Release Notes 1.5.0

What’s New

This version of con terra Technology Identity Service supports Keycloak 26 as well as ArcGIS Enterprise 11.2 and 11.3. It is now also possible to use the member roles of an ArcGIS Enterprise portal user. Groups of an ArcGIS Enterprise portal user can be provided as groups by the Identity Service in addition to roles.

Update Notes

If you skip several versions during the update, please also follow all update notes of the intervening versions.

Support Keycloak

With this release of Identity Services, Keycloak 26.x is supported.

Support ArcGIS Enterprise

With this release of Identity Services, ArcGIS Enterprise 11.2 and 11.3 are supported.

Database schema changes

The database schema has been updated in this version. The columns IDENT_TOKENS.TOKEN_KEY and IDENT_EXTSESSIONS.EXTSTATE have been reduced in length to avoid warnings on certain databases.

The recommended approach to apply these changes is to let Identity Service recreate the required database tables from scratch:

  • The database user must have permissions to create/alter tables and indices.

  • After the update these permissions can be revoked again.

To perform the update, proceed manually:

  1. Drop the existing tables. If you use a dedicated database only for Identity Service, you can alternatively drop the entire database. (Note: both approaches will drop existing user sessions).

    To drop the existing tables, use the appropriate SQL script for your database:

  2. Start Identity Service with db.hibernate.schemaUpdate set to update (this is the default). This will recreate the required database schema. Alternatively, you can recreate the database schema by running the appropriate SQL script included with the product distribution.

New default value

The default value for property security.oauth.provider.arcgis.roles.includeMappedRolesOnly has changed from true to false.

Changelog

1.5.0

Fixed Security Issues

IDENTITY-62

The tokens endpoint potentially returns a token for a service that might not be fully configured

New Features

IDENTITY-53

Allow mapping of ArcGIS Enterprise portal custom roles

IDENTITY-59

Support transport of "groups" for Portal-created identity

IDENTITY-61

Return primary 'transportAs' from tokens endpoint

IDENTITY-63

Change default value of security.oauth.provider.arcgis.roles.includeMappedRolesOnly to false

IDENTITY-77

Add SBOM to rollout

Fixed Issues

IDENTITY-54

[Keycloak] Missing revocation endpoint leads to error