--- title: "Release 2023.0.1 - What's New" slug: "release-202301-whats-new" description: "Notable enhancements and updates in the 2023.0.1 release of RapidIdentity LTS for on-premise and hosted Rapididentity customers" tags: ["What's New", "2023.0.1", "OIDC", "Entitlements", "Administrator", "Connect", "Duo", "PKCE"] updated: 2023-06-23T17:33:57Z published: 2023-06-23T17:33:57Z canonical: "help.rapididentity.com/release-202301-whats-new" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.rapididentity.com/llms.txt > Use this file to discover all available pages before exploring further. # Release 2023.0.1 - What's New ## Release 2023.0.1 - What's New This document is intended to provide you with the information and details about the new features and important changes in the 2023.0.1 release of RapidIdentity LTS. ### Notable Enhancements and New Features #### PKCE Support added in OAuth/OIDC Authorization Flow PKCE, "pixy", is an abbreviation for Proof Key for Code Exchange, an extension to the OIDC Authorization flow that enables applications to authenticate users without them needing to have a client secret. **NOTE:** The Authorization Code Flow + PKCE is an OpenId Connect flow specifically designed to authenticate native or mobile application users. While PKCE was originally designed to protect the authorization code flow in mobile apps, its ability to prevent authorization code injection makes it useful for every type of OAuth client, even web apps that use client authentication. PKCE is an optional setting on the OIDC Federation Partner configuration that can be enabled by checking the **Enable Proof Key for Code Exchange (PKCE)** checkbox in the **OpenID Connect Configuration** section of the Federation Partner configuration page. ![image.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image%28421%29.png) To configure an OIDC SSO Service Provider application in RapidIdentity, navigate to: *Configuration > Security > Identity Providers > Federation Partners* #### Support for DUO Universal Prompt Effective with the 2023.0.1 LTS release, RapidIdentity has replaced Duo's traditional Duo Prompt experience with Duo's next-generation authentication, Universal Prompt. **Note:** In order to support the new Duo Universal Prompt while still providing users the ability to **Start Over** or **Try Another Method**, RapidIdentity now displays a prompt for the user to **Proceed to Duo** before redirecting them to the Universal Prompt. To bypass the **Proceed to Duo** prompt, check the new **Bypass 'Proceed to DUO' Prompt** checkbox on the Duo Authentication Method in the associated Authentication Policy. ![image.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image%28423%29.png) *No additional changes in RapidIdentity are required for the new Duo Universal Prompt* **Additional Information** The following Duo publications provide additional information regarding Duo's new Universal Prompt: - [Duo Universal Prompt Update Guide](https://duo.com/docs/universal-prompt-update-guide) - [Duo Web v4 SDK - Duo Universal Prompt](https://duo.com/docs/duoweb#existing-web-sdk-applications) The following RapidIdentity articles provide additional information for configuring and using Duo as an authentication method in RapidIdentity: - [Duo Registration](https://help.rapididentity.com/v1/docs/duo-registration) - [Duo Authentication Setup](https://help.rapididentity.com/v1/docs/duo-authentication) - [Create a Duo Authentication Policy](https://help.rapididentity.com/v1/docs/duo) #### Search Entitlements Catalog A search bar has been added to the Entitlements Catalog page for users to more easily find the entitlements they're looking for. To search, enter any part of the Entitlement Name and press **Enter** or click the search Search is performed against any part of the Entitlement Name* ![image.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image%28425%29.png) Click the `Reset Search` button to re-display the full list of entitlements. #### New Entitlement Option to Extend or Restart the Time A new **Allow Entitlement to be Reset** option has been added to the Entitlement Configuration in *Requests* for `Time-based` entitlements. When an Entitlement *Expiration Type* is set to `Time-based` the option to **Allow Entitlement to be Reset** becomes visible and, if checked, an appropriate **Reset Workflow** and **Reset Workflow Form** can be selected. ![image.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image%28426%29.png) ![image.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image%28439%29.png) When **Allow Entitlement to be Reset** is enabled, users with an active `Time-based` entitlement can request to have the time of that entitlement extended for a specified amount of time that begins when the **Reset** request is approved. **Note:** *Reseting* an entitlement is similar but different from *Extending* an entitlement in that, when *Extended*, the requested extension time is added to the current expiration time when the extension request is approved whereas, when *Reset*, the requested extension time begins when the reset request is approved. To **Request an Entitlement Reset**, select the entitlement and click the **Request Reset** button from the bottom Action Menu. ![image.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image%28434%29.png) Reset requests, grants, denials and expirations are included in the history of the user's Entitlement. ![image.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image%28429%29.png) #### Additional Information Displayed on Request Approval Task Card Additional information has been added to task notification cards for Entitlement Requests. With this enhancement, the following details will be visible to provide approvers the information necessary to approve or deny the request without opening the request details: - *Entitlement Type* - *Requestor* has requested *Entitlement Name* for *Target* in *OU/Group*. - This request will expire in *Entitlement Request Expiration* ![image.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image%28432%29.png) #### Ability to Configure the Timezone in Connect Jobs The ability to set a Timezone when scheduling a Connect Job has been added in Connect > Jobs > Details > Schedule ![image.png](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image%28431%29.png) **Default Timezone** If not specified, the timezone of the Connect Server will be used. For Hosted RapidIdentity LTS customers, that time should be America/Chicago. For Rapididentity Cloud customers, that time will be Etc/GMT ### Significant Issues Resolved - The default 404 error page has been updated to prevent the Apache Tomcat version from displaying when a percent sign `%` is included in the appliance's URL path - A Null Pointer Exception when processing Workflow Approval Tasks has been corrected - Cloned workflows have been updated to create a new and unique form ID - An uncaught TypeError has been resolved in the Applications Module that prevented administrators from creating new SSO Form Fill Elements ## Related - [Duo Universal Prompt](/duo-universal-prompt-1.md) - [2023.0.1 Release Notes](/202301-release-notes.md) - [Single Sign On](/single-sign-on.md) - [RapidIdentity Connect - Best Practices](/rapididentity-connect-best-practices.md)