Identity Manager release note 5.1.0

Release date: 2025-08-19

Main new features

FIDO support: enrollment on behalf of another user with MS Entra

FIDO2 security keys are a great improvement to provide a secure and phishing-resistant authentication method. On the downside, the registration of a FIDO2-credential requires manual intervention and the presence of the future holder of the credential. The standard workflow requires a user to first authenticate with the service that they want to register the token for and then enroll the token itself. This leaves the user with two authentication methods, one of which is potentially a username/password-authentication.

A more enterprise suitable approach is to allow operators to register the tokens on behalf of the user and then distribute the tokens to the user. Microsoft Entra offers an interface to allow FIDO enrollment on behalf of another user. This Smart ID release supports FIDO enrollment on behalf of another user with MS Entra.

Android keystore provisioning

Mobile phones offer a high level of security through their sandboxing approaches built into the operating system. This can also be an obstacle to the usability of security features. For instance, if you want to read your encrypted emails not only on your desktop but also on your mobile device, the same encryption certificate and key would have to be accessible for the email reading app on the mobile device.

The new feature allows to provision keys and certificates to the Android keystore to share it with other apps like MS Outlook. This allows to use certificate-based security features seamlessly on desktop and the mobile device without too much interference with the user.

DATA REST API

The Data REST API provides a standard API interface for reading entity data like users, cards, certificates etc. via REST. All the data that can be seen in Identity Manager Operator UI search, can be made available to other systems through this API. It is based on the search configurations created in Identity Manager Admin and can be further refined via additional filter, sorting and paging options. For more information, see Identity Manager Public Data REST API .

High availability for scheduled jobs 

Smart ID Identity Manager supports high availability setups especially to allow load balancing with multiple nodes. However, some functions like Scheduled Jobs must be restricted to one node. This could be a problem in failover setups if these functions need to be highly available as well. With the new version, Scheduled jobs can now be configured to run on several nodes giving full high availability also for the Scheduler functionality. As the underlying library has been changed, there are some effects on cron formats and system.properties. See Upgrade Smart ID Identity Manager from 23.10.19 to 5.1.0 for more information.

Config format versioning 

Identity Manager allows up- and download of configuration files containing workflows, data structure etc. With the new versioning of the configuration format and with each new version it is indicated which config format version is compatible with the Identity Manager version. This makes it possible to share configuration files with different Identity Manager versions if the config format version is the same. Also, checks are introduced on upload to ensure that only compatible versions are uploaded. See Upgrade Smart ID Identity Manager from 23.10.19 to 5.1.0 for more information.

Java 21

One building block of cyber security is keeping the system up to date. This is true for software versions as well as the underlying libraries. Smart ID Identity Manager is based on Java and as such many dependencies rely on the Java version used. With Java 21 we are on the latest version with long term support. This allows using modern versions of dependent libraries as well.

Java 21 itself comes with improvements and and new features that lead to overall performance improvement.

There are some impacts when upgrading from an older version. See Upgrade Smart ID Identity Manager from 23.10.19 to 5.1.0 for more information.

Stabilizing Flowable: removed Messaging

With Identity Manager 5.0 we already introduced Flowable as the new forward looking process engine. The integration has been stabilized in Identity Manager 5.1.0. The messaging between Identity Manager and the process engine has been removed as it introduced more complexity while advantages could not be proven.

Removed features and changes in delivery 

• The undocumented module “cryptovision_integration” has been removed.

• Some custom classes have been deprecated as there are Java replacements available.

• Removal of Security Filter Chain filters:
  The filter chains have been reworked and filters have been removed and replaced by spring security standards. Some legacy projects might have introduced custom endpoints with custom filter chains. These need to be adjusted.

• Referencing “SetProcessMessageExecutionListener” via class name in BPMN is deprecated.

For more information, see Upgrade Smart ID Identity Manager from 23.10.19 to 5.1.0.

Detailed description of features

Features

Corrected bugs