML IdP. (Recommended for lower environments only.)
Signing Algorithm Support for SAML Certificates
Support for RSA-SHA1 and RSA-SHA256 signing algorithms for SAML certificates.
1.05.01.01 — January 24, 2022
Improvements
Customizable User Invite Expiration Time
Community administrators can now set the invitation expiration time when a user requests a passwordless login invite.
1.05.01 — January 6, 2022
What's New
HTTP POST Support for SAML Integration
Enhanced application integration capability to support SAML using HTTP-POST, including end-to-end testing with Office 365 Desktop Client, Android, and iOS native apps.
Email and SMS Gateway Management
Configure SMTP gateways for outgoing emails
Configure SMS gateways (Karix, Twilio, Infobip) for outgoing text messages
Configure backup gateways with round-robin support
Early Access
FIDO2 Registration and Authentication
Register multiple security keys and platform authenticators (device biometrics)
Rename and unlink FIDO keys
Authenticate using Windows Hello, Mac TouchID, and Security Keys on Edge, Chrome, Safari, and Firefox
Bug Fixes
Fixed issues ensuring proper disabling of users to remove linked accounts and devices.
1.04.02 — November 3, 2021
What's New
Secondary Email Support for Onboarding Invites
Passwordless onboarding invites can now be sent to secondary email or text messages.
Login Page Branding
Introduced login page branding with support for uploading logos and modifying background and text colors.
CAPTCHA for Invite Request Pages
Introduced CAPTCHA to protect against DDOS attacks.
Active Directory and LDAP Brokers
Introduced connections to on-premise Active Directory and LDAP user stores via AD and LDAP brokers. Capabilities include: viewing all connected brokers, renaming brokers, downloading the latest broker, and refreshing broker status every 10 seconds.
Improvements
Ability to edit the profiles of existing AdminX users.
Last updated
Was this helpful?