Zum Hauptinhalt springen
Version: 6.19

Security and authentication improvements

The following improvements regarding security and authentication have been made.

Possibility to log out users when their permissions are reduced (#658056)​

When an administrator reduces user permissions by removing roles from users or removing a permission from their assigned roles, he can now decide to log out the affected users automatically to end their active sessions. This ensures that the change can take effect immediately.

The following changes have been made in the Web Admin Suite for this purpose:

  • Roles page: New button Log out users and info message which are shown when permissions are reduced. The administrator can terminate all or single sessions in a modal that lists all active sessions belonging to the affected users.
  • Users page: When a role is unassigned from a user, a modal window where the administrator can terminate the active sessions of the user is shown after clicking the Update button.
  • Sessions page: The session status filter includes the new option Active (revoked permissions) to quickly locate sessions that may need termination.
info

Logging out users after reducing their permissions is optional. The administrator can still close the dialogs without terminating any sessions to avoid that the users loose work.

Support for bearer token authentication added (#667818)​

ConSol CM now supports OAuth authentication using tokens. This allows a secure connection between the MCP server and the ConSol CM server via REST API. The access token is sent in the request header Authorization: Bearer <access‑token> and the server matches it to a user or contact so that the application acts in the desired permission context.

If this authentication method is configured, the authentication flow is as follows:

  1. The user is redirected from the client to the authentication application, where he provides his credentials.
  2. The authentication application checks the credentials and redirects the user back to the client with an authorization code.
  3. The authorization code is exchanged for the ID, access and refresh tokens in the background.
  4. The tokens are sent with each request by the client, and the server checks their validity.

The system properties referring for OIDC in the module cmas-core-security have been extended with a property oidc.<client>.restAccess.<config_name> to determine if access via REST API is allowed or not for the client.

Role synchronization via OIDC claims (#668445)​

Automatic role synchronization can now be configured for users logging in via SSO using Microsoft Entra ID. During each login, the system automatically assigns or revokes ConSol CM roles based on the user's group membership in Entra ID, eliminating the need for manual role maintenance.

Administrators can configure the synchronization via the Web Admin Suite. Please proceed as follows:

  1. Create a mapping template on the Technical templates page which defines the relationship between Entra ID groups and internal ConSol CM roles. You can reference the group by ID or name.
  2. Create the property oidc.<client>.rolesMapping.default in the module cmas-core-security and enter the name of the mapping template.
  3. Create the property oidc.<client>.rolesClaim.default in the module cmas-core-security and enter the name of the claim which contains the group information. This can be either IDs or names.
Scope

Only the roles which are defined in the mapping template are automatically assigned or revoked. Manually assigned roles which are not referenced in the template remain untouched.

Example mapping template:

[
  {
    "groupId": "c45c462d-d72f-47d6-8958-fd5c4992c65e",
    "cmRoles": ["HD_1st_Level_Role"]
  },
  {
    "groupId": "67118684-4fe9-46cb-a655-8736b5b6f352",
    "cmRoles": ["Change_Queue_HD1_HD2_Role", "archiveAdmin"]
  }
]

Third-party library changes​

The following third-party libraries have been updated or replaced in this ConSol CM version:

  • atmosphere (#669006): Updated to version 5.0.41
  • axios (#669006, #669153): Updated to version 1.19.0
  • cidr-regex (#669006): Updated to version 7.0.1
  • codemirror (#669006) Updated to the latest version
  • commons-fileupload2 (#669005): Updated to version 2.0.0-M5
  • commons-validator (#669005): Updated to version 1.10.1
  • datatables (#666840): Updated to version 2.3.5
  • date-fns (#668796): Updated to version 4.4.0
  • deepl-java (#668778): Updated to version 1.16.0
  • diff (#668796): Updated to version 9.0.0
  • form-data (#668811): Updated to version 4.0.6
  • formik (#668796): Updated to version 2.4.9
  • formio/js (#669006): Updated to version 5.5.1
  • formio/react (#668796): Updated to version 6.2.1
  • freemarker (#669392): Updated to version 2.3.35
  • html-react-parser (#669184): Updated to version 6.1.5
  • html-to-text (#668796): Updated to version 10.0.0
  • http-proxy-middleware (#669006): Updated to version 4.2.0
  • immutable (#669002, #669003, #669006): Updated to version 5.1.8 and 5.1.9
  • jackson-bom (#669471): Updated to version 2.21.6
  • jackson-databind (#669471): Updated to version 3.2.2
  • jose (#669006): Updated to version 6.2.9
  • jquery (#668796): Updated to version 4.0.0
  • json-schema-validator (#668744): Updated to version 3.0.5
  • logback (#669471): Updated to version 1.6.3
  • log4j (#668744, #666919, #669001): Updated to version 2.25.3 and 2.25.5
  • mui (#669006): Updated to version 9.3.1
  • netty-bom (#669153, #669395): Updated to version 4.2.16 and 4.2.18
  • opennlp-tools (#669201): Updated to version 2.5.11
  • papaparse (#669006): Updated to version 5.6.0
  • postcss (#669199): Updated to version 8.5.26
  • postgresql (#668998): Updated to version 42.7.12
  • react (#669006, #669184): Updated to version 19.2.8
  • react-draggable (#669006): Updated to version 4.7.1
  • react-froala-wysiwyg (#669006): Updated to version 5.3.1
  • react-intl (#669006): Updated to version 10.1.20
  • react-lists (#669006): Updated to version 0.8.19
  • react-router (#669003, #669006, #669180): Updated to version 7.15.1 and 7.18.2 and 8.3.0
  • react-window (#669006): Updated to version 2.3.0
  • reactor-netty-http (#666919): Updated to version 1.2.14
  • redux-sage (#669006): Updated to version 1.5.1
  • spring-ai (#668744): Updated to version 1.1.8
  • spring-boot (#668744): Updated to version 3.5.15
  • tika (#669201): Updated to version 3.3.2
  • tomcat (#669153): Updated to version 10.1.59
  • typescript (#668796): Updated to version 6.0.3
  • uuid (#668796): Updated to version 14.0.1
  • wicket (#669392): Updated to version 10.11.0
  • wicketstuff (#669005): Updated to version 10.8.0
Field visualizations with datatables

If you implemented field visualizations using the datatables library, you need to check if the scripts are still working correctly, as the version jump from 1.13.3 to 2.3.5 contains breaking changes. Please check the official documentation at https://datatables.net/upgrade/2.

CM/Doc

You need to update CM/Doc for this change to become effective.