Changes in 6.6.3

16 Feb 2023 11:30 CET

Bug fixes, redirect rules improvement, security patch

Improvements

• Improvement to redirect rules: you can now choose to redirect the users that DO NOT have a certain group membership, as opposed to only redirect users with the group membership

• Fix a wider clickable area for the selects in Just-in-time provisioning

• Added a switch to show or hide the SAML certificate expired warning flag

• AUDIT log the identity provider’s name and ID for the logged in user in a successful login event

Bug fixes

• The redirect mode was missing from the Identity Provider overview page

• The last logged in attribute on users came as null for certain confluence users on the users API, leading to a match on users that were in fact not inactive.

Security

• Tag RC4-HMAC encryption as deprecated in Kerberos setup wizard

• Patch CVE-2022-25927 in transitive dependency to an npm json library. We are still awaiting a released patch for CVE-2022-25927 in the maven package org.json/json, but since we do not use the affected component this is not critical.

Changes in 6.6.2

30 Jan 2023 12:00 CET

Bug fixes, cache improvements and dependency updates

Improvements

• Disable browser history on client secret input field in setup wizard. This way the browser doesn’t save the values to it can auto-suggest them later.

• Improve caching in lookup of resources used in every-request filters when Exception groups for Prevent Traditional Login is configured

• Update in-app setup guide for Google Workspace API Connector (Cloud user sync)

Bug fixes

• Fix improper pagination support in the group sync membership API which meant that only the group members in the last “page” were persisted. This likely affects all groups with more that 200 members.

• The certificate expired warning leads to a broken URL.

Security

• Added Software Bill of Materials for frontend resources. It can be found packaged with the jar bundle, under SBOM, acting as a bill for the packages javascript resources bundled with the app. The maven SBOM can be found in the release notes text in the given release in the Marketplace listing.

• Patch dependencies. Update maven-dependency-check plugin to 8.0.1.

Changes in 6.6.1

16 Jan 2023 17:30 CET

Bug fixes

• Bug fix for User Cleanup config ui

Changes in 6.6.0

23 Dec 2022 10:30 CET

Just-in-time into AD, improve performance user lookup , and other improvements

Features

• Just-in-time provisioning can create users in Active Directory

• Publish BeforeUserAuthenticate event to help Atlassian cache handle logins over multiple servers https://community.developer.atlassian.com/t/publishing-beforeuserauthenticate-event/63352

• Notify admin user if username/password was used to log into K-SSO admin and he is about to lock himself out with this user

• Improved user lookup to reduce the number of username searches during login

Improvments

• Support for SAML key storage in other filename than SHA256 thumbprint. Created guide on how to use CA signed SAML request keys: https://kantega-sso.atlassian.net/l/cp/0K81JBjR

• Allow username to be sent as login_hint to IdPs when redirect mode is set to Fallback

• Remove cancel link during instant redirect. As before you may add ?noredirect in URL to stop instant redirect.

Bug fixes

• Fix behaviour on Force login when using up instant redirect to IdP in combination with Kerberos login