v1.7.0
Release Number: v1.7.0
Release Date: 2nd December, 2025
Overview
We’re excited to announce the release of eSignet v1.7.0, a feature-rich upgrade over v1.6.1 that introduces major advancements in security, enhanced user interaction flexibility, and improved deployment efficiency. This release includes full support for the FAPI 2.0 Security Profile, implemented through multiple industry-standard RFCs, and brings dynamic, schema-driven UI enhancements for both Signup and KBI authentication—while ensuring complete backward compatibility with existing authentication flows.
Major Highlights
New Features
Support for FAPI 2.0 Security Profile
eSignet now implements key RFCs required for FAPI 2.0 compliance, strengthening security and interoperability:
Pushed Authorization Request (PAR) – A new PAR endpoint is introduced to support secure, tamper-resistant authorization requests.
Demonstration of Proof of Possession (DPoP) – Adds cryptographic proof-of-possession for access tokens, preventing token replay attacks.
Authorization Server Issuer Identification – Enhances security by enabling the ‘Authorization Server’ to uniquely identify itself during authorization flows; includes updates to configurations in oauth authorization server well-known.
Tips:
eSignet now supports FAPI 2.0 security profile. However, enforcement of the FAPI 2.0 security profile is client-configurable. Each client can choose whether or not to enable FAPI 2.0 security profile for their integrations. If a client does not enforce the FAPI 2.0 security profile, their authentication flows will continue to work seamlessly without any change.
Enhancements
Dynamic Schema-Driven Signup UI
The Signup UI has been improved and can now be generated dynamically based on a backend-driven UI schema. This leverages a JSON form-builder library for improved flexibility and faster configuration changes.
Dynamic Schema-Driven KBI Authentication UI
The KBI authentication UI is now also fully dynamic and powered by the same schema-based JSON form builder, enhancing consistency and maintainability.
Improved Deployment Scripts
Deployment scripts for the eSignet service have been refined to simplify setup, reduce configuration overhead, and ensure smoother deployments across environments.
Bug Fixes
Several known issues from the previous release have been addressed to improve platform stability and performance. Please refer to the link here for the complete list of resolved issues.
Deployment : Not able to complete the sanity, after registration getting the error "Unable to process. Please try again".
Deployment : signup captcha is not working, throwing an error "The captcha you entered is incorrect. Please try again".
Deployment : esignet image is not getting updated to mosipqa/esignet-with-plugins:1.7.x its taking develop branch image.
Deployment : In init_values.yaml branch is pointing to develop branch instead of release-1.7.x.
Deployment : Still keyclock postgres image is pointing to bitnami.
Docker-compose : In mock-relying-party-portal-fapi2-docker-compose.yml volumes: are not given.
Linux : Docker Compose fails to start containers — “failed to extract layer” error.
eSignet-MOSIP: User is unable to complete eKYC verification in MOSIP-ID plugin.
esignet mock: Captcha is enabled but its not displayed in UI, but checking for captcha in UI and we are getting this error while signing up.
In mock : KBI Login is not working.
eSignet-MOCK: fetchUserInfo fails with error "Failed to get the User Info." when DPoP and PAR are disabled.
eSignet-MOSIP-ID: User is unable to register in signup-mosipid-qabase.
JWKS.json returning incorrect userinfo signing certificate.
Known Issues
Please refer here for full list of known issues.
In UI schema when email is marked as optional field by default its taking as mandatory field.
KBI login in mock is not working when captcha is enabled
Update documentation for partner-onboarding/esignet.
Update keycloak init scripts in esignet-signup.
Issue in partner on boarder script for eSignet.
Partner on boarder script issue in esignet-signup.
Story Development
eSignet - Signup - Add a new endpoint to support the multi-part data.
Signup Module - Signup UI registration Form - Add support to capture the face photo for the user.
Authorization Server Issuer Identification for FAPI 2.0 Compliance.
Add Support for additional Config in client management endpoint.
Push Authorization request (PAR) - FAPI 2.0 Compliance - Add a new authorize url to process request with clientid and request uri.
Push Authorization request (PAR) - FAPI 2.0 Compliance - New endpoint development to initiate PAR flow.
Sender constrained tokens using DPOP for FAPI 2.0 security profile compliance.
Enhance KBI form in eSignet UI.
Registration form on the eSignet sign-up page should dynamically adjust its fields and layout based on a predefined UI schema.
Repositories Released
Compatible Modules
eSignet compatibility with MOSIP
eSignet compatibility with Sunbird
Sunbird
eSignet Signup compatibility with MOSIP
DB Changes
Config Changes
eSignet: The properties listed below are newly added to the eSignet default configuration. For a comprehensive view of all configuration properties in eSignet, please refer here.
mosip.esignet.par.expire-seconds=60mosip.esignet.par.request-uri.prefix=urn:ietf:params:oauth:request_uri:mosip.esignet.dpop.clock-skew=10mosip.esignet.dpop.nonce.expire.seconds=15mosip.esignet.kbispec.ttl.seconds=18000mosip.esignet.client-assertion.unique.jti.required=true
Signup: The properties listed below are newly added to the Signup default configuration. For a comprehensive view of all configuration properties in eSignet, please refer here.
mosip.signup.uispec.ttl.seconds=18000
Documentation
API Documentation
Integration Guides
End User Guides
Last updated
Was this helpful?