App Suite Middleware

8.47.162

Behavioral Changes

SCR-2050

Summary: Composition spaces in the database or file storage are encrypted with AES/GCM

Effective: 8.47.162 and later

Composition spaces kept in the database or file storage (com.openexchange.mail.compose.mailstorage.enabled set to false) with com.openexchange.mail.compose.security.encryptionEnabled set to true were encrypted with AES/CBC, a fixed IV and no integrity protection: identical content produced identical ciphertext, and altered data went undetected. New content and attachments are now encrypted with AES/GCM and a random IV; attachments are sealed in 16 KiB segments. Existing data stays readable. The default draft-based storage is not affected.

Nodes on 8.46 to 8.54 read the new format only from the patch release that includes this change. Update them to that patch release before a rolling update to 8.55, and do not downgrade below it afterwards; otherwise composition spaces written by 8.55 cannot be opened.

8.47.157

Behavioral Changes

SCR-2096

Summary: IMAP temporary-down back-off no longer triggered by account-specific failures after login

Effective: 8.47.157 and later

After a failed connect attempt, the middleware marks the IMAP server as temporarily down for com.openexchange.imap.imapTemporaryDown milliseconds and rejects all further connects to that server on the node with MSG-1016. A connection failure after the server accepted the credentials, such as a reset because a single mailbox is being migrated, no longer sets that mark: it only fails the affected request, other accounts are not blocked. Failures before authentication (connection refused or timed out, TLS handshake, greeting) set it as before. No admin action.

8.47.156

Behavioral Changes

SCR-2096

Summary: IMAP temporary-down back-off no longer triggered by account-specific failures after login

Effective: applies to the 8.47 release line

After a failed connect attempt, the middleware marks the IMAP server as temporarily down for com.openexchange.imap.imapTemporaryDown milliseconds and rejects all further connects to that server on the node with MSG-1016. A connection failure after the server accepted the credentials, such as a reset because a single mailbox is being migrated, no longer sets that mark: it only fails the affected request, other accounts are not blocked. Failures before authentication (connection refused or timed out, TLS handshake, greeting) set it as before. No admin action.

8.47.154

Behavioral Changes

SCR-1759

Summary: Seal proxy registration URLs via ObfuscatorService instead of static DES key

Effective: 8.47.154 and later

Hardening. The proxy registration URLs for external image proxying were encrypted with a static DES key that is part of the public AGPL source, so any authenticated user could forge proxy URLs - stripping restrictions or targeting internal endpoints. They are now sealed via the ObfuscatorService with a per-installation secret (AES/GCM). The legacy format is still accepted for rolling upgrades. No configuration change.

8.47.147

API - Java

SCR-1681

Summary: Added DAVX5 constant to BuiltInProvider enum and deprecated SYNC_APP

Effective: 8.47.147 and later

Extended enum com.openexchange.client.onboarding.BuiltInProvider with a new constant DAVX5("davx5") for the DAVx5 Select onboarding provider. The existing SYNC_APP("syncapp") constant has been deprecated in favor of DAVX5.

API - REST

SCR-1680

Summary: Introduced new REST endpoint for DAVx5 Select configuration

Effective: 8.47.147 and later

A new REST endpoint is introduced to serve DAVx5 Select configuration JSON:

GET /davx5/v1/config/{token}

The endpoint supports two modes:

Initial setup (no Authorization header): Redeems a one-time token, creates an app-specific password scoped to CalDAV/CardDAV, and returns the full configuration including DAV URLs, credentials, and UI customization. The user identity is derived from the session reservation bound to the token.

Response:
{
  "baseRoot": "https://dav.example.org/dav/",
  "caldavRoot": "https://dav.example.org/caldav/",
  "carddavRoot": "https://dav.example.org/carddav/",
  "basicAuth": {
    "username": "peter@example.org",
    "password": "app-specific-password-here"
  },
  "customization": {
    "productName": "Example Mail",
    "description": "Sync service brought to you by Example Corp",
    "logoImage": "data:image/png;base64,iVBOR...",
    "headerImage": "https://example.com/header.png"
  },
  "supportInfos": {
    "linkDestination": "https://example.com/support",
    "linkTitle": "Contact Support",
    "description": "In case of any problem, please visit our support page."
  }
}

Authenticated re-query (Basic Auth header): Returns customization-only JSON with Cache-Control and ETag headers for efficient polling. The user identity is derived from the validated credentials. The token path segment is ignored in this mode.

Error responses: 401 (invalid credentials), 403 (token invalid/expired/used), 429 (rate limit exceeded), 500 (internal error), 503 (auth service unavailable).

Behavioral Changes

SCR-1682

Summary: Replaced Sync App with DAVx5 Select in Android onboarding scenarios

Effective: 8.47.147 and later

The former syncappinstall onboarding scenario for Android devices has been replaced by two new scenarios:

  • davx5install — A link to the DAVx5 Select app on the Google Play Store.
  • davx5setup — A one-time configuration link using the davx5://setup?config=<url> URI scheme that the DAVx5 Select app handles to automatically provision DAV URLs, an app-specific password, and optional UI customization.

The default values for the following properties have changed:

  • {}com.openexchange.client.onboarding.enabledScenarios: syncappinstall replaced by * davx5install, davx5setup

  • {}com.openexchange.client.onboarding.android.phone.scenarios: syncappinstall replaced by davx5install, davx5setup

  • {}com.openexchange.client.onboarding.android.tablet.scenarios: syncappinstall replaced by davx5install, davx5setup

A new davx5 capability is declared and awarded when both davx5install and davx5setup onboarding scenarios are enabled for a user.

Configuration

SCR-1687

Summary: Renamed DAVx5 Select configuration properties

Effective: 8.47.147 and later

All DAVx5 Select configuration properties have been moved from the com.openexchange.davx5.\* prefix to com.openexchange.client.onboarding.davx5.\* as part of merging the com.openexchange.davx5.rest bundle into {}com.openexchange.client.onboarding.davx5. The three URL properties were additionally renamed for consistency with the existing onboarding naming convention. ||Old property||New property|| |com.openexchange.davx5.baseRoot|com.openexchange.client.onboarding.davx5.base.url| |com.openexchange.davx5.caldavRoot|com.openexchange.client.onboarding.davx5.caldav.url| |com.openexchange.davx5.carddavRoot|com.openexchange.client.onboarding.davx5.carddav.url| |com.openexchange.davx5.appPasswordType|com.openexchange.client.onboarding.davx5.appPasswordType| |com.openexchange.davx5.appPasswordName|com.openexchange.client.onboarding.davx5.appPasswordName| |com.openexchange.davx5.rateLimit.maxPerMinute|com.openexchange.client.onboarding.davx5.rateLimit.maxPerMinute| |com.openexchange.davx5.customization.productName|com.openexchange.client.onboarding.davx5.customization.productName| |com.openexchange.davx5.customization.description|com.openexchange.client.onboarding.davx5.customization.description| |com.openexchange.davx5.customization.logoImage|com.openexchange.client.onboarding.davx5.customization.logoImage| |com.openexchange.davx5.customization.headerImage|com.openexchange.client.onboarding.davx5.customization.headerImage| |com.openexchange.davx5.support.linkDestination|com.openexchange.client.onboarding.davx5.support.linkDestination| |com.openexchange.davx5.support.linkTitle|com.openexchange.client.onboarding.davx5.support.linkTitle| |com.openexchange.davx5.support.description|com.openexchange.client.onboarding.davx5.support.description|

The new URL properties ({}base.url, {}caldav.url, {}carddav.url) now fall back to the shared onboarding properties com.openexchange.client.onboarding.caldav.url and com.openexchange.client.onboarding.carddav.url when left empty, so deployments that already have CalDAV/CardDAV onboarding URLs configured may not need to set the DAVx5-specific URL properties at all.

SCR-1683

Summary: Added configuration properties for DAVx5 Select integration

Effective: 8.47.147 and later

Added the following new lean configuration properties:

DAV URL configuration (config-cascade aware):

  • com.openexchange.davx5.baseRoot DAV base URL. Default: empty.

  • com.openexchange.davx5.caldavRoot CalDAV root URL. Default: empty.

  • com.openexchange.davx5.carddavRoot CardDAV root URL. Default: empty.

App password settings (config-cascade aware):

  • com.openexchange.davx5.appPasswordType App password type. Must match an entry in app-password-apps.yml. Default: "calcarddav".

  • com.openexchange.davx5.appPasswordName Display name for the app password. Default: "DAVx5 Select".

UI customization (config-cascade aware):

  • com.openexchange.davx5.customization.productName Product name shown in DAVx5 Select. Default: "OX App Suite".

  • com.openexchange.davx5.customization.description Product description. Default: "Sync your calendars and contacts".

  • com.openexchange.davx5.customization.logoImage Logo image as data URI or HTTPS URL. Default: empty.

  • com.openexchange.davx5.customization.headerImage Header/banner image as data URI or HTTPS URL. Default: empty.

Support information (config-cascade aware):

  • com.openexchange.davx5.support.linkDestination Support link URL. Default: empty.

  • com.openexchange.davx5.support.linkTitle Support link title. Default: empty.

  • com.openexchange.davx5.support.description Support description. Default: empty.

Rate limiting (not config-cascade aware):

  • com.openexchange.davx5.rateLimit.maxPerMinute Maximum requests per IP per minute for the configuration endpoint. Set to 0 to disable. Default: 10. Onboarding (config-cascade aware):

  • com.openexchange.client.onboarding.davx5.tokenTimeoutSeconds Token timeout in seconds for the one-time configuration link. Default: 30.

Packaging/Bundles

SCR-1679

Summary: Removed Sync App onboarding bundle

Effective: 8.47.147 and later

Removed the former Sync App onboarding activator ({}SyncAppOnboardingActivator) and its configuration file client-onboarding-syncapp.properties from the com.openexchange.client.onboarding bundle.

The Sync App onboarding provider has been replaced by the DAVx5 Select onboarding provider

SCR-1678

Summary: Added new bundle com.openexchange.davx5.rest for DAVx5 Select integration

Effective: 8.47.147 and later

Added new bundle com.openexchange.davx5.rest to the open-xchange-dav package.

This bundle provides a JAX-RS REST endpoint for serving DAVx5 Select configuration JSON to Android devices during CalDAV/CardDAV onboarding.

8.47.142

Behavioral Changes

SCR-1885

Summary: Cache invalidations cross remote Redis sites

Effective: 8.47.142 and later

With remote Redis sites enabled (com.openexchange.redis.sites.enabled), cache invalidations are now repeated on the remote sites' Redis storages, and the messages that invalidate node-local caches of contexts, users, resellers and cache events are published there as well. Two middleware clusters attached to one config database therefore no longer serve stale contexts, users or database assignments after a provisioning change on the other cluster until the cache entries expire. Remote sites are best-effort: an unreachable site is logged, counted in appsuite.redis.remote.failures.total and skipped with a back-off; it never fails the provisioning call. Deployments that only share the databases should set com.openexchange.redis.sites.scope to invalidation to keep sessions on their site. No admin action for deployments without remote sites.

Configuration

SCR-1884

Summary: New configuration options for remote Redis sites

Effective: 8.47.142 and later

Options for using remote Redis sites for cache invalidation, e.g. between two middleware clusters attached to one config database.

  • com.openexchange.redis.sites.scope What the configured remote sites are used for. all: sessions are replicated to the remote sites and looked up there, and cache invalidations are repeated there. invalidation: cache invalidations only; the sessiond sees no remote sites, so sessions stay on their site. Use invalidation for clusters that merely share the databases. Default all. Not reloadable, not config-cascade aware. File: redis.properties.

  • com.openexchange.redis.[site].cache.enabled Whether the remote site denoted by [site] (one of the identifiers listed in com.openexchange.redis.sites) runs a dedicated Redis instance for cache data. If enabled, that instance is configured through the [site].cache infix, e.g. com.openexchange.redis.[site].cache.hosts, and cache invalidations are repeated there; otherwise they are repeated on the remote site's regular Redis instance. Default false. Not reloadable, not config-cascade aware. File: redis.properties.

8.47.124

Configuration

SCR-1803

Summary: New properties for the replication monitor's replica status check

Effective: 8.47.124 and later

The replication monitor now probes read replicas' replication status (SHOW SLAVE STATUS) and redirects reads to the master while a replica reports broken replication or excessive lag. This closes the gap that a re-seeded or inconsistently restored replica could serve incomplete data undetected (middleware/core#4, follow-up to the incident behind appsuite/support#1599). Four new lean configuration properties control the behavior:

  • com.openexchange.database.replicationMonitor.checkReplicaStatus (default: true) - Whether to watch read replicas for broken or excessively lagging replication and redirect reads to the master meanwhile. Works out of the box: where the REPLICA MONITOR (MariaDB) or REPLICATION CLIENT (MySQL) privilege is available, the replication status statement provides fast, precise detection; without it the check falls back to a privilege-free heartbeat, a time stamp periodically written through the replication channel into the replicationMonitor table (reserved row cid=4294967295), needing only the regular INSERT/UPDATE/SELECT permissions. REPLICA MONITOR (MariaDB) or REPLICATION CLIENT (MySQL) privilege; both are global privileges, so one grant per database host covers all existing and future schemas, and initconfigdb -a now grants them automatically. Without the privilege the check suspends itself for the affected pool. Only effective if the replication monitor is active. Default: true. Reloadable: false. Config-cascade aware: false.
  • com.openexchange.database.replicationMonitor.maxReplicaLag - Maximum tolerated replication lag in seconds before reads are redirected to the master. Default: 300. Reloadable: false. Config-cascade aware: false.
  • com.openexchange.database.replicationMonitor.replicaStatusCheckInterval - Minimum number of seconds between two replication status probes per read pool. Default: 10. Reloadable: false. Config-cascade aware: false.
  • com.openexchange.database.replicationMonitor.requireReplication - Whether a read host that does not act as a replica at all (empty SHOW SLAVE STATUS) is considered unhealthy. Keep false for Galera or multi-primary setups; set to true where read pools are always asynchronous replicas. Default: false. Reloadable: false. Config-cascade aware: false.

All four properties are read once at middleware start-up; changing them requires a restart. They are server-scoped (no config-cascade evaluation) and documented in documentation-generic/config/ConfigDB.yml. Defaults are safe for every topology: without the privilege or without asynchronous replication the check fails open and behavior is unchanged.

8.47.112

General

SCR-1793

Summary: Redis connector: per-node client name, max. connection lifetime, deterministic shutdown

Effective: 8.47.112 and later

Hardening of the Redis connector against stale / orphaned connected clients.

New configuration option:

  • com.openexchange.redis.connection.pool.maxLifetimeSeconds Maximum lifetime in seconds of a pooled Redis connection. Once a connection exceeds this age it is proactively recycled by the connection-pool cleaner as soon as it becomes idle, regardless of usage; this applies to both the shared and the dedicated pool. Acts as defense-in-depth against slowly accumulating or long-lived stale connections that TCP keepalive cannot reap (a live-but-idle connection is never detected as dead). A value of 0 (zero) disables max. lifetime recycling. Default 3600 (one hour). Not reloadable, not config.cascade aware. Package: open-xchange-core.

Behavioral changes (no configuration):

  • Client name: the announced Redis client name now includes the local host / pod name (e.g. Open-Xchange-Redis-Connector-v8.53.0-<host>), so connections become attributable per node via Redis CLIENT LIST. This is what lets operators tell restart orphans (dead pod addresses) apart from live-node connections.
  • Deterministic shutdown: the shared connection pool now closes its connections synchronously on shutdown, so Redis reclaims the clients immediately on a graceful (rolling) restart instead of leaving them as ghosts.

8.47.82

CLT

SCR-1691

Summary: Added command-line tools for mail signatures

Effective: 8.47.82 and later

Added the following command-line tools for mail signatures

usage: listsignatures -c <contextId> -u <userId> -A <masterAdmin | contextAdmin> -P <masterAdminPassword |
                      contextAdminPassword> [-p <RMI-Port>] [-s <RMI-Server] [--responsetimeout <responseTimeout>] |
                      [-h]
 -A,--adminuser <adminUser>       Admin username
 -c,--context <contextId>         The context identifier
 -h,--help                        Prints this help text
 -p,--port <rmiPort>              The optional RMI port (default:1099)
 -P,--adminpass <adminPassword>   Admin password
    --responsetimeout <timeout>   The optional response timeout in seconds when reading data from server (default: 0s;
                                  infinite)
 -s,--server <rmiHost>            The optional RMI server (default: localhost)
 -u,--user <userId>               The user identifier

Command-line tool for listing signatures of a certain user.

usage: deletesignature -c <contextId> -u <userId> -s <signatureId> -A <masterAdmin | contextAdmin> -P
                       <masterAdminPassword | contextAdminPassword> [-p <RMI-Port>] [-s <RMI-Server] [--responsetimeout
                       <responseTimeout>] | [-h]
 -A,--adminuser <adminUser>       Admin username
 -c,--context <contextId>         The context identifier
 -h,--help                        Prints this help text
 -i,--identifier <signatureId>    The signature identifier
 -p,--port <rmiPort>              The optional RMI port (default:1099)
 -P,--adminpass <adminPassword>   Admin password
    --responsetimeout <timeout>   The optional response timeout in seconds when reading data from server (default: 0s;
                                  infinite)
 -s,--server <rmiHost>            The optional RMI server (default: localhost)
 -u,--user <userId>               The user identifier

Command line tool to delete a certain signatures of a user.

8.47.52

General

SCR-1656

Summary: Updated Apache Commons CLI library from v1.9.0 to v1.11.0

Effective: 8.47.52 and later

Updated Apache Commons CLI library from v1.9.0 to v1.11.0 in target platform (com.openexchange.bundles)

SCR-1650

Summary: Updated Jackson libraries from v2.19.2 to v2.21.0 in target platform

Effective: 8.47.52 and later

Updated Jackson libraries from v2.19.2 to v2.21.0 in `}com.openexchange.bundles}

  • jackson-annotations v2.19.2 to v2.21.0
  • jackson-core v2.19.2 to v2.21.0
  • jackson-databind v2.19.2 to v2.21.0
  • jackson-dataformat-cbor v2.19.2 to v2.21.0
  • jackson-dataformat-xml v2.19.2 to v2.21.0
  • jackson-dataformat-yaml v2.19.2 to v2.21.0
  • jackson-datatype-jsr310 v2.19.2 to v2.21.0
  • jackson-datatype-jsr353 v2.19.2 to v2.21.0
  • jackson-jakarta-rs-base v2.19.2 to v2.21.0
  • jackson-jakarta-rs-json-provider v2.19.2 to v2.21.0
  • jackson-jakarta-rs-xml-provider v2.19.2 to v2.21.0
  • jackson-module-jakarta-xmlbind-annotations v2.19.2 to v2.21.0
  • jackson-module-jaxb-annotations v2.19.2 to v2.21.0

3rd Party Libraries/License Change

SCR-1657

Summary: Updated Apache Commons Collections4 library from v4.4 to v4.5.0

Effective: 8.47.52 and later

Updated Apache Commons Collections4 library from v4.4 to v4.5.0 in target platform (com.openexchange.bundles)

SCR-1655

Summary: Update Apache Commons Codec

Effective: 8.47.52 and later

Updated Apache Commons Codec from v.1.17.2 to v1.21.0 in target platform (com.openexchange.bundles)

SCR-1654

Summary: Updated Apache Mime4j

Effective: 8.47.52 and later

Updated Apache Mime4j libraries in target platform (com.openexchange.bundles)

  • apache-mime4j-core-0.8.10.jar -> apache-mime4j-core-0.8.13.jar
  • apache-mime4j-dom-0.8.10jar -> apache-mime4j-dom-0.8.13.jar
  • apache-mime4j-storage-0.8.10.jar -> apache-mime4j-storage-0.8.13.jar

SCR-1653

Summary: Upgraded JSoup library

Effective: 8.47.52 and later

Upgraded JSoup library from v1.21.1 to v1.22.1 in target platform (com.openexchange.bundles)

SCR-1652

Summary: Updated OSGi target platform bundles

Effective: 8.47.52 and later

Updated the following OSGi target platform bundles

  • org.eclipse.osgi_3.23.200.v20250812-1847.jar updated to org.eclipse.osgi_3.24.0.v20251126-0427.jar

SCR-1649

Summary: Updated Fabric8 libraries from v7.4.0 to v7.5.2

Effective: 8.47.52 and later

Updated Fabric8 ibraries from v7.4.0 to v7.5.2 in bundle io.fabric8.kubernetes

  • kubernetes-client-7.5.2.jar
  • kubernetes-client-api-7.5.2.jar
  • kubernetes-httpclient-jdk-7.5.2.jar
  • kubernetes-model-admissionregistration-7.5.2.jar
  • kubernetes-model-apiextensions-7.5.2.jar
  • kubernetes-model-apps-7.5.2.jar
  • kubernetes-model-autoscaling-7.5.2.jar
  • kubernetes-model-batch-7.5.2.jar
  • kubernetes-model-certificates-7.5.2.jar
  • kubernetes-model-common-7.5.2.jar
  • kubernetes-model-coordination-7.5.2.jar
  • kubernetes-model-core-7.5.2.jar
  • kubernetes-model-discovery-7.5.2.jar
  • kubernetes-model-events-7.5.2.jar
  • kubernetes-model-extensions-7.5.2.jar
  • kubernetes-model-flowcontrol-7.5.2.jar
  • kubernetes-model-gatewayapi-7.5.2.jar
  • kubernetes-model-metrics-7.5.2.jar
  • kubernetes-model-networking-7.5.2.jar
  • kubernetes-model-node-7.5.2.jar
  • kubernetes-model-policy-7.5.2.jar
  • kubernetes-model-rbac-7.5.2.jar
  • kubernetes-model-resource-7.5.2.jar
  • kubernetes-model-scheduling-7.5.2.jar
  • kubernetes-model-storageclass-7.5.2.jar
  • zjsonpatch-7.5.2.jar

SCR-1648

Summary: Updated lettuce library from v6.5.5 to v6.8.2

Effective: 8.47.52 and later

Updated lettuce library from v6.5.5 to v6.8.2 in bundle io.lettuce

  • lettuce-core-6.8.2.RELEASE.jar

SCR-1647

Summary: Updated Netty libraries

Effective: 8.47.52 and later

Updated Netty libraries from v4.1.124 to v4.1.130 in bundle io.netty

  • netty-buffer-4.1.130.Final.jar
  • netty-codec-4.1.130.Final.jar
  • netty-codec-dns-4.1.130.Final.jar
  • netty-codec-http2-4.1.130.Final.jar
  • netty-codec-http-4.1.130.Final.jar
  • netty-codec-socks-4.1.130.Final.jar
  • netty-common-4.1.130.Final.jar
  • netty-handler-4.1.130.Final.jar
  • netty-handler-proxy-4.1.130.Final.jar
  • netty-resolver-4.1.130.Final.jar
  • netty-resolver-dns-4.1.130.Final.jar
  • netty-transport-4.1.130.Final.jar
  • netty-transport-native-unix-common-4.1.130.Final.jar
  • netty-transport-classes-epoll-4.1.130.Final.jar
  • netty-transport-native-epoll-4.1.130.Final.jar
  • netty-transport-classes-kqueue-4.1.130.Final.jar
  • netty-transport-native-kqueue-4.1.130.Final.jar
  • netty-tcnative-classes-2.0.72.Final

SCR-1646

Summary: Updated OpenId Connect libraries

Effective: 8.47.52 and later

Updated OpenId Connect libraries in bundle com.nimbus:

  • accessors-smart-2.4.11.jar updated to accessors-smart-2.5.2.jar
  • asm-9.1.jar updated to asm-9.7.1.jar
  • content-type-2.2.jar updated to content-type-2.3.jar
  • json-smart-2.4.11.jar updated to json-smart-2.5.2.jar
  • nimbus-jose-jwt-10.0.2.jar updated to nimbus-jose-jwt-10.6.jar
  • oauth2-oidc-sdk-10.7.jar updated to oauth2-oidc-sdk-11.32.jar

SCR-1641

Summary: Added RE2/J - linear time regular expression matching in Java

Effective: 8.47.52 and later

Added Google Open Source library RE2/J "re2j-1.8.jar" as bundle to target platform "com.openexchange.bundles". RE2 is a regular expression engine that runs in time linear in the size of the input.

SCR-1638

Summary: Updated Spring Framework libraries

Effective: 8.47.52 and later

Updated Spring Framework libraries from v5.3.39 to v6.2.15 in bundle com.openexchange.xml

  • com.openexchange.xml/lib/spring-beans-5.3.39.jar -> com.openexchange.xml/lib/spring-beans-6.2.15.jar
  • com.openexchange.xml/lib/spring-core-5.3.39.jar -> com.openexchange.xml/lib/spring-core-6.2.15.jar
  • com.openexchange.xml/lib/spring-jcl-5.3.39.jar -> com.openexchange.xml/lib/spring-jcl-6.2.15.jar

SCR-1663

Summary: Updated Apache Commons Pool2 library

Effective: 8.47.52 and later

Updated Apache Commons Pool2 library from v2.12.0 to v2.13.1 in target platform (com.openexchange.bundles)

SCR-1662

Summary: Updated Apache Commons Net library

Effective: 8.47.52 and later

Updated Apache Commons Compress library from v3.10.0 to v3.12.0 in target platform (com.openexchange.bundles)

SCR-1661

Summary: Updated Apache Commons Lang3 library

Effective: 8.47.52 and later

Updated Apache Commons Lang3 library from v318.0 to v3.20.0 in target platform (com.openexchange.bundles)

SCR-1660

Summary: Updated Apache Commons Exec library

Effective: 8.47.52 and later

Updated Apache Commons Exec library from v1.4.0 to v1.6.0 in target platform (com.openexchange.bundles)

SCR-1659

Summary: Updated Apache Commons CSV library

Effective: 8.47.52 and later

Updated Apache Commons CSV library from v1.13.0 to v1.14.1 in target platform (com.openexchange.bundles)

SCR-1658

Summary: Updated Apache Commons Compress library

Effective: 8.47.52 and later

Updated Apache Commons Compress library from v1.26.0 to v1.28.0 in target platform (com.openexchange.bundles)

API - Java

SCR-1505

Summary: Added methods to the MultifactorLoginService

Effective: 8.47.52 and later

Extended the com.openexchange.login.multifactor.MultifactorLoginService interface by following methods:

    /**

     * Checks if multi-factor enforcement property is set and the enforceMfa flag is set for a given user.
     *
     * @param userId The user identifier
     * @param contextId The context identifier
     * @return <code>true<code> If multi-factor enforcement is enabled
     * @throws OXException
     */
    boolean checkEnforceMultiFactorAuthentication(int userId, int contextId)throws OXException;

    /**

     * Checks if multi-factor enforcement property is set for a given user.
     *
     * @param userId The user identifier
     * @param contextId The context identifier
     * @return <code>true<code> If multi-factor enforcement is enabled as dismissable; otherwise <code>false</code>
     * @throws OXException If something went wrong trying to access the database
     */
    boolean checkEnforceMultiFactorAuthenticationDismissable(int userId, int contextId);

    /**

     * Records the login attempt for a given user.
     *
     * @param userId The user identifier
     * @param contextId The context identifier
     * @throws OXException If something went wrong trying to access the database
     */
    void recordLoginAttempt(int id, int contextId) throws OXException;

    /**

     * Gets the login information record.
     *
     * @param userId The user identifier
     * @param contextId The context identifier
     * @return A MultifactorEnforcementInformation record holding the information
     * @throws OXException If something went wrong trying to access the database
     */
    MultifactorEnforcementInformation getLoginInformation(int id, int contextId) throws OXException;

    /**

     * Enhances JSON with multi-factor enforcement data.
     *
     * @param json The JSON content to enhance
     * @param userId The user identifier
     * @param contextId The context identifier
     */
    void enhanceLoginJson(JSONObject json, int userId, int contextId);

    /**

     * Resets the login information for an user.
     *
     * @param userId The user identifier
     * @param contextId The context identifier
     * @throws OXException If something went wrong trying to access the database
     */
    void resetLoginInformation(int userId, int contextId) throws OXException;

API - REST

SCR-1504

Summary: Introduced a new REST interface for multifactor enforcement

Effective: 8.47.52 and later

New REST endpoint is introduced in order to manage multifactor enforcement.

Retrieve login information for a certain user:

GET /admin/v1/contexts/\{context-id}/users/\{user-id}/multifactor/enforcement

Response:
{
  "enforceMfa": true,
  "loginCounter": 5,
  "firstLogin": "<time-stamp>"
}

Reset login information for a certain user:

DELETE /admin/v1/contexts/\{context-id}/users/\{user-id}/multifactor/enforcement

CLT

SCR-1503

Summary: Add CLT for multifactor enforcement

Effective: 8.47.52 and later

Command-line tool resetenforcemfa to allow a reset of the multi-factor enforcement informations

usage: resetenforcemfa -c <contextId> -i <userId> -A <masterAdmin | contextAdmin> -P <masterAdminPassword |
                       contextAdminPassword>
 -A,--adminuser <adminuser>       Admin username
    --api-host <arg>              URL for an alternative REST end-point host. Example: 'https://192.168.0.1:8443'.
                                  Default: 'http://localhost:8009'
    --api-root <arg>              URL to an alternative HTTP API endpoint. Example: 'https://192.168.0.1:8443/admin/v1/'
 -c,--contextid <arg>             A valid context identifier.
 -h,--help                        Prints this help text
 -i,--userid <arg>                A valid user identifier.
 -P,--adminpass <adminpassword>   Admin password

The command-line tool to reset the multifactor enforcement for an user.

Configuration

SCR-1645

Summary: Added various properties for proxy functionality

Effective: 8.47.52 and later

Added various lean properties for proxy functionality

  • com.openexchange.proxy.path Specifies the path taken when replacing URIs and for registering proxy Servlet. Default value is "/servlet/proxy". It is reloadable, but not config-cascade aware.

  • com.openexchange.proxy.servlet.enabled The switch to enable/disable Proxy Servlet. Default value is true. It is reloadable, but not config-cascade aware. If Proxy Servlet is enabled, com.openexchange.proxy.encoding is required being set to "object".

  • com.openexchange.proxy.encoding The method how original URI and accompanying proxy registration is encoded. "plain": Only the original URI is base64-encoded. "object": The complete registration object is compressed and obfuscated within a base64 representation. Default value is "object". It is reloadable, but not config-cascade aware.

SCR-1501

Summary: Added new properties for MFA enforcement

Effective: 8.47.52 and later

Introduced new lean webauthn properties to use webauthn as a 2nd factor and as a preparation for webautn as a "full" authentication service

  • com.openexchange.multifactor.enabled Defines if MFA should be enforced.

  • com.openexchange.multifactor.login_limit Configures the amount of login attempts a user can do before MFA is really enforced.

  • com.openexchange.multifactor.period_limit Configures the period of time in days, starting from the first login, which defines when MFA is really enforced.

Database

SCR-1502

Summary: Add table for mfa enforcement

Effective: 8.47.52 and later

Warning

Update Task com.openexchange.multifactor.enforcement.storage.rdb.CreateMultifactorEnforcementTableTask

In order to implement the possibility to enforce multi-factor, a database table called multifactor_enforcement needs to be created to store the relevant informations.

CREATE TABLE `multifactor_enforcement`(
  `cid` int(10) unsigned NOT NULL,
  `id` int(10) unsigned NOT NULL,
  `enforceMfa` TINYINT(1) DEFAULT 0,
  `loginCounter` int(10) DEFAULT 0,
  `firstLogin` DATETIME DEFAULT NULL,
  PRIMARY KEY (`cid`, `id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci"

8.47.39

Configuration

SCR-1651

Summary: Added possibility to move a context to another database (pool) w/o using a surrounding transaction on config database

Effective: 8.47.39 and later

Added new lean property com.openexchange.admin.context.move.useSurroundingConfigdbTransaction considered when moving a context to another database (pool) that controls whether to use a surrounding transaction on config database or not. If set to false concurrent context provisioning is not blocked through locks on database layer, but comes with the burden that inconsistent data might be left on config database in case an unrecoverable error occurs. Default value is true (surrounding transaction is used and thus highest level of consistency safety). It is reloadable and config-cascade aware (down to context scope)

8.47.5

3rd Party Libraries/License Change

SCR-1644

Summary: Removed Eclipse Collections from target platform

Effective: 8.47.5 and later

Removed Eclipse Collections from target platform (com.openexchange.bundles):

  • eclipse-collections-api-13.0.0.jar
  • eclipse-collections-13.0.0.jar

8.47.1

Database

SCR-1643

Summary: Drops update task entry for orphaned "InitialTombstoneCleanupUpdateTask" update task

Effective: 8.47.1 and later

Warning

Update Task com.openexchange.database.tombstone.cleanup.update.DropInitialTombstoneCleanupEntryTask

Drops update task entry for orphaned "c.o.database.tombstone.cleanup.update.InitialTombstoneCleanupUpdateTask" update task