• further hardening against username enumeration
  • in addition to the changes in version 2.0.2, the error message in a 401 response is now identical to the one Atlassian sends: "Invalid username or password."

• further hardening against username enumeration
  • in addition to the changes in version 2.0.2, the error message in a 401 response is now identical to the one Atlassian sends: "Invalid username or password."

• fixed a bug that caused UI not to load if the user logged in has no e-mail address set
• hardened app against username enumeration
  • removed mentions of usernames in responses that led to 401 - Unauthenticated
  • for troubleshooting purposes, admins can still look up details of authentication failures in the log files
• Updated internal and 3rd party libraries

• fixed a bug that caused UI not to load if the user logged in has no e-mail address set
• hardened app against username enumeration
  • removed mentions of usernames in responses that led to 401 - Unauthenticated
  • for troubleshooting purposes, admins can still look up details of authentication failures in the log files
• Updated internal and 3rd party libraries

• Fixed a bug that caused usernames not to be shown in the token manager tab
• Updated internal and 3rd party libraries
• Improved text/ wording of a few element descriptions in the UI

• Fixed a bug that caused usernames not to be shown in the token manager tab
• Updated internal and 3rd party libraries
• Improved text/ wording of a few element descriptions in the UI

New Features

• Audit logging of configuration changes
• OpenPGP Encryption for tokens created on behalf
• Tags/ Notes for IP address restrictions

Changes

• Users who can't create their own tokens but can use tokens can now see a list of their tokens, i.e. to see expiration dates or other details
• The list of tokens now shows an expiration warning if a token expires within the next 14 days
• Changed texts in the permission settings so that it's more clear what the on-behalf permission implies

New Features

• Audit logging of configuration changes
• OpenPGP Encryption for tokens created on behalf
• Tags/ Notes for IP address restrictions

Changes

• Users who can't create their own tokens but can use tokens can now see a list of their tokens, i.e. to see expiration dates or other details
• The list of tokens now shows an expiration warning if a token expires within the next 14 days
• Changed texts in the permission settings so that it's more clear what the on-behalf permission implies

Updated an authentication library to its latest version to support all Atlassian platforms, including the latest Jira versions

Updated an authentication library to its latest version to support all Atlassian platforms, including the latest Jira versions

Added logging of rate-limited requests. Read more about it here: https://wiki.resolution.de/doc/api-token-authentication/1.9.x/admin-guide/logging/logging-in-bitbucket#id-.LogginginBitbucketv1.9.x-RateLimitedRequests

Added logging of rate-limited requests. Read more about it here: https://wiki.resolution.de/doc/api-token-authentication/1.9.x/admin-guide/logging/logging-in-bitbucket#id-.LogginginBitbucketv1.9.x-RateLimitedRequests

• fixed a bug that prevented users from successfully cloning a repository with a read-only token
• changed a few wordings in description texts of the audit logging page
• changed text for the audit/ log entry "user tried to authenticate with an invalid token or regular password" to "user is authenticating with an invalid token, or with a regular password"
• added a warning so that admins are aware of the fact that tokens that have been created before rate-limiting was enabled won't be rate-limited

• fixed a bug that prevented users from successfully cloning a repository with a read-only token
• changed a few wordings in description texts of the audit logging page
• changed text for the audit/ log entry "user tried to authenticate with an invalid token or regular password" to "user is authenticating with an invalid token, or with a regular password"
• added a warning so that admins are aware of the fact that tokens that have been created before rate-limiting was enabled won't be rate-limited

Since version 1.9.x the app offers functionality to apply rate limits to requests authenticated with API Tokens. Read more about rate-limiting here: https://wiki.resolution.de/go/ata/rate-limit-admin

This bugfix adds a missing database field annotation so that updating the app on instances with MS SQL databases works flawlessly.

If you already updated to 1.9.0/1 and use MS SQL, please contact us at https://www.resolution.de/go/support.

Since version 1.9.x the app offers functionality to apply rate limits to requests authenticated with API Tokens. Read more about rate-limiting here: https://wiki.resolution.de/go/ata/rate-limit-admin

This bugfix adds a missing database field annotation so that updating the app on instances with MS SQL databases works flawlessly.

If you already updated to 1.9.0/1 and use MS SQL, please contact us at https://www.resolution.de/go/support.

• extended audit logging so that failed authentication due to IP address restrictions is logged as well
  • until this version, this only happened when the app was configured to prevent Basic Authentication with regular passwords

• extended audit logging so that failed authentication due to IP address restrictions is logged as well
  • until this version, this only happened when the app was configured to prevent Basic Authentication with regular passwords

• Fixed a bug in IP address verification that caused client requests to be rejected even though they were in a range permitted
• Hardened and upgraded the internal license checker library to prevent issues when applying a new Atlassian application license

• Fixed a bug in IP address verification that caused client requests to be rejected even though they were in a range permitted
• Hardened and upgraded the internal license checker library to prevent issues when applying a new Atlassian application license

• Added a REST token test endpoint for support- and troubleshooting purposes, read more about it in our documentation
• Now returning authentication failure responses without HTML code wrapped around

• Added a REST token test endpoint for support- and troubleshooting purposes, read more about it in our documentation
• Now returning authentication failure responses without HTML code wrapped around

Bugfix:

• API Token Authentication returned 401 even with valid tokens
  • this was most likely only an issue surfacing in the latest Bitbucket versions 7.12, 7.13 or 7.14

REST API only: when creating a token on behalf, the user key provided in the payload is validated first. If it doesn't belong to a user, HTTP status 400 and a message are returned.

To get familiar with the app, please refer to our documentation: https://wiki.resolution.de/doc/api-token-authentication/latest

Bugfix:

• API Token Authentication returned 401 even with valid tokens
  • this was most likely only an issue surfacing in the latest Bitbucket versions 7.12, 7.13 or 7.14

REST API only: when creating a token on behalf, the user key provided in the payload is validated first. If it doesn't belong to a user, HTTP status 400 and a message are returned.

To get familiar with the app, please refer to our documentation: https://wiki.resolution.de/doc/api-token-authentication/latest

API tokens can now also be used as bearer tokens, read more about it in our documentation

API tokens can now also be used as bearer tokens, read more about it in our documentation

Security Improvement

• Immediately invalidate active sessions that have been created with API tokens and have expired or were deleted in the meantime (Previously the session remained active until the session timeout was reached)

New Feature

• Added option to disable Session Cookie Based Authentication

Full Releases Notes

Security Improvement

• Immediately invalidate active sessions that have been created with API tokens and have expired or were deleted in the meantime (Previously the session remained active until the session timeout was reached)

New Feature

• Added option to disable Session Cookie Based Authentication

Full Release Notes

Initial Bitbucket Release

Initial Bitbucket Release