• IDM 6.0.0.7 is the latest patch bundle release targeted for IDM 6.0 deployments and can be downloaded from the ForgeRock Backstage website. To view the list of fixes in this release, see Fixed Issues in IDM 6.0.0.7.

  The IDM 6.0.0.7 patch bundle release is cumulative and contains all the fixes included in the previous patch bundle releases.

  The release can be deployed as an initial deployment or updated from an existing deployment. For more information on either update method, see "Updating Servers" in the Installation Guide.

• The connectors bundled with IDM 6.0.0.7 have all been upgraded to version 1.5.20.0. For details of these connector versions, see the latest release of the Connector Release Notes.

• No new features were introduced in this release, only bug fixes.

• No new features were introduced in this release, only bug fixes.

• No new features were introduced in this release, only bug fixes.

• No new features were introduced in this release, only bug fixes.

• No new features were introduced in this release, only bug fixes.

• No new features were introduced in this release, only bug fixes.

The following repositories are supported for use in production:

• ForgeRock Directory Services (DS) 6.0

  By default, IDM uses an embedded DS instance for testing purposes. The embedded instance is not supported in production. If you want to use DS as a repository in production, you must set up an external instance.

• MySQL version 5.6 and 5.7 with MySQL JDBC Driver Connector/J 5.1.18 or later

• MariaDB version 10.0, 10.1, and 10.2 with MySQL JDBC Driver Connector/J 5.1.18 or later

• Microsoft SQL Server 2012, 2014, and 2016

• Oracle Database 11gR2, 12c, and 12cR1 (12.1)

• PostgreSQL 9.3.10, 9.4.5, 9.6, and 10

• IBM DB2, 10.1, 10.5, 11

IDM bundles the following connectors:

• Adobe CM Connector

• CSV File Connector

• Database Table Connector

• Google Apps Connector

• Groovy Connector Toolkit

  This toolkit enables you to create scripted connectors to virtually any resource.

• Kerberos Connector

• LDAP Connector

• Marketo Connector

• MongoDB Connector

• Salesforce Connector

• SCIM Connector

• Scripted REST Connector

• Scripted SQL Connector

• ServiceNow Connector

• Scripted SSH Connector

• Workday Connector

ForgeRock has tested many browsers with the IDM UI, including the following browsers:

• Chrome and Chromium, latest stable version

• Firefox, latest stable version

• Safari, latest stable version

• Internet Explorer 11 and later

IDM is supported on the following operating systems:

• Red Hat Enterprise Linux (and CentOS Linux) 6.5 and later, 7.x

• Ubuntu Linux 16.04

• Windows 2008 R2, 2012 R2, 2016

• OPENIDM-9710: With JDBC repo using explicit table for Managed User, integer properties are treated as string

• OPENIDM-12778: Schedules to execute a file-based script are generated incorrectly via the Admin UI

• OPENIDM-13095: DatabaseTable Connector sample: Update sample to not require __NAME__ on create

• OPENIDM-13854: REST - Deleting user with a non existent relationship object returns 404

• OPENIDM-14548: External REST: Calling endpoints which return a JSON array throws error

• OPENIDM-14576: A workflow started in IDM 4.5 cannot be completed after upgrading to 6.0.0.5

• OPENIDM-14768: Admin UI: Update Database Table Connector template

• OPENIDM-15000: Rhino: Handlebars.js is not multithreaded

• OPENIDM-15526: Opening link in new tab doesn't honour the link in IDM 6.0 UI fullstack setup

• OPENIDM-15862: sustaining/6.5.x - sample for scriptedrest is not working with scriptedrest connector 1.5.19.1

• OPENIDM-16197: Kerberos Connector NoClassDefFoundError: expect4j/Expect4j

• OPENIDM-16686: sustaining/6.0.x - multiple passwords sample JsonValueException

• OPENIDM-16745: sustaining/6.0.x - SSL errors on external/rest calls

• OPENIDM-17053: Registration form is not loading

• OPENIDM-11152: Unable to connect to External DS datastore via TLS/SSL

• OPENIDM-12038: 'statusCode:null' logged in Audit for successful GET on managed objects

• OPENIDM-12080: External Email connects to SMTP servers with TLSv1

• OPENIDM-12207: UI login fails with non-ASCII username or password

• OPENIDM-12208: Clustered reconciliation fails due to paging cookie from ldap AD

• OPENIDM-12248: Data races in state shared across threads in recon

• OPENIDM-12312: UNIQUE policy on properties other than userName not correctly check during self-registration

• OPENIDM-12680: Reconciliation stuck in ACTIVE_QUERY_ENTRIES (or other ACTIVE_ state) and cannot be cancelled

• OPENIDM-12897: Large integers not handled correctly in JavaScript

• OPENIDM-13086: Do not cache Managed Roles and Assignments within ReconContext during reconciliation

• OPENIDM-13111: !== in mergeWithTarget.js (and possibly other scripts) doesn't check if value is undefined only if value is null

• OPENIDM-13160: PATCH may succeed although If-Match does not match _rev

• OPENIDM-13162: ManagedObject UPSERT contract creates orphan meta object on update via PUT

• OPENIDM-13261: Fix exception in PendingLinkAction.getPendingActionContext

• OPENIDM-13292: IDM trying to initialize SSL Cert for the internal DJ even if it's not configured as the repo, Incompatible with HSM

• OPENIDM-13411: identityServer.getProperty() returns null pointer if property isn't set rather than being handled gracefully

• OPENIDM-13601: Add reuseConnections and pooledConnectionTTL options to SalesForce provisioner configuration

• OPENIDM-13683: Using an expired token returns an HTTP 500 error

• OPENIDM-14163: Workflow: Groovy classpath problem

• OPENIDM-14202: SQL script provided with openidm to create the auditdb fails

• OPENIDM-14266: Remove security/realm.properties

• OPENIDM-14287: cli.sh keytool export and import causes IDM startup failure with 'Invalid AES key length' error

• OPENIDM-14641: Small improvements for policy.js

• OPENIDM-4377: Implement JDBC count support on queries with QueryFilter

• OPENIDM-10708: ResourceException when external/rest receives HTTP 204 response

• OPENIDM-10829: PUT modifications to workflow/taskInstance/[_id] return 'Task updated' even when no changes occur

• OPENIDM-10987: Users have access to manager user data (no relationship filter policy)

• OPENIDM-11494: When an internal user changes password in UI, the user's roles get removed

• OPENIDM-11689: Specify Schema in External DJ Connection Factory

• OPENIDM-11800: The handling of PreconditionFailedException could induce infinite loop

• OPENIDM-12154: An attempt to use external DS with explicit tables as a repo fails on missing fr-idm-lastPasswordSet

• OPENIDM-12190: Router authz fails in multiple-passwords sample

• OPENIDM-12359: Changing "Identity Email Field" in "User Query Form" from "mail" to another managed object property throws an error

• OPENIDM-12370: Enable HSM data decryption from IDM 3.1.0 instances

• OPENIDM-12383: API descriptor not available after setting relationship-type property to nullable

• OPENIDM-12413: Multi-nodes clustered recon may fail with wrong situation

• OPENIDM-12528: IDM 6.0 with DS repo and explicit mapping, PATCH replace does nothing for case-insensitive attribute

• OPENIDM-12664: Target phase run when reconById dispatched on mapping configured for clustered recon

• OPENIDM-12796: jsonstorage "local" self-service with "uuid" option fails in multi-node cluster scenario

• OPENIDM-12804: uuid token expiry doesn't work with jdbc repo

• OPENIDM-12865: jwt token fails in multi-node cluster scenario

• OPENIDM-12904: Sending mail with null "to" field causes IDM to hang

• OPENIDM-13117: Harden upgrade to be resilient to transient errors due to router upgrade

• OPENIDM-13135: Do not load JWT signing key if JWT session module is disabled

• OPENIDM-10722: Investigate high CPU in sun.security.provider package for Create Managed User

• OPENIDM-11174: Unable to resume scheduler jobs after successful pause

• OPENIDM-11393: assigning a userTask to openidm-admin could cause null pointer exception

• OPENIDM-11640: null exception in defaultMappings.json

• OPENIDM-11852: clustered recon in multi-node environment may never complete

• OPENIDM-11862: Setting a timeout on a uuid token via jsonstore.json has no effect

• OPENIDM-12013: Cache CommonJS module exports globally and prevent re-execution of required scripts

• OPENIDM-12017: IDM CAUD syslog product name (APP-NAME) is null

• OPENIDM-12200: Uncaught TypeError in JavaScript console when saving reverse relationship

• OPENIDM-7687: Provide support for ClientHandlers to use a proxy server within OpenIDM

• OPENIDM-11052: Admin UI Mappings page load delay on system?_action=test REST call

• OPENIDM-11101: NPE when shutdown

• OPENIDM-11195: script query result not converted to correct groovy type

• OPENIDM-11244: Include milliseconds in IDM logs

• OPENIDM-11446: Impossible to add optional field to selfservice registration

• OPENIDM-11480: With Oracle repo, Create or Update Managed user via UI results in 500 error

• OPENIDM-11597: IllegalArgumentException updating external account if trace is enabled

• OPENIDM-11635: When using DB2 repo, read requests with relationship expansion and update requests are not working anymore

• OPENIDM-11269: process typeError is observed in UI for association tab in mapping details

• OPENIDM-11603: Backport OPENIDM-11512: Integrating Social Authentication with Identity Management fails

• OPENIDM-10915: Backport OPENIDM-10887: expose isInitiator flag for IWA module

• OPENIDM-10917: Backport OPENIDM-10542: IDM decryption fails with AES 256-bit key

• OPENIDM-10968: Backport OPENIDM-10919: JavaScript in Internet Explorer does not support includes method of String

• OPENIDM-10969: Backport OPENIDM-10948: OpenerHandler require does not work with Internet Explorer

• OPENIDM-10971: Backport OPENIDM-6782: Password is re-encrypted during any managed object update/patch

• OPENIDM-11087: Backport OPENIDM-11024: NPE can be thrown if the authentication service comes up before the identityService

• OPENIDM-11160: Backport OPENIDM-8043: Unable to initialize keystore and truststore when passwords are different

• OPENIDM-11167: Backport OPENIDM-5465: Performance Issue updating conditional role memberships

• OPENIDM-11240: Backport OPENIDM-10758: openidm.read() returns different content if called from managed.json action or a custom endpoint

• OPENIDM-11243: Backport OPENIDM-9783: Include thread id in all logging statements

• OPENIDM-11245: Backport OPENIDM-11215: IDM hangs using IE11 with error "Promise is undefined" in ResourceQueryFilterEditor.js

• OPENIDM-11354: Backport COMMONS-314 json-crypto: SimpleEncryptor symmetric no longer works with HSMs

• OPENIDM-11421: Backport OPENIDM-11292: Registration autologin with full-stack not working

• OPENIDM-11422: Session JWT key usage is not clear

• OPENIDM-10512: Mapping Scheduling Sync toggle has nothing to do with schedule or livesync

• OPENIDM-10472: readSchema=false is added to config.properties by the admin UI for connectors

• OPENIDM-10471: NPE X-OpenIDM-OAuth-Login: true without providing any token when invoking REST API

• OPENIDM-10468: 500 internal error when Referer header not provided with OAuth

• OPENIDM-10459: onCreateUser.js:emailUser assumes that a mail address has been configured for the created object

• OPENIDM-10388: Managed object scripts are called with org.forgerock.http.routing.UriRouterContext when roles are added

• OPENIDM-10340: NPE when performing GET with invalid arbitrary URL parameters

• OPENIDM-10323: Sample JMS Consumer listening on incorrect JMS Topic

• OPENIDM-10231: Unable to use read-only keystore

• OPENIDM-10205: Entered text is lost when using the attribute selector for a role's condition

• OPENIDM-10195: Relationship between a custom managed object and a default object can be created in both directions via the UI

• OPENIDM-10152: Roles condition queryFilter builder does not show all properties on managed/user

• OPENIDM-10145: Restart action in update does not work properly and should be removed

• OPENIDM-10141: Adding an attribute to a 'The value for' condition causes it to be duplicated in the drop-down list

• OPENIDM-10137: Unable to set manager property to nullable via UI

• OPENIDM-10135: Manager field disappears when type is null

• OPENIDM-10134: Self-service registration fails with cross-origin restrictions using Safari

• OPENIDM-10126: A condition query on roles shows an incomplete list of role members

• OPENIDM-9997: API Explorer should send OAuth headers when appropriate

• OPENIDM-9976: Self Service email validation link for Registration leads to blank page in Safari

• OPENIDM-9975: Startup.sh is setting PROJECT_HOME incorrectly when CDPATH is set

• OPENIDM-9964: No content and NullPointerException returned when creating a relationship using the source managed object's attribute within the URI and specifying a _fields parameter

• OPENIDM-9940: onRetrieve script executed for managed attributes not returned by fields

• OPENIDM-9855: Trusted Attribute fails with multiple instances using different resources

• OPENIDM-9819: GenericLDAP Connector setup does not read remote LDAP schema irrespective of readSchema setting

• OPENIDM-9805: DJ Password Sync Plugin retry doesn't send any data to IDM

• OPENIDM-9751: Authorize Apps shows "Invalid date" for expire value

• OPENIDM-9719: CORS headers returned to client with repeated values

• OPENIDM-9677: Instagram configuration within identityProviders.json contains incorrect attribute name for full_name

• OPENIDM-9624: Conflict between OAuth Datastore token usage for authentication and binding

• OPENIDM-9615: The conditionalRoles.js script should not create an empty roles array if no conditional roles are assigned

• OPENIDM-9602: "watchedFields" and "passwordFields" can be added for audit event types other than Activity

• OPENIDM-9601: "onSync" script for managed objects is not called for both vertices when a relationship is created between them

• OPENIDM-9588: In the provisioning-with-workflow sample, you cannot view single record details in system/rolesFile

• OPENIDM-9574: Custom Self-Service URL breaks social registration

• OPENIDM-9572: Terms and Conditions acceptance not added to the profile when using Social Registration

• OPENIDM-9568: NullPointerException when checking for updates in read-only file system

• OPENIDM-9562: Enabling a persistent schedule multiple times through the config API runs a custom script multiple times

• OPENIDM-9554: Workflow Processes Completed have "Not Found Error" for managed/user

• OPENIDM-9549: "Current policy is read-only" notification shows after changing Mapping Detail policy

• OPENIDM-9545: Unable to execute taskscanner via REST endpoint when schedule is not file-based

• OPENIDM-9543: Patch/update requests of the _ref field against the relationship endpoint are not handled correctly

• OPENIDM-9476: Editable row for Display/Search Properties in Identity Relationships widget settings not showing the correct value when in edit mode

• OPENIDM-9458: Timezone is set incorrectly when a new schedule is created

• OPENIDM-9454: With an explicit mapping in a MySQL repo, you cannot create a managed user with password longer than 13 characters

• OPENIDM-9444: Patch Copy and Patch Move fail when the target property exists

• OPENIDM-9409: stdDev has incorrect value 0 for all clustered recon metrics

• OPENIDM-9390: Various problems configuring scheduled scripts in the UI

• OPENIDM-9389: Scheduled scripts with file paths are saved incorrectly

• OPENIDM-9387: Paged queries with query-all-ids don't work correctly for explicit mappings

• OPENIDM-9363: Attributes are removed from the managed object configuration when edited in the UI, if they do not appear within an order array

• OPENIDM-9362: Managed.json does not contain all attributes within the order array for default managed object types

• OPENIDM-9335: Admin UI shows the password for CSV audit tamper prevention as a JSON string

• OPENIDM-9328: Enabling CSV tamper prevention in the Admin UI dumps all config details to log file

• OPENIDM-9286: install-service.bat has a broken classpath variable

• OPENIDM-9217: Do not execute managed property's onRetrieve when returnByDefault is false

• OPENIDM-9213: When all topics are removed from an audit handler, the Admin UI saves 'null' instead of an empty list

• OPENIDM-9211: External REST service does not return error details from remote server

• OPENIDM-9207: recon creates incorrect links when using linkQualifiers

• OPENIDM-9201: Failure to send welcome email leads to user creation failure, inconsistent state

• OPENIDM-9195: From address in Password Reset email template is ignored

• OPENIDM-9170: A conditional role with assignments, created with single quotes over REST, does not display in the Admin UI

• OPENIDM-9045: Performance problem getting triggers for a scheduler job

• OPENIDM-8869: PagedResultsCookie response state in JDBCRepoService in violation of CREST Spec

• OPENIDM-8839: enum values do not display in API Explorer

• OPENIDM-8837: Deleting all KBA questions through the UI prevents user registration w/o visible Error Message

• OPENIDM-8827: ScriptedCrest samples uses _id in sync.json which is forbidden

• OPENIDM-8653: 'Unknown Error' when pasting a value into the username field when creating a managed user in IE 11

• OPENIDM-8593: Lots of API Descriptor errors in the logs on startup

• OPENIDM-8543: Patch remove on a field succeeds but is not propagated to the target

• OPENIDM-8381: Recovery of scheduled jobs following cluster node failure does not work

• OPENIDM-8045: Creating a new managed object with unsupported characters causes an exception

• OPENIDM-7947: With DJ as a repo, OpenIDM fails to start when using HSM

• OPENIDM-7536: Relationship fields are not returned on an "upsert" update

• OPENIDM-7284: Create manager/reports relationship with POST or PUT work on managed/user/id/reports but fails on managed/user/id/manager

• OPENIDM-6886: The Password Reset form applies policies from the 'password' field even if you are using a different field for the password

• OPENIDM-5914: Role is still showing as assigned in effectiveRoles attribute on query-all output if role is unassigned via the admin UI

• OPENIDM-5909: ScriptedSSH incorrect sample provisioner group members nativeName

• OPENIDM-5907: ScriptedSSH search script unsupported filter cause timeout exception

• OPENIDM-5227: LDAP Connector search filters are not persisted by the Admin UI

• OPENIDM-4686: Neither empty _fields nor _fields=* on a system resource read return all fields

• OPENIDM-3330: Inconsistent use of uidAttribute in LDAP Provisioner Config

• There are no known limitations in IDM 6.0.0.7, other than those identified in IDM 6.0.0.

• There are no known limitations in IDM 6.0.0.6, other than those identified in IDM 6.0.0.

• There are no known limitations in IDM 6.0.0.5, other than those identified in IDM 6.0.0.

• There are no known limitations in IDM 6.0.0.4, other than those identified in IDM 6.0.0.

• There are no known limitations in IDM 6.0.0.3, other than those identified in IDM 6.0.0.

• The automated update process is not currently supported on Windows platforms.

• When you add or edit a connector through the Admin UI, the list of required Base Connector Details is not necessarily accurate for your deployment. Some of these details might be required for specific deployment scenarios only. If you need a connector configuration where not all the Base Connector Details are required, you must create your connector configuration file over REST or by editing the provisioner file. For more information, see "Configuring Connectors" in the Integrator's Guide. directly.

• For OracleDB repositories, queries that use the queryFilter syntax do not work on CLOB columns in explicit tables.

• A conditional GET request, with the If-Match request header, is not currently supported.

• IDM provides an embedded workflow and business process engine based on Activiti and the Business Process Model and Notation (BPMN) 2.0 standard. As an embedded system, local integration is supported. Remote integration is not currently supported.

• OPENIDM-11597: IllegalArgumentException updating external account if trace is enabled

• OPENIDM-11704: UI: Can't edit validation policy without specifying a parameter

• OPENIDM-11739: Concurrent recons could cause exception deleting interim state instance deleteInterimStateInstance

• OPENIDM-11879: Workflow time zone handling is not consistent and leads to unexpected results

• OPENIDM-12131: UI javascript errors when a property does not have a nativeType attribute in a provisioner config file

• OPENIDM-12149: "/username: Expecting a value" exception when calling the authenticate function of connectors

• OPENIDM-12161: IDM does not propagate CAUD transactionId to DS

• OPENIDM-12200: Uncaught TypeError in JavaScript console when saving reverse relationship

• OPENIDM-12208: Clustered reconciliation fails due to paging cookie from ldap AD

• OPENIDM-12248: Data races in state shared across threads in recon

• OPENIDM-12259: New assignment is not reflected in onSync script hook when a new role with its members and assignments is created in one REST call

• OPENIDM-12283: correlateTreeToQueryFilter.js may be vulnerable to injection

• OPENIDM-12319: Audit Event Handler Port only displays first number in UI

• OPENIDM-12334: UI: IDM Recon result failure summary doesn't respond to click on "View Entries"

• OPENIDM-12354: Admin UI "Change Source to Target Association" button doesn't respond to click

• OPENIDM-12379: /openidm/recon endpoint fails on an upgraded repository

• OPENIDM-12664: Target phase run when reconById dispatched on mapping configured for clustered recon

• OPENIDM-12691: Scheduler performance in IDM 6.x

• OPENIDM-12796: jsonstorage "local" self-service with "uuid" option fails in multi-node cluster scenario

• OPENIDM-12804: uuid token expiry doesn't work with jdbc repo

• OPENIDM-12814: Setting returnByDefault for a relationship property to true could cause reconciliation exception with DJ repo explicit mapping managed user

• OPENIDM-12827: Setting returnByDefault to true on relationship properties in managed objects DJ repo could cause missing attributes in sync.json script hooks

• OPENIDM-12833: Removing the preferences property causes admin UI mapping/association to stop responding properly

• OPENIDM-12877: Exception caught signalling deletion of edge when removing a relationship

• OPENIDM-12904: Sending mail with null "to" field causes IDM to hang

• OPENIDM-13023: Include an out of the box Oracle specific bnd file in db/oracle/scripts

• OPENIDM-13111: !== in mergeWithTarget.js (and possibly other scripts) doesn't check if value is undefined only if value is null

• OPENIDM-13129: PATCH remove a field could result in 500 error: Can not add or remove a 'null' value

• OPENIDM-13940: Query workflow via REST with non-string parameter

• OPENIDM-14290: Internal Server Error reported when entering double quotes into username field

• OPENIDM-14501: Reset selfservice stage is checking mail attribute and not identityEmailField

• OPENIDM-14505: ManagedObjectSet handling of patch removal of singleton relationship field will prevent successful calculation of virtual properties based on this field

• OPENIDM-14538: Exception 412 thrown when multiple updates occur on a single managed/user

• OPENIDM-15016: OperationOptions specified within the provisioner configuration are not passed to connectors by OpenIDM

• OPENIDM-11597: IllegalArgumentException updating external account if trace is enabled

• OPENIDM-11704: UI: Can't edit validation policy without specifying a parameter

• OPENIDM-11739: Concurrent recons could cause exception deleting interim state instance deleteInterimStateInstance

• OPENIDM-11879: Workflow time zone handling is not consistent and leads to unexpected results

• OPENIDM-12038: 'statusCode:null' logged in Audit for successful GET on managed objects

• OPENIDM-12149: "/username: Expecting a value" exception when calling the authenticate function of connectors

• OPENIDM-12161: IDM does not propagate CAUD transactionId to DS

• OPENIDM-12200: Uncaught TypeError in JavaScript console when saving reverse relationship

• OPENIDM-12207: UI login fails with non-ASCII username or password

• OPENIDM-12208: Clustered reconciliation fails due to paging cookie from ldap AD

• OPENIDM-12248: Data races in state shared across threads in recon

• OPENIDM-12249: Backport OPENIDM-12248: Data races in state shared across threads in recon

• OPENIDM-12259: New assignment is not reflected in onSync script hook when a new role with its members and assignments is created in one REST call

• OPENIDM-12283: correlateTreeToQueryFilter.js may be vulnerable to injection

• OPENIDM-12319: Audit Event Handler Port only displays first number in UI

• OPENIDM-12334: UI: IDM Recon result failure summary doesn't respond to click on "View Entries"

• OPENIDM-12354: Admin UI "Change Source to Target Association" button doesn't respond to click

• OPENIDM-12379: /openidm/recon endpoint fails on an upgraded repository

• OPENIDM-12664: Target phase run when reconById dispatched on mapping configured for clustered recon

• OPENIDM-12691: Scheduler performance in IDM 6.x

• OPENIDM-12796: jsonstorage "local" self-service with "uuid" option fails in multi-node cluster scenario

• OPENIDM-12804: uuid token expiry doesn't work with jdbc repo

• OPENIDM-12814: Setting returnByDefault for a relationship property to true could cause reconciliation exception with DJ repo explicit mapping managed user

• OPENIDM-12827: Setting returnByDefault to true on relationship properties in managed objects DJ repo could cause missing attributes in sync.json script hooks

• OPENIDM-12833: Removing the preferences property causes admin UI mapping/association to stop responding properly

• OPENIDM-12877: Exception caught signalling deletion of edge when removing a relationship

• OPENIDM-12904: Sending mail with null "to" field causes IDM to hang

• OPENIDM-13023: Include an out of the box Oracle specific bnd file in db/oracle/scripts

• OPENIDM-13111: !== in mergeWithTarget.js (and possibly other scripts) doesn't check if value is undefined only if value is null

• OPENIDM-13124: Backport OPENIDM-13111: !== in mergeWithTarget.js (and possibly other scripts) doesn't check if value is undefined only if value is null

• OPENIDM-13129: PATCH remove a field could result in 500 error: Can not add or remove a 'null' value

• OPENIDM-13292: IDM trying to initialize SSL Cert for the internal DJ even if it's not configured as the repo, Incompatible with HSM

• OPENIDM-13403: Backport OPENIDM-13261: Fix exception in PendingLinkAction.getPendingActionContext

• OPENIDM-13683: Using an expired token returns an HTTP 500 error

• OPENIDM-13895: Backport OPENIDM-12208: Clustered reconciliation fails due to paging cookie from ldap AD

• OPENIDM-13940: Query workflow via REST with non-string parameter

• OPENIDM-14163: Workflow: Groovy classpath problem

• OPENIDM-14202: SQL script provided with openidm to create the auditdb fails

• OPENIDM-14287: cli.sh keytool export and import causes IDM startup failure with 'Invalid AES key length' error

• OPENIDM-14501: Reset selfservice stage is checking mail attribute and not identityEmailField

• OPENIDM-8052: Cannot create a remote (.NET) connector through the UI

• OPENIDM-8122: OpenIDM Cluster incorrectly shows ready and running

• OPENIDM-8295: Non-required single relationship properties should be nullable

• OPENIDM-8518: Not Found error when accessing a process instance via Admin UI

• OPENIDM-9081: WARNING about extensions directory not existing appears in felix console upon restart of IDM

• OPENIDM-9339: Clustered recon update may abort due to a Rhino NPE

• OPENIDM-9353: IDM does not audit the http response headers in the access audit log

• OPENIDM-9791: Error while generating process diagram, image will not be stored in repository

• OPENIDM-9828: Performance bottleneck when adding user to role members

• OPENIDM-9966: NullPointerException returned when creating a relationship using the source managed object's attribute within the URI and specifying a _fields parameter

• OPENIDM-10208: Setting an attribute's minLength applies as a string via Admin UI

• OPENIDM-10455: Query and non-read operations not authorised for openidm-admin role with OAuth

• OPENIDM-10660: User metadata is logged in the audit log when an object is changed

• OPENIDM-10761: Progressive Profiling scripted condition does not include user fields within "object" map

• OPENIDM-11050: Mutual SSL authentication failure with external REST

• OPENIDM-11370: Activiti workflow mail task goes to default localhost:25

• OPENIDM-11536: Cannot set user password for user created through full-stack social registration

• OPENIDM-12080: External Email connects to SMTP servers with TLSv1

• OPENIDM-12142: Progressive profile page fails to load if attribute wasn't added to the form

• OPENIDM-12312: UNIQUE policy on properties other than userName not correctly check during self-registration

• OPENIDM-12540: Unable to change openidm-admin password via self service UI

• OPENIDM-12591: authzMembers can have duplicate entries when added using openidm.create() in scripts

• OPENIDM-12709: Workflow Processes Completed have "Not Found Error" for managed/user

• OPENIDM-12778: Schedules to execute a file-based script are generated incorrectly via the Admin UI

• OPENIDM-13153: Create a pre-patch for update to 6.0.0.5

• OPENIDM-12363: After update NoClassDefFoundError: org/forgerock/openidm/core/MapPropertyResolver

• OPENIDM-12379: /openidm/recon endpoint fails on an upgraded repository

  Note

  OPENIDM-12379 has a workaround where you must run a Groovy script after your update process. Review the issue for a background on the problem. To view the script, see "To Apply the 6.0.0.7 Patch Bundle Release" in the Installation Guide.

• OPENIDM-12033: proxySystem property in external.rest.json does nothing

• OPENIDM-12055: NullPointerException when changing Authentication/Session

• OPENIDM-11265: Unable to pause scheduler jobs with REST call

• OPENIDM-11370: Activiti workflow mail task goes to default localhost:25

  Workaround: Use the external email service described in "Configuring Outbound Email" in the Integrator's Guide.

• OPENIDM-10851: Cluster doesn't recognize forcibly killed node on windows

• OPENIDM-10833: Cluster widget doesn't show shutdown time for killed node correctly

• OPENIDM-10829: PUT modifications to workflow/taskInstance/[_id] return 'Task updated' even when no changes occur

• OPENIDM-10828: MongoDB Connector UI configuration has an incorrect documentation link

• OPENIDM-10823: UI intermittently doesn't work with the new REST context when using Firefox

• OPENIDM-10800: Port does not display correctly in the UI if property substitution is used

• OPENIDM-10793: Problems with propvalue column size in properties tables

• OPENIDM-10780: IDM does not work with a Luna HSM keystore provider

• OPENIDM-10773: IDM does not start up if the parent folder name includes ' -> '

• OPENIDM-10761: Progressive Profiling scripted condition does not include user fields within "object" map

• OPENIDM-10740: Sharing and Activity (UMA) sections in the Self-Service UI do not display thumbnails

• OPENIDM-10736: Attribute substitution not supported for CSV connector filepath

• OPENIDM-10733: Compensate hangs when downstream connector is offline

• OPENIDM-10696: Full attribute details not available to policies when creating role via relationship collection

• OPENIDM-10692: IDM startup can be very slow with a DB2 repo

  Workaround: After you have imported the IDM schema for DB2, either run the command db2 connect to dopenidm in a terminal or run CONNECT TO DOPENIDM in a DB2 iterative command session (as the DB2 instance owner) and keep the session. IDM should then start with low latency.

• OPENIDM-10683: UMA: When a user shares a resource, the recipient doesn't see the share

• OPENIDM-10673: The augmentSecurityContext script should still execute when runAs cannot find the user

• OPENIDM-10660: User metadata is logged in the audit log when an object is changed

• OPENIDM-10653: Password reset fails using explicit tables

• OPENIDM-10623: With an embedded DS repo, PATCH remove on a null value does not delete the property

• OPENIDM-10603: Unexpected "manager" property in the "before" of activity audit records when patching manager on a user

• OPENIDM-10600: Internal error "no deployed process definition found" after deleting process definition

• OPENIDM-10579: The policy.js script does not support conditions with type 'queryFilter'

• OPENIDM-10578: Unable to specify the authenticationId within augmentSecurityContext script

• OPENIDM-10542: IDM decryption fails with AES 256-bit key

• OPENIDM-10537: Deleting a previously set field during profile completion does not work

• OPENIDM-10455: Query and non-read operations not authorised for openidm-admin role with OAuth

• OPENIDM-10400: When configuring a new LDAP Connector config for AD using the Admin UI, the groupMembership, groupType, and groupScope attributes in the user schema are not set up properly

• OPENIDM-10286: Idle timeout for JWT authentication module is not working

• OPENIDM-10263: Salesforce connector error while accessing data from User and Profile objects

• OPENIDM-10072: Scheduler service registered too early by OSGi

• OPENIDM-10039: Various Admin UI errors when accessing mappings or data tab using Salesforce sample

• OPENIDM-9791: Error while generating process diagram, image will not be stored in repository

• OPENIDM-9726: User List sort by Description shows only manually edited users

• OPENIDM-9576: Records with missing _sortKeys are not returned in query results

• OPENIDM-9521: Backport OPENIDM-6068: Target reconciliation does not finish for large datasets

• OPENIDM-9520: Update via REST with PUT removes private fields which are not included in the request

• OPENIDM-9517: Backport OPENIDM-5906: PATCH request with null rev invoked twice at the same time causes infinite loop

• OPENIDM-9502: Backport OPENIDM-5150: JSON configuration files always reloaded at startup irrespective of modifications

• OPENIDM-9446: Random startup failures when using DB2 as a repo

• OPENIDM-9360: Align "returnByDefault" behavior between roles and effectiveRoles

• OPENIDM-9353: IDM does not audit the http response headers in the access audit log

• OPENIDM-9331: Enabling CSV tamper prevention through the Admin UI may fail with a keystore password error

• OPENIDM-9138: Unable to create user with virtual attribute defined when using explicit mappings

• OPENIDM-9081: WARNING about extensions directory not existing appears in felix console upon restart of IDM

• OPENIDM-8659: Property onRetrieve hook returns null even though value is absent

• OPENIDM-8518: Not Found error when accessing a process instance via Admin UI

• OPENIDM-8295: Non-required single relationship properties should be nullable

• OPENIDM-8122: OpenIDM Cluster incorrectly shows ready and running

• OPENIDM-8052: Cannot create a remote (.NET) connector through the UI

• OPENIDM-7665: Admin UI mapping view returns HTTP 400 error

• OPENIDM-6514: JDBC repo errors on startup when using mysql

• OPENIDM-6467: syslog audit event handler created although required property not set

• OPENIDM-6032: In some situations, the Admin UI does not display the properties of a completed workflow

• OPENIDM-5465: Performance Issue updating conditional role memberships

• OPENIDM-4149: availableConnectors are not updated after remote ICF shut down

• Support for the TLSv1.1 protocol has been deprecated and will be removed in a future release. For more information, on the potential vulnerability, see CVE-2011-3389 from the National Vulnerability Database from the US National Institute of Standards and Technology.

  The default security protocol for IDM is TLSv1.2. Do not downgrade this protocol to TLSv1.1 unless necessary. For more information, see "Setting the TLS Version" in the Integrator's Guide.

• The ability to update servers by using the UI is deprecated and will be removed in the next release. You can still update from IDM 5.5 to IDM 6.0 through the UI, but UI update will no longer be available after this release.

• In schedule configurations, setting a time zone using the timeZone field is deprecated. To specify a time zone for schedules, use the startTime and endTime fields, as described in "Configuring Schedules" in the Integrator's Guide.

• Support for the MD5 and SHA-1 hash algorithms is deprecated and will be removed in a future release. You should use more secure algorithms in a production environment. For a list of supported hash algorithms, see "Encoding Attribute Values by Using Salted Hash Algorithms" in the Integrator's Guide.

• boot.properties has moved. It was previously located in project-dir/conf/boot, and is now located in install-dir/resolver/.

• The following directory variables have been deprecated and replaced:

  • &{launcher.working.location} is now &{idm.data.dir}

  • &{launcher.working.url} is now &{idm.data.url}

  • &{launcher.install.location} is now &{idm.install.dir}

  • &{launcher.install.url} is now &{idm.install.url}

  • &{launcher.project.location} is now &{idm.instance.dir}

  • &{launcher.project.url} is now &{idm.instance.url}

• The Active Directory (AD) .NET Connector is deprecated and support for its use in IDM will be removed in a future release.

  For simple Active Directory (and Active Directory LDS) deployments, the Generic LDAP Connector works better than the Active Directory connector, in most circumstances. For more information, see "Generic LDAP Connector" in the Connector Reference.

  For more complex Active Directory deployments, use the PowerShell Connector Toolkit, as described in "PowerShell Connector Toolkit" in the Connector Reference.

  Note that deprecating the AD Connector has no impact on the PowerShell connector, or on the .NET Connector Server.

• When configuring connectors, (see "Configuring Connectors" in the Integrator's Guide), you can set up nativeType property level extensions. The JAVA_TYPE_DATE extension is deprecated.

• Support for a POST request with ?_action=patch is deprecated, when patching a specific resource. Support for a POST request with ?_action=patch is retained, when patching by query on a collection.

  Clients that do not support the regular PATCH verb should use the X-HTTP-Method-Override header instead.

  For example, the following POST request uses the X-HTTP-Method-Override header to patch user jdoe's entry:

  $ curl \
   --header "X-OpenIDM-Username: openidm-admin" \
   --header "X-OpenIDM-Password: openidm-admin" \
   --header "Content-Type: application/json" \
   --request POST \
   --header "X-HTTP-Method-Override: PATCH" \
   --data '[
      {
      "operation":"replace",
      "field":"/description",
      "value":"The new description for Jdoe"
      }
    ]' \
    "http://localhost:8080/openidm/managed/user/jdoe"

• Support for the TLSv1.0 protocol has been removed. For more information, see the following PDF: Migrating from SSL and Early TLS from the PCI Security Standards Council.

  The default security protocol for IDM is TLSv1.2. Do not downgrade this protocol unless you have a specific need.

• The ability to update IDM through the Admin UI has been removed from IDM 6.

  If you're updating IDM from version 5.5 to 6.0.0.7, you must first update from 5.5 to 6, then to 6.0.0.7.

• The OPENAM_SESSION authentication module has been removed. If you are integrating IDM with ForgeRock Access Management (AM), you should use the OAUTH_CLIENT module instead. For an example, see "Integrating IDM With the ForgeRock Identity Platform" in the Samples Guide.

• Support for the Security Management Service has been removed.

  As a part of this change, the securitykeys table has been removed from the database schema. If you are updating from a previous version of IDM, an update script is available in the openidm/db/repo/scripts/updates directory to delete this table from existing repositories. For more information about updating your IDM instance, see "Updating Servers" in the Installation Guide.

• Support for a POST request with ?_action=sendEmail when sending an email with a REST call has been removed. Support for a POST request with ?_action=send is retained, on the /openidm/external/email endpoint. For an example of this REST call, see "Sending Mail Over REST" in the Integrator's Guide.