Kantega SSO Enterprise 5.5.x release notes

We are pleased to announce Kantega SSO Enterprise 5.5.

Compatible applications

Kantega SSO Enterprise for Bamboo Data Center March 2022

We are happy to announce that Kantega SSO Enterprise will be release for Bamboo Data Center this spring. The version is planned for release during March, when the Atlassian certification is completed. Data Center customers will be required to purchase a Data Center app license upon their next renewal.

Changelog

Security patches and bug fixes and GUI improvements.

Changes in 5.5.0

Jan 31, 2022

Improvements

• SAML/OIDC The setup wizard has been refactored with more a new, faster form system and state management

• Migrate usage of a deprecated SAL UserManager methods for obtaining UserProfile

• More consistent with external link symbol for links pointing outside the product

Bug fixes

• Saml/oidc Fix poor handling of Websudo / Secure Administration Session timeout Setup wizard

• SAMl/oidc Instant redirect didn’t show text on dashboard page in Jira

• KSSO for bitbucket Nullpointer exception introduced in 5.4.0 in referer header check in servlet filter chain for REST endpoints

Changes in 5.5.2

Feb 4, 2022

Improvements

• global configuration Added a toggle so it is an option to turn off the CSRF Origin Header check that was introduced in built-in to version 5 of Kantega SSO Enterprise if your system encounters issues with headers. The feature acts like ‘Disable Basic Auth’, and can be disabled also by removing a file on the application server. It is recommended to keep this check turned on for security reasons.

• SAML/OIDC Updated Bouncy Castle bcpkix dependency in SAML component

• kerberos Updated Bouncy Castle bcprov dependency in Kerberos component

• Deprecated javascript resource com.atlassian.auiplugin:dialog2 migrated to com.atlassian.auiplugin:aui-dialog2

Bug fixes

• Saml/oidc Fixed redirect to Jira Service Management (JSM/JSD) not working

• SAML/OIDC Fix metadata URL hint missing for Keycloak in IDP setup wizard

• saml Innacurate / incorrect test result text in SAML login test results for Missing User Info status

Dependency updates

Security vulnerabilities patched

The dependency patching resolved the following vulnerabilities:

Changes in 5.5.3

Feb 16, 2022

Improvements

• SAML/OIDC Rewrote and improved the User Lookup page with more powerful regex transformation test and improved UX

• SAML/oidc Improve how progress is kept in setup wizard when navigating to previous steps

Bug fixes

• Saml/oidc Setup wizard did no allow characters outside ISO-8859-1

• Saml/oidc Could not abort automatic redirect on login page with esc button

• saml/oidc Managed groups under Group Memberships had inconsistencies and didn’t work properly

• saml Inconsistent login test result status regarding user not found

• kerberos Incorrect summary on Kerberos test page when Kerberos is disabled but is still enabled for users in a certain user group or directory.

• Update of config warning flag gave wrong link path to Configuration status from certain pages

Security vulnerabilities patched

Audit and update NPM packages and one maven dependency. The following vulnerabilities were patched:

Changes in 5.5.4

Feb 20, 2022

Bug fixes

• kerberos In this release, we temporary roll back Kerberos (back to bouncycastle.bcprov-jdk15@140 in org.simplericity.serberuhs) due to some compatibility issues with the library update performed in verison 5.5.2. We will investigate and troubleshoot the issues with the update before reintroducing it more stabilized in a later release.

• saml Setup wizard summary step was stuck on ‘Loading…’ due to changes in 5.5.3

• saml Metadata URL was not saved after SAML IDP setup due to changes in 5.5.3

• saml/oidc Unchanged display name was not persisted in IDP setup draft due to changes in 5.5.3