New features

2026-05-08 New feature: set password when enabling an account

The new feature

Now, when an account is disabled, its password is deleted. Afterwards, if the user changes his password, the disabled account will still have no password. If the disabled account is enabled, the agent of the account will set the password of the password domain to the account and send it to the target system.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

Let’s look at an example, here we have the user "ethan_miller" to whom we are going to assign the password "Dummy01.".

image.png

You can check your password on the "My accounts" page, click on the "View password" of the "app-demo" account.

image.png

Now let's disable the "app-demo" account.

image.png

Check the password again, it must be empty.

image.png

We are going to assign a new password "Dummy02.".

image.png

The other account has the new password.

image.png

Enable the "app-demo" account.

image.png

Check the account with the new password.

image.png


2026-05-19 New feature: filter holder groups at the IdP login

The new feature

From now on, the service providers who have selected the “Ask for group membership after authentication” option will be able to filter which of these should be selectable with the attribute "Script to filter out group memberships".

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

In a later release, further attributes have been added to the script:

The Service Providers reference page lists the attributes that can be used.

Let's look at an example

Let’s look at an example, here we have the user "user4" who has already set up the holder groups.

image.png

We had a service provider that was already selected the option "Ask for group membership after authentication".

image.png

The holder groups have several custom attributes (startDate, endDate and status).

image.png

We now want to filter the holder groups with the attibute status with the Active value.

image.png

So we're going to create a script in the "Script to filter out group memberships" of the service provider.

image.png

This is the script.

// Return the groups whose “status” attribute has the value "Active"
//
l = new java.util.ArrayList();
lug = serviceLocator.getGroupService().findUsersGroupByUserName(user.userName);
for (i=0; i<lug.size(); i++) {
  ug = lug.get(i);
  if (ug.attributes!=null &&
      ug.attributes.get("status")!=null &&
      "Active"===ug.attributes.get("status"))
  {
    l.add(ug.group);
  }
}
return l;

Please note that if the script fails or is not configured correctly, the holder groups page will not be displayed.

Now, to test it, we’ll log in to the application (the service provider), and these are the IdP’s login pages

image.png

image.png

About the attributes we can use

Here is a brief example of a script that we can use to return a specific group based on the additional data.

externalWithPermissions = false;
if (accountName.contains(".") && "Extranet".equals(serviceProvider) && "PO".equals(authenticationMethod)) {
  externalWithPermissions = true;
}

l = new java.util.ArrayList();
lug = serviceLocator.getGroupService().findUsersGroupByUserName(user.userName);
for (i=0; i<lug.size(); i++) {
  ug = lug.get(i);
  if (ug.attributes!=null && ug.attributes.get("external")!=null && "false"===ug.attributes.get("external")) {
    l.add(ug.group);
  } else if (ug.attributes!=null && ug.attributes.get("external")!=null && "true"===ug.attributes.get("external") && externalWithPermissions) {
    l.add(ug.group);
  }
}
return l;

Here another example:

l = new java.util.ArrayList();

log.info("accountName: "+accountName);
if (!authenticationMethod.contains("P"))
  accountName = null;

if(accountName!=null && accountName.equals(user.getAttributes.get("loginInternal")))
  l.add("INTERNAL");
else if (accountName!=null && accountName.equals(user.getAttributes.get("loginExternal")))
  l.add("EXTERNAL");
else if (accountName == null){
  l.add("ANONYMOUS");
}

log.info("l: " + l);
return l;

 

 

 

2026-05-21 New feature: CSV connector in Soffid 4

The new feature

The first version of the "CSV connector" has been released in Soffid 4. This connector only includes the “Customisable CSV file” agent. In this version, this agent is used to generate a CSV file as part of the Soffid synchronisation engine.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

Step 1: install the CSV plugin from the marketplace (Add new button) in the License and plugin page. The name of the connector is "Test plugin".

image.png

image.png

Step 2: create an agent of the "Customisable CSV file" type.

image.png

Step 3: configure the agent with the mappins you need (in the "Attribute mapping" tab).

For further information on how to configure this agent, please refer to the CSV connector in Soffid 4 page.

image.png

Step 4. Create CSV accounts for users.

image.png

Step 5. The accounts created will have synchronised automatically as the engine is set to automatic and the agent is in write mode, and it is active in the monitoring.

The accounts.

image.png

The engine.

image.png

The agent.

image.png

And the monitoring.

image.png

Step 6. Now let’s check the CSV file. It was configured in the "/tmp/users.csv" path of the container.

image.png

2026-05-31 New feature: new authorization for the SCIM webservice

The new feature

From now on, all users used to access the SCIM webservice will require the new "webservice:user" authorisation.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

For this example, we will be using the Bruno application; for further information, please see this page Testing Tool.

First, let’s check that the "Test" user we were using in the SCIM web service no longer has access, see the "401 Unauthorized" error.

image.png

On the Roles page, we are going to create a new role, "SOFFID_SCIM", and then assign the new authorisation to it.

image.png

On the Authorisations page, we assign the new authorisation "webservice:user" to it.

image.png

The final step is to grant the SOFFID_SCIM role to the user.

image.png

Now, when we query the web service, it returns results.

image.png

2026-05-31 New feature: hidden stack tracers

The new feature

Users who do not have the SOFFID_ADMIN role will no longer see the details of errors in the Console; instead, an identifier will be displayed so that administrators can look it up in the Console log.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

Let’s follow these steps.

image.png

Now the user has to share the id with the Soffid administrator, in this exemple XFVBYOJTVZU4VO75.

Soffid administrators can look up the id in the "Console log" page.

image.png

2026-06-02 New feature: syslog with new protocols

The new feature

Until now, when we enabled the sending of logs via syslog to a SIEM tool, the only protocol available was UDP on port 514; now, TCP and SSL protocols have been added, and we also allow you to configure the port instead of using the default settings.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

Let’s follow these steps.

image.png


2026-07-08 New feature: geolocation service available by default

The new feature

From now on, the geolocation service and the use of AI service will be enabled by default if the AM or IRC modules have been activated. Consequently, the Network Intelligence page has been removed

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Following this change, there have been further updates

Let's look at an example

First of all, the Network Intelligence screen no longer exists.

image.png

We have the necessary modules in our Soffid system.

image.png

First, let’s ask the Soffid chat-bot.

image.png

And also create a new script on the Custom scripts page.

image.png

image.png

Regarding geolocation, if Soffid is installed in a public location, you can check new accesses via the Access logs page.

image.png

2026-07-08 New feature: new property removeDisabledObjects

The new feature

A new generic property “removeDisabledObjects” has been created which can be used in all agents, on the “user” and “accounts” objects. By default, its value is “false”.

Bear in mind

Please note the following points:

For more informatio you can check the Windows Connector page.

How to configure it?

The following components must be installed:

Let's look at an example

We have a disabled account on Soffid.

image.png

The account exists as inactive in the final system

image.png

We set the removeDisableObject property

image.png

We synchronise the changes with the final system.

image.png

Finally, the account has been deleted from the final system.

image.png


 

2026-06-13 New feature: device posture

The new feature

The new "Device posture" feature allows Soffid administrators to decide whether some service providers must comply specific operating system requirements.

Bear in mind

Please note the following points:

In scripts, you can use ESSO Scripting Language, for instance the SystemInfo object

How to configure it?

The following components must be installed:

Let's look at an example

As a prerequisite, you must have a Soffid identity provider set up.

image.png

In the Authentication section, you need to fill in the "Script to check posture" field.

image.png

We’re going to use the following script as an example.

debug("************");
var result = null;
v = SystemInfo.os;
d = SystemInfo.domainName;
debug("In "+v+" / "+d);
if (v == 'Windows')
  result = true;
else
  throw "You can only start a session from Windows";

return result;

You now need to enable the "Check device posture" field in the service providers.

image.png

We can now log in to this service provider, which in this case is the Soffid console.

image.png

image.png

And now, following authentication, the device posture will be evaluated.

image.png

You browser may ask you permissions.

image.png

If the validation is successful, you will be redirected to the service provider.

image.png

If the validation fails, the error specified in the validation script will be displayed.

image.png

2026-06-13 New feature: select images for Soffid Authenticator

The new feature

The Soffid Authenticator app now has four different sets of images, and you can now select the set of images using the "soffid.push.images" parameter.

Bear in mind

Please note the following points:

The details of the parameter can be found on the Soffid parameters page, Soffid Autenticator section..

How to configure it?

The following components must be installed:

Let's look at an example

Do you need a Soffid IdP.

image.png

Add Soffid Authenticator as a first or second factor.

image.png

We can now use the parameter "soffid.push.images" to view the different sets of images.

image.png

Let’s take a look at the four examples of logins!

No soffid.push.images parameter or soffid.push.images=birds

image.pngScreenshot_20260717_174126.jpg


soffid.push.images=numbers

image.pngScreenshot_20260717_174954.jpg

soffid.push.images=flowers

image.pngScreenshot_20260717_175156.jpg

soffid.push.images=fishes

image.pngScreenshot_20260717_175237.jpg

Please note that if you enter an incorrect value for the parameter, this error will appear.

image.png

2026-07-20 New feature: configure maximum openid logins

The new feature

A new feature has been introduced in the Soffid Identity Provider that limits the number of requests a user can make to an OpenID Connect service provider. The new attribute is name "Max login per user and minute".

A new issue "issue-login-limit" has also been created to manage this new configuration.

Bear in mind

Please note the following points:

About the platform:

For more information you can check the OpenIdProfile page, or the Defining profiles page

About the issue:

For more information you can check the Issue policies page

How to configure it?

The following components must be installed:

Let's look at an example

Step 1: configure the limit

Let’s go to our Soffid identity provider.

Go to Main Menu > Configuration > Web SSO > Identity providers.

Select your Soffid IDP.

And go the Profiles group and select the OpenIdProfile.

image.png

To activate the attribute "Max login per user and minute" add a number, por example 30, 60, etc.

image.png

To validate this functionality, we need to authenticate as a service provider.

First, let’s check that the service provider has configured the authentication types that the limit validates.

image.png

We’re going to test it using a testing tool; we can see that it responds correctly when the limit is not reached.

image.png

But when it reaches its limit, it returns a HTTP code 400 with the message "Login limit reached".

image.png

400 Bad Request
{
  "error_description": "com.soffid.iam.exception.InternalErrorException: Login limit reached",
  "error": "server_error"
}

Step 2: configure the issue

First, we need to open the new issue.

Main Menu > Configuration > Security settings > Issue policies.

Select the user-login-limit.

image.png

To activate the issue, we will need to assign an action type (Record or Manage).

image.png

Now create one or more actions using the "Add new" button; in our case, a personalised email will be sent.

image.png

On leaving, we can see that the issue has been Managed.

image.png

If we push the limit, a new issue will now also be created in Soffid.

Main Menu > Monitoring and reporting > Issues (or Main Menu > Self-Service portal > My issues)

image.png

And here is an example of the email that was sent

image.png

2026-09-30 New feature: role suggestions

The new feature

A new method has been added to suggest roles that can be assigned to a user.

With this feature, on some Soffid pages, when you want to assign a role to a user, the system will suggest the most likely roles.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

And optionally some addons:

Let's look at an example

Step 1: activation

To enable this feature, you need to upgrade the console and the mining addon.

A syncserver restart is also required after the upgrade.

We can now find the "Role assignment suggestions" page in the "Tools" menu.

image.png

And we have to enable this feature.

image.png

Step 2: configuration

To configure this functionality, we need to decide which user attributes the system should analyse, for which types of users, and select a sync server.

image.png

Once this step has been configured, we need to run or schedule the task so that Soffid generates an internal matrix containing all the possibilities.

Once the process has been run for the first time, this feature is ready for use.

Step 3: usage

To make use of the role suggestions, we can go to the Users page, select a user and go to the roles tab.

image.png

When you click on "Add new" to add a new role, Soffid will show you the suggested roles that, based on the settings from the previous step, are the most likely to apply to this user.

image.png

Step 4: BPM addon

When you upgrade the BPM addon, you will be able to use suggestions in the permission request workflows.

If you already have a workflow, go to the BPM editor page.

In this case, we will open the "Request roles massive".

image.png

In the diagram select the "Start" node.

image.png

 

And enable "Suggest new roles".

image.png

 

Close the popup and click on the "Save and publish" button.

Finally, we can now go to the ISS module and, now "My requests", select the "Request roles masive" workflow, and the suggested roles will then be displayed under "Filter out roles".

image.png

2026-09-30 New feature: simulate IdP attributes

The new feature

A button has been added to the "Attribute sharing policies" page to simulate the attributes generated for a user and a service provider.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

Let’s go to the "Attribute sharing policies" page, in the top right-hand corner, you’ll see the new "Simulate" button.

image.png

In the popup, select a user and a service provider and click on Simulate.

image.png

 

We can now see the attributes that would be sent to the service provider for this user.

image.png

 

If the user does not have an account or their account is inactive, this error will appear.

image.png

 

2026-09-30 New feature: select external IdP using script

The new feature

If there are several external identity providers, a script has been added to the external identity providers to determine whether they are valid for authentication.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

First of all, we have several external IdPs.

image.png

 

We can now see in Soffid IdP that authentication for internal users uses external providers.

image.png

 

When we try to log in, a list of all the options appears.

image.png

 

We have now decided that one of the external IdPs is not valid for internal users.

image.png

 


Now, when accessing an SP, it will no longer appear in the list.

image.png

 

2026-09-30 New feature: Soffid metrics update

The new feature

The Soffid metrics service has been modified so that it analyses active threads every 10 seconds, rather than waiting for them to finish.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

First, you need to enable the service.

You must add two system variables in the Console and/or Syncserver. 

These are the system variables:

soffid.metrics.service.enable=true
soffid.metrics.service.min=60000 (number in miliseconds)

This is an example for the Console with docker compose

image.png

The instances need to be redeployed.

We can now see the statistics for active processes in the log.

 

2026-09-30 New feature: launcher clipboard update

The new feature

The use of the clipboard in the launcher has been drastically improved. It is now possible to copy and paste various formats in both directions: plain and rich text, as well as images and graphics

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

Example 1: copy text and html text from the PAM session

Start a windows connection with the launcher.

image.png

We open the Soffid.com web page.

image.png

Now we can copy a text and click the Get clipboard button.

image.png

Paste it in a notepad as text.

image.png

And finally we paste it in an html editor.

image.png

Example 2: copy text and html text to the PAM session

Copy a text or html on your computer.

image.png

Then paste it directly into the PAM session as text.

image.png

Or as html.

image.png

Example 3: copy an image from the PAM session

Start a windows connection with the launcher.

image.png

Copy an image.

image.png

Now we can paste it in our editor.

image.png

Example 4: copy an image to the PAM session

Copy an image or take a screenshot on your computer.

image.png

Then paste it directly into the PAM session.

image.png