UAA-Release v80+ Breaking Changes Planning

In consideration for v80

• remove support for HS256 JWT signing algorithm
• removal of already-deprecated SAML IDP configs:
  • config.socketFactoryClassName
  • config.samlConfig.certificate
  • config.samlConfig.privateKey
  • config.samlConfig.privateKeyPassword
  • config.links.logout.disableRedirectParameter

Done for v77

• Feature removal: UAA functions as a SAML IDP
  • Deprecation notice: Published in README.
  • Progress: https://github.com/cloudfoundry/uaa/pull/2638
• Feature removal: New Relic integration
  • Deprecation notice: None but asked around.
  • Progress: https://github.com/cloudfoundry/uaa-release/pull/760
• Feature removal: UAA native MFA
  • Deprecation notice: Published in README.
  • Progress: https://github.com/cloudfoundry/uaa/pull/2717 and https://github.com/cloudfoundry/uaa-release/pull/784

Other candidates

• removal: user_token grant
  • discussion here: https://github.com/cloudfoundry/uaa/pull/2193
• removal: password, implicit_grant
  • Deprecation notice: Published on UAA API docs.
• removal of the already-deprecated Introspect Token endpoint's "Authorization header = Basic authentication" option
  • Deprecation notice: Published on UAA API docs.
• removal of The /check_token endpoint
  • Deprecation notice: Published on UAA API docs.
• remove k8s related support
• remove option to use empty string as client secret
• formal removal of MySQL 5 support (flyway upgrade)
• fix introspect (maybe create a v2 endpoint but deprecate the old one)
  • https://github.com/cloudfoundry/uaa/issues/1229
• change uaa.jwt.refresh.format's default from jwt to opaque: https://github.com/cloudfoundry/uaa-release/issues/813
• defaulting uaa.client.redirect_uri.matching_mode to “exact”, which would become mandatory in OAuth 2.1

Start by reviewing the v80 candidates and the referenced UAA and uaa-release pull requests, issues, API documentation, and jobs/uaa/spec entries. The issue is a planning list rather than a defined change, so first establish which removal or default change is in scope. Done would require an agreed scope and corresponding implementation or tracking work.