App Suite Middleware

8.49.129

General

SCR-1793

Summary: Redis connector: per-node client name, max. connection lifetime, deterministic shutdown

Hardening of the Redis connector against stale / orphaned connected clients.

New configuration option:

  • com.openexchange.redis.connection.pool.maxLifetimeSeconds Maximum lifetime in seconds of a pooled Redis connection. Once a connection exceeds this age it is proactively recycled by the connection-pool cleaner as soon as it becomes idle, regardless of usage; this applies to both the shared and the dedicated pool. Acts as defense-in-depth against slowly accumulating or long-lived stale connections that TCP keepalive cannot reap (a live-but-idle connection is never detected as dead). A value of 0 (zero) disables max. lifetime recycling. Default 3600 (one hour). Not reloadable, not config.cascade aware. Package: open-xchange-core.

Behavioral changes (no configuration):

  • Client name: the announced Redis client name now includes the local host / pod name (e.g. Open-Xchange-Redis-Connector-v8.53.0-<host>), so connections become attributable per node via Redis CLIENT LIST. This is what lets operators tell restart orphans (dead pod addresses) apart from live-node connections.
  • Deterministic shutdown: the shared connection pool now closes its connections synchronously on shutdown, so Redis reclaims the clients immediately on a graceful (rolling) restart instead of leaving them as ghosts.

8.49.119

API - REST

SCR-1714

Summary: New Administrative REST Servlet for Shared Accounts

Permissions and capabilities a particular user effectively has for a shared account are not persisted as such, but evaluated dynamically at runtime - based on the base configuration and all shared account permissions the user received, directly as well as indirectly through his group memberships. Since this calculated result can therefore not be deduced directly from the provisioned data, a dedicated administrative REST interface is available that answers the question: which effective permissions and capabilities does a certain user have for a shared account?

The endpoints are exposed below /preliminary/sharedaccounts/v1 and are protected via HTTP Basic Authentication, with the credentials configured through the properties com.openexchange.rest.services.basic-auth.login and com.openexchange.rest.services.basic-auth.password.

The user whose access is to be evaluated - and, where applicable, the targeted shared account - can be referenced in three alternative ways: by their explicit internal identifiers, by their email address, or by their mail login string.

See the general documentation, as well as the REST API documentation for further details.

8.49.109

Database

SCR-1709

Summary: Enlarge the "meta" column from BLOB to MEDIUMBLOB for the "oxfolder_tree" and "del_oxfolder_tree" tables

Added new update task com.openexchange.groupware.update.tasks.EnlargeMetaForOXFolderTablesTask enlarging the "meta" column from BLOB to MEDIUMBLOB for the "oxfolder_tree" and "del_oxfolder_tree" tables

8.49.91

3rd Party Libraries/License Change

SCR-1689

Summary: Updated Netty libraries from v4.1.130 to v4.1.132

Updated Netty libraries from v4.1.130 to v4.1.131 in bundle io.netty

  • netty-buffer-4.1.132.Final.jar
  • netty-codec-4.1.132.Final.jar
  • netty-codec-dns-4.1.132.Final.jar
  • netty-codec-http2-4.1.132.Final.jar
  • netty-codec-http-4.1.132.Final.jar
  • netty-codec-socks-4.1.132.Final.jar
  • netty-common-4.1.132.Final.jar
  • netty-handler-4.1.132.Final.jar
  • netty-handler-proxy-4.1.132.Final.jar
  • netty-resolver-4.1.132.Final.jar
  • netty-resolver-dns-4.1.132.Final.jar
  • netty-transport-4.1.132.Final.jar
  • netty-transport-native-unix-common-4.1.132.Final.jar
  • netty-transport-classes-epoll-4.1.132.Final.jar
  • netty-transport-native-epoll-4.1.132.Final.jar
  • netty-transport-classes-kqueue-4.1.132.Final.jar
  • netty-transport-native-kqueue-4.1.132.Final.jar
  • netty-tcnative-classes-2.0.72.Final

API - Java

SCR-1681

Summary: Added DAVX5 constant to BuiltInProvider enum and deprecated SYNC_APP

Extended enum com.openexchange.client.onboarding.BuiltInProvider with a new constant DAVX5("davx5") for the DAVx5 Select onboarding provider. The existing SYNC_APP("syncapp") constant has been deprecated in favor of DAVX5.

API - REST

SCR-1680

Summary: Introduced new REST endpoint for DAVx5 Select configuration

A new REST endpoint is introduced to serve DAVx5 Select configuration JSON:

GET /davx5/v1/config/{token}

The endpoint supports two modes:

Initial setup (no Authorization header): Redeems a one-time token, creates an app-specific password scoped to CalDAV/CardDAV, and returns the full configuration including DAV URLs, credentials, and UI customization. The user identity is derived from the session reservation bound to the token.

Response:
{
  "baseRoot": "https://dav.example.org/dav/",
  "caldavRoot": "https://dav.example.org/caldav/",
  "carddavRoot": "https://dav.example.org/carddav/",
  "basicAuth": {
    "username": "peter@example.org",
    "password": "app-specific-password-here"
  },
  "customization": {
    "productName": "Example Mail",
    "description": "Sync service brought to you by Example Corp",
    "logoImage": "data:image/png;base64,iVBOR...",
    "headerImage": "https://example.com/header.png"
  },
  "supportInfos": {
    "linkDestination": "https://example.com/support",
    "linkTitle": "Contact Support",
    "description": "In case of any problem, please visit our support page."
  }
}

Authenticated re-query (Basic Auth header): Returns customization-only JSON with Cache-Control and ETag headers for efficient polling. The user identity is derived from the validated credentials. The token path segment is ignored in this mode.

Error responses: 401 (invalid credentials), 403 (token invalid/expired/used), 429 (rate limit exceeded), 500 (internal error), 503 (auth service unavailable).

Behavioral Changes

SCR-1682

Summary: Replaced Sync App with DAVx5 Select in Android onboarding scenarios

The former syncappinstall onboarding scenario for Android devices has been replaced by two new scenarios:

  • davx5install — A link to the DAVx5 Select app on the Google Play Store.
  • davx5setup — A one-time configuration link using the davx5://setup?config=<url> URI scheme that the DAVx5 Select app handles to automatically provision DAV URLs, an app-specific password, and optional UI customization.

The default values for the following properties have changed:

  • {}com.openexchange.client.onboarding.enabledScenarios: syncappinstall replaced by * davx5install, davx5setup

  • {}com.openexchange.client.onboarding.android.phone.scenarios: syncappinstall replaced by davx5install, davx5setup

  • {}com.openexchange.client.onboarding.android.tablet.scenarios: syncappinstall replaced by davx5install, davx5setup

A new davx5 capability is declared and awarded when both davx5install and davx5setup onboarding scenarios are enabled for a user.

CLT

SCR-1691

Summary: Added command-line tools for mail signatures

Added the following command-line tools for mail signatures

usage: listsignatures -c <contextId> -u <userId> -A <masterAdmin | contextAdmin> -P <masterAdminPassword |
                      contextAdminPassword> [-p <RMI-Port>] [-s <RMI-Server] [--responsetimeout <responseTimeout>] |
                      [-h]
 -A,--adminuser <adminUser>       Admin username
 -c,--context <contextId>         The context identifier
 -h,--help                        Prints this help text
 -p,--port <rmiPort>              The optional RMI port (default:1099)
 -P,--adminpass <adminPassword>   Admin password
    --responsetimeout <timeout>   The optional response timeout in seconds when reading data from server (default: 0s;
                                  infinite)
 -s,--server <rmiHost>            The optional RMI server (default: localhost)
 -u,--user <userId>               The user identifier


Command-line tool for listing signatures of a certain user.

usage: deletesignature -c <contextId> -u <userId> -s <signatureId> -A <masterAdmin | contextAdmin> -P
                       <masterAdminPassword | contextAdminPassword> [-p <RMI-Port>] [-s <RMI-Server] [--responsetimeout
                       <responseTimeout>] | [-h]
 -A,--adminuser <adminUser>       Admin username
 -c,--context <contextId>         The context identifier
 -h,--help                        Prints this help text
 -i,--identifier <signatureId>    The signature identifier
 -p,--port <rmiPort>              The optional RMI port (default:1099)
 -P,--adminpass <adminPassword>   Admin password
    --responsetimeout <timeout>   The optional response timeout in seconds when reading data from server (default: 0s;
                                  infinite)
 -s,--server <rmiHost>            The optional RMI server (default: localhost)
 -u,--user <userId>               The user identifier


Command line tool to delete a certain signatures of a user.

Configuration

SCR-1693

Summary: New Configuration Property 'com.openexchange.saml.validationClockSkew'

In order to configure a clock screw tolerance when validating assertions in SAML responses, the new lean configuration property com.openexchange.saml.validationClockSkew is introduced. It allows to configure a grace timespan in milliseconds which is considered when checking the NotOnOrAfter and NotBefore attributes for validity. It defaults to 0, and is neither reloadable, nor config-cascade-aware.

See the property documentation for further details.

SCR-1687

Summary: Renamed DAVx5 Select configuration properties

All DAVx5 Select configuration properties have been moved from the com.openexchange.davx5.\* prefix to com.openexchange.client.onboarding.davx5.\* as part of merging the com.openexchange.davx5.rest bundle into {}com.openexchange.client.onboarding.davx5. The three URL properties were additionally renamed for consistency with the existing onboarding naming convention. ||Old property||New property|| |com.openexchange.davx5.baseRoot|com.openexchange.client.onboarding.davx5.base.url| |com.openexchange.davx5.caldavRoot|com.openexchange.client.onboarding.davx5.caldav.url| |com.openexchange.davx5.carddavRoot|com.openexchange.client.onboarding.davx5.carddav.url| |com.openexchange.davx5.appPasswordType|com.openexchange.client.onboarding.davx5.appPasswordType| |com.openexchange.davx5.appPasswordName|com.openexchange.client.onboarding.davx5.appPasswordName| |com.openexchange.davx5.rateLimit.maxPerMinute|com.openexchange.client.onboarding.davx5.rateLimit.maxPerMinute| |com.openexchange.davx5.customization.productName|com.openexchange.client.onboarding.davx5.customization.productName| |com.openexchange.davx5.customization.description|com.openexchange.client.onboarding.davx5.customization.description| |com.openexchange.davx5.customization.logoImage|com.openexchange.client.onboarding.davx5.customization.logoImage| |com.openexchange.davx5.customization.headerImage|com.openexchange.client.onboarding.davx5.customization.headerImage| |com.openexchange.davx5.support.linkDestination|com.openexchange.client.onboarding.davx5.support.linkDestination| |com.openexchange.davx5.support.linkTitle|com.openexchange.client.onboarding.davx5.support.linkTitle| |com.openexchange.davx5.support.description|com.openexchange.client.onboarding.davx5.support.description|

The new URL properties ({}base.url, {}caldav.url, {}carddav.url) now fall back to the shared onboarding properties com.openexchange.client.onboarding.caldav.url and com.openexchange.client.onboarding.carddav.url when left empty, so deployments that already have CalDAV/CardDAV onboarding URLs configured may not need to set the DAVx5-specific URL properties at all.

SCR-1683

Summary: Added configuration properties for DAVx5 Select integration

Added the following new lean configuration properties:

DAV URL configuration (config-cascade aware):

  • com.openexchange.davx5.baseRoot DAV base URL. Default: empty.

  • com.openexchange.davx5.caldavRoot CalDAV root URL. Default: empty.

  • com.openexchange.davx5.carddavRoot CardDAV root URL. Default: empty.

App password settings (config-cascade aware):

  • com.openexchange.davx5.appPasswordType App password type. Must match an entry in app-password-apps.yml. Default: "calcarddav".

  • com.openexchange.davx5.appPasswordName Display name for the app password. Default: "DAVx5 Select".

UI customization (config-cascade aware):

  • com.openexchange.davx5.customization.productName Product name shown in DAVx5 Select. Default: "OX App Suite".

  • com.openexchange.davx5.customization.description Product description. Default: "Sync your calendars and contacts".

  • com.openexchange.davx5.customization.logoImage Logo image as data URI or HTTPS URL. Default: empty.

  • com.openexchange.davx5.customization.headerImage Header/banner image as data URI or HTTPS URL. Default: empty.

Support information (config-cascade aware):

  • com.openexchange.davx5.support.linkDestination Support link URL. Default: empty.

  • com.openexchange.davx5.support.linkTitle Support link title. Default: empty.

  • com.openexchange.davx5.support.description Support description. Default: empty.

Rate limiting (not config-cascade aware):

  • com.openexchange.davx5.rateLimit.maxPerMinute Maximum requests per IP per minute for the configuration endpoint. Set to 0 to disable. Default: 10. Onboarding (config-cascade aware):

  • com.openexchange.client.onboarding.davx5.tokenTimeoutSeconds Token timeout in seconds for the one-time configuration link. Default: 30.

Packaging/Bundles

SCR-1679

Summary: Removed Sync App onboarding bundle

Removed the former Sync App onboarding activator ({}SyncAppOnboardingActivator) and its configuration file client-onboarding-syncapp.properties from the com.openexchange.client.onboarding bundle.

The Sync App onboarding provider has been replaced by the DAVx5 Select onboarding provider

SCR-1678

Summary: Added new bundle com.openexchange.davx5.rest for DAVx5 Select integration

Added new bundle com.openexchange.davx5.rest to the open-xchange-dav package.

This bundle provides a JAX-RS REST endpoint for serving DAVx5 Select configuration JSON to Android devices during CalDAV/CardDAV onboarding.