[Unity-idm-discuss] Unity 3.11.0 release

[Krzysztof B. <kb...@un...>]

Dear Subscribers,

I'm happy to announce availability of a new Unity release.

As always all relevant links are available at 
https://unity-idm.eu/releases/release-3-11-0/

The 3.11.0 release is a major step towards Unity 4: big changes ahead. 
All upgrades should be carefully pre-tested, after review of Unity 
3.11.0 update instruction, available in Unity manual.


        Java 17 supported & groovy update

Java 17 is officially supported runtime since this release. It will 
become mandatory when Unity turns 4.

To make it happen we had to upgrade Groovy to version 3.0.12. This means 
that Groovy 3 features can be used in Unity extension scripts. Please 
note that Groovy 3 introduces also couple of breaking changes over 
previously used Groovy 2.


        SAML related enhancements

The biggest change in SAML area is pre-fetching of federation logo 
images by Unity, and serving them from the local HTTP server, on sign-in 
pages. This change resolves many problems related to the previous 
approach where a person entering Unity sign-in page could get requests 
(and get cookies) from a number of federation IdPs. Also certificate and 
TLS related misconfigurations of IdP servers could interfere with Unity 
page loading, what won’t happen any more.

Besides of this change we have applied several smaller improvements to 
SAML federations handling:

  * Performance of the first loading of trusted SAML entities was
    significantly improved.
  * The first metadata refresh was always postponed for the metadata
    refresh interval which was effective at server start. So a decrease
    of the interval soon after server start could be made effective
    after prolonged amount of time. This problem was resolved.
  * A spurious metadata refresh that could randomly happen was
    eliminated. This situation was possible at server startup and after
    reconfiguration.


        OAuth: refresh tokens for public clients

Unity OAuth Authorization server can now issue refresh tokens for public 
clients. This feature must be enabled, and also turns on extra security 
measure: tokens rotation. In this scenario, each refresh token can be 
used only once, and each refresh is returning a new access token and a 
new refresh token.


        Upman on the latest web technology stack

This is by far the biggest change in this release, although touching the 
rarely used UpMan service. Web technology stack used by UpMan was 
upgraded from Vaadin 8 to Vaadin 23 and now is based on cutting edge web 
technologies, including web components.

The default UI look and feel was refreshed, as the underlying theme was 
changed as well. Also all UI customizations need to be prepared in a 
different, significantly simpler, form.

This change is the first step towards upgrading of all Unity web UIs, 
which will be rebased to the same technology as UpMan is using since 
this release. This bigger work will be available in the version 4 of Unity.


        Jetty 9 → 10

Jetty, our embedded HTTP server, was upgraded to the version 10. This 
change should not affect production setups, but allows us to expose new 
features in future like SNI.


        Miscellaneous improvements

  * “GN” is supported in X.500 identity as an alias to GIVENNAME.
  * Some parts of SCIM endpoint configuration can be controlled with its
    dedicated admin REST API.
  * Resending of invitations (especially expired ones) from UpMan was
    fixed and resets validity time.
  * Possible crashing of trusted applications tab loading in Home UI was
    fixed.


Best regards,
Krzysztof