SurePassID MFA Server subtitle: Release Notes 2026.4

Highlights

This release introduces Idp One a single integrated identity provider for SAML2, OpenID Connect (OIDC) provider support and External Authentication Method (EAM) / Microsoft Entra ID integration to the SurePassId MFA Server admin UI, along with session-lifetime controls, logout-flow handling, in-product help and guided tours, and numerous cosmetic UI fixes for existing JIRA issues.

New Features

OpenID Connect (OIDC) Provider Support

• Added OIDC support throughout the admin SSO UI, including a new OIDC application detail for configuring OIDC relying-party applications.
• Extended the SSO customization to surface OIDC and EAM configuration options.
• Added design and specification documentation under docs/features/oidc_one/ (Provider Design, Admin UI Spec, Implementation Plan, QA Plan).
• Certified against OIDC Core 1.0 and 1.0.1 specifications, including support for the Authorization Code Flow and PKCE.
• Proud member of the OIDC community (https://openid.net/foundation/sponsoring-members/) and contributed to the OIDC certification program.

External Authentication Method (EAM) / Microsoft Entra ID Integration

• New EAM configuration page for configuring Microsoft Entra ID (Azure) External Authentication Method integration.
• Added supporting help imagery and an Entra ID integration cheat sheet.

Session Lifetime & Logout Controls

• Added configuration items for setting an absolute session limit to force re-authentication after a fixed period.
• Added UI changes to support logout-flow scenarios (updates to Site2.Master, spCommonPage.cs, and related pages).

In-Product Help & Guided Tours

• Added guided tour (driver.js) and specifically covering OIDC and EAM configuration.
• Added on-line context sensitive help system to the admin UI putting our knowledge at your finger tips. No need to download the help files to view them. Great for environments that do not have external access such as OT and air-gapped environments.
• Added Offline OTP documentation and cheat sheet (OfflineOTP-CheatSheet.md, OfflineOTP-and-CacheUpdate.md).

Improvements & Fixes

• Resolved multiple existing JIRA issues: MFASERVER-1651, MFASERVER-1865, MFASERVER-1901, MFASERVER-2047, MFASERVER-2651.
• Restored missing user-group help content.
• Cleaned up legacy functionality that had been deprecated long ago.
• Fixed a compilation issue and a tour.js build issue.

Dependency & Housekeeping

• Upgraded jQuery from 3.6.0 to 3.7.1 (removed old 3.6.0 script/map/intellisense files).
• Updated packages.config and project references (SurePassIdLegacyMfaServer.csproj).
• Advanced the SurePassIdDotNetLibs submodule pointer to pick up shared library/message updates.
• Database migration updates in mfa_db_update.sql to support the new OIDC/EAM/session features.

Upgrade Notes

• Database migration required: Apply mfa_db_update.sql (and docs/features/oidc_one/Oidc_Schema.sql) to provision the OIDC/EAM tables and new session-limit configuration.
• Entra ID / EAM setup: Refer to EAM_EntraId_SurePassId_Integration_CheatSheet.md for configuring the Azure application (Tenant ID, etc.).