Amster

Fixes, Limitations, and Known Issues

Key Fixes

The following issues are fixed in this release. For details, see the OpenAM issue tracker.

Amster 7.1.4

  • OPENAM-19592: Unable to use Amster on an M1 MacBook

Amster 7.1.3

  • OPENAM-18715: Amster 7.1.1 cannot execute multi-line commands from a script while creating realm using :load option

Amster 7.1.2

  • No new issues have been fixed in this release.

Amster 7.1.1

Amster 7.1

  • OPENAM-17020: Amster import fails after removing identity store and setting User Profile to ignore

  • OPENAM-17072: eval(String) function in Amster shell results in MissingMethodException

Limitations

The following important issues remained open at the time release 7.1 became available:

  • No support for load balanced deployments

    Amster cannot connect to a load balancer URL. You must connect Amster directly to a single AM instance. Using a load balancer could send sequential commands to different AM instances, and could result in concurrency issues when writing to the underlying configuration store.

  • Bulk import to external application stores with affinity

    If affinity is enabled for an external application data store, bulk import intermittently fails with errors similar to the following:

    /Resource path 'http////////eea87a38e3ca476fa93a3669375ada3a' contains empty path elements

    Before using Amster for a bulk import to an application store, disable data store affinity, or remove the load balancer from the application store deployment. You can re-enable affinity when the import has completed.

  • Importing resources containing slash characters can fail

    Some Access Management resources have names that can contain slash characters (/), for example policy names, application names, and SAML v2.0 entities. These slash characters can cause unexpected behavior and failures in Amster when importing into Access Management instances running on Apache Tomcat.

    To work around this issue, configure Apache Tomcat to allow encoded slash characters by updating the CATALINA_OPTS environment variable. For example:

    On Unix/Linux systems:

    $ export CATALINA_OPTS= \
  "-Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true"
$ startup.sh

    On Windows systems:

    C:\> set CATALINA_OPTS= ^
  "-Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true"
C:\> startup.bat
    It is strongly recommended that you do not enable org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH when running AM in production as it introduces a security risk on Apache Tomcat.

    For more information, see How do I safely enable the org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH setting in AM/OpenAM (All Versions)? in the ForgeRock Knowledge Base.

  • [INFO] Messages Showing On SuSE On Amster Start Up

    Running Amster on SuSE may produce [INFO] messages, for example:

    # ./amster
[INFO] Unable to bind key for unsupported operation: up-history
[INFO] Unable to bind key for unsupported operation: down-history
[INFO] Unable to bind key for unsupported operation: up-history
[INFO] Unable to bind key for unsupported operation: down-history
OpenAM Shell (version build build, JVM: version)
Type ':help' or ':h' for help.
-----------------------------------------------------
am>

    These messages are caused by the keyboard mappings configured in the /etc/inputrc file and can safely be ignored, as they do not affect functionality.

Known Issues

Amster 7.1

Amster 7.1.4

  • OPENAM-21278: Amster doesn’t use the system console correctly for interactive mode

  • OPENAM-21277: Running Amster in debug mode doesn’t work on Windows

  • OPENAM-21180: Amster should set file encoding to UTF-8 internally

  • OPENAM-19668: Amster export-config shows errors for Google components

  • OPENAM-19666: Amster gets stuck if you input a line that ends with a colon character (:)

  • OPENAM-19580: Amster export-config returns default values instead of empty values

  • OPENAM-19529: Amster doesn’t export non-global service schema defaults

  • OPENAM-19216: Amster Entity Reference: Incorrect Site update schema

  • OPENAM-18963: Amster can’t import WS-Federation metadata

  • OPENAM-18715: Amster can’t create a realm if the script has many lines

  • OPENAM-17909: Exported SAML metadata doesn’t include the KeyDescriptor if there is no entity-specific secretID

  • OPENAM-17743: Amster sms.transport.key causes performance issues if it’s left in the keystore

  • OPENAM-14478: Running Amster with JDK 11 shows warnings such as Illegal reflective access by org.codehaus.groovy.vmplugin.v7.Java7$1

Copyright © 2010-2023 ForgeRock, all rights reserved.