OpenID Connect

Release date 2026/07/07

Bugfix

• Fixed an issue where a token endpoint response with expires_in <= 0 was cached indefinitely with the proactive expiry re-check disabled, causing the plugin to silently forward an already-expired token to the upstream until a worker/process restart.

• Fixed an issue where switching clients within a single request (via client_arg) failed to use the matching client’s JWK.

• Fixed an issue where consumer groups could not be resolved when the groups claim was only available from the user info endpoint, which resulted in a 500 error.

Release date 2026/07/02

Feature

• Added proof_of_possession_mtls_from_header for mTLS PoP validation via HTTP header when TLS is pre-terminated by downstream.

• Added support for Kong Identity principal lookup after token verification, enabling consumer and consumer group mapping from Kong Identity with caching and miss-behavior control.

• Added support for reading bearer tokens from a custom header.

• Added the cluster_cache_items configuration option. This option controls which items are stored in the cluster cache backend configured via cluster_cache_strategy. Token material is AES-encrypted before being written to the cache.

• Added verify_signature and jwks_uri fields to token_exchange.subject_token_issuers for verifying incoming subject token signatures before exchange.

Bugfix

• Fixed an inconsistency where credential_claim resolved the same claim name to a different value than upstream_headers_claims because it consulted the id_token before the access_token, while the upstream headers resolver consulted the access_token first. With IdPs (e.g. Okta) that set distinct sub values in the two tokens, authenticated_entity.id did not match the upstream header the plugin set on the same request.

• Fixed an issue where nested claim paths were not resolved correctly.

• Fixed an issue where Redis-backed session storage could fail when Redis connections were routed through a proxy.

• Fixed an issue where token cluster cache entries were not written when the cluster_cache_strategy was updated using incremental sync.

• Fixed DPoP verification for opaque tokens (RFC 9449 Section 6.2) where Kong failed to correctly parse nested cnf.jkt claims from introspection responses.

Release date 2026/07/02

Bugfix

• Fixed an issue where token endpoint responses with expires_in <= 0 were cached indefinitely when proactive expiry re-check was disabled, causing the plugin to silently forward already-expired tokens to the upstream until a worker/process restart.

Release date 2026/06/23

Bugfix

• Fixed an inconsistency where credential_claim resolved the same claim name to a different value than upstream_headers_claims because it consulted the id_token before the access_token, while the upstream headers resolver consulted the access_token first. With IdPs (like Okta) that set distinct sub values in the two tokens, authenticated_entity.id did not match the upstream header the plugin set on the same request.

• Fixed an issue where the redirect_uri parameter was sent to the token endpoint for all grant types. It is now included only for the authorization_code grant, as required by RFC 6749.

Release date 2026/06/04

Bugfix

• Fixed an issue where Redis-backed session storage could fail when Redis connections were routed through a proxy.

Release date 2026/04/28

Bugfix

• Fixed DPoP verification for opaque tokens (RFC 9449 Section 6.2) where Kong failed to correctly parse nested cnf.jkt claims from introspection responses.

Release date 2026/04/10

Bugfix

• Fixed an issue where nested claim paths were not resolved correctly.

Release date 2026/04/07

Feature

• Added consumer_claims to support mapping consumers from multiple claim paths, while retaining and supporting the existing consumer_claim as a shorthand configuration.

• Marked issuers_allowed as a referenceable field.

• Added jwks_endpoint configuration to override the discovered jwks_uri when a custom JWKS endpoint is required.

• Marked fields issuer, extra_jwks_uris, and introspection_endpoint are now supported as vault references.

• The authenticated token is now stored in the request context via kong.client.set_token.

• Added upstream_headers and downstream_headers schema fields that support nested claims.

  The previous upstream_headers_claims, upstream_headers_names, downstream_headers_claims, and downstream_headers_names schema fields are now deprecated.

• the ssl_verify(for verifying identity provider server certificate) and the session_memcached_ssl_verify(for verifying session storing memcached server certificate) option are now enabled by default as well.

• Added support for token exchange from multiple IdPs based on RFC8693.

• Added WebSocket protocol support. This authentication plugin can now protect WebSocket connections (ws and wss protocols) in addition to HTTP/HTTPS. In hybrid mode, WebSocket protocol support for this plugin requires data planes running Kong Gateway 3.14 or later; for older data planes, ensure routes do not use ws/wss protocols, as their propagation will be blocked.

Bugfix

• Fixed an issue where client-provided headers could be forwarded to upstream services when the corresponding JWT claim was missing from the token. The plugin now clears client headers before processing upstream_headers_names, ensuring that only verified JWT claim values are sent to upstream or downstream.

• Fixed an issue where the username and password were used for Redis Sentinel and no authentication supported for Redis, causing NOAUTH Authentication Required errors.

Release date 2026/06/30

Bugfix

• Fixed an inconsistency where credential_claim resolved the same claim name to a different value than upstream_headers_claims because it consulted the id_token before the access_token, while the upstream headers resolver consulted the access_token first. With IdPs (e.g. Okta) that set distinct sub values in the two tokens, authenticated_entity.id did not match the upstream header the plugin set on the same request.

• Fixed an issue where Redis-backed session storage could fail when Redis connections were routed through a proxy.

Release date 2026/04/08

Bugfix

• Fixed DPoP verification for opaque tokens (RFC 9449 Section 6.2) where Kong failed to correctly parse nested cnf.jkt claims from introspection responses.

• Fixed an issue where client-provided headers could be forwarded to upstream services when the corresponding JWT claim was missing from the token. The plugin now clears client headers before processing upstream_headers_names, ensuring that only verified JWT claim values are sent to upstream or downstream.

• Fixed an issue where the username and password were used for Redis Sentinel and no authentication supported for Redis, causing NOAUTH Authentication Required errors.

Release date 2025/12/18

Feature

• added support to the tls_certificate_verify global option. When this option is enabled the plugin’s flags ssl_verify, tls_client_auth_ssl_verify, and session_memcached_ssl_verify cannot be disabled.

• added the flags session_memcached_ssl and session_memcached_ssl_verify to switch certificate verification when connecting to Memcached server.

Bugfix

• Fixed an issue where for incremental sync, consumer related caches may not be properly invalidated, causing stale data to be served.

• Fixed an issue where the issuer mismatch error message for the token’s iss claim did not reflect the correct token type and expected issuers.

• Fixed an issue where the client_credentials/authorization_code auth would not auto-recover if IdP was not accessible during Kong startup.

• Improved claim validation logic to correctly handle timestamp claims (exp, nbf, iat) even when provided as non-numeric types.

• Fixed an issue where TLS client certificate loading failed in non-default workspaces. The certificate lookup now explicitly specifies the plugin’s workspace when querying the database during configuration initialization.

Release date 2026/04/15

Bugfix

• Fixed DPoP verification for opaque tokens (RFC 9449 Section 6.2) where Kong failed to correctly parse nested cnf.jkt claims from introspection responses.

• Fixed an issue where client-provided headers could be forwarded to upstream services when the corresponding JWT claim was missing from the token. The plugin now clears client headers before processing upstream_headers_names, ensuring that only verified JWT claim values are sent to upstream or downstream.

Release date 2026/02/26

Bugfix

• Fixed an issue where the username and password were used for Redis Sentinel and no authentication supported for Redis, causing NOAUTH Authentication Required errors.

Release date 2025/11/18

Bugfix

• Fixed an issue where for incremental sync, consumer related caches may not be properly invalidated, causing stale data to be served.

• Fixed an issue where the client_credentials/authorization_code auth would not auto-recover if IdP was not accessible during Kong startup.

Release date 2025/10/01

Feature

• Added support for session binding (IP, scheme, and/or User-Agent header).

• Added support for claim to consumer groups mapping.

Bugfix

• Fixed an issue where upstream_session_id_header and downstream_session_id_header mistakenly required the downstream_headers_claims and downstream_headers_names to be present.

Release date 2026/06/30

Bugfix

• Fixed an inconsistency where credential_claim resolved the same claim name to a different value than upstream_headers_claims because it consulted the id_token before the access_token, while the upstream headers resolver consulted the access_token first. With IdPs (e.g. Okta) that set distinct sub values in the two tokens, authenticated_entity.id did not match the upstream header the plugin set on the same request.

• Fixed an issue where Redis-backed session storage could fail when Redis connections were routed through a proxy.

Release date 2026/04/15

Bugfix

• Fixed DPoP verification for opaque tokens (RFC 9449 Section 6.2) where Kong failed to correctly parse nested cnf.jkt claims from introspection responses.

• Fixed an issue where client-provided headers could be forwarded to upstream services when the corresponding JWT claim was missing from the token. The plugin now clears client headers before processing upstream_headers_names, ensuring that only verified JWT claim values are sent to upstream or downstream.

Release date 2026/02/26

Bugfix

• Fixed an issue where the username and password were used for Redis Sentinel and no authentication supported for Redis, causing NOAUTH Authentication Required errors.

Release date 2025/11/03

Bugfix

• Fixed an issue where for incremental sync, consumer related caches may not be properly invalidated, causing stale data to be served.

• Fixed an issue where the client_credentials/authorization_code auth would not auto-recover if IdP was not accessible during Kong startup.

Release date 2025/07/03

Bugfix

• Fixed an issue where caused IdP to report invalid redirect_uri errors when config.redirect_uri was not configured and the uri path contained spaces.

• Fixed an issue where the OIDC plugin caused the third-party IDP to throw an error during logout attempts if the session had already been invalidated. Added the client_id to the logout URL to ensure the logout request is sent to the correct client, preventing such errors.

Performance

• improved the performance of signature verification.

Release date 2026/07/08

Bugfix

• Fixed an issue where switching clients within a single request (via client_arg) failed to use the matching client’s JWK.

Release date 2026/06/30

Bugfix

• Fixed an inconsistency where credential_claim resolved the same claim name to a different value than upstream_headers_claims because it consulted the id_token before the access_token, while the upstream headers resolver consulted the access_token first. With IdPs (e.g. Okta) that set distinct sub values in the two tokens, authenticated_entity.id did not match the upstream header the plugin set on the same request.

Release date 2026/05/14

Bugfix

• Fixed an issue where Redis-backed session storage could fail when Redis connections were routed through a proxy.

Release date 2026/04/09

Bugfix

• Fixed DPoP verification for opaque tokens (RFC 9449 Section 6.2) where Kong failed to correctly parse nested cnf.jkt claims from introspection responses.

• Fixed an issue where client-provided headers could be forwarded to upstream services when the corresponding JWT claim was missing from the token. The plugin now clears client headers before processing upstream_headers_names, ensuring that only verified JWT claim values are sent to upstream or downstream.

Release date 2026/02/11

Bugfix

• Fixed an issue where the username and password were used for Redis Sentinel and no authentication supported for Redis, causing NOAUTH Authentication Required errors.

Release date 2025/12/09

Bugfix

• Fixed an issue where for incremental sync, consumer related caches may not be properly invalidated, causing stale data to be served.

• Fixed an issue where the client_credentials/authorization_code auth would not auto-recover if IdP was not accessible during Kong startup.

• Fixed an issue where the OIDC plugin caused the third-party IDP to throw an error during logout attempts if the session had already been invalidated. Added the client_id to the logout URL to ensure the logout request is sent to the correct client, preventing such errors.

Release date 2025/05/20

Bugfix

• Fixed an issue which caused an IdP to report invalid redirect_uri errors when config.redirect_uri was not configured and the URI path contained spaces.

Release date 2025/03/27

Breaking Change

• Fixed an issue where forbidden requests were redirected to unauthorized_redirect_uri if configured. After the fix, forbidden requests will be redirected to forbidden_redirect_uri if configured.

Performance

• Removed issuer discovery from schema to improve performance upon plugin initialization or updating. The issuer discovery will only be triggerd by client requests.

Release date 2025/07/07

Bugfix

• Fixed an issue where caused IdP to report invalid redirect_uri errors when config.redirect_uri was not configured and the uri path contained spaces.

Release date 2024/12/12

Feature

• Allowed http_proxy_authorization and https_proxy_authorization to be referenceable.

• Added the introspection_post_args_client_headers config option, allowing you to pass client headers as introspection POST body arguments.

Bugfix

• Fixed an 500 error caused by JSON null from the request body when parsing bearer tokens or client IDs.

• Fixed an issue where the configured Redis database was ignored.

• Fixed an issue where the token_cache_key_include_scope feature was not considering scopes defined via config.scopes to generate the cache key.

Release date 2025/07/02

Bugfix

• Fixed an 500 error caused by JSON null from the request body when parsing bearer tokens or client IDs.

• Fixed an issue where caused IdP to report invalid redirect_uri errors when config.redirect_uri was not configured and the uri path contained spaces.

Release date 2024/09/11

Deprecation

• Standardized Redis configuration across plugins. The Redis configuration now follows a common schema shared with other plugins.

Feature

• Added claims_forbidden property to restrict access.

• Added support for redis cache for introspection result with new fields cluster_cache_strategy and cluster_cache_redis. When configured, the plugin will share the tokens introspection responses cache across nodes configured to use the same Redis Database.

Bugfix

• Fixed a bug where anonymous consumers may be cached as nil under a certain condition.

• Updated the rediscovery to use a short lifetime (5s) if the last discovery failed.

• Fixed an issue where using_pseudo_issuer does not work when patching.

Release date 2024/06/18

Bugfix

• Fixed a bug where anonymous consumers may be cached as nil under a certain condition.

Release date 2024/05/28

Feature

• Added support for DPoP (Demonstrating Proof-of-Possession) tokens validation. The feature is available by enabling proof_of_possession_dpop

• Add support for JWT Secured Authorization Requests (JAR) on Authorization and Pushed Authorization (PAR) endpoints, see: config.require_signed_request_object

• Add support for JARM response modes: query.jwt, form_post.jwt, fragment.jwt, jwt

Release date 2024/06/18

Bugfix

• Fixed a bug where anonymous consumers may be cached as nil under a certain condition.

Release date 2024/02/12

Feature

• configurations scopes, login_redirect_uri, logout_redirect_uri can now be referenced as a secret in the Kong Vault

• extend token_post_args_client to support injection from headers

• add support for explicit proof key for code exchange (PKCE).

• add support for pushed authorization requests (PAR).

• Support the tls_client_auth and self_signed_tls_client_auth auth methods in the OpenID Connect plugin, allowing to do mTLS Client Authentication with the IdP.

Bugfix

• Mark the introspection_headers_values in the openid-connect plugin as an encrypted and referenceable field

• Fix logout uri suffix detection by using normalized version of kong.request.get_forwarded_path() instead of ngx.var.request_uri (especially when passing query strings to logout)

• remove unwanted argument ignore_signature.userinfo from the userinfo_load function

• support for consumer group scoping by using pdk kong.client.authenticate function

• fix the cache key collision when config issuer and extra_jwks_uris contain the same uri

• Correctly handle boundary conditions for token expiration time checking

• update time when calculating token expire

Release date 2024/06/18

Bugfix

• Fixed a bug where anonymous consumers may be cached as nil under a certain condition.

Release date 2024/05/20

Bugfix

• Mark the introspection_headers_values in the openid-connect plugin as an encrypted and referenceable field

• support for consumer group scoping by using pdk kong.client.authenticate function

Release date 2023/12/21

Feature

• Openid-Connect configurations scopes, login_redirect_uri, logout_redirect_uri can now be referenced as a secret in the Kong Vault

• extend token_post_args_client to support injection from headers

Bugfix

• Fix logout uri suffix detection by using normalized version of kong.request.get_forwarded_path() instead of ngx.var.request_uri (especially when passing query strings to logout)

• update time when calculating token expire

Release date 2023/11/08

Feature

• New field unauthorized_destroy_session, which when set to true, we destory the session (delete the user’s session cookie) when the request is unauthorized. Default to true. Set to false to preserve the session.

• New field using_pseudo_issuer. When set to true, the plugin instance will not discover configuration from the issuer.

• ‘openid-connect’ plugin now supports public client

• Fix when the Dev portal OIDC is enabled, a 500 error is thrown when the administrator login successfully and then retrieves the session

• OpenID-Connect now support designate parameter name of token for introspection and revocation with introspection_token_param_name and revocation_token_param_name respectively.

Bugfix

• Fix issue on token revocation on logout where the code was revoking refresh token when it was supposed to revoke access token when using the discovered revocation endpoint.

• Fix the issue where using_pseudo_issuer does not work.

Dependency

• bump the dependency kong-openid-connect of oidc plugin from 2.5.5 to 2.5.7.

Release date 2026/04/09

Bugfix

• Fixed an issue where client-provided headers could be forwarded to upstream services when the corresponding JWT claim was missing from the token. The plugin now clears client headers before processing upstream_headers_names, ensuring that only verified JWT claim values are sent to upstream or downstream.

Performance

• Removed issuer discovery from schema to improve performance upon plugin initialization or updating. The issuer discovery will only be triggerd by client requests.

Release date 2025/11/24

Bugfix

• Fixed an issue where the client_credentials/authorization_code auth would not auto-recover if IdP was not accessible during Kong startup.

• OpenID Connect Updated the rediscovery to use a short lifetime (5s) if the last discovery failed.

Release date 2025/06/25

Bugfix

• Fixed an 500 error caused by receiving a JSON null from the request body when parsing bearer tokens or client IDs.

Release date 2025/04/29

Bugfix

• Fixed an issue which caused IdPs to report invalid redirect_uri errors when config.redirect_uri was not configured and the URI path contained spaces.

Release date 2024/06/08

Bugfix

• Fixed a bug where anonymous consumers may be cached as nil under a certain condition.

Release date 2024/03/21

Bugfix

• Mark the introspection_headers_values in the openid-connect plugin as an encrypted and referenceable field

• support for consumer group scoping by using pdk kong.client.authenticate function

Release date 2023/12/15

Feature

• configurations scopes, login_redirect_uri, logout_redirect_uri can now be referenced as a secret in the Kong Vault

• extend token_post_args_client to support injection from headers

• Fix when the Dev portal OIDC is enabled, a 500 error is thrown when the administrator login successfully and then retrieves the session

Bugfix

• update time when calculating token expire

Release date 2023/11/10

Bugfix

• Fix the issue where using_pseudo_issuer does not work.

Release date 2023/09/28

Feature

• New field unauthorized_destroy_session, which when set to true, we destory the session (delete the user’s session cookie) when the request is unauthorized. Default to true. Set to false to preserve the session.

• New field using_pseudo_issuer. When set to true, the plugin instance will not discover configuration from the issuer.

Bugfix

• Fix issue on token revocation on logout where the code was revoking refresh token when it was supposed to revoke access token when using the discovered revocation endpoint.

Release date 2023/08/09

Feature

• This plugin now supports the error reason header. This header can be turned off by setting expose_error_code to false.

• OpenID Connect now supports adding scope to the token cache key by setting token_cache_key_include_scope to true.

Bugfix

• Changed some log levels from notice to error for better visibility.

• Correctly set the right table key on log and message.

• If an invalid opaque token is provided but verification fails, the plugin now prints the correct error.

Release date 2023/09/15

Bugfix

• Correctly set the right table key on log and message.

• If an invalid opaque token is provided but verification fails, print the correct error.

Release date 2023/02/28

Feature

• These plugins now use lua-resty-session v4.0.0.

  This update includes new session functionalities such as configuring audiences to manage multiple sessions in a single cookie, global timeout, and persistent cookies.

  Due to this update, there are also a number of deprecated and removed parameters in these plugins. See the invidividual plugin documentation for the full list of changed parameters in each plugin.

  • Session changelog
  • OpenID Connect changelog
  • SAML changelog

• Session changelog

• OpenID Connect changelog

• SAML changelog

• Improved Plugin Documentation: Revised docs for the following plugins to include examples:

  • CORS
  • File Log
  • HTTP Log
  • JWT Signer
  • Key Auth
  • OpenID Connect
  • Rate Limiting Advanced
  • SAML
  • StatsD

• Improved Plugin Documentation: OpenID Connect

Bugfix

• Fixed an issue where it was not possible to specify an anonymous consumer by name.

• Fixed an issue where the authorization_cookie_httponly and session_cookie_httponly parameters would always be set to true, even if they were configured as false.

Release date 2022/12/06

Feature

• The anonymous field can now be configured as the username of the consumer. This field allows you to configure a string to use as an “anonymous” consumer if authentication fails.

Release date 2022/09/09

Bugfix

• Fixed an issue with kong_oauth2 consumer mapping.

Breaking Change

• Updated the priority for some plugins.: openid-connect changed from 1000 to 1050

Release date 2024/01/17

Bugfix

• update time when calculating token expire

Release date 2023/11/28

Feature

• New field unauthorized_destroy_session, which when set to true, we destory the session (delete the user’s session cookie) when the request is unauthorized. Default to true. Set to false to preserve the session.

Bugfix

• Fix issue on token revocation on logout where the code was revoking refresh token when it was supposed to revoke access token when using the discovered revocation endpoint.

Release date 2023/09/18

Bugfix

• If an invalid opaque token is provided but verified failed, print the correct error.

Release date 2022/10/12

Bugfix

• Fixed issues with OIDC role mapping where admins couldn’t be added to more than one workspace, and permissions were not being updated.

Release date 2022/04/07

Bugfix

• Provide valid upstream headers e.g. X-Consumer-Id, X-Consumer-Username

Release date 2022/03/02

Feature

• Added Redis ACL support (Redis v6.0.0+) for storing and retrieving a session. Use the session_redis_username and session_redis_password configuration parameters to configure it.

  These parameters replace the session_redis_auth field, which is now deprecated and planned to be removed in 3.x.x.

• Added support for distributed claims. Set the resolve_distributed_claims configuration parameter to true to tell OIDC to explicitly resolve distributed claims.

  Distributed claims are represented by the _claim_names and _claim_sources members of the JSON object containing the claims.

• Beta feature: The client_id, client_secret, session_secret, session_redis_username, and session_redis_password configuration fields are now marked as referenceable, which means they can be securely stored assecretsin a vault. References must follow a specific format.

Bugfix

• Fixed negative caching, which was loading wrong a configuration value.