Single Sign On SAML SSO for Jira (SSO SAML) + User Sync/SCIM

Made the add-on compatible with the latest versions of Jira.

• Restore the Default Custom Login and Logout template.
• Advance Audit Log Search
• Updated security requirements: ADFS IdP must use the RSA-SHA256 signing algorithm. If it is still using RSA-SHA1, it must be updated to RSA-SHA256. If it is already using RSA-SHA256, no action is required.

1. Added deprovisioning support for removing users from groups in Duo IDP.
2. Improved performance for Keycloak and Gsuite Sync.
3. Added patches to account for vulnerabilities found in some 3rd party libraries.

Made the add-on compatible with the latest versions of Jira.

Jira SAML SSO

• Added: Auto-assign default groups to users not mapped manually.
• Improved: Prevents duplicate SAML assertion schedulers being triggered on startup.
• Fixed: JSD portal login showing Jira Software template instead of Service Desk page.
• Fixed: Logout redirection loop when a context path is set.
• Fixed: JSM logout failure with context path.
• Fixed: Double context path in ACS URL causing login errors with miniOrange IdP.

Jira SCIM Provisioning

• Added: Deprovisioning flow for user un-assignment from Oracle app/group.
• Improved: Faster user sync with multi-threaded processing.
• Improved: Enhanced Custom Attribute Mapping for flexibility and reliability.
• Fixed: Quarantine handling issue during user sync.
• Fixed: Oracle REST API bugs affecting provisioning and updates.

Added a minor patch for a 3rd party library vulnerability.

You can now use SCIM-based user provisioning directly within the SAML plugin. We’ve also reworked the UI to make navigation and accessing features easier, which includes moving some settings to new sections. As a result, the plugin backup file structure has changed.

Before Upgrade:

• Refer to the guide to determine where the settings have been relocated.
• Download the plugin configuration backup from the Backup and Restore section.
• We recommend installing the plugin in a staging or testing environment before upgrading your production instance.

After Upgrade:

• Test and verify the changes in your staging environment.
• If you use the backup file in scripts, download the new version from Backup and Restore.

Changelog:

• Added SCIM provisioning support.
• Major UI rework for smoother navigation.
• Security update: switched from openSAML to OneLogin for improved SAML handling.

• Added a fix to update the SSO and SLO binding types during metadata refresh.
• Added a fix for an issue with rendering Custom Login Page for Jira and JSD, and accessing anonymous pages.

Made the add-on compatible with Jira v11

Bug Fixes:-

• Added a fix for the Header-based Authentication flow
• Added a fix for the upload Metadata option in the Quick Setup flow
• Fixed a licensing issue with the Restrict Local Authentication feature

Bug Fixes:-

• Added a fix for an issue with notify multiple admins.
• Added a fix for an issue with redirection rules based on directory.

Improvements:-

• Improvement in rendering custom login templates.
• Improvement in certificate generation.

Knowledge Base Improvements:-

• Added a use case documentation under the Knowledge Base tab.

Default Certificate Update Banner:

• A banner has been added to inform users that the default miniOrange SP certificates have been replaced with new certificates having extended validity. The banner includes a “Replace Default Certificates” button, allowing users to seamlessly update to the latest certificate with extended expiry.
  
  Knowledge Base Section:
• Introduced a new Knowledge Base tab that provides easy access to helpful resources. It includes:
  • Video Tab – Setup guides, use case demonstrations, and feature walkthroughs.
  • FAQ Tab – Answers to commonly asked questions.
  • Handbook Tab – Comprehensive documentation and guides.

Advisory

• Added certificate expiry alert (flag and banner) in the Manage Apps section and plugin headers for users whose default plugin signing certificates will expire within 60 days.

Bug Fixes

• Added a fix for an issue where SSO fails sometimes on the first attempt.
• Added a fix for the Restrict Local Authentication feature.

Security Patch

• Updated the versions of some 3rd party libraries to account for vulnerabilities pointed out in them.

Updated the versions of some 3rd party libraries being used to account for some issues found in them

• Fixed the dropdown functionality in the 'Restrict Backdoor Groups' feature.
• Fixed a bug affecting the default rule in Redirection Rule Settings.
• Improved code for validating the destination URL in OneLogin SAML library.
• Improved the flow for restricting duplicate assertion IDs.

Compatibility Update:

• Updated the plugin to ensure compatibility with Jira v10.5.0.

Bug Fixes:

• Resolved issues in the Restrict Local Authentication feature.
• Addressed handling of empty values in Oracle databases.

Bug Fix:

• Bug fix in Restrict backdoor groups.

ADFS Configuration Update Required:

• Important Configuration Update for customers using ADFS as an IDP: Please refer to this guide for detailed instructions - Guide link.

• Bug fixes in the quick setup process during IDP configuration.
• Bug fix in authentication context class ref saml attribute while using azure as an idp.

What’s New

This update brings major backend improvements for enhanced performance and security.

Key Enhancements:

• Database Migration: Moved to Active Objects tables for better performance. Tables are created automatically upon installation.
• Security & Library Update: Switched from openSAML to OneLogin for improved SAML request and response handling.

New Features:

• Restrict SSO by User Groups: Block SSO login for specific groups (Advanced Settings tab).
• Restrict SSO by User Attribute: Restrict SSO based on configured attributes (Advanced Settings tab).
• Relay State Whitelisting: Allow only specified domains apart from Jira base URL (Sign-In Settings tab).

Upgrade Considerations

We strongly recommend testing in a staging environment before upgrading.

Before You Upgrade:

• Download the backup file from the Backup and Restore menu.

After You Upgrade:

• Verify all configurations and settings.
• If using backup files in scripts, download the backup file.

Added a minor JS fix for the Add New IDP button.

• Added a fix for issue faced while Emergency URL.

New Feature

• Added support for the selection of multiple admins for certificate expiry mailing service.

Bug Fix

• Fixed login page compatibility issues.

Made the plugin compatible with Jira V10.3.0

Updated some of the 3rd party libraries used to account for vulnerabilities found in them.

• Made the plugin compatible with the Dark Theme introduced in Jira 10.1.1

Added a fix for a potential XSS vulnerability.

Improved some of the instructions provided in the plugin.

• Added patches for vulnerable versions of 3rd party libraries being used in the plugin.

Added support for Personal Access Tokens in the REST API provided for plugin configuration.

Added support for Personal Access Tokens in the REST API provided for plugin configuration.

• Minor improvement in the On The Fly group mapping flow.
• Minor UI fix for the Test Group Regex option in the Group Mapping section.

• Minor improvement in the On The Fly group mapping flow.
• Minor UI fix for the Test Group Regex option in the Group Mapping section.

New Feature

• Added a feature where you can now disable Password Auto-fill from within the plugin directly for your Jira instance.

Improvement

• Added support for complex regex expressions which can be used to transform usernames.

Bug Fix

• Fixed a minor bug in the import/export configuration feature.

New Feature

• Added a feature where you can now disable Password Auto-fill from within the plugin directly for your Jira instance.

Improvement

• Added support for complex regex expressions which can be used to transform usernames.

Bug Fix

• Fixed a minor bug in the import/export configuration feature.

• Added a fix for an issue with Emergency URL restriction.
• Minor UI improvement.

• Added a fix for an issue with Emergency URL restriction.
• Minor UI improvement.

• Added a fix for an issue faced in the logout flow if Jira has been setup behind a proxy.

• Added a fix for an issue faced in the logout flow if Jira has been setup behind a proxy.

We've implemented a security fix for admin authorization on a few plugin's endpoints. We highly recommend updating to this version as soon as possible

We've implemented a security fix for admin authorization on a few plugin endpoints. We highly recommend updating to this version as soon as possible

• Added a fix for and issue faced with the Remember-Me functionality provided with the plugin.
• Added a fix for an issue faced with the Manual Group mapping feature.

• Added a fix for and issue faced with the Remember-Me functionality provided with the plugin.
• Added a fix for an issue faced with the Manual Group mapping feature.

Improvements:

• Updated the plugin framework to the latest version supported by Atlassian.

Bug Fixes:

• Added fixes for an issue faced with Certificate generation on instances running with Java 17.
• Added a fix for certificates getting reverted to default values on some fresh instance installs.
• Added a fix for a redirection issue faced while trying to directly access admin privilege pages.

Improvements:

• Updated the plugin framework to the latest version supported by Atlassian.

Bug Fixes:

• Added fixes for an issue faced with Certificate generation on instances running with Java 17.
• Added a fix for certificates getting reverted to default values on some fresh instance installs.
• Added a fix for a redirection issue faced while trying to directly access admin privilege pages.

Fixed infinite loop between unauthorized Jira page and IDP if "Auto Redirect" is enabled

Fixed infinite loop between unauthorized Jira page and IDP if "Auto Redirect" is enabled

A few external libraries with vulnerabilities used in the plugin have been updated to the latest patched version.

Few external libraries with vulnerabilities used in the plugin has been updated to the latest patched version.

• Minor fix added for a UI issue with one of the descriptions in the plugin.

• Minor fix added for a UI issue with one of the descriptions in the plugin.

Improvement

• Exciting News! In the latest release for our Jira SAML app, we're delighted to announce that you can now get the SCIM (System for Cross-domain Identity Management) app for free! Enhance your identity management capabilities seamlessly with SCIM integration. Download today to enjoy the latest features and unlock the power of SCIM at no additional cost! Visit the "User Sync" Tab in the plugin settings for more information.

New Features

• You now have an option to login users using any custom attribute you might have in your IDP, instead of just the username or email attributes.
• Option to convert group names to lowercase in the On The Fly group mapping feature.

Improvements

• Exciting News! In the latest release for our Jira SAML app, we're delighted to announce that you can now get the SCIM (System for Cross-domain Identity Management) app for free! Enhance your identity management capabilities seamlessly with SCIM integration. Download today to enjoy the latest features and unlock the power of SCIM at no additional cost! Visit the "User Sync" Tab in the plugin settings for more information.

New Features

• You now have an option to login users using any custom attribute you might have in your IDP, instead of just the username or email attributes.
• Option to convert group names to lowercase in the On The Fly group mapping feature.

• Account section introduced to view plugin license details
• Email service for license expiry
• Improvements in the licensing module

• Account section introduced to view plugin license details
• Email service for license expiry
• Improvements in the licensing module

Improvements

• Updated Quicsetup guide for quick setup flow
• Enhance the capability to show only the SSO button for the Websudo login page

Bugfix

• Bug fix for IDP-initiated SAML logout flow
• Bug fix for showing session timeout warning message on inactive tabs despite the user's session being active
• Bug fix for comma-separated group mapping configuration

Improvements

• Updated Quicsetup guide for quick setup flow
• Enhance the capability to show only the SSO button for the Websudo login page

Bugfix

• Bug fix for IDP-initiated SAML logout flow
• Bug fix for showing session timeout warning message on inactive tabs despite the user's session being active
• Bug fix for comma-separated group mapping configuration

Bug fix for a miniOrange license framework issue that blocked access to the plugin configuration

Bug fix for a miniOrange license framework issue that blocked access to the plugin configuration

SSO button fix for admin permissions pop-up which is displayed while editing the project workflow if the user's admin session doesn't exist.

SSO button fix for admin permissions pop-up which is displayed while editing the project workflow if the user's admin session doesn't exist.

The app's default certificate (SP certificate) will expire on July 15, 2023. You can find steps to replace it with a new certificate in the Certificates tab. You can check the steps in the link below too.

https://faq.miniorange.com/knowledgebase/update-saml-certificate-miniorange-plugin/

The app's default certificate (SP certificate) will expire on July 15, 2023. You can find steps to replace it with a new certificate in the Certificates tab. You can check the steps in the link below too.

https://faq.miniorange.com/knowledgebase/update-saml-certificate-miniorange-plugin/

New Feature

• Added a feature to enable a warning a message before a user is logged out

Bug Fix

• Added some certificate compatibility fixes for Java version 11
• Fixed an issue with the Remote Directory Sync feature

New Feature

• Added a feature to enable a warning a message before a user is logged out

Bug Fix

• Added some certificate compatibility fixes for Java version 11
• Fixed an issue with the Remote Directory Sync feature

• Added fix for the Remember my IDP functionality, where the cookie wasn't being set properly.

• Added fix for the Remember my IDP functionality, where the cookie wasn't being set properly.

Bugfix for redirection rule configuration not showing all IDPs

Bugfix for redirection rule configuration not showing all IDPs

Adding a fix for the redirection loop issue introduced in the last release(v2.0.20)

Adding a fix for the redirection loop issue introduced in the last release(v2.0.20)

• We've added a few UI Improvements to the user and group provisioning sections.
• Added a fix for an issue where the error message isn't displayed if a user enters password incorrectly.
• Added a fix for the Remember My IDP feature

• We've added a few UI Improvements to the user and group provisioning sections.
• Added a fix for an issue where the error message isn't displayed if a user enters password incorrectly.
• Added a fix for the Remember My IDP feature