Release Notes 4.24

After support for ArcGIS services was already announced to be discontinued as of December 1, 2025, this functionality has been removed from the software in release 4.24.

As of version 4.24.0, the ArcGIS Server entries in the database are no longer required. You can remove them after the update. This step is optional: leaving the entries in the database has no effect on the installation.

The entries are deleted using a supplied SQL script. Proceed as follows:

The vulnerability-report.md file in the root of the extracted rollout folder has been replaced by sbom/security.manager-4.24.0-openvex.vex.json. VEX (Vulnerability Exploitability eXchange) is a machine-readable format that communicates whether a product is affected by known vulnerabilities.

Google has announced that support for 'Third-Party Cookies' in Google Chrome will be phased out by the end of 2024. This can be read at Update on the plan for phase out of third party cookies on chrome . The security.manager uses 'Third-Party Cookies' for user authentication when integrating protected services into external websites via the /sso endpoint. An example of this is the integration of security.manager protected services into ArcGIS Online via the /sso endpoint. In this case, communication takes place via the browser from an external website (www.arcgis.com) to the security.manager (e.g. security.example.com). We recommend switching to the agstoken authentication method, as it does not rely on Third-Party Cookies.

Additionally, we recommend disabling the use of Third-Party Cookies by setting the option security.sso.cookie.samesite=true.

To visualize changes from other users / systems in the tree displayed on the left side of the Administrator interface, simply select the root node of the tree and the reload tree button.

When two rights are defined that are applicable to a user, it is important to determine the correct sequence in the Security Manager administrator (in the dialog "Policy Set"). For example: It is a legal definition that all users are granted access to a WMS, but with copyright restrictions. A user might be a member of a user group "registered" where another piece of legislation for this WMS defines that the access granted WITHOUT Copyright constraint. Both of these rights are valid if the user group "registered" accesses the WMS. In this case, the first policy in the list is used. To prevent the users of the group "registered" from seeing the same copyright notice as unregistered users, this right must be uppermost in the administration set.

The security.manager does not distinguish feature types which have the same name but different namespaces, for example x:city is recognized as equal to y:city. Therefore It is required that feature types have unique names.

Care must be taken of the accuracy and stability of the displayed feature IDs when using them to create spatial obligations. Feature IDs of the form fid-4d0f905b_126c17decf6_-7d52 indicate internal auto-generated feature-IDs, which change with each new request and thus can not be used for referencing features. If feature IDs change with each request to the WFS, this is due to a lack of feature IDs in the WFS response. The configuration of the WFS service needs to be reviewed so that stable feature identifiers are delivered correctly.

Alternative 1: Create the folder prior to installation.

Alternative 2: During an installation, the context.xml files are stored in the [SECMAN_INSTALL]/postinstall directory. They can be simply copied into the directory [TOMCAT_HOME]/conf/Catalina/localhost. In the installation type container-managed database, the xml files with the suffix -jndi.xml need to be copied.

The following files must be copied:

ArcGIS Server WFS do not support multipolygons or more than one polygon within a spatial filter. Thus, spatial restrictions cannot be applied if more than one geometry are selected for this restriction or if the incoming request already contains a spatial filter.

When using a Safari browser, repeated logins might be required. To avoid this, change the security settings to always accept cookies.

As described in "Filtering features using the layerDefs parameter in WMS requests" , layerDefs has a lower priority when SLD or SLD-BODY parameter is present and is ignored.

ArcGIS for INSPIRE Feature Download Services do not support Polygons in queries with spatial filters. Hence for a spatial restriction is not possible.

ArcGIS for INSPIRE Feature Download Services might create invalid responses if a GetFeature request references multiple stored queries or contains multiple query elements.

Access to protected ArcGIS Server-based WFS might fail when spatial obligations or OGC Filter Expression obligations are in play. Affected are ArcGIS Server versions 10.3 and higher, which don’t properly support the OGC specifications. Depending on the WFS versions requested by the client (1.0.0, 1.1.0, 2.0.0) you might encounter different error messages.

The WFS 1.0.0 and 1.1.0 implementations of UMN MapServer do not support the GML versions as stated in the specifications. Because of this spatial obligations and obligations with OGC Filter Expressions are not supported.

For ArcGIS Server WFS services, DescribeFeatureType requests without listing actual FeatureTypes might lead to exceptions, if this WFS provides many FeatureTypes, or the FeatureTypes have long names.

If a protected service contains a huge number (> 60) of resources (for example layers) performance of service requests decreases noticeably. Consider splitting up such mapping services into several services.

When trying to load a protected service into ArcGIS Pro via httpauth login fails although correct credentials were specified if username or password contain non-ASCII characters like german umlauts.