# New features



# 2026-05-08 New feature: set password when enabling an account

### The new feature

<p class="callout info">Now, when an account is **disabled**, its **password** is **deleted**. Afterwards, if the user changes his password, the disabled account will still have no password. If the disabled account is **enabled**, the agent of the account will **set** the password of the **password domain** to the account and send it to the target system.</p>

### Bear in mind

Please note the following points:

- The user's **password domain** will have **value** once at least one password has been assigned.
- The account must be a **single-user account**; these are the ones that can be viewed in a user’s accounts tab.

### How to configure it?

The following **components** must be installed:

- Console 4.0.57 (or higher)
- Syncserver 4.0.35 (or higher)
- SAP plugin 4.0.2 (or higher)

### Let's look at an example

Let’s look at an example, here we have the user "**ethan\_miller**" to whom we are going to assign the password "**Dummy01.**".

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/8KacmI0v1LGoDJfV-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/8KacmI0v1LGoDJfV-image.png)

You can check your password on the "**My accounts**" page, click on the "**View password**" of the "**app-demo**" account.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/xcUYNTHc1zmEcTHX-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/xcUYNTHc1zmEcTHX-image.png)

Now let's **disable** the "app-demo" account.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/6t1qrUFAOBlmIeqP-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/6t1qrUFAOBlmIeqP-image.png)

Check the password again, it must be empty.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-05/scaled-1680-/BeGQeZT3Rla7fpaH-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-05/BeGQeZT3Rla7fpaH-image.png)

We are going to assign a new password "**Dummy02.**".

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/18lgUFrATVmk75jn-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/18lgUFrATVmk75jn-image.png)

The other account has the new password.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/gT7ORlraCtVORk9z-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/gT7ORlraCtVORk9z-image.png)

**Enable** the "app-demo" account.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/ZA3P6gdNmBQCncYV-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/ZA3P6gdNmBQCncYV-image.png)

Check the account with the new password.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/FR3F7F3Qdx8kpCs6-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/FR3F7F3Qdx8kpCs6-image.png)

# 2026-05-19 New feature: filter holder groups at the IdP login

### The new feature

<p class="callout info">From now on, the **service providers** who have selected the “**Ask for group membership after authentication**” option will be able to filter which of these should be selectable with the attribute "**Script to filter out group memberships**".</p>

### Bear in mind

Please note the following points:

- The **holder groups** **must be** correctly **configured** in Soffid.
- If there is only **one** possible **holder group**, it is **selected automatically** and is not displayed to the user.

### How to configure it?

The following **components** must be installed:

- Addon federation 4.0.25 (or higher)

### Let's look at an example

Let’s look at an example, here we have the user "**user4**" who has already set up the **holder groups**.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-05/scaled-1680-/JpAKXBOb9tYRKvLA-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-05/JpAKXBOb9tYRKvLA-image.png)

We had a **service provider** that was already selected the option "**Ask for group membership after authentication**".

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-05/scaled-1680-/kP8QV9hPqFVt8sdA-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-05/kP8QV9hPqFVt8sdA-image.png)

The holder groups have several **custom attributes** (startDate, endDate and status).

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-05/scaled-1680-/jSgdoRMeh0qAllS1-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-05/jSgdoRMeh0qAllS1-image.png)

We now want to **filter** the **holder groups** with the attibute **status** with the **Active** value.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-05/scaled-1680-/YqrDoi5j8iFQ3WLV-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-05/YqrDoi5j8iFQ3WLV-image.png)

So we're going to create a script in the "**Script to filter out group memberships**" of the service provider.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-05/scaled-1680-/9PjFDOz2srel64TD-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-05/9PjFDOz2srel64TD-image.png)

This is the script.

```
// Return the groups whose “status” attribute has the value "Active"
//
l = new java.util.ArrayList();
lug = serviceLocator.getGroupService().findUsersGroupByUserName(user.userName);
for (i=0; i<lug.size(); i++) {
  ug = lug.get(i);
  if (ug.attributes!=null &&
      ug.attributes.get("status")!=null &&
      "Active"===ug.attributes.get("status"))
  {
    l.add(ug.group);
  }
}
return l;
```

<p class="callout warning">Please note that if the **script fails** or is **not configured correctly**, the holder groups page will **not be displayed**.</p>

Now, to test it, we’ll log in to the application (the service provider), and these are the IdP’s login pages

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-05/scaled-1680-/ljIO7Xg3gF9ZXiLx-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-05/ljIO7Xg3gF9ZXiLx-image.png)

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-05/scaled-1680-/ZZ0FVGgc0tVBYgrq-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-05/ZZ0FVGgc0tVBYgrq-image.png)

# 2026-05-21 New feature: CSV connector in Soffid 4

### The new feature

<p class="callout info">The first version of the "**CSV connector**" <span style="text-decoration: underline;">has been released in Soffid 4</span>. This connector only includes the “**Customisable CSV file**” <span style="text-decoration: underline;">agent</span>. In this version, this agent is used to **generate a CSV file** as part of the Soffid synchronisation engine.</p>

### Bear in mind

Please note the following points:

- The "Customisable CSV file" agent is used to **synchronice**, <span style="text-decoration: underline;">not for load authoritative o reconcile</span>.
- **Users** who need to be created in the CSV file must **have** an **account** with that **agent**.
- Please note the **location** where the file will be created; its configuration will depend on the **operating system** and the type of Soffid **architecture/installation**

### How to configure it?

The following **components** must be installed:

- CSV plugin 4.0.0 (or higher)

### Let's look at an example

Step 1: install the **CSV plugin** from the marketplace (Add new button) in the [License and plugin](https://bookstack.soffid.com/books/soffid-4-reference-guide/page/license-and-plugin "License and plugin") page. The name of the connector is "Test plugin".

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/2oB9SLFndZ0lcQaW-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/2oB9SLFndZ0lcQaW-image.png)

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/dhespCDZJ3dOM1sl-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/dhespCDZJ3dOM1sl-image.png)

Step 2: **create** an **agent** of the "Customisable CSV file" type.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/APaiPdzP2khgdjXu-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/APaiPdzP2khgdjXu-image.png)

Step 3: **configure** the agent with the **mappins** you need (in the "Attribute mapping" tab).

<p class="callout info">For further information on how to configure this agent, please refer to the [CSV connector in Soffid 4](https://bookstack.soffid.com/books/connectors/page/csv-connector-in-soffid-4 "CSV connector in Soffid 4") page.</p>

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/wGHA94XZpt2v0SM4-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/wGHA94XZpt2v0SM4-image.png)

Step 4. Create **CSV accounts** for users.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/5D2TnLjvWXwEAvSc-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/5D2TnLjvWXwEAvSc-image.png)

Step 5. The **accounts** created will have synchronised automatically as the **engine** is set to automatic and the **agent** is in write mode, and it is active in the **monitoring**.

The accounts.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/HZ82yAznNziSLr0g-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/HZ82yAznNziSLr0g-image.png)

The engine.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/yqx43Nf2PizJgw15-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/yqx43Nf2PizJgw15-image.png)

The agent.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/2FWWp81w2FGprT3F-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/2FWWp81w2FGprT3F-image.png)

And the monitoring.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/gMGGVd6cwWGO37Be-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/gMGGVd6cwWGO37Be-image.png)

Step 6. Now let’s **check** the CSV file. It was configured in the "/tmp/users.csv" path of the container.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/HPjZQHTHOTP0y1wY-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/HPjZQHTHOTP0y1wY-image.png)

# 2026-05-31 New feature: new authorization for the SCIM webservice

### The new feature

<p class="callout info">From now on, all **users** used to access the **SCIM webservice** will **require** the new "**webservice:user**" authorisation.</p>

### Bear in mind

Please note the following points:

- Users with the **SOFFID\_ADMIN** role **already have** this authorisation inherited by inheritance.
- <span style="text-decoration: underline;">After updating Soffid</span>, you will <span style="text-decoration: underline;">need to grant this authorisation</span> to users who are not administrators and who are already using the SCIM web service.

### How to configure it?

The following **components** must be installed:

- Console 4.0.58 (or higher)

### Let's look at an example

<p class="callout info">For this example, we will be using the Bruno application; for further information, please see this page [Testing ](https://bookstack.soffid.com/books/scim/page/testing-tool "Testing Tool")[Tool](https://bookstack.soffid.com/books/scim/page/testing-tool "Testing Tool").</p>

First, let’s check that the "**Test**" user we were using in the SCIM web service <span style="text-decoration: underline;">no longer has access</span>, see the "**401 Unauthorized**" error.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/YOxbb2qt0WTvXENH-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/YOxbb2qt0WTvXENH-image.png)

On the **Roles page**, we are going to create a new role, "**SOFFID\_SCIM**", and then assign the new authorisation to it.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/7PvJwwbnBMztwL3i-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/7PvJwwbnBMztwL3i-image.png)

On the **Authorisations page**, we assign the new authorisation "**webservice:user**" to it.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/aKeNA4AKyeJsXCtY-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/aKeNA4AKyeJsXCtY-image.png)

The final step is to **grant** the **SOFFID\_SCIM** role to the **user**.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/7Yegz9EcBDB6t9PU-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/7Yegz9EcBDB6t9PU-image.png)

Now, when we query the web service, it returns results.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/shHwcMrzgAyCMKh3-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/shHwcMrzgAyCMKh3-image.png)

# 2026-05-31 New feature: hidden stack tracers

### The new feature

<p class="callout info">**Users** who do not have the SOFFID\_ADMIN role will **no** longer **see** the details of **errors** in the **Console**; instead, an **identifier** will be displayed so that **administrators can look it up in the** [Console log](https://bookstack.soffid.com/books/soffid-4-reference-guide/page/console-log "Console log").</p>

### Bear in mind

Please note the following points:

- Users with the **SOFFID\_ADMIN** role will be able to **view the error log**.
- End **users** will see an **identifier** which they must share with the administrator.

### How to configure it?

The following **components** must be installed:

- Console 4.0.58 (or higher) -&gt; recommended Console 4.0.62 (or higher)

### Let's look at an example

Let’s follow these steps.

- Open the **Console**.
- Next, go to the **Identity Self Service** module.
- Select the **Process Search** page.
- In the search bar, select the **Advanced** option.
- Type in **any text**, for example "Test".
- Then click on the **magnifying glass** to search.
- In the pop-up window displaying the error, **click on the "+" icon** to the right of the text "‘Technical data".
- You can now see the **identifier**.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/MLyGC2KBhY6TpZYJ-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/MLyGC2KBhY6TpZYJ-image.png)

Now the user has to share the id with the Soffid administrator, in this exemple XFVBYOJTVZU4VO75.

Soffid administrators can **look up** the **id** in the "**Console log**" page.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-06/scaled-1680-/Ohnd3Hf8uSjU7dSj-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-06/Ohnd3Hf8uSjU7dSj-image.png)

# 2026-06-02 New feature: syslog with new protocols

### The new feature

<p class="callout info">Until now, when we enabled the sending of logs via syslog to a SIEM tool, the only **protocol** available was **UDP** on port 514; now, **TCP** and **SSL** protocols have been added, and we also allow you to **configure** the **port** instead of using the default settings.</p>

### Bear in mind

Please note the following points:

- Customers who have **already configured** syslog will continue to **use it as before**.
- Configuration is done through **parameters**; you can check them on the [Soffid Parameters](https://bookstack.soffid.com/books/soffid-4-reference-guide/page/soffid-parameters#bkmrk-siem-and-syslog "Soffid parameters") page.
- Once you have **created/modified/removed** the **parameters**, there is **no need to restart**.

### How to configure it?

The following **components** must be installed:

- Console 4.0.62 (or higher)

### Let's look at an example

Let’s follow these steps.

- Open the **Console**.
- Next, go to the **Soffid parameters** page.
- Create the next parameters:

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/JMVrIwkkMfUuNJyw-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/JMVrIwkkMfUuNJyw-image.png)

# 2026-07-08 New feature: geolocation service available by default

### The new feature

<p class="callout info">From now on, the **geolocation service** and the **use of AI service** will be **enabled by default** if the AM or IRC modules have been activated. Consequently, the [Network Intelligence](https://bookstack.soffid.com/books/soffid-4-reference-guide/page/network-intelligence "Network intelligence") page has been removed</p>

### Bear in mind

Please note the following points:

- This **feature** is only **enabled** if the licence includes the **AM** or **IRC** **module**.
- The **geolocation service** requires that the service be available on a **public internet machine**.
- The **AI service** is available on the [Soffid chat-bot](https://bookstack.soffid.com/books/soffid-4-reference-guide/page/soffid-chat-bot "Soffid chat-bot") page and in all script-type attributes that may appear on any page in the Console.

### How to configure it?

The following **components** must be installed:

- Console 4.0.64 (or higher)
- Syncserver 4.0.39 (or higher)
- Addon federation 4.0.36 (or higher)

Following this change, there have been further updates

- Addon admin 4.0.6 (or higher) --&gt; to use the AI assistant correctly
- Console 4.0.67 (or higher) --&gt; to use the variable SOFFID\_DISABLE\_GEOIP to disable this service

### Let's look at an example

First of all, the Network Intelligence screen no longer exists.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/6FKNvOy7UQGxZXYg-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/6FKNvOy7UQGxZXYg-image.png)

We have the necessary modules in our Soffid system.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/mF3KomSjMEKrkEIW-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/mF3KomSjMEKrkEIW-image.png)

First, let’s ask the [Soffid chat-bot](https://bookstack.soffid.com/books/soffid-4-reference-guide/page/soffid-chat-bot "Soffid chat-bot").

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/iaYutsZXlB78mh5c-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/iaYutsZXlB78mh5c-image.png)

And also create a new script on the [Custom scripts](https://bookstack.soffid.com/books/soffid-4-reference-guide/page/custom-scripts-addon-admin "Custom scripts (addon admin)") page.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/3oFrwj8sblTFG0VZ-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/3oFrwj8sblTFG0VZ-image.png)

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/e5U29IAojsSdVFdh-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/e5U29IAojsSdVFdh-image.png)

Regarding **geolocation**, if Soffid is installed in a public location, you can check new accesses via the **Access logs** page.

- Go to **Access logs** page (in **Monitoring and reporting** folder).
- Use the **magnifying glass** button to search.
- **Sort** the list by **Start Date** in descending order.
- Click the **View** button
- Add the **Country Code** attribute.
- The country should then appear in the most **recent accesses**.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/1UU5IMk0RG45AogK-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/1UU5IMk0RG45AogK-image.png)

# 2026-07-08 New feature: new property removeDisabledObjects

### The new feature

<p class="callout info">A new generic **property** “**removeDisabledObjects**” has been created which can be used in all agents, on the “**user**” and “**accounts**” objects. By default, its value is “false”.</p>

### Bear in mind

Please note the following points:

- From this version onwards, the property will always be **used internally**; if it is **not defined**, it will take the **default value** of "false".
- This property can be **used for** synchronising **users** and **accounts**.

<p class="callout info">For more informatio you can check the [Windows Connector](https://bookstack.soffid.com/books/connectors/page/windows-connector#bkmrk-propertiesWindows%20Connector "Windows Connector") page.</p>

### How to configure it?

The following **components** must be installed:

- Console 4.0.67 (or higher)
- Syncserver 4.0.39 (or higher)

### Let's look at an example

We have a **disabled account** on Soffid.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/CBPcE6xLZBaYjMXi-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/CBPcE6xLZBaYjMXi-image.png)

The **account exists** as inactive in the final system

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/NhUiSuttuuZUduBr-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/NhUiSuttuuZUduBr-image.png)

We set the **removeDisableObject** property

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/proae7Yt7pB2ZMkz-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/proae7Yt7pB2ZMkz-image.png)

We **synchronise** the **changes** with the final system.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/VMxYiXojbINP0ays-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/VMxYiXojbINP0ays-image.png)

Finally, the account has been **deleted** from the final system.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/PHZ2bmepMBsUq7FE-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/PHZ2bmepMBsUq7FE-image.png)

# 2026-06-13 New feature: device posture

### The new feature

<p class="callout info">The new "**Device posture**" feature allows Soffid administrators to decide whether some **service providers** must **comply** specific **operating system requirements**.</p>

### Bear in mind

Please note the following points:

- The "**Check device posture**" option must be **enabled** on the **service providers** in order for it to be evaluated.
- The "**Script to check posture**" for evaluating the **operating system rules** must be added to the **identity provider**.
- If you need a **specific rule** for **different service providers**, you will need to create a **virtual identity provider**, add the specific rules there, and select the service providers that must comply with them.

<p class="callout info">In scripts, you can use [ESSO Scripting Language](https://bookstack.soffid.com/books/esso/page/esso-scripting-language "ESSO Scripting Language"), for instance the [SystemInfo object](https://bookstack.soffid.com/books/esso/page/3-systeminfo-object "SystemInfo object")</p>

### How to configure it?

The following **components** must be installed:

- Addon federation 4.0.37 (or higher)
- ESSO 3.5.50-enterprise (or higher)

### Let's look at an example

As a prerequisite, you must have a **Soffid identity provider** set up.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/CMWpYs3aIMuNWds2-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/CMWpYs3aIMuNWds2-image.png)

In the Authentication section, you need to fill in the "**Script to check posture**" field.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/Tnt920tq6m55LZ60-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/Tnt920tq6m55LZ60-image.png)

We’re going to use the following **script** as an example.

```
debug("************");
var result = null;
v = SystemInfo.os;
d = SystemInfo.domainName;
debug("In "+v+" / "+d);
if (v == 'Windows')
  result = true;
else
  throw "You can only start a session from Windows";

return result;
```

You now need to enable the "**Check device posture**" field in the **service providers**.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/IVq8arU47Ej9NhwB-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/IVq8arU47Ej9NhwB-image.png)

We can now **log in** to this **service provider**, which in this case is the Soffid console.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/T7HvWc0x9lnCBEId-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/T7HvWc0x9lnCBEId-image.png)

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/P3J04QZsUHdInCk5-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/P3J04QZsUHdInCk5-image.png)

And now, following authentication, the **device posture** will be evaluated.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/PGiUalseVtSquy8A-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/PGiUalseVtSquy8A-image.png)

You browser may ask you **permissions**.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/Ta5cu8ezPiY9s30u-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/Ta5cu8ezPiY9s30u-image.png)

If the validation is **successful**, you will be redirected to the **service provider**.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/CcGCljAybSB75Kw9-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/CcGCljAybSB75Kw9-image.png)

If the **validation fails**, the **error** specified in the validation **script** will be displayed.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/keqJ7rGY1fC4Ayt6-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/keqJ7rGY1fC4Ayt6-image.png)

# 2026-06-13 New feature: select images for Soffid Authenticator

### The new feature

<p class="callout info">The [Soffid Authenticator](https://bookstack.soffid.com/books/soffid-authenticator-app "Soffid Authenticator App") app now has four different **sets of images**, and you can now select the set of images using the "**soffid.push.images**" parameter.</p>

### Bear in mind

Please note the following points:

- A **Soffid** type **Identity Provider** must be set up, and the **Soffid Authenticator** (push option) must be added as the **first** or **second** **factor**.
- Users are required to install the **Soffid Authenticator** on their **phones**.

<p class="callout info">The **details of the parameter** can be found on the [Soffid parameters](https://bookstack.soffid.com/books/soffid-4-reference-guide/page/soffid-parameters#bkmrk-soffid-autenticator "Soffid parameters") page, Soffid Autenticator section..</p>

### How to configure it?

The following **components** must be installed:

- Addon federation 4.0.36 (or higher)

### Let's look at an example

Do you need a Soffid IdP.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/2roBeWD1VQLaePTe-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/2roBeWD1VQLaePTe-image.png)

Add Soffid Authenticator as a first or second factor.

- Go to **Soffid IdP**.
- Go to **Default authentication methods** or **Adaptive authentication** (used this option in the example)
- Add the Soffid Authenticator (**Push** option) as **first** or **second factor** used this option in the example)

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/entDRGiRRu5ucabP-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/entDRGiRRu5ucabP-image.png)

We can now use the **parameter** "**soffid.push.images**" to view the different sets of images.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/D7dHUw9ufn6Ju0fr-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/D7dHUw9ufn6Ju0fr-image.png)

Let’s take a look at the four examples of logins!

No soffid.push.images parameter or soffid.push.images=**birds**

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/9tx0ZPCU1jNzlLz0-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/9tx0ZPCU1jNzlLz0-image.png)[![Screenshot_20260717_174126.jpg](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/dNEONzTcEfvl4qww-screenshot-20260717-174126.jpg)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/dNEONzTcEfvl4qww-screenshot-20260717-174126.jpg)

soffid.push.images=**numbers**

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/3tVKxCUAWkXoBi42-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/3tVKxCUAWkXoBi42-image.png)[![Screenshot_20260717_174954.jpg](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/5JD8qCnr5DuZNjv2-screenshot-20260717-174954.jpg)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/5JD8qCnr5DuZNjv2-screenshot-20260717-174954.jpg)

soffid.push.images=**flowers**

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/IaqaNXt9FS8BQzkS-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/IaqaNXt9FS8BQzkS-image.png)[![Screenshot_20260717_175156.jpg](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/Ouq5fUgRuhLCxqPy-screenshot-20260717-175156.jpg)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/Ouq5fUgRuhLCxqPy-screenshot-20260717-175156.jpg)

soffid.push.images=**fishes**

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/itKpUTyGBdmcENMH-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/itKpUTyGBdmcENMH-image.png)[![Screenshot_20260717_175237.jpg](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/ocCRWmM6r2ZmSETq-screenshot-20260717-175237.jpg)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/ocCRWmM6r2ZmSETq-screenshot-20260717-175237.jpg)

Please note that if you enter an incorrect value for the parameter, this **error** will appear.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/USiBH7lKWTiWTt48-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/USiBH7lKWTiWTt48-image.png)

# 2026-07-20 New feature: configure maximum openid logins

### The new feature

<p class="callout info">A new feature has been introduced in the Soffid Identity Provider that **limits the number of requests** a user can make to an **OpenID Connect service provider**. The new attribute is name "**Max login per user and minute**".</p>

<p class="callout info">A new **issue** "**issue-login-limit**" has also been created to manage this new configuration.</p>

### Bear in mind

Please note the following points:

- The limit only applies to OpenID service providers using "User’s password", "User’s password + Client credentials" or "Client credentials" authentication.
- The limit applies globally to all service providers using these authentication types.
- The limit is for a user, each user can reach or not the limit.
- For each request, the system checks whether the limit has been exceeded in the last minute; if the total number of requests exceeds the configured number, an error is returned.
- The system re-evaluates whether the limit has been reached with each request.
- For example, if the limit is 30 request, and 31 requests are made in 1 second, the 31st request would return an error; and for the next 59 seconds – as 31 requests plus any new ones would still be counted within the last minute – errors would continue to be returned. If, on average, one request were made every 2 seconds, the limit would never be triggered.

About the platform:

- All the previous requisites are for a non Soffid Cloud solution.
- In the Soffid Cloud the number of request is configured for a Soffid administrator, the field is not visible for the tenant

<p class="callout info">For more information you can check the [OpenIdProfile](https://bookstack.soffid.com/books/federation/page/openidprofile "OpenIdProfile") page, or the [Defining profiles](https://bookstack.soffid.com/books/federation-guide/page/defining-profiles#bkmrk-%C2%A0-1 "Defining profiles") page</p>

About the issue:

- The issue must be enabled and configured to suit your requirements.

<p class="callout info">For more information you can check the [Issue policies](https://bookstack.soffid.com/books/soffid-4-reference-guide/page/issue-policies "Issue policies") page</p>

### How to configure it?

The following **components** must be installed:

- Console 4.0.67 (or higher)
- Addon federation 4.0.37 (or higher)

### Let's look at an example

#### Step 1: configure the limit

Let’s go to our Soffid identity provider.

Go to Main Menu &gt; Configuration &gt; Web SSO &gt; **Identity providers**.

Select your **Soffid IDP**.

And go the **Profiles** group and select the **OpenIdProfile**.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/1jSHKcty45gi9gTx-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/1jSHKcty45gi9gTx-image.png)

To activate the attribute "**Max login per user and minute**" add a number, por example 30, 60, etc.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/AXxeAFOLnYpAoCfD-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/AXxeAFOLnYpAoCfD-image.png)

To validate this functionality, we need to authenticate as a **service provider**.

First, let’s check that the service provider has configured the **authentication types** that the limit validates.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-08/scaled-1680-/bIZrM1taJTpvaxzm-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-08/bIZrM1taJTpvaxzm-image.png)

We’re going to test it using a testing tool; we can see that it **responds correctly** when the limit is not reached.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/LrLi5nA4Ffm03Seh-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/LrLi5nA4Ffm03Seh-image.png)

But when it reaches its limit, it returns a **HTTP code 400** with the message "**Login limit reached**".

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/blL2sqlsGIlxfzSn-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/blL2sqlsGIlxfzSn-image.png)

```
400 Bad Request
{
  "error_description": "com.soffid.iam.exception.InternalErrorException: Login limit reached",
  "error": "server_error"
}
```

#### Step 2: configure the issue

First, we need to open the new issue.

<span class="link" id="bkmrk-main-menu">Main Menu</span><span id="bkmrk-%C2%A0%3E%C2%A0"> &gt; </span><span class="link" id="bkmrk-configuration">Configuration</span><span id="bkmrk-%C2%A0%3E%C2%A0-1"> &gt; </span><span class="link" id="bkmrk-security-settings">Security settings</span><span id="bkmrk-%C2%A0%3E%C2%A0-2"> &gt; </span><span id="bkmrk-issue-policies.">**Issue policies**.</span>

Select the **user-login-limit**.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/D02Cws9frWFsJBja-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/D02Cws9frWFsJBja-image.png)

To activate the issue, we will need to assign an **action** type (Record or Manage).

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/g12xFfRUG4fHo0ah-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/g12xFfRUG4fHo0ah-image.png)

Now **create** one or more **actions** using the "**Add new**" button; in our case, a personalised email will be sent.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/b7xdCVkAssgqTAE9-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/b7xdCVkAssgqTAE9-image.png)

On leaving, we can see that the issue has been **Managed**.

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/KubQvBIjyTFs63KM-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/KubQvBIjyTFs63KM-image.png)

If we push the limit, a new issue will now also be created in Soffid.

Main Menu &gt; Monitoring and reporting &gt; **Issues** (or Main Menu &gt; Self-Service portal &gt; **My issues**)

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/FTGVGv9xaVEMUtHE-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/FTGVGv9xaVEMUtHE-image.png)

And here is an example of the **email** that was sent

[![image.png](https://bookstack.soffid.com/uploads/images/gallery/2026-07/scaled-1680-/guxCpsPJFxKZYbHf-image.png)](https://bookstack.soffid.com/uploads/images/gallery/2026-07/guxCpsPJFxKZYbHf-image.png)