Versions Compared

Old Version 19

changes.mady.by.user Francesco Chicchiriccò

Saved on

compared with

New Version 20

changes.mady.by.user Francesco Chicchiriccò

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Info
titleUpgrade procedure

Upgrading from 2.0.3? There are some notes about this process.

New and noteworthy

Netbeans Plugin

Besides the consolidated Eclipse IDE Plugin, a new plugin is now available for Apache Netbeans, with similar features.

Elasticsearch-based Search Engine

Especially suitable for large deployments, a new search engine relying on an external Elasticsearch cluster is provided, dramatically improving the overall search performance when the number of managed entities (Users, Groups and Any Objects) raises above tens of thousands.

JWT and security improvements

SSO header change for RESTful services

In Apache Syncope 2.0.3, SSO support was added (Image AddedSYNCOPE-1035 - JWT-based access to REST services CLOSED) for RESTful services by sending a JWT Token using the X-Syncope-Token header, e.g.:

Code Block
curl -H "X-Syncope-Token: eyJ0e..." http://localhost:8080/syncope/rest/users/self

From Syncope 2.0.4 onwards (Image AddedSYNCOPE-1120 - Use the standard Bearer Authorization header for JWT tokens CLOSED), this header value is no longer supported. Instead, you must use the standard Authorization Bearer header, e.g.:

Code Block
curl -H "Authorization: Bearer eyJ0e..." http://localhost:8080/syncope/rest/users/self

Third Party JWT SSO integration

Besides validating and accepting the JSON Web Tokens generated during the authentication process as sketched above, Apache Syncope can be enabled to cope with tokens generated by third parties.

JWS signing key reference

In Apache Syncope 2.0.3, the default signing JWS key was referenced in securityContext.xml as follows:

Code Block
"${jwsKey}.bytes"

However, this was incorrect and results in the key value with ".bytes" appended to it. In Syncope 2.0.4, the following value should be used instead

Code Block
"#{jwsKey.getBytes()}"

Default key and password checking

In Apache Syncope 2.0.4, a warning is logged if the default JWS key is used to either create / update an access token, or is used to invoke on a RESTful service. Similarly, a warning is logged if the default admin password or anonymous key are detected.

If you see these warnings in the logs then it is critical to change the default values.

More information about the internal authorization process is now available in the Reference Guide.

Issues

Sub-task

Bug

  • [SYNCOPE-1066] - WADL servlet uses request url to provide wadl
  • [SYNCOPE-1069] - Incomplete HA setup instructions
  • [SYNCOPE-1070] - Conversion pattern ignored for date, long and double values during propagation
  • [SYNCOPE-1071] - The executed notification tasks are not displaying on the console
  • [SYNCOPE-1075] - User lastChangeDate attribute is not displayed correctly
  • [SYNCOPE-1076] - The console doesn't allow to download the report in various formats
  • [SYNCOPE-1078] - Activiti modeler window doesn't open on click
  • [SYNCOPE-1079] - Missing toggle panel for the job control widget of the administration console dashboard
  • [SYNCOPE-1081] - Console: new toggle panel behavior anomalies
  • [SYNCOPE-1082] - Concurrent CRUD random failures with dynamic memberships
  • [SYNCOPE-1085] - Custom tasks modal page shouldn't show "Cancel" button
  • [SYNCOPE-1089] - Improve provisioning mapping page in order to avoid duplicates in internal attribute name list
  • [SYNCOPE-1090] - Error defining clause to search for group owners
  • [SYNCOPE-1091] - Error while downloading Jpeg binary attribute content
  • [SYNCOPE-1094] - Out of memory error while rendering PDF
  • [SYNCOPE-1098] - User edit modal page opening takes long in case of a lot of groups defined
  • [SYNCOPE-1099] - Dynamic group membership does not trigger propagation
  • [SYNCOPE-1101] - Error showing action icons on Notidfication events managements
  • [SYNCOPE-1104] - Missing autocomplete for ConnId object class when defining new provision
  • [SYNCOPE-1107] - The installer fails with a NoClassDefFoundError
  • [SYNCOPE-1108] - NullPointerException while saving an empty template
  • [SYNCOPE-1109] - Installer fails to setup Activiti
  • [SYNCOPE-1110] - Error replacing group/auxclass/resource during self-management operation
  • [SYNCOPE-1111] - New any type not shown unders Realms
  • [SYNCOPE-1112] - Error searching for user/group/anyobject by providing conditions on attribute with schema type Long
  • [SYNCOPE-1114] - Dynamic group information not available during propagation
  • [SYNCOPE-1121] - Enduser form customization does not work with empty section in edit mode
  • [SYNCOPE-1122] - Enduser must show all attributes when customForm.json has empty section with show=true
  • [SYNCOPE-1123] - Enduser UserRequestValidator NPE on custom form empty sections
  • [SYNCOPE-1125] - Password on external resource not updated via Enduser
  • [SYNCOPE-1127] - Membership attribute values are not shown
  • [SYNCOPE-1128] - Content exporter does not sort for internal foreign keys
  • [SYNCOPE-1130] - NPE refreshing realm page after realm creation
  • [SYNCOPE-1131] - Cannot delete resources owned by realms
  • [SYNCOPE-1133] - Search panel used for relationships definition does not work
  • [SYNCOPE-1134] - Action menu not working after page refresh
  • [SYNCOPE-1135] - Groups list not refreshing after realm change

Improvement

  • [SYNCOPE-1047] - Replace ActionLinksPanel with TogglePanel
  • [SYNCOPE-1053] - Show actual pending modifications during approval
  • [SYNCOPE-1067] - More flexible delegated administration model
  • [SYNCOPE-1068] - Console: CSRF protection
  • [SYNCOPE-1072] - Display or enable add button only to realms were CREATE is owned
  • [SYNCOPE-1073] - Hide realm management if no realm entitlement are owned
  • [SYNCOPE-1074] - Realm navigator: show only relevant realms for delegated admin
  • [SYNCOPE-1083] - ConnInstance location is not normalized
  • [SYNCOPE-1084] - Switch to HikariCP for Core's default DataSource definitions
  • [SYNCOPE-1086] - Avoid to read whole entities to check ETag
  • [SYNCOPE-1087] - Avoid to read input entities if no notification or audit are requested
  • [SYNCOPE-1088] - Store authorizations with access tokens
  • [SYNCOPE-1093] - Add some feedbacks when linking not existing groups/resources to existing user
  • [SYNCOPE-1100] - Provide JWT expiration information to self
  • [SYNCOPE-1103] - Option to disable Quartz instances across cluster
  • [SYNCOPE-1106] - Remove misleading getAttrMap and similar methods from TOs
  • [SYNCOPE-1117] - Make it more obvious that the jwsKey needs to be changed
  • [SYNCOPE-1118] - Update docs to explain what "anonymousKey" refers to
  • [SYNCOPE-1119] - Make it more obvious that the default admin password needs to be changed
  • [SYNCOPE-1120] - Use the standard Bearer Authorization header for JWT tokens
  • [SYNCOPE-1124] - Support functions for internal JEXL engine
  • [SYNCOPE-1126] - Include realms into the Explore Resource feature
  • [SYNCOPE-1136] - Groups list reset always after realm change

New Feature

Task

...