SSO Connect On-Prem 17.1.3

Released August 19, 2026

This release delivers post-quantum cryptography readiness, security hardening across several components, FIPS-compliant cryptography, and a simplified deployment model. No configuration changes are required.

Features

Post-quantum cryptography support (ML-KEM-1024)

SSO Connect now supports ML-KEM-1024 (Module-Lattice-Based Key Encapsulation Mechanism) for encrypted API requests, providing quantum-resistant key encapsulation aligned with Gov/Fed/IL5 requirements.

Consolidated single-JAR deployment

The SSO Connect build is now distributed as a single SSOConnect.jar, with BouncyCastle libraries in a separate lib folder for integrity verification. This simplifies deployment and reduces distribution complexity.

Redesigned error screens

Error screens have been refreshed with a clean HTML template that surfaces the affected user's email address for faster troubleshooting.

Admin login session status indicator

The administrative interface now accurately reflects server session state on load — active sessions go directly to the configuration page, with a visible indicator showing the signed-in user and session expiry.

Improvements

• Upgraded BouncyCastle to the FIPS-certified version for hardened cryptographic operations.

• Updated all third-party dependencies; the 17.1.3 release carries a clean SBOM with no known CVEs.

Security Updates

These issues were identified through Keeper's Bugcrowd vulnerability disclosure program and have been fully remediated in this release.

KSC-546 — Resolved an issue in SAML assertion signature validation that could, under specific conditions, allow authentication to succeed against a malformed response. Signature verification is now correctly bound to the target assertion element.

KSC-532 — Resolved an XSS issue on the SSO Connect debug panel. Output is now properly sanitized.

KSC-540 — Resolved a reflected XSS issue on the SSO login success page. Input is now escaped before rendering.

KSC-541 — Resolved a reflected XSS issue on the redirect page. All dynamic content on the page is now sanitized.

Keeper recommends upgrading to this release promptly. Customers on a managed update schedule will receive this release automatically.

Compatibility & Upgrade Notes

• Supported OS: Windows Server 2022/2025, Red Hat Enterprise Linux 6.8+, Ubuntu 16.04+, openSUSE 15.0+

• Java Runtime: Java 17 LTS

• No admin-side configuration changes required.

• We recommend validating SSO sign-in with your IdP (Okta, Entra ID, ADFS, Ping, Keycloak) in a non-production environment before production rollout.