New features

2026-05-08 New feature: set password when enabling an account

The new feature

Now, when an account is disabled, its password is deleted. Afterwards, if the user changes his password, the disabled account will still have no password. If the disabled account is enabled, the agent of the account will set the password of the password domain to the account and send it to the target system.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

Let’s look at an example, here we have the user "ethan_miller" to whom we are going to assign the password "Dummy01.".

image.png

You can check your password on the "My accounts" page, click on the "View password" of the "app-demo" account.

image.png

Now let's disable the "app-demo" account.

image.png

Check the password again, it must be empty.

image.png

We are going to assign a new password "Dummy02.".

image.png

The other account has the new password.

image.png

Enable the "app-demo" account.

image.png

Check the account with the new password.

image.png


2026-05-19 New feature: filter holder groups at the IdP login

The new feature

From now on, the service providers who have selected the “Ask for group membership after authentication” option will be able to filter which of these should be selectable with the attribute "Script to filter out group memberships".

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

Let’s look at an example, here we have the user "user4" who has already set up the holder groups.

image.png

We had a service provider that was already selected the option "Ask for group membership after authentication".

image.png

The holder groups have several custom attributes (startDate, endDate and status).

image.png

We now want to filter the holder groups with the attibute status with the Active value.

image.png

So we're going to create a script in the "Script to filter out group memberships" of the service provider.

image.png

This is the script.

// Return the groups whose “status” attribute has the value "Active"
//
l = new java.util.ArrayList();
lug = serviceLocator.getGroupService().findUsersGroupByUserName(user.userName);
for (i=0; i<lug.size(); i++) {
  ug = lug.get(i);
  if (ug.attributes!=null &&
      ug.attributes.get("status")!=null &&
      "Active"===ug.attributes.get("status"))
  {
    l.add(ug.group);
  }
}
return l;

Please note that if the script fails or is not configured correctly, the holder groups page will not be displayed.

Now, to test it, we’ll log in to the application (the service provider), and these are the IdP’s login pages

image.png

image.png

2026-05-21 New feature: CSV connector in Soffid 4

The new feature

The first version of the "CSV connector" has been released in Soffid 4. This connector only includes the “Customisable CSV file” agent. In this version, this agent is used to generate a CSV file as part of the Soffid synchronisation engine.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

Step 1: install the CSV plugin from the marketplace (Add new button) in the License and plugin page. The name of the connector is "Test plugin".

image.png

image.png

Step 2: create an agent of the "Customisable CSV file" type.

image.png

Step 3: configure the agent with the mappins you need (in the "Attribute mapping" tab).

For further information on how to configure this agent, please refer to the CSV connector in Soffid 4 page.

image.png

Step 4. Create CSV accounts for users.

image.png

Step 5. The accounts created will have synchronised automatically as the engine is set to automatic and the agent is in write mode, and it is active in the monitoring.

The accounts.

image.png

The engine.

image.png

The agent.

image.png

And the monitoring.

image.png

Step 6. Now let’s check the CSV file. It was configured in the "/tmp/users.csv" path of the container.

image.png

2026-05-31 New feature: new authorization for the SCIM webservice

The new feature

From now on, all users used to access the SCIM webservice will require the new "webservice:user" authorisation.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

For this example, we will be using the Bruno application; for further information, please see this page Testing Tool.

First, let’s check that the "Test" user we were using in the SCIM web service no longer has access, see the "401 Unauthorized" error.

image.png

On the Roles page, we are going to create a new role, "SOFFID_SCIM", and then assign the new authorisation to it.

image.png

On the Authorisations page, we assign the new authorisation "webservice:user" to it.

image.png

The final step is to grant the SOFFID_SCIM role to the user.

image.png

Now, when we query the web service, it returns results.

image.png

2026-05-31 New feature: hidden stack tracers

The new feature

Users who do not have the SOFFID_ADMIN role will no longer see the details of errors in the Console; instead, an identifier will be displayed so that administrators can look it up in the Console log.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

Let’s follow these steps.

image.png

Now the user has to share the id with the Soffid administrator, in this exemple XFVBYOJTVZU4VO75.

Soffid administrators can look up the id in the "Console log" page.

image.png

2026-06-02 New feature: syslog with new protocols

The new feature

Until now, when we enabled the sending of logs via syslog to a SIEM tool, the only protocol available was UDP on port 514; now, TCP and SSL protocols have been added, and we also allow you to configure the port instead of using the default settings.

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Let's look at an example

Let’s follow these steps.

image.png


2026-07-08 New feature: geolocation service available by default

The new feature

From now on, the geolocation service and the use of AI service will be enabled by default if the AM or IRC modules have been activated. Consequently, the Network Intelligence page has been removed

Bear in mind

Please note the following points:

How to configure it?

The following components must be installed:

Following this change, there have been further updates

Let's look at an example

First of all, the Network Intelligence screen no longer exists.

image.png

We have the necessary modules in our Soffid system.

image.png

First, let’s ask the Soffid chat-bot.

image.png

And also create a new script on the Custom scripts page.

image.png

image.png

Regarding geolocation, if Soffid is installed in a public location, you can check new accesses via the Access logs page.

image.png

2026-07-08 New feature: new property removeDisabledObjects

The new feature

A new generic property “removeDisabledObjects” has been created which can be used in all agents, on the “user” and “accounts” objects. By default, its value is “false”.

Bear in mind

Please note the following points:

For more informatio you can check the Windows Connector page.

How to configure it?

The following components must be installed:

Let's look at an example

We have a disabled account on Soffid.

image.png

The account exists as inactive in the final system

image.png

We set the removeDisableObject property

image.png

We synchronise the changes with the final system.

image.png

Finally, the account has been deleted from the final system.

image.png


 

2026-06-13 New feature: device posture

The new feature

The new "Device posture" feature allows Soffid administrators to decide whether some service providers must comply specific operating system requirements.

Bear in mind

Please note the following points:

In scripts, you can use ESSO Scripting Language, for instance the SystemInfo object

How to configure it?

The following components must be installed:

Let's look at an example

As a prerequisite, you must have a Soffid identity provider set up.

image.png

In the Authentication section, you need to fill in the "Script to check posture" field.

image.png

We’re going to use the following script as an example.

debug("************");
var result = null;
v = SystemInfo.os;
d = SystemInfo.domainName;
debug("In "+v+" / "+d);
if (v == 'Windows')
  result = true;
else
  throw "You can only start a session from Windows";

return result;

You now need to enable the "Check device posture" field in the service providers.

image.png

We can now log in to this service provider, which in this case is the Soffid console.

image.png

image.png

And now, following authentication, the device posture will be evaluated.

image.png

You browser may ask you permissions.

image.png

If the validation is successful, you will be redirected to the service provider.

image.png

If the validation fails, the error specified in the validation script will be displayed.

image.png

2026-06-13 New feature: select images for Soffid Authenticator

The new feature

The Soffid Authenticator app now has four different sets of images, and you can now select the set of images using the "soffid.push.images" parameter.

Bear in mind

Please note the following points:

The details of the parameter can be found on the Soffid parameters page, Soffid Autenticator section..

How to configure it?

The following components must be installed:

Let's look at an example

Do you need a Soffid IdP.

image.png

Add Soffid Authenticator as a first or second factor.

image.png

We can now use the parameter "soffid.push.images" to view the different sets of images.

image.png

Let’s take a look at the four examples of logins!

No soffid.push.images parameter or soffid.push.images=birds

image.pngScreenshot_20260717_174126.jpg


soffid.push.images=numbers

image.pngScreenshot_20260717_174954.jpg

soffid.push.images=flowers

image.pngScreenshot_20260717_175156.jpg

soffid.push.images=fishes

image.pngScreenshot_20260717_175237.jpg

Please note that if you enter an incorrect value for the parameter, this error will appear.

image.png

2026-07-20 New feature: configure maximum openid logins

The new feature

A new feature has been introduced in the Soffid Identity Provider that limits the number of requests a user can make to an OpenID Connect service provider. The new attribute is name "Max login per user and minute".

A new issue "issue-login-limit" has also been created to manage this new configuration.

Bear in mind

Please note the following points:

About the platform:

For more information you can check the OpenIdProfile page, or the Defining profiles page

About the issue:

For more information you can check the Issue policies page

How to configure it?

The following components must be installed:

Let's look at an example

Step 1: configure the limit

Let’s go to our Soffid identity provider.

Go to Main Menu > Configuration > Web SSO > Identity providers.

Select your Soffid IDP.

And go the Profiles group and select the OpenIdProfile.

image.png

To activate the attribute "Max login per user and minute" add a number, por example 30, 60, etc.

image.png

To validate this functionality, we need to authenticate as a service provider.

First, let’s check that the service provider has configured the authentication types that the limit validates.

image.png

We’re going to test it using a testing tool; we can see that it responds correctly when the limit is not reached.

image.png

But when it reaches its limit, it returns a HTTP code 400 with the message "Login limit reached".

image.png

400 Bad Request
{
  "error_description": "com.soffid.iam.exception.InternalErrorException: Login limit reached",
  "error": "server_error"
}

Step 2: configure the issue

First, we need to open the new issue.

Main Menu > Configuration > Security settings > Issue policies.

Select the user-login-limit.

image.png

To activate the issue, we will need to assign an action type (Record or Manage).

image.png

Now create one or more actions using the "Add new" button; in our case, a personalised email will be sent.

image.png

On leaving, we can see that the issue has been Managed.

image.png

If we push the limit, a new issue will now also be created in Soffid.

Main Menu > Monitoring and reporting > Issues (or Main Menu > Self-Service portal > My issues)

image.png

And here is an example of the email that was sent

image.png