Notes covering new features, fixes and known issues for ForgeRock® Access Management Java agents. ForgeRock Access Management provides open source authentication, authorization, entitlement and federation software.

• Java Agents 5.6.3 is the latest release targeted for Java Agents 5.6.x deployments and can be downloaded from the ForgeRock Backstage website.

  See the list of fixes here.

• Added Support for Public AM URLs

  Java Agents 5.6.3 includes a new bootstrap property, org.forgerock.agents.public.am.url, that specifies the public URL of the AM instance.

  Use this property only if:

  • The agent is using the custom login redirection mode (custom login pages using SSO tokens).

  • The custom login pages are not in the same domain as the agent, and there is a proxy, firewall, or any other technology that remaps URLs between AM and the custom login pages.

  Consider an example where the traffic between AM and the agent happens through the example-internal.com network, but the custom login pages are on the example-external.com domain. In this case, you would configure https://openam.example-external.com:8443/openam as the public AM URL.

  For more information, see org.forgerock.agents.public.am.url in the User Guide.

• No new features were introduced in this release, only bug fixes.

• SSO Token Compatibility Properties Added

  Java Agents 5.6.2.0 adds properties for allowing use of SSO tokens, which can be exchanged for JWTs, therefore allowing a mixture of older and newer agents in a deployment.

  For more information, see Enabling Support for Exchanging SSO Tokens in the User Guide.

• Added Ability to Specify Cookie and Header Values in Not-enforced Rules

  Java Agents 5.6.2.0 adds the ability to specify cookie and header values in not-enforced rules and combine them with HTTP methods.

  For more information, see Not-Enforced URI Processing Properties in the User Guide.

• Allow Agents to Refresh Session's Idle Timeout

  Sessions in AM have an idle timeout after which they expire. In general, when users access protected resources through an agent, the agent requests a policy decision on behalf of that user, which resets the idle timeout.

  When the agent does not need to reach out for AM frequently, however, sessions may unexpectedly expire in AM due to idle timeout before users have finished accessing the application.

  Java Agents 5.6.2.0 includes the new org.forgerock.agents.idle.time.window.minutes property to specify the amount of time the agent will wait before making a call to AM to refresh the session's idle timeout, provided that the user is actively accessing the application or site.

  For more information, see Idle Timeout Window in the User Guide.

• No new features were introduced in this release, only bug fixes.

• No new features were introduced in this release, only bug fixes.

• No new features were introduced in this release, only bug fixes.

• AMAGENTS-2060: Allow Configuration for amFilterCDSSORequest Expiration Time

• AMAGENTS-3106: JASPA : Enable redirect to session's successURL if needed.

• AMAGENTS-3133: JASPA : Deal with samesite=lax issues

• AMAGENTS-3264: JASPA: Check the browser version(s) and set the samesite cookie attributes if browser supports

• There are no major improvements or enhancements in this release.

• Add TRACE Messages to Login Process

  TRACE-level debugging has been added to better track any issues.

• New Option to Change Advice Format Value

  Web agents 5.6.2.0 introduces a new property, com.forgerock.agents.advice.b64.url.encode=1, which changes the advice format XML, sent as part of the composite advice by the agent to AM. When the property is enabled, the advice is sent as base64url-encoded data.

  For more information, see AMAGENTS-2973: Create option to Change Advice Format Value

• There are no major improvements or enhancements in this release.

• There are no major improvements or enhancements in this release.

• Specify Agent Profile Realm During Installation

  Java Agents 5.6 allow you to specify the realm in which the agent profile exists, making the process easier if you are not using the top-level realm.

  Performing installation using an existing response file that does not specify the realm will assume the top-level realm.

  For more information, see "Installing Java Agents" in the User Guide.

• OpenAM

• AM versions earlier than 5.5.

• There are no important changes in functionality in this release, other than bug fixes.

• There are no important changes in functionality in this release, other than bug fixes.

• Cookies Marked as HTTPOnly by Default

  Java Agents 5.6.2.0 sets the com.sun.identity.cookie.httponly property to true by default.

  If you are upgrading from a previous version and have scripts that require access to the contents of the cookies set by the agent, you should switch this property to false.

• There are no important changes in functionality in this release, other than bug fixes.

• There are no important changes in functionality in this release, other than bug fixes.

• There are no important changes in functionality in this release, other than bug fixes.

• No functionality has been deprecated in this release.

• No functionality has been deprecated in this release.

• No functionality has been deprecated in this release.

• No functionality has been deprecated in this release.

• No functionality has been deprecated in this release.

• No functionality has been deprecated in this release.

• No functionality has been removed in this release.

• No functionality has been removed in this release.

• No functionality has been removed in this release.

• No functionality has been removed in this release.

• No functionality has been removed in this release.

• No functionality has been removed in this release.

• AMAGENTS-2060: Allow Configuration for amFilterCDSSORequest Expiration Time

• AMAGENTS-2863: Missing Binding JAR for SLF4J

• AMAGENTS-2892: Agent writes to static value /tmp before debug config attributes are initialised.

• AMAGENTS-2906: Invalid token makes exception in agent debug log

• AMAGENTS-2981: Java Agent 5 will not redirect to AMPostAuthProcessInterface.POST_PROCESS_LOGIN_SUCCESS_URL value

• AMAGENTS-3090: JASPA : ACR is missing in JWT while swapping ssotoken -> JWT when custom login is used.

• AMAGENTS-3106: JASPA : Enable redirect to session's successURL if needed.

• AMAGENTS-3118: JASPA: Once again it is impossible to change the debugging level.

• AMAGENTS-3126: JASPA: Incorrect legacy property used for session polling

• AMAGENTS-3210: Invent the Java Agents equivalent of com.forgerock.agents.public.am.url

• AMAGENTS-3215: Java Agent implementation for pre-authentication cookie issues

• AMAGENTS-3223: JASPA: Agent is redirecting to /am/console, when session successURL is not specified.

• AMAGENTS-3293: JASPA reporting cookie entry for nonce can't be retrieved from pre-authn bookkeeping cookie if authn takes longer than 5 minutes to complete.

• AMAGENTS-3305: JASPA throws HTTP 400 when agent receives advices in one cookie per an unauthenticated request

• AMAGENTS-3384: (JASPA) Redirect loop is possible in tracked custom login mode because invalid sso cookie is not removed

• AMAGENTS-3389: JASPA: id token cookie is not removed after logout in accept.ipdp.token mode

• AMAGENTS-3449: Enabling self service causes JWTValidator.validate error in Java Agent

• AMAGENTS-2625: Java agent fails to install on windows docker image with JDK 11

• AMAGENTS-2961: Can't change J2EE agent password

• AMAGENTS-2770: Consider removing javax packages from agent jars

• AMAGENTS-2781: Implement NER improvements

• AMAGENTS-2815: Reintroduce custom handlers

• AMAGENTS-2829: Java Agents bundle classes from Java SE 8

• AMAGENTS-2862: Agent throws error if OpenSSOAgentConfiguration.properties is not there when in central config mode.

• AMAGENTS-2910: Not enforce requests containing particular cookie or header

• AMAGENTS-2913: Address issues logging out a user possessing an SSO token as well as, or instead of, a JWT

• AMAGENTS-2932: NPE when exchanging SSO tokens for JWTs

• AMAGENTS-2950: Custom login will not auto detect the realm when it is not specified

• AMAGENTS-2953: Address issues with realm retrieval

• AMAGENTS-2954: SSO->JWT exchange fails to create cookies when a cached SSO token is found

• A security fix was made in this release. For more information, see "Security Advisories".

The following important issues were fixed in this release:

• AMAGENTS-2416: Resolve conflicts for depentent external libraries

• AMAGENTS-2648: Space characters in UID aren't encoded

• AMAGENTS-2666: It is not possible to login when "Invert Not Enforced URIs" property is set

The following important issues were fixed in this release:

• AMAGENTS-96: RFE: Base conditional login url on a specific request header instead of on the FQDN of the request.

• AMAGENTS-896: When using local configuration for Agent and setting log level to be message we do not get any output in debug.out

• AMAGENTS-988: Java Agent 5 should not have a value for com.sun.identity.client.notification.url property in OpenSSOAgentConfiguration.properties

• AMAGENTS-1035: JASPA initialises data members corresponding to properties it no longer uses.

• AMAGENTS-1036: com.sun.identity.agents.config.cdsso.enable is ignored for JASPA 5 and should be deleted from OpenSSOAgentConfiguration.properties file

• AMAGENTS-1578: Java Agent makes error messages when NEU property is empty

• AMAGENTS-2369: JASPA does not handle token expiry if notifications are disabled, not working, or slow

• AMAGENTS-2416: resolve conflicts for depentent external libraries

• AMAGENTS-2431: JASPA: When specifying any agent profile realm, the agent dies on startup

• There are no new known limitations in this release.

• Remote Audit Logging May Decrease Throughput

  Testing has found that use of remote audit logging may impact performance throughput due to the large number of requests sent from the web agent to AM.

• There are no known limitations in this release.

• There are no known limitations in this release.

• There are no known limitations in Java Agents 5.6.1.0, other than those identified in Java Agents 5.6.0.

The following limitations and workarounds apply to Java Agents 5.6.0:

• CDSSO Domain List Restrictions for WildFly and JBoss

  Cookie support in WildFly and JBoss has been implemented so that only one cookie can be set with a certain name. This prevents setting the same cookie for multiple domains.

  Configuring the CDSSO Doimain List policy agent property with more than one cookie domain may result in redirection loops.

  To work around this issue, perform the following steps:

  1. Navigate to Realms > Realm Name > Applications > Agents > Java > Agent Name > SSO.

  2. Remove all cookie domains from the CDSSO Domain List (com.sun.identity.agents.config.cdsso.domain) property.

  3. Navigate to Realms > Realm Name > Applications > Agents > Java > Agent Name > Global.

  4. Configure any required entries in the Agent Root URL for CDSSO (sunIdentityServerDeviceKeyValue) property.

  The Java agent will set the cookie domain based on the requested resource.

• The agentadmin Command Shows Warning Messages When Using JDK 11

  The agentadmin command may show warning messages similar to the following when using JDK 11:

  WARNING: An illegal reflective access operation has occurred
  WARNING: Illegal reflective access by org.forgerock.openam.sdk.com.google.inject.internal.cglib.core.$ReflectUtils$1 ...
  WARNING: Please consider reporting this to the maintainers of org.forgerock.openam.sdk.com.google.inject.internal.cglib.core.$ReflectUtils$1
  WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
  WARNING: All illegal access operations will be denied in a future release

  You can safely ignore these messages.

• There are no new known issues in this release.

• There are no new known issues in this release.

• There are no new known issues in this release.

• There are no known issues in this release.

• There are no known issues in Java Agents 5.6.1.0, other than those identified in Java Agents 5.6.0.

• AMAGENTS-2585: When uninstalling and reinstalling the Java Agent on windows, we get a message saying "Agent Configuration JVM option ...FAILED"

• AMAGENTS-2589: The --acceptLicense parameter does not accept license permanently for java agent installer

• AMAGENTS-2590: The Installer and the Agent Debug Logs should be updated so that the do not refer to Tomcat Agent v 6.0

• AMAGENTS-2599: Uninstalling Java agent makes fake Failure message

• AMAGENTS-2616: Java agent installer makes warning messages when JDK 11 is used