Version: 21.10
Release Date: 2021-11-09
The Smart ID 21.10 release provides updates in Identity Manager, Self-Service, Digital Access and Physical Access. Messaging provides minor improvements and bugfixes only. All components also provide several bugfixes and library updates to ensure high quality and security.
Upgrade Smart ID
See Upgrade Smart ID with information regarding upgrade from 21.04.3 to 21.10.
Main new features
Smart ID 21.10 provides major updates in with new features in Identity Manager, Digital Access and Physical Access.
The Identity Manager component has extended again SAML authentication capabilities: it is now possible to fetch group information from the SAML ticket in order to map this on IDM roles for user authorization. This means both - authentication and authorization can now be managed directly via the IDP.
Digital Access introduces SAML Single-Logout as a new feature.
In Physical Access Smart ID provides a new PACS connector to DormaKaba Exos.
Smart ID compatibility
Smart ID 21.10 is compatible with the following component versions:
Detailed feature list
Features
Jira ticket no | Description | Digital Access | Identity Manager & Self-Service | Physical Access | Messaging |
|---|
CRED-6610 | Updated crypto libraries Updated crypto libraries in ADCS PKI connector for security reasons. |
| X |
|
|
CRED-9336 | Added support for Subject DN Attribute "pseudonym" Added support for Subject DN Attribute "pseudonym" in the certificate templates in Identity Manager. |
| X |
|
|
CRED-10316 | Improved usability of open tasks in Identity Manager Operator The maximum number of shown open tasks in Identity Manager Operator is now limited to avoid long loading time for the system. It is also possible to filter on a date range. |
| X |
|
|
CRED-10641 | Removed 40 character limitation in BPMN designer The Eclipse plugin to design BPMN workflows ("Activiti Designer") had a 40 character limitation on the process names. This limitation is now removed. |
| X |
|
|
CRED-10654 | Improved UX of certificate login in Self-Service The user experience of the certificate login in Self-Service has been improved. This is the new flow: Click Sign In with Client Certificate, select certificate, enter PIN and get logged in to Self-Service. Read more here: Configure login screen for Smart ID Self-Service. |
| X |
|
|
CRED-10760 | Added permissions for viewing object history in Identity Manager Operator The object history permissions control if a user can see the full history, certain types of history entries only (such as data change, status change, process execution), or not see the history entries at all. Read more here: Identity Manager Operator and Set permissions from Identity Manager users or roles. |
| X |
|
|
CRED-10864 | Email as unique ID for DFN The DFN PKI connector is now supporting the EMAIL_ID_DFN field. The value will not be added to the certificate, but can be used as unique ID and user identifier in requests and lifecycle management. |
| X |
|
|
CRED-10873 | Post-login process configuration in Identity Manager Admin The post-login processes (BPMN-processes executed intermediately after login to Identity Manager), can now be configured in the Identity Manager Admin UI as part of the authentication profiles. Read more here: Standard service tasks in Identity Manager, "Login: Finalize post-login process". |
| X |
|
|
CRED-10970 | Support for Certificate Manager 8.4.1 Identity Manager has updated the integration with Certificate Manager by supporting Certificate Manager 8.4.1, which is the latest version. |
| X |
|
|
CRED-10973 | Improved SCEP service task The standard service task for SCEP registration in Identity Manager has been improved. New drop-down lists have been introduced to simplify the configuration. See Standard service tasks in Identity Manager, Cert: Create SCEP order request. |
| X |
|
|
CRED-11376 | Added support for deleting single certificates from a smart card For smart card encoding, for example when doing renewal, there is added support for selecting one or more dedicated certificates via certificate serial number and delete them. |
| X |
|
|
CRED-11540 | Changed sorting of open tasks in Self-Service The sort order of open tasks in Self-Service has changed and now starts with the newest open task as the topmost entry. |
| X |
|
|
DA-72 | SAML Single logout front channel SAML Single Logout (SLO) is a SAML flow that allows the end-user to logout from a single session and be automatically logged out of all related sessions that were established during SSO. Added the feature for enabling both IDP initiated, and SP initiated single logout. Refer to SAML Single Logout in Digital Access for more details about the feature. | X |
|
|
|
DA-471 | Added ability to add OIDC Issuer per client instance Added the Open ID Connect (OIDC) Issuer field for every client instance. If the OIDC Issuer value is not set in the client then it will use the global configuration setting value. | X |
|
|
|
DA-566 | Added ability to send OTP on multiple channels It is now possible to send One Time Passwords (OTP) to multiple channels through XPI. | X |
|
|
|
IDC-1589 | Added Kaba integration with Physical Access It is now possible to configure the Kaba exos 9300 Service, to enable integration between Smart ID Identity Manager, Physical Access and the Kaba exos 9300 Service. Read more here: Set up integration with Dorma Kaba Exos. |
|
| X |
|
Corrected bugs
Jira ticket no | Description | Digital Access | Identity Manager & Self-Service | Physical Access | Messaging |
|---|
CRED-7690 | There was an issue when revoking certificates directly in the smart card encoding process (setting certificates on hold), where the revocation state was not returned correctly to Identity Manager after encoding. This has been fixed. |
| X |
|
|
CRED-7956 | The logging for the "change state in CA" task fails was not clear. This has been fixed by adding a more clear message into the logfile. |
| X |
|
|
CRED-9309 | There was an issue with translations of "meta fields" (for example, object status, Template name etc.) in Self-Service. This has been fixed. |
| X |
|
|
CRED-9885 | Unnecessary warning messages regarding "Certificate-based logout" are now removed from the Identity Manager Operator logs. |
| X |
|
|
CRED-10258 | Configuration of a custom attribute statement (instead of name ID) for SAML authentication in Identity Manager was not working. This has been fixed. |
| X |
|
|
CRED-10335 | The "forgot password" link, and the "pre-login" process in general, disappeared in Self-Service when doing a page refresh. This has been fixed. |
| X |
|
|
CRED-10408 | When using a filter on the fields Certificate.renewalApplied or Certificate.KeyArchival in a search configuration, an error message appeared. This has been fixed. |
| X |
|
|
CRED-10476 | Improved error handling in Identity Manager when the connection to the database is down by adding a user-friendly message and allowing the user to close the application. |
| X |
|
|
CRED-10496 | Fixed coloring by showing warning messages in orange again in Self-Service. |
| X |
|
|
CRED-10674 | There was an issue when revoking certificates via the certificate state graphs of the standard packages. Consolidation of supported revocation reasons and certificate states of the standard workflow package has been done for all PKI connectors in order to resolve these issues. |
| X |
|
|
CRED-10758 | When deleting states from a state graph, the deleted states where still displayed in the extended search dropdown menu, because the states where still present in the core template configuration. Consistency checks have been added to avoid such situations. |
| X |
|
|
CRED-10811 | Self-Service was throwing an error after login, when no searches with purpose "self-service" (to show in the menu bar) where configured. This has been fixed. |
| X |
|
|
CRED-10828 | When configuring a certificate template in more than one application for smart card encoding, the encoding did fail. This has been changed now, and the same certificate template can be used for multiple applications in the encoding description. |
| X |
|
|
CRED-10839 | When capturing photos in Self-Service on smartphones via the photo upload functionality, the photos had the wrong orientation (90° rotated). This has been fixed now. |
| X |
|
|
CRED-10941 | Field validation error messages in Self-Service (e.g. missing mandatory field input) where not shown correctly for "meta fields" (status, template name, change state reason etc). This has been fixed. |
| X |
|
|
CRED-11036 | When disabling a BatchSync job in Identity Manager Operator, it got executed anyway (disable flag was ignored). This has been fixed. |
| X |
|
|
CRED-11059 | Fixed a multi-language issue when using SAML/ LDAP authentication profiles. Other languages than English where not translated correctly i that case. |
| X |
|
|
CRED-11160 | Export search results to CSV in Extended Search was broken when running Identity Manager on MS SQL Server. This has been fixed. |
| X |
|
|
CRED-11256 | Fixed file upload in Self-Service for upper-case file extensions. |
| X |
|
|
CRED-11294 | The LDAP connection context was not closed explicitly, and this could potentially lead to a memory leak. This has been fixed now, and LDAP context get closed properly. |
| X |
|
|
CRED-11418 | When using Status fields in quick search of Identity Manager Operator, the status field was not translated. This is fixed now. |
| X |
|
|
CRED-11463 | Fixed an issue in the standard service task "Process: Search the newest Encryption Certificate". When multiple certificate templates are involved, the result could have been inconsistent. |
| X |
|
|
CRED-11503 | "List Processes" in Identity Manager Operator was running into an error in some cases. This is fixed now, and listing processes is working stable again. |
| X |
|
|
CRED-11507 | When uploading a PDF file of binary type document/PDF in Self-Service, the pre-selected extensions in the upload window was wrong (*.jpeg instead of *.pdf). Also upload did not work after changing the pre-selection. This is fixed now. |
| X |
|
|
CRED-11518 | Improved user guidance and error handling when configuring an LDAP URL in configuration. |
| X |
|
|
CRED-11545 | Removed some exceptions that appeared in the UI Framework log of Identity Manager Operator. This change does not only keep the logs clean but also improves performance. |
| X |
|
|
CRED-11598 | Exporting photos in base64 format via IN Groupe card production connector did not work. This has been fixed, and photos are now transmitted correctly now for card production. |
| X |
|
|
CRED-11599 | Fixed encoding of IN Groupe card production export. The export data is now UTF-8 encoded. |
| X |
|
|
CRED-11600 | When exporting card orders to IN Groupe card production, optional fields were not handled correctly when they were empty. This has been fixed. |
| X |
|
|
CRED-11654 | Order Reference field in IN Groupe Card production export did not resolve variable fields on all cases. This is fixed now. |
| X |
|
|
CRED-11659 | When importing results from IN Groupe card production, the result XML file was sometimes moved to the "valid" folder even though the import had errors. This has been fixed. |
| X |
|
|
CRED-11736 | Fixed count of number of requests (ReqNb field) in the IN Groupe card order export. |
| X |
|
|
DEVOPS-1205 | Improved error handling when creating non-personal visitor cards: the "number of requests" field is now marked as mandatory, and error messages have been corrected. |
| X |
|
|
DEVOPS-1236 | When withdrawing an employee card with the standard Digital ID package, the status if the original card did not change. This has been fixed. |
| X |
|
|
DA-261 | Fixed the incorrect namespace in case of configuring additional WSFed attributes. | X |
|
|
|
DA-514 | Fixed the issue when a syslog message is sent from Digital Access to the syslog server, it was not UTC timestamped earlier which led to missing logs information. | X |
|
|
|
DA-637 | Fixed the issue that was caused when deleting a service provider having an access rule. | X |
|
|
|
DA-656 | Updated the migrate script to ask user whether to remove the previous images and stop the running instance of Digital Access. Care needs to be taken if the current instance is not stopped. The new instance should not connect to the same DB instance otherwise it might cause conflicts and corrupt data. Updated the upgrade script to not delete the previous images. It will be the user's responsibility to delete the previous images of older versions of Digital Access from the system and to keep the space free. | X |
|
|
|
Release announcement
From this release, only Docker deployment is supported for the Smart ID components Identity Manager, Physical Access, Digital Access and Messaging. For full instructions, see Deploy Smart ID.
From Smart ID 20.11 and on, components now only have the Smart ID version number and not the different component version numbers. For information on previous releases, see Nexus Documentation Archive.
For details on the updated Smart ID configurations and deployment configurations, see here:
Smart ID configuration release note
Smart ID deployment configuration release note
CODE
All notable changes to this project will be documented in this file. Be aware that the [Unreleased] features are not yet available in the official tagged builds.
## [Release 23.10.2-2023-10-27]
### Added
### Changed
- Modified permissions of the 'certs' directory in init-smartid.sh to 755 (to allow Hermod to read the directory). [CRED-16526]
- Updated Prime Connectors version. [CRED-16153]
## [Release 23.04.9-2023-10-31]
### Added
### Changed
- Modified permissions of the 'certs' directory in init-smartid.sh to 755 (to allow Hermod to read the directory). [CRED-16526]
## [Release 23.04.7-2023-08-28]
### Added
- Added missing attestation key config to signencrypt.xml (fixes VSC). [CRED-16128]
## [Release 23.04.5-2023-07-17]
### Added
- Added a readme-wsl-dev.txt how to setup SmartID Docker containers in a WSL environment. [CRED-15948]
- Added environment variable to docker-compose.yml of authentication service.
### Changed
- Restored environment references for Digital Access and Physical Access containers [CRED-15915]
## [Release 23.04.4-2023-06-30]
### Added
- Added restart-all.sh for easy stopping and starting of all containers or a subset of them. [CRED-15854]
### Changed
- The variable DOCKER_NETWORK_MTU has the default value 1500 now. You are not forced to choose between several options. [CRED-15854]
- When executing init-smartid.sh a message informs you about the current MTU value and when it is recommended to reduce it. [CRED-15854]
- The names of most of the docker containers start with "smartid-" by default. This prefix can be changed now via variable DOCKER_CONTAINER_BASE_NAME in file smartid.env. [CRED-15854]
- The hostname of the postgresql container now has the DOCKER_CONTAINER_BASE_NAME prefix as well.
## [Release 23.04.3-2023-06-23]
### Added
- Added AriadNext Connector Docker image. [CRED-14963]
- Added file .gitattributes to make \*.sh and \*.env files always containing only LF instead of any CRLF. Fixed file datadog.env accordingly. [CRED-15795]
### Changed
- Escaped the ESC character (0x1B) in echo statements of shell scripts to avoid problems with Azure file preview and git diff output. [CRED-15795]
## [Release 23.04.2-2023-06-02]
### Added
### Changed
## [Release 23.04.1-2023-05-11]
### Added
- Added init-smartid.env to configure the docker network MTU. [CRED-14088 via CRED-15316]
- Added helperFunctions.sh and helperCreateLink.sh to be used by init-smartid.sh. [CRED-14088 via CRED-15316]
### Changed
- Replace deprecated docker network syntax in docker-compose.yml files. [CRED-14088 via CRED-15316]
- init-smartid.sh / stop-smartid.sh detect if docker needs sudo. [CRED-14088 via CRED-15316]
- init-smartid.sh now optionally removes files created by previous runs (postgres db, bootstrapped certs, etc). [CRED-14088 via CRED-15316]
- No explicit setting of env_file in docker-compose.yml files. [CRED-14088 via CRED-15316]
- Messaging database is now configured via MESSAGING_DB_URL var. [CRED-14088 via CRED-15316]
- stop-smartid.sh now uses the compose command "down" instead of "stop", which also removes the containers after shutting them down. [CRED-14088 via CRED-15316]
## [Release 23.04.0-2023-04-28]
### Added
- Added Workspace One Connector Docker image. [CRED-14215]
### Changed
## [Release 22.10.8-2023-11-27]
### Added
### Changed
- Modified permissions of the 'certs' directory in init-smartid.sh to 755 (to allow Hermod to read the directory). [CRED-16526]
## [Release 22.10.0-2022-09-20]
### Added
- Added ContentProviderJWSSigner descriptor in signencrypt.xml. [CRED-12232]
- Added renewFromKeypairs.sh to renew end-entity certs.
WARNING:
- This only works if you (re-)bootstrap with the updated createca.sh, as the old version discarded data required for renewal.
- Re-bootstrapping will invalidate any encrypted secrets and history signatures in IDM due to chaning the keys.
- Re-bootstrapping will also overwrite the certificates and keys in the docker deployment folder, so make a backup first,
so you can use the respective tools for re-signing and re-encrypting existing history/secrets.
### Changed
- automatically (re-)start mailhog
- fixed naming of traefik rules for mobile-iron
- Changed createca.sh to retain keypairs and CA metadata, so we can enable renewal (see above).
- Removed cRLSign attribute from ca.conf to avoid issues with failing CRL checks.
NOTE: This only has an effect on newly bootstrapped CAs.
## [Release 22.04.0-2022-05-05]
### Added
- Added Mobile Iron Docker image. [CRED-11817]
- Added new properties for MI image in smartid.env. [CRED-11817]
### Changed
- Changed properties for Nexus GO Cards API V2. [CRED-12951]
## [Release 21.10.0-2021-11-09]
### Added
- Added Digicert Global Root CA certificate. [CRED-11688]
- Added some Let's Encrypt root certificates. [DEVOPS-971]
- Added documentation for maxProfiles option to hermod-conf.yml
- Added `.yamllint` file to set default YAML linting config. [DEVOPS-1085]
- Added volume mapping for logs folder in IDM and Self Service. [DEVOPS-403]
- Fixed cacerts folder permissions in init-smartid.sh script.
- Added support for docker compose v2 command in init-smartid.sh script.
### Changed
- New properties for CAAS credentials in smartid.env (placeholders must be replaced before using Nexus GO Cards). [CRED-11688]
- Fixed some copy issues in the init-smartid.sh script.
- Changed the default selfservice config to include auth methods params example.
- It is now possible to change IDM language settings via system properties. [DEVOPS-860]
- It is now possible to change Self-Service configuration via `CONFIG_JSON` environment variable. [DEVOPS-945]
- Fixed typo. [DEVOPS-1090]
- Replaced Self-Service `IDM_URL`, `INSTANCE_ID`, `IDM_TENANT` by `APPLICATION_YAML` json. [DEVOPS-1127]
- Set logging driver to json-file (the default one) for all containers explicitly [DEVOPS-1136]
- Fixed YAML format. [DEVOPS-1085]
- IDM and SelfService now support custom translations and do not require mapping the whole translation files again. See doc for more info. [DEVOPS-1118]
- Change Import Logger to correct class [DEVOPS-1143]
- Switched to new image naming for IDM
- `nexus-prime/explorer` changed to `smartid/identitymanager/operator`
- `nexus-prime/designer` changed to `smartid/identitymanager/admin`
- `nexus-prime/tenant` changed to `smartid/identitymanager/tenant`
- `nexus-prime/updatedb` changed to `smartid/identitymanager/updatedb`
- `nexus-prime/ussp2` changed to `smartid/selfservice`
- Changed Smart ID version to 21.10.0
### Removed
- Removed Self-Service config.json file. [DEVOPS-945]
- Removed expired Let's Encrypt certificates. [DEVOPS-971]
- Removed translation files for IDM and SelfService. [DEVOPS-1118]
## [Release 21.04.0-2021-05-20]
### Added
- Default values for Selfservice tenant id and instance id. [DEVOPS-738]
- Added example format for MSSQL everywhere we build the DB URL (`${DBHOST}/${XX_DB_NAME}`) because MSSQL requires a different URL format. [DEVOPS-737]
- Include SANs from CSR in bootstrap TLS cert in `bootstrap/conf/ca.conf`.
- Generate tls certificate for non-treafik setup in `bootstrap/createca.sh`.
- Log4j2 config and template for json layout [DEVOPS-758]
- Datadog agent compose file, with some examples, see nexus and datadog documentation if you want to use it [DEVOPS-759]
- Added a check in `init-smartid.sh` that exits the script if user didn't fill the mandatory properties in `smartid.env` (thoose with <XX> value pattern). [DEVOPS-759]
- Added Physical Access Interflex PACS. [DEVOPS-752]
### Changed
- IDM DB will no longer be initialized through init-smartid.sh script. Initialisation has to be done manually by starting container in identitymanager/updatedb. [DEVOPS-739]
- Rename containers to use dash instead of underscore, so containerName can work for DNS lookup (underscore is not allowed in DNS names).
WARNING! This can cause issues if you use the new config with existing containers using the old names!
- Align idm update db naming to use the name "updatedb" everywhere
WARNING! This can cause issues if you use the new config with existing containers using the old names!
- Align digital access directory names with service names
- fix bootstrap cert folder permissions in init script
- Changed all HERMOD*\* properties to MESSAGING*\*. [DEVOPS-751]
- Moved each component's respective config into their own config folder. [DEVOPS-751]
- Made all volume mappings static in compose file, no more properties. [DEVOPS-751]
- Reorganized smartid.env to be split by component, making it easier to find component related properties. [DEVOPS-751]
- Internal ports (inside docker) are now static in the compose file. [DEVOPS-751]
- Moved postgres related properties outside smartid.env, because it is a separate tool not meant for production. [DEVOPS-751]
- Renamed service names in compose files to match their container name. [DEVOPS-751]
- Changed traefik version to 2.4.8. [DEVOPS-638]
- Changed file extension of generated certificates from `.base64` to `.cer`.
- Updated translation files for IDM. [DEVOPS-761]
- Updated Messaging config for 21.04 (Hermod version 3.1.1). [DEVOPS-802]
- Changed chmod command to give permission 700 instead of 600, because hermod needs execute permission.
- Updated SmartID version to 21.04
### Fixed
- Fixed typos in the strings that are echoed to the user during the initialisation. [DEVOPS-646]
### Removed
- Removed unused properties in smartid.env. [DEVOPS-751]
- Removed unused ports for Physical Access. [DEVOPS-752]
- Removed Physical Access config files. Configuration is now handled using environment variables. [DEVOPS-752]
- Removed TZ from all docker-compose files. Since it is set in `smartid.env` which is mapped using `env_file`, declaring the variable a second time in `env` was not necessary.
## [Release 20.11.2-2021-03-23]
### Added
- If you say Yes to the question if Digital Access shall be deployed in the host, it will make it possible for the containers to listen on 80 and 443. [DEVOPS-540]
### Changed
- Bump SmartID version to 20.11.2
- Updated IDM translation files with newer ones. [DEVOPS-561]
- Adjust volumes for hermod certificates. [DEVOPS-651]
- Removed Selfservice hotfixes introduced in previous release. [DEVOPS-626]
### Fixed
- Fixed tenant startup by removing mapped sign encrypt configuration, so it uses the default one from inside the container. Since IDM Tenant uses less certificates, the same config as IDM operator or admin cannot be used.[DEVOPS-640]
- Fixed the copy_files.sh script used in IDM operator, admin and tenant [DEVOPS-692] + [DEVOPS-656]
## [Release 20.11.1-2021-02-18]
### Added
- Added issuing and root CA certificates to IDM containers for config signing (These certs should NEVER be used for production). [DEVOPS-549]
- Added hotfix for SelfService -> IDM connection [DEVOPS-626] Has to be removed with 20.11.2+
### Changed
- Update sign-encrypt engine to the newest state. [DEVOPS-549]
- Update version number to 20.11.1
## [Release 20.11.0-2021-02-01]
### Added
- Added mailhog as tool in /tools/mailhog. The tool can be used to test to send emails in Digital Access and Identity Manager. [DEVOPS-482]
### Changed
- Set false on traefik network in the traefik, adminer and mailhog to be enabled in traefik by default. [DEVOPS-486]
- Changed file extension of generated certificates from `.crt` to `.base64`
- Changed so that identity manager Admin and Operator do not require signed configurations/modules for uploading and downloading them by default. [DEVOPS-515]
### Fixed
- Fix environment variable usage inside traefik config file. [DEVOPS-514]
## [Release 20.11.0-2020-12-22]
### Added
- Added support for selfservice branding. [DEVOPS-471]
- Added log4j volume mapping for idm containers. [DEVOPS-470]
### Changed
- Updated traefik version to 2.3.4 [DEVOPS-464]
- Renamed selfservice container from "idm_selfservice" to "selfservice".
- Renamed all environment variables starting with "IDM_SELFSERVICE_x" to "SELFSERVICE_x".
- Changed Hermod config to disable by default some end-points and to hide sensitive data in logs. [DEVOPS-484]
- Improved the `stop-smartid.sh` script to handle dynamically all docker-compose stop commands and to work regardless of where the script is called from.
- Improved the `init-smartid.sh` script to work regardless of where the script is called from.
- Improved the `createca.sh` script to work regardless of where the script is called from.
- Renamed `idm-selfservice-language.json` to `idm-selfservice-config.json`.
### Fixed
- Fixed volume mapping for selfservice tomcat server.xml by using a separate variable than identitymanager.
- Fixed French translations for IDM and Selfservice.
## [Release 20.11.0-2020-12-07]
### Added
- Added `postgres/init/init-smartid-databases.sql` so that Physical Access database is created when starting up postgres. The "pauser" is created, and a default password is set.
- Added LE CA Certificate to cacerts. [DEVOPS-455]
- Added AJP port variables in smartid.env and use them in identitymanager docker-compose files. Also added AJP Connector in `config/idm-tomcat-server.xml`, which has to be enabled manually (and port set accordingly). [DEVOPS-348]
- Add following new features to the identitymanager docker-compose files: [DEVOPS-406]
- Support for new CA store volume mapping
- Support for new system properties environment variable
- Support for new DB properties environment variables
- Support for new spring bean volume mapping. See `IDM_VOLUME_PATH_SPRING` in `smartid.env`.
- Support for new jars volume mapping. See `IDM_VOLUME_PATH_LIBS` in `smartid.env`.
- Support for new class files volume mapping. See `IDM_VOLUME_PATH_CLASSES` in `smartid.env`.
- Add following new features to the selfservice docker-compose file: [DEVOPS-406]
- Support for new CA store volume mapping
- Support for new IDM url environment variable
- Added adminer as tool [DEVOPS-407]
- Added maxVersion for TLS to be 1.2 due to compatibility issues with some mobile devices. [DEVOPS-413]
### Changed
- Changed smartid version to 20.11.0.
- Moved "/certs/boostrap" to "/boostrap".
- Changed postgres version in smartid.env from 9.6.18 to 12.5. [DEVOPS-431]
- Split identity manager containers into their own docker-compose files: [DEVOPS-382]
- Added `identitymanager/admin/docker-compose.yml`
- Added `identitymanager/tenant/docker-compose.yml`
- Added `identitymanager/init-db/docker-compose.yml`
- Added `identitymanager/operator/docker-compose.yml`
- Adapted `init-/stop-smartid.sh`, and paths inside `smartid.env` and some docker-compose files to fit new docker-compose yaml files. [DEVOPS-382]
- Change the ini-smartid.sh script to ask if traefik is going to be used as Ingress/proxy. [DEVOPS-408]
- Changed in `config/hermod-conf.yml` some values to <IDM-HOST-HERE> and <DA-HOST-HERE> on client samples.
### Removed
- Removed MSSQL from deployment package, since Physical Access now support postgres. [DEVOPS-448]
- Removed unnecessary variables in `smartid.env`.
- Removed identitymanager compose docker-compose file. [DEVOPS-382]
- Removed entrypoint definition from identitymanager docker-compose files. [DEVOPS-406]
- Removed pgAdmin and portainer and its variables from smartid.env. [DEVOPS-407]
- Removed modern and old options for tls in `config/traefik/traefik-tls.yml`. [DEVOPS-413]
- Removed TRAEFIK_TLS_OPTION from smartid.env. [DEVOPS-413]
- Removed identitymanager spring beans because we changed how handle them.
- Removed samples.
## [Release 20.06.1-2020-10-27]
### Added
- Added port forwarding to hermod container in the messaging docker-compose file.
- Added spring bean files for identitymanager in `config/idm/spring_operation` and spring_admin.
- Added translation files for identitymanager in `config/idm/translation_id`m and for selfservice in `config/idm/translation_selfservice`.
- It is now possible to enable Strict SNI using TRAEFIK_TLS_STRICTSNI=true
### Changed
- changed smartid version to 20.06.1.
- Changed HERMOD_DOMAIN_PREFIX from "mb" to "messaging".
- Changed the DB init/update script behavior, can be controlled with `IDM_DBUPDATE_SCRIPT` in smartid.env.
- Changed `traefik-tls.toml` file to YAML and used variables from .env file. Possibility to change TLS certificate file names TRAEFIK_TLS_DEFAULT_CERTIFICATE and TRAEFIK_TLS_DEFAULT_CERTIFICATEKEY.
- Improved the `init-smartid.sh` script.
- Moved seflservice to a separate docker-compose file.
### Fixed
- Fixed the jdbc url for `config/da-admin-customize.conf`.
### Removed
- Dropped `restart: always` for identittymanager init-db.
- Removed explicit DBHOST naming in `smartid.env` to force user to set its own value.
## [Release 20.06.0-2020-09-28]
### Added
- Added possibility to add custom-beans for IDM Operator and Admin, in `config/idm`.
- Added possibility to change translation for IDM Operator, Admin, Selfservice and Tenant.
- Added IDM_DB_QUARTZ example for MSSQL, Oracle and DB2.
- Added `container_name` for all containers in:
- identitymanager/docker-compose.yml
- traefik/docker-compose.yml
- Added docker hostname for postgresdb DB_HOST in `postgres/docker-compose.yml`, this will make test deployment work from start.
- Added docker hostname for mssqldb PA_DB_HOST in `mssql/docker-compose.yml`.
- Added `restart: always` to all containers. All containers will the start up after re-boot, if they have been started once before.
- Included SAML example files for IDM in `/samples/idm_saml`.
### Changed
- Changed smartid version to 20.06.0.
- Changed explorer/operator url in `idm-selfservice-application.yml`.
- Changed location of Identity Manager SAML samples files from `/docker/compose/examples` to `/samples/idm_saml`.
- Updated `init-smartid.sh`:
- Now check if docker and docker-compose are installed, if not the script will exit.
- Now asks if the deployment is a production deployment, if "Yes", the script will complete and deployment configuration can be done. If "No":
- Ask if postgres and/or mssql shall be deployed and started.
### Fixed
- Moved comments in `smartid.env` file to be on a separate line instead of behind the value. This was breaking the applications since comments would be evaluated as part of the value.
- Fixed `init-smartid.sh` so that it works properly on CentOS.
- Fixed a typo for variable `IDM_DB_QUARTZ`.
- Fixed typo in idm-operator container in `identitymanager/docker-compose.yml`, in the path to the castore.jks.
## Removed
- Removed `init-smartid-test.sh`, it is included in init-smartid.sh.
For information regarding support, training and other services in your area, please visit our website at www.nexusgroup.com/.
Support
Nexus offers maintenance and support services for Smart ID components to customers and partners. For more information, please refer to the Nexus Technical Support at www.nexusgroup.com/support/, or contact your local sales representative.
