User Sync: SCIM Provisioning, Group Sync for Jira

Compatibility release for Jira 11.

• Resolved a critical issue where attributes could get mixed up during concurrent SCIM requests, significantly improving reliability during full syncs and under heavy load.
• SCIM connector logging has been enhanced to optionally log HTTP requests to the system log for improved readability and performance tracking. As a result, HTTP requests are no longer logged to the sync status.
• Changed the log level for User Sync start/stop events to WARN, ensuring important operational messages are more visible.

• Fixed an issue where sub-groups were not being returned by the groups endpoint from Keycloak starting from version 23 and above.
• Enhanced error handling to ensure that updating a user via SCIM with no actual changes no longer triggers an error in Okta.

• Added a Watchdog feature for monitoring sync status, improving system reliability and visibility into synchronization processes.
• Fixed a critical bug where audience validation failed due to unqualified OAuth2 scopes, ensuring proper connection to Microsoft Graph API by requiring fully qualified scope parameters.
• Resolved an issue where the extended token check prevented access token refresh during synchronization if the token expired, ensuring uninterrupted sync operations.

• Added a Watchdog feature for monitoring sync status, improving system reliability and visibility into synchronization processes.
• Fixed a critical bug where audience validation failed due to unqualified OAuth2 scopes, ensuring proper connection to Microsoft Graph API by requiring fully qualified scope parameters.
• Resolved an issue where the extended token check prevented access token refresh during synchronization if the token expired, ensuring uninterrupted sync operations.

• Resolved an issue where Entra ID access tokens could be assigned to the incorrect connector, enhancing security and ensuring tokens are mapped accurately.
• Improved SCIM connector by making the default group mapping required and undeletable, reducing the risk of misconfiguration.

• Resolved an issue where Entra ID access tokens could be assigned to the incorrect connector, enhancing security and ensuring tokens are mapped accurately.
• Improved SCIM connector by making the default group mapping required and undeletable, reducing the risk of misconfiguration.

• Updated Apache POI (used in Excel importer/exporter) to 5.4.1.

• Updated Apache POI (used in Excel importer/exporter) to 5.4.1.

• Resolved Groovy transformation failures caused by a hardcoded timeout.
• Addressed an issue requiring a sysadmin account under delegated permission (Authorization Code flow) in supported connectors.
• Fixed a bug causing connectors with Authorization Code flow to appear invalid when the access token expired.

• Resolved Groovy transformation failures caused by a hardcoded timeout.
• Addressed an issue requiring a sysadmin account under delegated permission (Authorization Code flow) in supported connectors.
• Fixed a bug causing connectors with Authorization Code flow to appear invalid when the access token expired.

This is a maintenance release that updates external dependencies.

This is a maintenance release that updates external dependencies.

• Redesign User Sync UI: Introduced a redesigned User Sync UI featuring both vertical and horizontal tabs
• Show warning dialog when exporting config: A warning dialog is now displayed during config export operations to confirm user intent and help prevent accidental exports.
• Apply PATCH button visibility: Addressed an issue where the PATCH button was not always visible, ensuring it is displayed as expected.
• Email validation bug: Resolved an issue that caused a timeout during the email validation process, ensuring validation completes reliably.
• SCIM: Accept group patches including displayName: Updated SCIM functionality to properly handle group patch operations when the displayName attribute is included.
• Connector list not loading on 2025/02/28: Fixed a scheduling issue where a cron expression pointing to the next day caused the connector list to fail to load on February 28, 2025.

• Redesign User Sync UI: Introduced a redesigned User Sync UI featuring both vertical and horizontal tabs
• Show warning dialog when exporting config: A warning dialog is now displayed during config export operations to confirm user intent and help prevent accidental exports.
• Apply PATCH button visibility: Addressed an issue where the PATCH button was not always visible, ensuring it is displayed as expected.
• Email validation bug: Resolved an issue that caused a timeout during the email validation process, ensuring validation completes reliably.
• SCIM: Accept group patches including displayName: Updated SCIM functionality to properly handle group patch operations when the displayName attribute is included.
• Connector list not loading on 2025/02/28: Fixed a scheduling issue where a cron expression pointing to the next day caused the connector list to fail to load on February 28, 2025.

• Added the possibility of running the REST API sync call on a local node.
• Added a directory assignment table that shows all directories managed by or related to User Sync connectors. Directories without assignment to a connector will no longer receive a "DELETED" suffix.
• Added support for reverse proxies for allowed IPs in SCIM 2.0 connector.
• Added a timestamp to the user list in sync user results.
• Fixed an issue where profile pictures were not updated when changing the resolution in Entra ID connectors.
• Fixed issue with cron expressions using the LW keyword.
• Enhanced error messaging for testing server-side filtering of groups with Azure and Okta.

• Added the possibility of running the REST API sync call on a local node.
• Added a directory assignment table that shows all directories managed by or related to User Sync connectors. Directories without assignment to a connector will no longer receive a "DELETED" suffix.
• Added support for reverse proxies for allowed IPs in SCIM 2.0 connector.
• Added a timestamp to the user list in sync user results.
• Fixed an issue where profile pictures were not updated when changing the resolution in Entra ID connectors.
• Fixed issue with cron expressions using the LW keyword.
• Enhanced error messaging for testing server-side filtering of groups with Azure and Okta.

• Added WebSudo support for User Sync the admin page, bolstering security by ensuring administrative authentication.
• Added the ability to create sync results for incoming SCIM requests, enhancing transparency and traceability of user sync operations.
• Enhanced group JSON diff functionality to provide clearer results, aiding in better understanding and visibility of group changes.
• Resolved a bug that prevented the User Created Event from being triggered. This event now functions as expected, supporting custom workflows and notifications.
• Several smaller fixes and improvements.

• Added WebSudo support for User Sync the admin page, bolstering security by ensuring administrative authentication.
• Added the ability to create sync results for incoming SCIM requests, enhancing transparency and traceability of user sync operations.
• Enhanced group JSON diff functionality to provide clearer results, aiding in better understanding and visibility of group changes.
• Resolved a bug that prevented the User Created Event from being triggered. This event now functions as expected, supporting custom workflows and notifications.
• Several smaller fixes and improvements.

• Added Jira 10 compatibility.
• Fixed issue with inactive sysadmin users when modifying Entity Properties during sync.

• Added Jira 10 compatibility.
• Fixed issue with inactive sysadmin users when modifying Entity Properties during sync.

• Resolved an issue where the Excel exporter would fail due to a missing dependency.
• Resolved a bug where Groovy transformations would fail due to an issue with String concatenation.

• Resolved an issue where the Excel exporter would fail due to a missing dependency.
• Resolved a bug where Groovy transformations would fail due to an issue with String concatenation.

• Resolved an issue in the SCIM 2.0 connector where PATCH requests were not applying group defaults when mapped to an alternate source attribute.
• The SCIM 2.0 connector now returns the department attribute, if set.
• When calling Jira APIs, User Sync is now using a user with system administrator priviliges instead of administrator privileges to make sure that all operations are successfully executed.

• Resolved an issue in the SCIM 2.0 connector where PATCH requests were not applying group defaults when mapped to an alternate source attribute.
• The SCIM 2.0 connector now returns the department attribute, if set.
• When calling Jira APIs, User Sync is now using a user with system administrator priviliges instead of administrator privileges to make sure that all operations are successfully executed.

• Addresses the issue where a failed transformation affects only the current user without disrupting the entire synchronization process.

• Addresses the issue where a failed transformation affects only the current user without disrupting the entire synchronization process.

• Google Cloud Identity connector: Implemented a retry mechanism for failed user sync attempts.
• SCIM 2.0 connector: Enhanced SCIM requests and responses by optionally filtering out locally managed groups.
• SCIM 2.0 connector: Corrected the encoding of IDs in $ref fields within SCIM responses to prevent errors and improve interoperability.
• SCIM 2.0 connector: Fixed an issue where SCIM group updates failed due to group names not being transformed properly.
• Entra ID connector: The Azure AD integration UI has been updated to reflect its new name, Microsoft Entra ID, aligning with Microsoft's rebranding initiative.
• Disable inactive users connector: Corrected a problem where simulations erroneously removed actual groups from inactive users.
• Fixed inconsistencies in the synchronization behavior for both new and existing users, ensuring a unified sync experience.
• Resolved a bug where the "Contact support" dialog was broken, ensuring users can reach out for support when needed.

• Google Cloud Identity connector: Implemented a retry mechanism for failed user sync attempts.
• SCIM 2.0 connector: Enhanced SCIM requests and responses by optionally filtering out locally managed groups.
• SCIM 2.0 connector: Corrected the encoding of IDs in $ref fields within SCIM responses to prevent errors and improve interoperability.
• SCIM 2.0 connector: Fixed an issue where SCIM group updates failed due to group names not being transformed properly.
• Entra ID connector: The Azure AD integration UI has been updated to reflect its new name, Microsoft Entra ID, aligning with Microsoft's rebranding initiative.
• Disable inactive users connector: Corrected a problem where simulations erroneously removed actual groups from inactive users.
• Fixed inconsistencies in the synchronization behavior for both new and existing users, ensuring a unified sync experience.
• Resolved a bug where the "Contact support" dialog was broken, ensuring users can reach out for support when needed.

• The audit log entries now include the name of the admin user who initiates a full sync.
• SCIM 2.0 connector
  • Added advanced group settings to be able to configure "Never Remove Users From These Groups", "Only Assign These SCIM 2.0 Groups" and "Never Assign These SCIM 2.0 Groups".
  • Fixed issue where attempting to change the group name returned a 200 OK status incorrectly.
  • User reponses now also contain givenName and familyName.
  • User and group responses now contain meta location attribute.
  • Modified behavior for creating conflicting users to enhance system stability.
• It's now optionally possible for users with ADMIN privileges to execute Single User Syncs via REST endpoint.
• Fixed: prevent the deletion of default mappings in attribute mapping.
• Fixed: resolved issue where deleted users were not listed in the downloaded sync results.

• The audit log entries now include the name of the admin user who initiates a full sync.
• SCIM 2.0 connector
  • Added advanced group settings to be able to configure "Never Remove Users From These Groups", "Only Assign These SCIM 2.0 Groups" and "Never Assign These SCIM 2.0 Groups".
  • Fixed issue where attempting to change the group name returned a 200 OK status incorrectly.
  • User reponses now also contain givenName and familyName.
  • User and group responses now contain meta location attribute.
  • Modified behavior for creating conflicting users to enhance system stability.
• It's now optionally possible for users with ADMIN privileges to execute Single User Syncs via REST endpoint.
• Fixed: prevent the deletion of default mappings in attribute mapping.
• Fixed: resolved issue where deleted users were not listed in the downloaded sync results.

• Resolved a bug where users were mistakenly anonymized during simulation instead of only simulating this action.

• Resolved a bug where users were mistakenly anonymized during simulation instead of only simulating this action.

• Fixed an issue in the AtlasUserResult where the isSuccess() method was missing. The absence of this method could disrupt Groovy Transformations and result in unexpected outcomes.
• Resolved an issue where the $ref keyword in the SCIM response was not correctly implemented. This could lead to unexpected behaviors or errors when interfacing with systems using SCIM protocols.

• Fixed an issue in the AtlasUserResult where the isSuccess() method was missing. The absence of this method could disrupt Groovy Transformations and result in unexpected outcomes.
• Resolved an issue where the $ref keyword in the SCIM response was not correctly implemented. This could lead to unexpected behaviors or errors when interfacing with systems using SCIM protocols.

• Sync Simulation allows you to thoroughly test synchronization actions before applying them, ensuring your synchronization process runs smoothly before applying changes in a real sync. You can now use this feature by running a full simulated sync or a simulated single user update. See documentation for more information.
• The Sync Result Browser provides a sleek and intuitive user interface to browse recent sync results. This feature simplifies user synchronization management and enables you to browse individual sync results and all the changes on each user happened during the sync, giving you finer control over your synchronization data, so you don't have to dive into endless JSON files anymore.
• The SCIM connector has been enhanced to utilize the Groovy cleanup decider properly.
• The Inactive User Connector has been enhanced to support group-based deactivation.

• Sync Simulation allows you to thoroughly test synchronization actions before applying them, ensuring your synchronization process runs smoothly before applying changes in a real sync. You can now use this feature by running a full simulated sync or a simulated single user update. See documentation for more information.
• The Sync Result Browser provides a sleek and intuitive user interface to browse recent sync results. This feature simplifies user synchronization management and enables you to browse individual sync results and all the changes on each user happened during the sync, giving you finer control over your synchronization data, so you don't have to dive into endless JSON files anymore.
• The SCIM connector has been enhanced to utilize the Groovy cleanup decider properly.
• The Inactive User Connector has been enhanced to support group-based deactivation.

• Resolved high CPU and memory usage during synchronizations with numerous group assignments.

• Resolved high CPU and memory usage during synchronizations with numerous group assignments.

• Added new diff view for Single User Update.
• Improved connection tester visuals.
• Added group exclusion for "Remove group memberships during cleanup".
• Azure connector: Improved sync performance.
• Azure connector: Implemented Server-Side Filtering, see documentation for more details.
• Okta connector: Implemented Server-Side Filtering, see documentation for more details.
• SCIM connector: Added support for nested groups, see documentation for more details.
• Cleanup Inactive Users Connector: Fixed "Remove group memberships during cleanup" doesn't remove groups from the already disabled users.
• Fixed: Cleanup now removes sync status data for non-existent connectors from database.
• Fixed: Patch config button not longer shows up in Edit mode.
• Fixed: Directories are no longer renamed if connectors are still assigned to the directory.

• Added new diff view for Single User Update.
• Improved connection tester visuals.
• Added group exclusion for "Remove group memberships during cleanup".
• Azure connector: Improved sync performance.
• Azure connector: Implemented Server-Side Filtering, see documentation for more details.
• Okta connector: Implemented Server-Side Filtering, see documentation for more details.
• SCIM connector: Added support for nested groups, see documentation for more details.
• Cleanup Inactive Users Connector: Fixed "Remove group memberships during cleanup" doesn't remove groups from the already disabled users.
• Fixed: Cleanup now removes sync status data for non-existent connectors from database.
• Fixed: Patch config button not longer shows up in Edit mode.
• Fixed: Directories are no longer renamed if connectors are still assigned to the directory.

• Added connection testers for Azure AD, Okta, G Suite, Keycloak and OneLogin connectors.
• Improved sync error handling in Azure AD and Okta connectors to avoid irregularly occurring sync failures.
• SCIM: added presets for enterprise attributes.
• SCIM: fixed overwritten groups when patching users.
• SCIM: fixed incorrect Totaltems field in ListResponse.
• SCIM: changed default preset for email attribute.
• Fixed: the Linchpin endpoints are no longer accessed from the frontend when not running on Confluence.

• Added connection testers for Azure AD, Okta, G Suite, Keycloak and OneLogin connectors.
• Improved sync error handling in Azure AD and Okta connectors to avoid irregularly occurring sync failures.
• SCIM: added presets for enterprise attributes.
• SCIM: fixed overwritten groups when patching users.
• SCIM: fixed incorrect Totaltems field in ListResponse.
• SCIM: changed default preset for email attribute.
• Fixed: the Linchpin endpoints are no longer accessed from the frontend when not running on Confluence.

• Azure: fixed a performance issue introduced in User Sync 2.7.1 that resulted in slower sync times and increased CPU and memory usage.

• Azure: fixed a performance issue introduced in User Sync 2.7.1 that resulted in slower sync times and increased CPU and memory usage.

• Added configuration import and export via admin UI.
• Improved sync status message cleanup performance.
• Improved result when user is not found during Single User Update.
• Azure: Added option to select the profile picture size.
• Okta: Fixed required groups tester when there are no required groups in the config yet.

• Added configuration import and export via admin UI.
• Improved sync status message cleanup performance.
• Improved result when user is not found during Single User Update.
• Azure: Added option to select the profile picture size.
• Okta: Fixed required groups tester when there are no required groups in the config yet.

• Fixed validation error that appears while editing required groups.

• Fixed validation error that appears while editing required groups.

• Allow synchronizing profile pictures from Azure or GSuite
• Minor improvements and bugfixes
• Please check our release notes for more details.

• Allow synchronizing profile pictures from Azure or GSuite
• Minor improvements and bugfixes
• Please check our release notes for more details.