Release Notes - Version 5.0¶

External Authentication¶

• Improvement to security of session based external authentication (REGSERVER-1900). An “encrypted session ID” is now used to initiate the authentication session. This ensures that no useable data appears in the Apache access log of the External Authentication Service.
• Multi-language support: TeamDrive External authentication Services now support both English and German (REGSERVER-1903).
• Fixed a problem when entering a Space marked “2FA required” on the Web Portal, when 2-Factor authentication is performed by the External Authentiation Service (REGSERVER-1887). This fix also requires a client update.

Licenses and Devices¶

• The setting InviteOldDevicesPeriodActive has been renamed to DeviceInactiveTimeout to indicate the fact that devices that have not been used for the specified period are considered generally “inactive” or not in use. Inactive devices do not receive invitations and the user will not be notified (by email) if an inactive device is disabled (or neabled) due to the device limit of a license.

• Implemented a “soft limit” option for the device limit specified by the MAXIMUM_DEVICES_PER_USER Provider setting (REGSERVER-1895). The soft limit is indicated by prefixing the value with a ‘~’ character, for example: “~5” means a soft limit of 5 devices per user. Soft limit in this case means that the limit is only enforced if a user does not already exceed the specified limit (see MAXIMUM_DEVICES_PER_USER for details).

• It is now possible to create “device based” licenses (REGSERVER-1894). These licenses may only be used by one user and limit the number of active devices of the user.

  If the number of devices exceeds the limit, access devices are disabled automatically starting with the devices the have been idle for the longest time.

Shop References¶

• Licenses, depots, users and accounts now have a “shopreference” which is used instead of the standard external reference, if the license or depot is referenced by an external Shop system (REGSERVER-1881).

  For licenses, in addition to “contractnumber” the fields “constractstatus” and “contractenddate”, may also be set using the API. These fields, including the “shopreference” may be set when a license is created (“createlicense” API call) or using the “setlicensecontract” API call.

  The depot “shopreference” may be set using the “createdepot” and “updatedepot” API calls.

• The setting API_ADMINCONSOLE_LIC_REF has been renamed to ADMIN_LICENSE_REFERENCE.

• In the Admin Console, when editing a license or a depot, the “Change Comment” field no longer has a pre-filled value. A change comment must be entered in order to modify certain feilds of a license or depot.

• If a license has a Shop reference, changes to the license contract number will not cause an email to be sent to the license owners or users. In general, changes to the contract details will not result in an email, as it is assumed the user is aware of the changes done in the Shop.

• The following API calls now support the <shopreference> tag: “registeruser”, “updateuser”, “createdepot”, “updatedepot”, “createlicense”, “setlicensecontract”, “createaccount”, “updateaccount”.

Bounced Email Handling¶

A number of changes have been made to the handling of bounced emails (REGSERVER-1880):

• Once the email status of a user account has been set to “Bounced” the status can only be reset by sending the user a “Confirmation Email”.

  The user must click the link in the email in order to reset the email status before the Registration Server will resume sending emails to the user. This still applies if the user changes their email address. In this case the user will first receive an associated “Email Change Confirmation” email.

• The setting ResetEmailLimit has been added. By default it is set to 20. The purpose of this setting is to avoid flooding the user’s inbox when the status of a large number of emails is reset. This is done by setting older emails to th “PAUSED” status.

  When the user clicks in the link in the Conformation Email, all emails that have an error status are reset. If the number of emails reset exceeds ResetEmailLimit then the excess emails are “paused”.

  The PAUSED status must be manually removed using the “Unpause Email” button available on the Email list in the user’s account. They status of any email can also be reset in the global “Mail Queue”, on the “View Mail Queue” page in the Admin Console.

• There are a number of new functions available when you open the Mail Queue on the “Edit User” page in the Admin Console:

  Delete All: This button will delete all emails in the user’s Mail Queue.

  Delete Failed Emails: This will remove all emails with an error status,

  including: Send-Error, Email-Bounced, Fatal-Error, Incorrect-Address.

  If you wish to retry sending emails that are in error you must send a “Confirmation Email” to the user. See “Set Bounced Status” below.

  Unpause Emails: If you have paused emails, use this button to manually

  unpause up to ResetEmailLimit emails.

  Manage Emails...: If you have the required privileges, this will take you to

  the “View Mail Queue” page in the Admin Console, and display the current user’s emails.

• The “Set Bounced Status” has been added to the “Edit User” page. The “Bounced” email status must be set on the user’s account before you can send “Conformation Email”. to the user. As described above, clicking on the link in the email will reset the status of all emails in the user’s Mail Queue.

• If the email server is not reachable, the email will not remain in the “To-Be-Sent” state (REGSERVER-1882). Errors of this form include “Could not resolve host”, “Host not reachable” and connection timeouts. When such an error occurs, the “Send Emails” autotask will quit, and try to send the same email again on the next run.

• Fixed a bug that resulted in the Reg Server background process hanging (infinite loop) when forwarding an email notification, if the user/email could not be found on the TeamDrive network (REGSERVER-1885).

Security¶

• Support HMAC hashing based keys for the Host Server API access (REGSERVER-1826).

• It is now possible to set the Authorisation Type on services belonging to other Registration Servers (REGSERVER-1825). This applies to Shop and Web Portal services that are referenced using the SHOP_SERVICE_NAME and WEBPORTAL_SERVICE_NAME Provider settings.

  In other words, if you have a Shop or Web Portal that provides services to multiple Registration Servers, then the authorisation type and key can be specified separately for each Registration Server.

  The “References” column has been added to the Service list in the Admin Console, which indicates references to a service from other Providers. This column is only filled after a Registration Server update.

• Added support for Microsoft Authenticator App for users that require 2-Factor authentication (REGSERVER-1861). This feature requires a client update.

• The Registration Server no longer support the Diffie-Hellmen (DH) public/private keys, also known as DH/1.0 keys (REGSERVER-1864). Only RSA public/private keys are supported.

  In some cases this may require a TeamDrive client update to version 5.2.0. This includes:

  • some client installations from 2012 or earlier,
  • the Key Repository is enabled with a large number of keys (> 500 Spaces),
  • a large profile picture is uploaded,
  • an large activity report is sent via email by the client.

External Authentication¶

• You can now specify that an External Authentication Services performs Two-facter Authentication (2FA). In this case the Registration Server will not perform 2FA when the user’s account is set to 2FA required (REGSERVER-1815).

• External authentication now supports “session based” login (REGSERVER-1851). Using this method, the TeamDrive App redirects to the Auth Service, and then use a (previously obtained) session ID to verify whether the login is successful. This removes the need for an embedded browser in the TeamDrive Desktop App.

• External Authentication: when accessing a Authentication Service that does not return the service name (in the verify authentication token reply), then the Provider setting DEFAULT_AUTH_SERVICE_NAME must be set.

  Note that this is only the case when dealing with an Authentication Service that has not been upgraded (or cannot be upgraded) to the latest version.

Administration Console¶

• A column “Referenced By” has been added to the list of Services on the “Manage Domains & Services” page. This column contains a list of Providers that reference the service.
• It is now possible to disable access to the Admin Console for a specific Provider (REGSERVER-1853). When disabled, no user or administrator of the Provider is allowed to login to the Admin Console.
• When deleting a user you can now add a comment (REGSERVER-1827). This will appear in the change history of users in the Admin Console.
• Fixed listing of Spaces on the “Edit Depot” Depot page (REGSERVER-1837).
• Fixed the “Move Space” dialog on the “Edit Depot” page which was returning an when the Depot owner was entered (REGSERVER-1870).
• Fixed the output of the “Edit Auto Task” page.
• Removed certain incorrect entries from the Depot “Change History” (REGSERVER-1839).