4.1.0-M0 (February 19th, 2026)
Less than 1 year and about 500 commits after Syncope 4.0 Notturno, here it comes the new major series Syncope 4.1 Capriccio.
Syncope 4.1 Capriccio is a full-fledged IAM system covering provisioning, reconciliation and reporting needs, access management and API management.
What's new
The codebase is based on Java 21 and Jakarta EE 10.
All the Syncope components are now based on Spring Boot 3.5.
Syncope Web Access is now based on Apereo CAS 7.3.
Relationship attributes
Similarly to what already supported by Memberships, Relationships can now hold attributes, defined by Type Extensions and configurable for External Resource Mapping.
Any Managers
Users, Groups and Any Objects can designate a User or a Group as their manager.
This allows for greater flexibility when designing and implementing delegated administration.
WA: Password Management
Provide full support and configuration for CAS Password Management, e.g. the ability to centrally manage and configure the ability to intercept when login requests fail due to password policy rejection, and allow the user to update the account password in place.
Upgrade from Syncope 4.0
Planning the upgrade of an existing Apache Syncope 4.0 deployment to Syncope 4.1 can be achieved by following the indications in the Reference Guide.
Issues
Bug
- [SYNCOPE-1873] - LocalDateTime fields not properly handled in BeanPanel
- [SYNCOPE-1875] - SAML delegated authentication: metadata keeps getting re-generated
- [SYNCOPE-1878] - Priority propagation failing with NOT_ATTEMPTED
- [SYNCOPE-1879] - Serialization error while auditing Pull data
- [SYNCOPE-1881] - WA: SP Metadata not fetched from Core
- [SYNCOPE-1882] - Multivalue dropdown attributes show additional empty selectable value
- [SYNCOPE-1883] - Google MFA authentication does not validate scratch codes
- [SYNCOPE-1884] - Errors with Encrypted plain values
- [SYNCOPE-1888] - Console: change required property for specific inputs in policy configuration
- [SYNCOPE-1890] - Configure max retry attempts for login with Syncope authentication module on WA
- [SYNCOPE-1891] - Missing mapped attribute setting for SAML2IdPAuthModuleConf
- [SYNCOPE-1894] - Mapping parsing error while schema contains a dot
- [SYNCOPE-1895] - Console CSV export does not consider search filter
- [SYNCOPE-1896] - Audit: not serializable exception for ConnectorObject and Any instances
- [SYNCOPE-1899] - Console: code editor does not persist changes
- [SYNCOPE-1902] - Can't set Unauthorized Redirect URL in access policy via Console
- [SYNCOPE-1904] - Console: cannot edit authentication.attributes under Keymaster > Parameters
- [SYNCOPE-1905] - Error while pulling a specific group (single pull) from resource
- [SYNCOPE-1906] - Wrong result order if sorting by plain attribute
- [SYNCOPE-1910] - Tasks and Reports executed nevertheless inactive
- [SYNCOPE-1911] - Case sensisitve search failing with Elasticsearch or OpenSearch
- [SYNCOPE-1912] - Linked account password is not propagated on update
- [SYNCOPE-1913] - Missing dependency to resolve inline Groovy in Syncope WA
- [SYNCOPE-1915] - Failure when running the Persistence Storage Upgrader against Oracle DBMS
- [SYNCOPE-1919] - Notification Job occasionally stuck
- [SYNCOPE-1920] - Error in search panel while trying to add a condition after an attribute of type Long
- [SYNCOPE-1922] - Disallow searches by encrypted attribute
- [SYNCOPE-1924] - Bug in retainAll, removeAll, and removeIf methods of PropagationByResource
- [SYNCOPE-1925] - Contextual menu stays open after modal window is closed
- [SYNCOPE-1928] - Session timeout not working for Console
- [SYNCOPE-1933] - Console: only first dynamic group is shown
- [SYNCOPE-1936] - WA: only SIGNATURE and CURRENT keys generated for OIDC
- [SYNCOPE-1937] - User password history length is not correctly trimmed
- [SYNCOPE-1942] - Menu localization doesn't work properly on admin console
- [SYNCOPE-1943] - French Canadian GUI failed with Groups contextual menu
- [SYNCOPE-1944] - Membership derived attributes are not computed from membership plain attributes
New Feature
Improvement
- [SYNCOPE-1621] - Allow export for individual items in XML
- [SYNCOPE-1841] - Read-only multi value schema must not show new and delete button
- [SYNCOPE-1870] - Generic exception handling (RestServiceExceptionMapper)
- [SYNCOPE-1872] - Allow setting of force execution for MFA authentication
- [SYNCOPE-1880] - SCIM endpoints ignore the Prefer header
- [SYNCOPE-1885] - Self password reset does not trigger notification tasks without Flowable extension
- [SYNCOPE-1886] - Elasticsearch and Opensearch query performance improvements
- [SYNCOPE-1887] - Enduser: require re-authentication for sensitive features
- [SYNCOPE-1889] - Improve group search using SCIM extension
- [SYNCOPE-1892] - Further Macro improvements
- [SYNCOPE-1893] - SCIM extension improvement
- [SYNCOPE-1897] - WA: mapping Google MFA crypto settings
- [SYNCOPE-1898] - Reset password with WA if mustChangePassword is true
- [SYNCOPE-1900] - Implement OIDC Back-Channel Logout for Console and Enduser
- [SYNCOPE-1903] - Add endpoint to verify the security answer during password reset in CAS
- [SYNCOPE-1907] - Run Groovy code in a sandbox
- [SYNCOPE-1908] - Improve Relationship management
- [SYNCOPE-1909] - Docker containers as unprivileged user
- [SYNCOPE-1914] - WA SAML 2.0: support IdP customization per Client Application
- [SYNCOPE-1917] - Manage bypassTrustedDeviceEnabled on Syncope WA
- [SYNCOPE-1918] - Push task with assign unmatching rule remove dynamic memberships
- [SYNCOPE-1926] - Reduce number of update on Syncope after a SCIM PATCH
- [SYNCOPE-1927] - Macro Tasks: simplify binary form property binding
- [SYNCOPE-1929] - Console: allow to extend session duration
- [SYNCOPE-1930] - Exploit MariaDB with JSON
- [SYNCOPE-1931] - Allow for JEXL custom functions
- [SYNCOPE-1932] - Improve AES management
- [SYNCOPE-1934] - Allow to select multiple AnyTypeClasses for Realm
- [SYNCOPE-1949] - Allow to search AuthProfile owners
- [SYNCOPE-1950] - Allow configuration of OIDC Token Expiration Policy in WA
Task