OAuth2 and OpenID Connect 2.30.1
Last modified by Thomas Mortagne on 2026/11/13 20:51
Various tools to manipulate OAuth2 and OpenID Connect protocols in XWiki
| Type | Project |
| Developed by | |
| License | GNU Lesser General Public License 2.1 |
Table of contents
Release Notes
Potential breakage
- On wikis where the OpenID Connect provider was first installed before version 1.15, some existing access tokens of OpenID Connect consents are now rejected: the clients (and scripts or tools using a user access token) relying on them will get an authentication error until they get a new token.
- For an OpenID Connect client, simply going through the authorization flow again is enough to get a new token: the consent is kept, so the user is not asked to approve the application again.
- For an access token created by a user in the "Applications" section of their profile, the user has to delete it and create a new one. The affected tokens are marked with an error message in that section.
- A warning is logged each time such a token is rejected.
- Administrators who want to keep accepting those tokens can set the following property in xwiki.properties (not recommended):
oidc.consent.clearAccessTokenAllowed=true
