Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/975241217/Kantega+SSO+Enterprise+5.7.x+release+notes#Changes-in-5.7.2

P.S. This version contains a database migration for API tokens. Make sure to take a Backup of your configuration (Snapshot of config) before this update, in case you have to revert back.

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/975241217/Kantega+SSO+Enterprise+5.7.x+release+notes#Changes-in-5.7.2

P.S. This version contains a database migration for API tokens. Make sure to take a Backup of your configuration (Snapshot of config) before this update, in case you have to revert back.

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/962461705/Kantega+SSO+Enterprise+5.6.x+release+notes#Changes-in-5.6.2

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/962461705/Kantega+SSO+Enterprise+5.6.x+release+notes#Changes-in-5.6.2

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/962461705/Kantega+SSO+Enterprise+5.6.x+release+notes

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/962461705/Kantega+SSO+Enterprise+5.6.x+release+notes

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/947683329/Kantega+SSO+Enterprise+5.5.x+release+notes#Changes-in-5.5.4

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/947683329/Kantega+SSO+Enterprise+5.5.x+release+notes#Changes-in-5.5.4

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/947683329/Kantega+SSO+Enterprise+5.5.x+release+notes#Changes-in-5.5.2

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/947683329/Kantega+SSO+Enterprise+5.5.x+release+notes#Changes-in-5.5.2

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/947683329/Kantega+SSO+Enterprise+5.5.x+release+notes#Changes-in-5.5.0

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/947683329/Kantega+SSO+Enterprise+5.5.x+release+notes#Changes-in-5.5.0

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/945291281/Kantega+SSO+Enterprise+5.4.x+release+notes#Changes-in-5.4.0

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/945291281/Kantega+SSO+Enterprise+5.4.x+release+notes#Changes-in-5.4.0

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/939720711/Kantega+SSO+Enterprise+5.3.x+release+notes#Changes-in-5.3.2

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/939720711/Kantega+SSO+Enterprise+5.3.x+release+notes#Changes-in-5.3.2

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/939720711/Kantega+SSO+Enterprise+5.3.x+release+notes

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/939720711/Kantega+SSO+Enterprise+5.3.x+release+notes

https://kantega-sso.atlassian.net/l/c/JHuQ5WzB

https://kantega-sso.atlassian.net/l/c/JHuQ5WzB

Please note that Kantega SSO is not affected by Log4shell (CVE-2021-44228), but this is a consolidation to avoid other potential vulnerabilities. Read the whole release note here: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/925892617/Kantega+SSO+Enterprise+5.1.x+release+notes#Changes-in-5.1.2

Please note that Kantega SSO is not affected by Log4shell (CVE-2021-44228), but this is a consolidation to avoid other potential vulnerabilities. Read the whole release note here: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/925892617/Kantega+SSO+Enterprise+5.1.x+release+notes#Changes-in-5.1.2

Consolidated logging by replacing all remaining direct references to the provided dependency of Log4j 1.2.17 with the facade Slf4j. Older versions of Kantega SSO are not affected by CVE-2021-44228, but this release mitigates risk of other vulnerabilities. Read more about the log4j vulnerability here: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/932118634/About+the+Log4j+vulnerability+CVE-2021-44228

Consolidated logging by replacing all remaining direct references to the provided dependency of Log4j 1.2.17 with the facade Slf4j. Older versions of Kantega SSO are not affected by CVE-2021-44228, but this release mitigates risk of other vulnerabilities. Read more about the log4j vulnerability here: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/932118634/About+the+Log4j+vulnerability+CVE-2021-44228

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/925892617/Kantega+SSO+Enterprise+5.1.x+release+notes#Changes-in-5.1.1

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/925892617/Kantega+SSO+Enterprise+5.1.x+release+notes#Changes-in-5.1.1

Fix performance issue with unnecessary database queries to AO_xx_RESTRICT_APIENDPOINT on REST API filter

Fix performance issue with unnecessary database queries to AO_xx_RESTRICT_APIENDPOINT on REST API filter

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/925892617/Kantega+SSO+Enterprise+5.1.x+release+notes

Release notes: https://kantega-sso.atlassian.net/wiki/spaces/KSE/pages/925892617/Kantega+SSO+Enterprise+5.1.x+release+notes

https://kantega-sso.atlassian.net/l/c/iuFW12Nw

https://kantega-sso.atlassian.net/l/c/iuFW12Nw

https://kantega-sso.atlassian.net/l/c/0DJ91HjR

https://kantega-sso.atlassian.net/l/c/0DJ91HjR

https://kantega-sso.atlassian.net/l/c/nq0KLcJA

https://kantega-sso.atlassian.net/l/c/nq0KLcJA

Bugs

• API tokens are blocked when BasicAuth is disabled
• When using JIT provisioning and sending the email parameter as a list instead of a string, the first email is not extracted correctly

Bugs

• API tokens are blocked when BasicAuth is disabled
• When using JIT provisioning and sending the email parameter as a list instead of a string, the first email is not extracted correctly

Improvements

• Allow user lookup in an AD directory where the user is a member of a subdomain of the directory baseDn
• Allow Jira Crowd requests to pass through when Basic Auth and API tokens are restricted

Bugs

• Just-in-time provisioning does not work with a delegated user directory

Improvements

• Allow user lookup in an AD directory where the user is a member of a subdomain of the directory baseDn
• Allow Jira Crowd requests to pass through when Basic Auth and API tokens are restricted

Bugs

• Just-in-time provisioning does not work with a delegated user directory

Features:

• [User Provisioning] Authenticated anonymous browsing: allow users to browse "anonymous" to the Atlassian product after SAML/OIDC login instead of Just-in-time create user
• [Kerberos] Toggle Kerberos based on user directory

Improvements:

• [OIDC] Support incoming list in OIDC email claim
• [OIDC/SAML] Support \L and \U for lowercase/uppercase in OIDC/SAML user lookup regular expressions
• [SCIM] Support externalId claim for filter in SCIM
• [API Tokens] REST API Access blocking non-API token requests reduced to DEBUG level logging and added to access log

Bugs:

• [API Connector] Bad handling of incorrect tenant name input
• [OIDC] OIDC single logout not triggered from Jira Service Management

Features:

• [User Provisioning] Authenticated anonymous browsing: allow users to browse "anonymous" to the Atlassian product after SAML/OIDC login instead of Just-in-time create user
• [Kerberos] Toggle Kerberos based on user directory

Improvements:

• [OIDC] Support incoming list in OIDC email claim
• [OIDC/SAML] Support \L and \U for lowercase/uppercase in OIDC/SAML user lookup regular expressions
• [SCIM] Support externalId claim for filter in SCIM
• [API Tokens] REST API Access blocking non-API token requests reduced to DEBUG level logging and added to access log

Bugs:

• [API Connector] Bad handling of incorrect tenant name input
• [OIDC] OIDC single logout not triggered from Jira Service Management

Features:

• Kerberos: Wizard helps to fix UPN bound to incorrect AD account issues
• SCIM: Ability to turn off SCIM request authentication using bearer tokens

Improvements:

• SCIM is now out of BETA

Bugs:

• Depreciation warning when configuring CDN with Kantega SSO installed

Features:

• Kerberos: Wizard helps to fix UPN bound to incorrect AD account issues
• SCIM: Ability to turn off SCIM request authentication using bearer tokens

Improvements:

• SCIM is now out of BETA

Bugs:

• Depreciation warning when configuring CDN with Kantega SSO installed

Support for login when using Refined Mobile app

Support for login when using Refined Mobile app

Fix:

• Redirect based on user directory is no longer independent of user lookup attribute

Fix:

• Redirect based on user directory is no longer independent of user lookup attribute

New features

• [SCIM] Added support for filtered sub-attribute targets in PATCH requests

Security

• App configuration access level increased to system administrator to avoid the possibility for ordinary administrators to elevate privileges

New features

• [SCIM] Added support for filtered sub-attribute targets in PATCH requests

Security

• App configuration access level increased to system administrator to avoid the possibility for ordinary administrators to elevate privileges

New features

• Added support tab with ability to search documentation and quickly contact support
• Added page for debug information about entire app configuration
• Allow username/password login only for specific user groups

Improvements

• Backup of API tokens and Restrict API endpoint settings in "Snapshot of config"

New features

• Added support tab with ability to search documentation and quickly contact support
• Added page for debug information about entire app configuration
• Allow username/password login only for specific user groups

Improvements

• Backup of API tokens and Restrict API endpoint settings in "Snapshot of config"

New features

• Restrict rest API endpoints only to use API tokens for Authentication
• [SAML] Schedule automatic metadata refresh
• [OIDC] Support for Azure AD multi-tenant architecture • Disable traditional login based on the user directory
• Assign default groups based on regex rules

Improvements

• Rewritten license warnings to give a better understanding of why the license is not valid

Fixes

• NoSuchElementException in logs when loading the login page
• SCIM does not accept usernames with apostrophes
• Possible NullPointerException during Single Logout
• Moved away from using CLOB value

New features

• Restrict rest API endpoints only to use API tokens for Authentication
• [SAML] Schedule automatic metadata refresh
• [OIDC] Support for Azure AD multi-tenant architecture • Disable traditional login based on the user directory
• Assign default groups based on regex rules

Improvements

• Rewritten license warnings to give a better understanding of why the license is not valid

Fixes

• NoSuchElementException in logs when loading the login page
• SCIM does not accept usernames with apostrophes
• Possible NullPointerException during Single Logout
• Moved away from using CLOB values

Fixes:

• SAML/OIDC: Inconsistent behavior with auto redirect mode using remember-my-login
• SAML: Test page for certificate shows variables instead of actual values

Fixes:

• SAML/OIDC: Inconsistent behavior with auto redirect mode using remember-my-login
• SAML: Test page for certificate shows variables instead of actual values

New features:

• OIDC: support for "client_secret_post" client authentication method
• Kerberos: toggle to disable Kerberos on JSM/JSD knowledge base

Improvements:

• OIDC: more robust and richer test login flow and more details in debug info
• OIDC/SAML: test result page has better tracking with a unique ID

Fixes:

• SAML: missing sanitization of URL on SAML response page

New features:

• OIDC: support for "client_secret_post" client authentication method
• Kerberos: toggle to disable Kerberos on JSM/JSD knowledge base

Improvements:

• OIDC: more robust and richer test login flow and more details in debug info
• OIDC/SAML: test result page has better tracking with a unique ID

Fixes:

• SAML: missing sanitization of URL on SAML response page

Improvements

• ForceSSO for JEditor

Fixes

• Possible NullPointerException on API Tokens

Improvements

• ForceSSO for JEditor

Fixes

• Possible NullPointerException on API Tokens

Fixes

• [OIDC] Single Logout issues with activation, incorrect return URL, and improved error handling
• API Tokens incorrectly logs error on version upgrade

Fixes

• [OIDC] Single Logout issues with activation, incorrect return URL, and improved error handling
• API Tokens incorrectly logs error on version upgrade

Improvements:

• Remove use of API_TOKEN prefix
• Added origin validation as part of CSRF check

Bug fixes:

• Some URLs got 404 on Confluence 6.15.10 and older

Improvements:

• Remove use of API_TOKEN prefix
• Added origin validation as part of CSRF check

Bug fixes:

• Some URLs got 404 on Confluence 6.15.10 and older

Features

• SAML: Added support for changing SSL fingerprint during metadata refresh
• SAML: Added support for HTTP (not only HTTPS) in metadata URL

Fixes

• Kerberos: Fixed logging and improved exception handling for AD server DNS lookup

Also, the following third party libraries were updated:

• commons-io 1.4 to 2.4
• commons-fileupload 1.2.1 to 1.4
• guava 19.0 to 30.0-jre
• jetty 9.4.7.v20170914 to 9.4.34.v20201102
• jackson-databind 2.9.8 to 2.9.10.6
• jackson-module-parameter-names 2.9.8 to 2.9.10
• jackson-datatype-jdk8 2.9.8 to 2.9.10
• jackson-datatype-jsr310 2.9.8 to 2.9.10
• jackson-module-jaxb-annotations 2.9.8 to 2.9.10
• opensaml-saml-impl 3.4.2 to 3.4.5
• slf4j-api 1.7.5 to 1.7.30

Features

• SAML: Added support for changing SSL fingerprint during metadata refresh
• SAML: Added support for HTTP (not only HTTPS) in metadata URL

Fixes

• Kerberos: Fixed logging and improved exception handling for AD server DNS lookup

Also, the following third party libraries were updated:

• commons-io 1.4 to 2.4
• commons-fileupload 1.2.1 to 1.4
• guava 19.0 to 30.0-jre
• jetty 9.4.7.v20170914 to 9.4.34.v20201102
• jackson-databind 2.9.8 to 2.9.10.6
• jackson-module-parameter-names 2.9.8 to 2.9.10
• jackson-datatype-jdk8 2.9.8 to 2.9.10
• jackson-datatype-jsr310 2.9.8 to 2.9.10
• jackson-module-jaxb-annotations 2.9.8 to 2.9.10
• opensaml-saml-impl 3.4.2 to 3.4.5
• slf4j-api 1.7.5 to 1.7.30

Features

• Support for Identity Providers requiring POST binding of SAML Request

Fixes

• X509 Certificates for SAML does not display correctly
• Header Authentication does not work for REST
• API Tokens does not work if there exists an inactive user in Internal Directory and an active user in Active Directory with the same username

Features

• Support for Identity Providers requiring POST binding of SAML Request

Fixes

• X509 Certificates for SAML does not display correctly
• Header Authentication does not work for REST
• API Tokens does not work if there exists an inactive user in Internal Directory and an active user in Active Directory with the same username

Fixes

• OIDC: aud (Audience) claim in id_token only accepts string value and not array

Fixes

• OIDC: aud (Audience) claim in id_token only accepts string value and not array

New features

• OIDC: Rewritten library for OIDC
• OIDC: Configure scopes used in OIDC request
• OIDC: Support for domain hint for Azure AD and hosted domain for Google

Improvements

• OIDC: Better feedback when something goes wrong

New features

• OIDC: Rewritten library for OIDC
• OIDC: Configure scopes used in OIDC request
• OIDC: Support for domain hint for Azure AD and hosted domain for Google

Improvements

• OIDC: Better feedback when something goes wrong

Fixes

• API token authentication can now receive a request with session cookie without account lockout.
• Hosted Domain is not added to the SAML authentication URL in a two-step login flow.

Fixes

• API token authentication can now receive a request with session cookie without account lockout.
• Hosted Domain is not added to the SAML authentication URL in a two-step login flow.

Fixes

• API Tokens: Valid token requests counted as failed password attempts. Prefix old tokens with API_TOKEN_ to make use of the new functionality.

Fixes

• API Tokens: Valid token requests counted as failed password attempts. Prefix old tokens with API_TOKEN_ to make use of the new functionality.

New features

• SAML: Hosted domain (hd) support for suggesting domain to the identity provider.

Fixes

• API Tokens: Storage format not compatible with the Atlassian backup mechanism.
• API Tokens: Failed token requests counted as failed password attempts. Prefix old tokens with API_TOKEN_ to make use of the new functionality.

New features

• SAML: Hosted domain (hd) support for suggesting domain to the identity provider.

Fixes

• API Tokens: Storage format not compatible with the Atlassian backup mechanism.
• API Tokens: Failed token requests counted as failed password attempts. Prefix old tokens with API_TOKEN_ to make use of the new functionality.

New features

• API tokens: Ability to restrict requests based on IP addresses, and user permissions can be set based on group memberships.
• Kerberos: Possibility to enable SSO for user avatar URLs.
• SAML: Support for login hint when using 2-step login.

Fixes

• OIDC: Redirect based on user directory does not save selected user directories.

Improvements

• Name change of IP restriction modes to prevent confusion with IP lists.
• Improved SAML test page debug info.
• More robust test login incognito mode detection.

New features

• API tokens: Ability to restrict requests based on IP addresses, and user permissions can be set based on group memberships.
• Kerberos: Possibility to enable SSO for user avatar URLs.
• SAML: Support for login hint when using 2-step login.

Fixes

• OIDC: Redirect based on user directory does not save selected user directories.

Improvements

• Name change of IP restriction modes to prevent confusion with IP lists.
• Improved SAML test page debug info.
• More robust test login incognito mode detection.

New features

• SAML/OIDC: Redirect based on username now respects all configured lookup attributes when using redirect by user directory or redirect by selected groups.
• SAML/OIDC: Possibility to require SAML/OIDC response to contain at least one group to allow Just-in-Time provisioning to create users.

Fixes

• Active Directory test does not support multi-domain.
• Broken Just-in-Time provisioning link on the Group memberships page.

Improvements

• Changed wording from whitelist/blacklist to unblocked list/blacked list.

New features

• SAML/OIDC: Redirect based on username now respects all configured lookup attributes when using redirect by user directory or redirect by selected groups.
• SAML/OIDC: Possibility to require SAML/OIDC response to contain at least one group to allow Just-in-Time provisioning to create users.

Fixes

• Active Directory test does not support multi-domain.
• Broken Just-in-Time provisioning link on the Group memberships page.

Improvements

• Changed wording from whitelist/blacklist to unblocked list/blacked list.

Okta has changed the attributes and pagination in their user APIs.

If you use the API Connector features to syncronize Okta users and experience that you are only able to sync 200 users but have a larger user base, you are most likely hit by this change and should upgrade to version 4.2.2 of Kantega SSO.

Okta has changed the attributes and pagination in their user APIs.

If you use the API Connector features to syncronize Okta users and experience that you are only able to sync 200 users but have a larger user base, you are most likely hit by this change and should upgrade to version 4.2.2 of Kantega SSO.

• New feature OIDC/SAML: Group creation and synchronization of all incoming group claims as an alternative to managed groups
• SAML fix: Error on test page when incoming SAML response is incomplete

• New feature OIDC/SAML: Group creation and synchronization of all incoming group claims as an alternative to managed groups
• SAML fix: Error on test page when incoming SAML response is incomplete

• Fix: Links from Jira issues to Confluence pages not working

• SAML/OIDC improvement: Regular expressions in username transformation will now also try original username if no match is found
• Cloud User Sync performance improvements when adding synced users to local groups
• Internal technical improvements

• Fix: Links from Jira issues to Confluence pages not working

• SAML/OIDC improvement: Regular expressions in username transformation will now also try original username if no match is found
• Cloud User Sync performance improvements when adding synced users to local groups
• Internal technical improvements

Fix regression introduced in 4.1.12, where basic auth REST requests would give 401 response code when Kerberos is enabled

Fix regression introduced in 4.1.12, where basic auth REST requests would give 401 response code when Kerberos is enabled

• Feat: Rate limit delay for Okta API Connector. Avoid creating too many API requests within a short timeframe.

• Improvement: Update Keycloak setup guides
• Fix: 500 error on SAML key management page

• Feat: Rate limit delay for Okta API Connector. Avoid creating too many API requests within a short timeframe.
• Improvement: Update Keycloak setup guides
• Fix: 500 error on SAML key management page