Page History

...

New and noteworthy

SAML 2.0 Service Provider improvements

The SAML 2.0 Service Provider extension - e.g. the ability to SSO into Admin Console, Enduser UI and any other Java EE application properly enabled - was provided with several enhancements:

1. allow to define complete mapping between Syncope Schema and SAML 2.0 attributes
2. allow to specify custom IdP Actions - which can be used, among other things, for flexible Role assignment based on SAML 2.0 statements
3. consent to on-the-fly creation of unmatched SAML 2.0 users, allowing users not pre-existing in a given Apache Syncope deployment to be created in case of SAML 2.0 SSO
4. strict validation of SAML 2.0 payloads
5. signature of the generated Service Provider Metadata
6. support for IdP-initiated SSO

Realm provision enhancements

Introduced in earlier versions, Realm provisioning is now feature-equivalent to Users, Groups and Any Objects provisioning, with complete mapping, resource exploration and more.

Delegated Administration for Connectors and External Resources

Connectors now requires to specify a Realm, which is then used to evaluate the entitlements owned by administrators when performing management operations on Connectors and their External Resources.

Moreover, changes in Connectors and External Resources configuration are now tracked by default and allow to revert unwanted / breaking changes at hand.

Issues

Bug

• [SYNCOPE-1139] - StackOverflowError while serializing AuditEntry after propagation
• [SYNCOPE-1140] - Error when trying to assign a relationship
• [SYNCOPE-1141] - Error when getting /numbers with application/xml
• [SYNCOPE-1149] - Access token still required for the third party JWT SSO integration scenario
• [SYNCOPE-1150] - Invalid property set for propagation task modal page header
• [SYNCOPE-1151] - Glinch in the root realm information
• [SYNCOPE-1158] - Misleading Push Task reports
• [SYNCOPE-1162] - Change to Connector's display name not reflected by contextual menu
• [SYNCOPE-1163] - External Resource priority is never NULL
• [SYNCOPE-1166] - No propagation task is created for resources where the password is not propagated
• [SYNCOPE-1168] - Encryptor pads short secret keys with "0" instead of random characters
• [SYNCOPE-1169] - Operation not supported error when trying to run a bulk action for users
• [SYNCOPE-1170] - Can't remove a "Dynamic USER assignment"
• [SYNCOPE-1174] - NPE in AccessTokenDataBinderImpl if no 'jwt.lifetime.minutes' schema is present
• [SYNCOPE-1175] - Password Reset Token Generation Not Working After Upgrading to 2.0.4
• [SYNCOPE-1178] - PlainSchema page empty while self update on Enduser
• [SYNCOPE-1179] - JWT "Date" claims are interpreted using milliseconds instead of seconds
• [SYNCOPE-1180] - No e-mail debug output
• [SYNCOPE-1184] - In the "Attributes to be displayed" sellection show the ones already displayed by default
• [SYNCOPE-1188] - NPE Message while saving Dynamic Realm with empty key
• [SYNCOPE-1189] - Realms page not accessible when user has permissions on dynamic realms
• [SYNCOPE-1190] - Username not refreshed on toggle menu after user update
• [SYNCOPE-1193] - Add the option to update a user via REST by using the username as key

Improvement

• [SYNCOPE-1096] - Download button should be disabled while populating for the first time a binary attribute
• [SYNCOPE-1097] - Downloaded file for binary attribute better naming
• [SYNCOPE-1115] - Display attributes for propagation tasks
• [SYNCOPE-1143] - Fine-grained administration rights for Connector and Resources
• [SYNCOPE-1146] - On-the-fly creation of unmatched users logging via SAML 2.0
• [SYNCOPE-1147] - Extend SAML 2.0 IdP mapping to Roles
• [SYNCOPE-1152] - Clear out unneeded anonymous authenticated services
• [SYNCOPE-1153] - Push Tasks result to show "no operation" when operation is not enabled
• [SYNCOPE-1154] - Edit resource to show always in the same order in list of object provision rules
• [SYNCOPE-1155] - Hard-coded /syncope-enduser HTTP subcontext
• [SYNCOPE-1159] - Allow to set Realm for Push Tasks
• [SYNCOPE-1164] - Complete mapping for Realm provisioning
• [SYNCOPE-1167] - Preliminary AnyType selection when adding new provision rule
• [SYNCOPE-1171] - Skip Relationships page when no relationship types exist
• [SYNCOPE-1172] - Error message of "Malformed Path" could be made a little clearer
• [SYNCOPE-1173] - Replace List<String> dynGroups with List<MembershipTO> dynMemberships
• [SYNCOPE-1176] - Edit provisioning rules menu is flat and not toggle
• [SYNCOPE-1177] - Configuration Parameter deletion should ask for confirmation
• [SYNCOPE-1182] - Use Remote Key in the Mapping to fetch external entities
• [SYNCOPE-1183] - Realm attribute available (as a detail) to use as a column in the "realm view" object list
• [SYNCOPE-1185] - Further validate SAML responses with CXF's SAMLSSOResponseValidator
• [SYNCOPE-1192] - Provide latest GIT commit hash alongside with version number
• [SYNCOPE-1194] - Sign the SAML SSO Service Provider Metadata
• [SYNCOPE-1196] - Binary previewer also for configuration parameters
• [SYNCOPE-1197] - Enduser console doesn't specify "SAML 2.0" as per the admin console
• [SYNCOPE-1198] - Make the signature algorithm configurable for SAML SSO
• [SYNCOPE-1200] - Allow to update user data during approval
• [SYNCOPE-1201] - Allow AnyType-based conditions for DynRealms
• [SYNCOPE-1202] - Support IdP Initiated SAML SSO

New Feature

• [SYNCOPE-1144] - Customizable Audit appender
• [SYNCOPE-1145] - Connector and Resource configuration versioning

Task

• [SYNCOPE-1195] - Remove copy of OpenSAMLUtil when WSS4J 2.1.11 is out

Wish

• [SYNCOPE-1161] - Option to clone a resource

...

New and noteworthy

Netbeans Plugin

Besides the consolidated Eclipse IDE Plugin, a new plugin is now available for Apache Netbeans, with similar features.

...

With the increasing number of potential actions, this mechanism proved to be poor: now, instead, a contextual menu will appear after clicking on any row, reporting all the available actions for the selected entity. 

...

New and noteworthy

SAML 2.0 Service Provider features

...

Moreover, with SYNCOPE-1015 it is now possible to configure which user attribute(s) can be passed as login name for authentication, besides username (default).

Issues

Bug

• [SYNCOPE-1003] - Error when accessing notification tasks for a given user
• [SYNCOPE-1004] - Notification tasks generated for self read event not linked to user
• [SYNCOPE-1007] - NPE in Console when on an empty search term for user assignment
• [SYNCOPE-1008] - Maven home directory not trimmed of whitespace
• [SYNCOPE-1010] - Some PushActions methods not invoked even if assigned
• [SYNCOPE-1012] - Security answer not recognized during password reset
• [SYNCOPE-1013] - Password reset link generated by default notification template does not trigger Enduser UI features
• [SYNCOPE-1014] - The list of security questions is not refreshed after creating new one
• [SYNCOPE-1016] - Last change date not updated for users when attributes are updated via pull
• [SYNCOPE-1022] - UTF-8 characters in security questions not correctly encoded by Enduser UI
• [SYNCOPE-1023] - Maven projects from archetype deploy test content with 'all' profile
• [SYNCOPE-1024] - Enduser does not manages properly ENUM schema labels
• [SYNCOPE-1025] - SYNCOPEAUDIT table not populated
• [SYNCOPE-1026] - Cannot remove group owner once set
• [SYNCOPE-1027] - Mapping errors cannot be fixed when defining provision rules for a new resource
• [SYNCOPE-1030] - Invalid DefaultAccountRule definition from Admin Console
• [SYNCOPE-1032] - Role key must be not modifiable during edit from Admin Console
• [SYNCOPE-1033] - NPE in Admin Console when working with Reconciliation Report
• [SYNCOPE-1034] - Assigned Auxiliary classes disappear in the Type Extensions panel when click on cancel
• [SYNCOPE-1036] - Notification icon does not refresh on new approval event
• [SYNCOPE-1037] - Pending approvals list is clickable
• [SYNCOPE-1038] - User create: finish button should remain clickable if the last step is reached
• [SYNCOPE-1039] - User attributes in user edit/create form are reset after validation error
• [SYNCOPE-1040] - Membership derived attributes cannot reference own plain attributes
• [SYNCOPE-1042] - Removal of all executed pull tasks via bulk action returns a missing resource exception
• [SYNCOPE-1043] - Improve JWT token expiration handling
• [SYNCOPE-1044] - By editing the provisioning rules, modal footer is not disabled
• [SYNCOPE-1045] - Activiti Modeler: log out from Admin Console in case of error
• [SYNCOPE-1046] - Console: task execution sort not working properly
• [SYNCOPE-1048] - Into the connector configuration page the same bundle appear more then once if different versions exist
• [SYNCOPE-1049] - Console returns an error if you try to explore Syncope as a remote object
• [SYNCOPE-1051] - It is possible to schedule task execution in the past
• [SYNCOPE-1052] - Enduser CAPTCHA not reloading
• [SYNCOPE-1057] - Type extensions cleared after group update during pull
• [SYNCOPE-1060] - Date in membership attribute is propagated as timestamp
• [SYNCOPE-1062] - Changes pulled from one resource not propagated externally

...