• Add warning for NTLM when using incorrect Java 11, Java 17 runtime configuration
• Reload kerberos config after properties have changed
• Update dependencies

• Add warning for NTLM when using incorrect Java 11, Java 17 runtime configuration
• Reload kerberos config after properties have changed
• Update dependencies

• Add warning for Kerberos when using incorrect Java 11, Java 17 runtime configuration

• Add warning for Kerberos when using incorrect Java 11, Java 17 runtime configuration

• Add SAML support for SessionNotOnOrAfter attribute
• Add SAML request signing on login for redirect binding
• Add SAML request signing on logout for redirect binding
• Add SAML support for redirect binding Single Log Out (SLO)

• Add SAML support for SessionNotOnOrAfter attribute
• Add SAML request signing on login for redirect binding
• Add SAML request signing on logout for redirect binding
• Add SAML support for redirect binding Single Log Out (SLO)

• Add logging for session info not sent on logout
• Fix metadata for SLO based on admin binding type
• Fix mismatched SPNameQualifier on login and logout
• Fix jespa upload problem with debug enabled

• Add logging for session info not sent on logout
• Fix metadata for SLO based on admin binding type
• Fix mismatched SPNameQualifier on login and logout
• Fix jespa upload problem with debug enabled

• Signed Requests for SAML Login POST bindings
• Signed Requests for SAML Logout POST bindings
• Update security dependencies
• Bug fixes

• Signed Requests for SAML Login POST bindings
• Signed Requests for SAML Logout POST bindings
• Update security dependencies
• Bug fixes

• Update outdated dependencies
• Improve error messages for SAML Signature validation

• Update outdated dependencies
• Improve error messages for SAML Signature validation

• Improved error handling
• Improved Jespa IOPLEX v2 compatibility

• Improved error handling
• Improved Jespa IOPLEX v2 compatibility

• UI changes for "blocklist" and "allowlist"
• IOPLEX Jespa library version displayed in EasySSO/NTLM/About dialog (if re-uploaded)

• UI changes for "blocklist" and "allowlist"
• IOPLEX Jespa library version displayed in EasySSO/NTLM/About dialog (if re-uploaded)

• Improve error messages for NTLM configuration
• Update dependencies

• Improve error messages for NTLM configuration
• Update dependencies

• Update dependencies

• Update dependencies

• Update dependencies

• Update dependencies

IOPLEX Jespa library 1.2.11 introduced some incompatible changes. This fix addresses this incompatibility and makes EasySSO support both old and new versions of Jespa.

IOPLEX Jespa library 1.2.11 introduced some incompatible changes. This fix addresses this incompatibility and makes EasySSO support both old and new versions of Jespa.

• Removed session check from metadata URL
• Added a message in UI to indicate that the SAML metadata is only available to IP addresses not filtered out by the IP filtering
• Updated the license warning message

• Removed session check from metadata URL
• Added a message in UI to indicate that the SAML metadata is only available to IP addresses not filtered out by the IP filtering
• Updated the license warning message

• Added support for NameID formats(transient, persistent … ) when performing Single Log Out (SLO)
• Fixed a bug in how logout binding types and URLs were identified from the UI settings (Redirect vs. POST)

• Fix a bug where incorrect SAML binding type is selected on logout

• Fix a bug where incorrect SAML binding type is selected on logout

• Improved screen reader support on NTLM/Kerberos, SAML, X509 & Headers configuration pages

• Success and error messages are now announced to screen reader when displayed
• All configuration links now accessible by keyboard navigation
• Improved description and help messages

Bugfixes:

• Added a log warning when a non-admin user attempts to update groups for system-admin groups.

• Improved screen reader support on NTLM/Kerberos, SAML, X509 & Headers configuration pages
• Success and error messages are now announced to screen reader when displayed
• All configuration links now accessible by keyboard navigation
• Improved description and help messages

Bugfixes:

• Added a log warning when a non-admin user attempts to update groups for system-admin groups.

• Fix for bug where SAML SLO will not complete with certain configurations
• Fix for bug where incorrectly cased computer account name used for Kerberos - causing Message Stream Modified errors

• Fix for bug where SAML SLO will not complete with certain configurations
• Fix for bug where incorrectly cased computer account name used for Kerberos - causing Message Stream Modified errors

• Fix for an issue where the computer account name is entered in the format username$@domain.com results in "message stream modified" exception.

• Fix for an issue where the computer account name is entered in the format username$@domain.com results in "message stream modified" exception.

New Features:

• Support Kerberos with Strong Encryption Types
• JIT User Provisioning and syncing from SAML IdP

Bugfixes:

• Fix for popup when leaving admin form
• Fix for SAML failure page rendering variable name
• Fix for Computer account screen text-overflow
• Fix for SAML failing on internal forwards
• Fix for session invalidation error when response committed early
• Fix for SAML button misalignment

New Features:

• Support Kerberos with Strong Encryption Types
• JIT User Provisioning and syncing from SAML IdP
• Full support for read only mode

Bugfixes:

• Fix for popup when leaving admin form
• Fix for SAML failure page rendering variable name
• Fix for Computer account screen text-overflow
• Fix for SAML failing on internal forwards
• Fix for session invalidation error when response committed early
• Fix for SAML button misalignment

• Fix for advanced settings not displayed due to caching bug
• Fix for app not correctly transitioning to fully enabled state

• Fix for a bug where raw Kerberos tokens not parsed correctly
• Fix for a bug in SAML where email is not parsed correctly on subsequent logins.
• Fix for bug where SAML login button not displayed in some scenarios in JSD

• Fix for a bug where raw Kerberos tokens not parsed correctly
• Fix for a bug in SAML where email is not parsed correctly on subsequent logins.
• Fix for bug where SAML login button not displayed in some scenarios in JSD

• We added a consistent footer across all screens with links to How to Get Logs article, FAQ and a button to email our 24x7 support
• Map group names send by the SAML IdP to the pre-existing application groups, to add the user provisioned on successful login added to these automatically
• Where available use whitelist to control the ability for the SAML IdP to redirect to URLs other than the baseURL
• EasySSO for Bitbucket adds a configuration option in EasySSO/NTLM/Advanced Configuration screen to display the HTTP(S) clone URLs before SSH ones in the default "clone" dialog
• Updates to EasySSO SAML with Azure AD documentation
• Listed in Azure AD Enterprise Applications gallery: EasySSO for Jira, EasySSO for Confluence, EasySSO for Bitbucket, EasySSO for Bamboo
• Improved Jira Mobile app compatibility
• HTTP Headers authenticator can be applied to all URLs now
• Extended logging for the SAML Management endpoint
• Fixes for the SAML IdP metadata import from a URL
• Small usability fixes
• Bugfixes

• We added a consistent footer across all screens with links to How to Get Logs article, FAQ and a button to email our 24x7 support
• Map group names send by the SAML IdP to the pre-existing application groups, to add the user provisioned on successful login added to these automatically
• Where available use whitelist to control the ability for the SAML IdP to redirect to URLs other than the baseURL
• EasySSO for Bitbucket adds a configuration option in EasySSO/NTLM/Advanced Configuration screen to display the HTTP(S) clone URLs before SSH ones in the default "clone" dialog
• Updates to EasySSO SAML with Azure AD documentation
• Listed in Azure AD Enterprise Applications gallery: EasySSO for Jira, EasySSO for Confluence, EasySSO for Bitbucket, EasySSO for Bamboo
• Improved Jira Mobile app compatibility
• HTTP Headers authenticator can be applied to all URLs now
• Extended logging for the SAML Management endpoint
• Fixes for the SAML IdP metadata import from a URL
• Small usability fixes
• Bugfixes

• Added regex parse and replace capability to X.509 authenticator to handle complex conversions. See updated EASYSSO WITH X.509 - CONFIGURATION page for details.
• Restored regex parse and replace capability in SAML. See PARSING USERNAMES FUNCTIONALITY WHEN USING SAML page for details.
• Updated HOW TO CONFIGURE EASYSSO WITH NTLM/KERERBOS instructions
• Updated I HAVE NTLM WORKING, HOW DO I ENABLE KERBEROS SUPPORT? page

• Added regex parse and replace capability to X.509 authenticator to handle complex conversions. See updated EASYSSO WITH X.509 - CONFIGURATION page for details.
• Restored regex parse and replace capability in SAML. See PARSING USERNAMES FUNCTIONALITY WHEN USING SAML page for details.
• Updated HOW TO CONFIGURE EASYSSO WITH NTLM/KERERBOS instructions
• Updated I HAVE NTLM WORKING, HOW DO I ENABLE KERBEROS SUPPORT? page

• Fixed XSRF vulnerability in admin screens of EasySSO
• Fixed After upgrade to Confluence 7.3 and/or Java 11, EasySSO stops working. It's no longer necessary to do ADDITIONAL CONFIGURATION FOR JAVA 11
• Fixed intermittent failures on upgrade of EasySSO due to incorrect implementation of cluster locking
• Added forgotten password and captcha URLs to the default excludes for SAML
• Included REST URLs previously ignored by NTLM/Kerberos/X.509/HTTP Headers authenticators that a human likely to trigger (e.g. search) to perform SSO if a session previously established has expired.

• Fixed XSRF vulnerability in admin screens of EasySSO
• Fixed After upgrade to Confluence 7.3 and/or Java 11, EasySSO stops working. It's no longer necessary to do ADDITIONAL CONFIGURATION FOR JAVA 11
• Fixed intermittent failures on upgrade of EasySSO due to incorrect implementation of cluster locking
• Added forgotten password and captcha URLs to the default excludes for SAML
• Included REST URLs previously ignored by NTLM/Kerberos/X.509/HTTP Headers authenticators that a human likely to trigger (e.g. search) to perform SSO if a session previously established has expired.

FOR Bitbucket 6.x+ installations with Java 11 please read: Additional Configuration for Java 11

• Fixed SAML Single Log-out (SLO) doesn't work with Keycloak
• Fixed SAML exclusions do not allow to exclude /plugins/*

FOR Bitbucket 6.x+ installations with Java 11 please read: Additional Configuration for Java 11

• Fixed SAML Single Log-out (SLO) doesn't work with Keycloak
• Fixed SAML exclusions do not allow to exclude /plugins/*

• Fixed IPv6 parsing issue in IP Filter component ("an IPv6 address should contain 8 shorts")
• Fixed logout behaviour with forced SAML - now all applications arrive to the "default page" e.g. "dashboard"
• Fixed logout behaviour with SAML Single Logout (SLO) going to the fail page - now all applications go to the login page after successful SLO logout.

• Fixed IPv6 parsing issue in IP Filter component ("an IPv6 address should contain 8 shorts")
• Fixed logout behaviour with forced SAML - now all applications arrive to the "default page" e.g. "dashboard"
• Fixed logout behaviour with SAML Single Logout (SLO) going to the fail page - now all applications go to the login page after successful SLO logout.

• second part of the "fail page" fix - if we do arrive to the fail page while already logged in (e.g. from the default login page) we will immediately redirect to the the application root/dashboard.

• second part of the "fail page" fix - if we do arrive to the fail page while already logged in (e.g. from the default login page) we will immediately redirect to the the application root/dashboard.

• Fixed issue with the "failed to log you in" page ("fail page") being displayed again when the user after landing on the page initially is subsequently successful with authentication either via SAML SSO or via direct login
• Fixed SAML configuration UI issues with Redirect binding URL being displayed as the default option after upgrade from 4.1.x or earlier and overwriting the previously configured and functional POST binding URL on save

• Fixed issue with the "failed to log you in" page ("fail page") being displayed again when the user after landing on the page initially is subsequently successful with authentication either via SAML SSO or via direct login
• Fixed SAML configuration UI issues with Redirect binding URL being displayed as the default option after upgrade from 4.1.x or earlier and overwriting the previously configured and functional POST binding URL on save

• improved security in HTTP Headers authenticator.
• increased maximum waiting time for a response to a SAML request
• fix for possible infinite loop on logout with SAML authenticator
• changes to some internal UI element

• improved security in HTTP Headers authenticator.
• increased maximum waiting time for a response to a SAML request
• fix for possible infinite loop on logout with SAML authenticator
• changes to some internal UI element

• Data Center compatibility
• Changes to configuration screen to support handling multiple nodes of Bitbucket
• SAML Single Log Out from IdP

• Data Center compatibility
• Changes to configuration screen to support handling multiple nodes of Bitbucket
• SAML Single Log Out from IdP

• Fix for redirects to URLs with anchors/fragments/hashtags after successful SAML login.
• Fix for sending password back to client in NTLM/Kerberos computer account dialog
• Fix for IOPLEX Jespa license corruption - CR/LF insertion on some Windows systems
• Support for Keycloak metadata containing multiple entities
• Time Skew parameter value in SAML configuration now defaults to 5 seconds

• previous release enabled SAML Login Button in WebSudo (Secure Administrator Session) mode - we removed it again for now

• 2FA support with SecureLogin 2FA for Bitbucket
• OAuth-related excludes for SAML when building Application Links
• Troubleshooting screen "Delete EasySSO folder" dialog bug fixes
• Re-applied additional default excludes for SAML from 4.1.12.4
• Re-applied NPE fixes in SAML from 4.1.12.4
• Re-applied fix from 4.1.12.4 for forced SAML endless loop in Bitbucket when "SAML on login/logout" was unchecked

• Fixed a bug when SAML is enabled where entering credentials into the regular login screen would not correctly log the user in.
• Fixed a bug where elements of the regular login screen would render incorrectly when SAML is enabled.

• Fixed a bug where EasySSO would ignore the "stopsso" query parameter even if it was configured to not perform SAML authentication in its prescence.

• Fixed bug where the RecentlyAccessedRepositories listener would throw an exception after logging in using EasySSO.
• Allow clients authenticating via OAuth to not be blocked by SAML.
• Fixed bug with SAML RelayState parameter.

• Additional default excludes for SAML
• NPE fixes in SAML
• fix for forced SAML endless loop in Bitbucket when "SAML on login/logout" was unchecked

• Bitbucket 6.0 compatibility
• Fixed UTF-8 encoding bug with the SAML configuration
• Fixed javascript initialization errors

• bot-killer fix: for products that have Atlassian Bot Killer plugin this will prevent session established via EasySSO from being invalidated every hour
• correct redirect after SAML re-authentication when session expires e.g. overnight
• correct redirect to the original URL after several SAML re-authentications e.g. unsuccessful ones followed by a successful one

• a common release to bring numbering in line with version that introduces SAML, X.509 and headers-based authenticators to EasySSO for Bitbucket
• fixed an issue in the EasySSO common library: after un-install and re-install the app wouldn't enable until restart of the application node
• fixed an issue with logging introduced in 4.1.5

• When a user logs in successfully through EasySSO, a Bitbucket authentication success event is now fired. Most noticeably this means than the last authenticated timestamp for the user will be updated.

• Fixed an issue with authentication in Bitbucket 5.5.x

• When a user logs in successfully through EasySSO, a Bitbucket authentication success event is now fired. Most noticeably this means than the last authenticated timestamp for the user will be updated.

• We have changed the default user agent filtering to make it easier to set up application links without having to do any special configuration in EasySSO.

• Fixed a bug where uploading a new Jespa trial license on top of an existing expired could be result in EasySSO still reporting that the license was expired.

• Fixed a bug where IP filtering would not properly work when a specific port of an IP address was specified in the request header.

IOPLEX Jespa library 1.2.x introduced some incompatible changes to code and encryption of licenses. This fix addresses this incompatibility and makes EasySSO support both old and new versions of Jespa

This release contains no new features, but it includes some core changes to request filtering.

• We've fixed a problem that could cause the add-on to fail to enable if the jespa.log location was set incorrectly.
• Made some changes to the IP address filter to properly support several fringe use-cases.

• Native support for X.509 client certificate authentication
• Support for external authentication (e.g. in front-facing reverse proxies) via header-based integration
• Support for custom authenticator add-ons via attribute-based integration

• EasySSO Configuration UI has been completely redesigned to be less busy: the main screen now contains the minimum required fields, a progress tracker has been introduced, any values that could have reasonable defaults have them now

• Parameter values validation has been added - less chances to make mistakes
• Additional configuration parameters, IP Filtering, User-Agent Filtering and Advanced Filtering have been moved under "Advanced" button
• "Test Connection" button has been added to enable testing the connection to the domain controller
• SetComputerPassword.vbs script is now available for download directly from the UI
• “Troubleshooting” button allows you to download the logs and inspect them to check if anything has gone wrong
• “About” button opens a dialog that allows you to review the status of your licenses, including the IOPLEX Jespa one, as well as the mode in which EasySSO is operating
• Offline installation instructions have been added - for installing without no internet connection

• User-Agent Filtering: config screen now supports parsing arbitrary UA strings on demand
• UserAgentUtils library has been updated to version 1.20
• Cookie Opt-Out: Admins can enable SSO opt-out via cookie in Advanced Filtering tab, users can opt-out in their User Profile settings, anonymous users can opt-out if enabled (to support regular non-domain users)
• new IP Filtering tab in EasySSO config
• ability to specify client IP addresses whitelist and blacklist as single IP, IP ranges, in CIDR, and host-based notation
• ability to specify regex-based whitelist and blacklist for client IP addresses
• the old "Included IP Addresses" regex client IP address filter configuration will be migrated to the new "IP Regex Whitelist" automatically
• Support for reverse proxies, local, remote, and multiple chained reverse proxies
• Reduced log chattiness when EasySSO trial license or evaluation license has expired
• Fix for uploading fresh ioplex.zip over already expired trial one
• bug fixes and improvement

Backward compatible with pre-Datacenter releases in terms of the filesystem locations - no reload of jespa.zip or license necessary

Fresh installations failing - resolved

ATTENTION: After upgrade you will need to re-upload IOPLEX Jespa .zip distribution and (if in production, with more than 25 users) your production Jespa license in EasySSO config screen - *USE VERSION 2.3.5 INSTEAD*

• compatibility with Data Center
• new IP Filtering tab
• added ability to specify client IP addresses whitelist and blocklist, supports single IP, ranges, CIDR and host-based notation - multiple rules, one per line
• added ability to specify client IP addresses Regex-based whitelist and blocklist - multiple regexes one per line
• "Included IP Addresses" field, a client IP address filter based on Regular Expression has been migrated to the new "IP Filtering" tab as "IP Regex Whitelist" and enhanced to support a list of expressions, one per line. This list is backward compatible with the old field and will take the old pre-existing value by default and continue to work as is after upgrade.

• debug logging for Kerberos
• NPE on Kerberos server credentials expiry
• fixes in KDC DNS discovery
• additional escaping for values in the config screen
• TechTime Plugins section in Add-Ons admin screen
• fixes for empty settings values causing issues in Bitbucket

• Addressed an issue that may occur during startup if a big number of other add-ons (including system ones) is present. This used to result in excessive re-initialization of IOPLEX Jespa library on startup and has been identified as the root cause for "jcifs.smb.SmbException: All pipe instances are busy" exception observed in the logs later during operation.

• Better handling of server Kerberos pre-authenticated credentials.

• Support for Kerberos authentication has been added
• now works on Mac OS X and Linux (if joined to a domain)
• as always works on Windows - but better than ever!

This is a port of EasySSO for Jira and Confluence to Bitbucket

• User-Agent Filtering: config screen now supports parsing arbitrary UA strings on demand
• UserAgentUtils library has been updated to version 1.20
• Cookie Opt-Out: Admins can enable SSO opt-out via cookie in Advanced Filtering tab, users can opt-out in their User Profile settings, anonymous users can opt-out if enabled (to support regular non-domain users)
• new IP Filtering tab in EasySSO config
• ability to specify client IP addresses whitelist and blacklist as single IP, IP ranges, in CIDR, and host-based notation
• ability to specify regex-based whitelist and blacklist for client IP addresses
• the old "Included IP Addresses" regex client IP address filter configuration will be migrated to the new "IP Regex Whitelist" automatically
• Support for reverse proxies, local, remote, and multiple chained reverse proxies
• Reduced log chattiness when EasySSO trial license or evaluation license has expired
• Fix for uploading fresh ioplex.zip over already expired trial one
• bug fixes and improvemen