> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/authentication-broker/release-notes-for-authentication-broker.md). # Release Notes for Authentication Broker Release notes for the AdminX Broker, listed newest first. ### 1.09.00 *July 31, 2025* **Enhancements** * 1Kosmos now supports generic password reset operations for users in an LDAP directory. ### 1.08.11 *June 30, 2025* **Enhancements** * When requesting certificates, the user's unique object SID is now included in the certificate subject name for improved identity tracking. * Certificates are properly issued and stored, ensuring seamless authentication and credential management. **Fixes** * Fixed an issue where the Fetch All Basic Users API did not return the correct user count and user details on the last page index. ### 1.08.10 *April 25, 2025* **Fixes** * Fixed an issue where the broker's certificate request created by `createreq.exe` included the same attribute OID twice with different values. ### 1.08.09 *April 11, 2025* **New Features** * In organizations with a hybrid environment of Windows and Linux brokers, sending SCEP requests tailored to each broker type is challenging, as Linux brokers require an NDES server while Windows brokers do not. To address this, the broker now includes additional payload fields, alongside the existing ones, in the initialization message to enable OS-specific SCEP requests: * `Os` * `ScepSupported` * `NdesBypassSupported` ### 1.08.08 *January 16, 2025* **Enhancements** * The user principal search has been modified to explicitly exclude locked or disabled users from search results, ensuring only active users are returned during authentication and lookup processes. ### 1.08.07 *August 30, 2024* **Enhancements** * During authentication, some LDAP applications—including GoBroker—perform user authentication by binding with the user's Distinguished Name (DN) and password. The previous implementation incorrectly extracted the Common Name (CN) from the DN and used it as the username when querying users-mgmt, causing authentication to fail when the actual username differed. LDAP applications now use the incoming DN to fetch users by `distinguishedName` without re-escaping it, then perform all subsequent operations using the retrieved username. * LDAP filter escaping has been removed from the broker, deferring all escaping responsibilities to user-management. This prevents double-escaping of DNs and ensures correct LDAP queries. ### 1.08.05 *July 5, 2024* **Enhancements** * The broker has been enhanced to return the `ms-DS-ConsistencyGuid` attribute as a readable GUID string, consistent with how `objectGUID` is handled. This ensures uniform formatting of GUID-based attributes and improves compatibility with downstream systems that rely on standard GUID representations. ### 1.08.04.04 *July 1, 2024* **Enhancements** * On Windows, the broker has been updated to limit its reconnection attempts to 1Kosmos. Instead of retrying indefinitely, the broker now attempts to reconnect for 1 minute (4 retries). If all retries fail, the broker exits the process, allowing the Windows Service Manager to automatically restart it. This improves stability and ensures recovery without hanging the process in a retry loop. ### 1.08.04.03 *June 28, 2024* **Enhancements** * The broker now correctly converts and returns the `objectGuid` attribute in a readable UUID format instead of a raw byte or UTF-8 string. * GoBroker has been updated to handle unexpected Go panics in LDAP processing, SCEP enrollment, and script execution using the Go recover mechanism. This prevents the broker process from hanging in a panic state and allows it to log the error and continue running normally. **Note:** This change is focused solely on improving runtime stability and does not involve any broker restart mechanism. ### 1.08.03 *May 9, 2024* **Enhancements** * Improved the broker's handling of Active Directory (AD) configurations with multiple hosts. Even if one or more AD hosts are unavailable, the broker can now reliably establish a connection with the remaining active hosts, ensuring uninterrupted authentication and directory operations. ### 1.08.02 *April 25, 2024* **New Features** * When a user's password has expired in Active Directory (AD), the system now detects the status and displays a clear message informing the user that their password has expired. **Fixes** * Fixed an issue where AD users with expired passwords were not shown the "Password expired" message during password authentication. ### 1.08.01 *March 28, 2024* **Enhancements** * 1Kosmos has enhanced the security of broker creation to prevent misuse of previously authorized broker configuration identifiers. If a new broker connection is established and any potential security risk is detected—such as reuse of an old configuration—the system will automatically fail authorization, deauthorize the broker, and notify administrators via email. An **`E_BROKER_DEAUTHORIZED`** event is also triggered to indicate broker disconnection due to suspicious activity. Additionally, the AdminX UI now displays the client IP address of all registered brokers for better visibility, and a new security recommendation section has been added on the Download Broker page under **Directory Integrations > Brokers** to warn admins about insecure access management practices on machines running brokers. * The broker has been enhanced to use the `encryptionKey`—instead of `clientId`—for encrypting and decrypting data in the YAML file, starting from version `gobroker_1.08.01`. After updating the broker, existing encrypted data can still be decrypted and re-encrypted using the `encryptionKey`, ensuring secure and seamless upgrades. * The go-broker functionality now supports custom JavaScript-based user attribute transformation before sending data to users-mgmt. A new permission, `directory.edit.user-transformationjs-management`, controls access to this feature; only users with this permission can access the User Attribute Transformation tab to view and edit transformation scripts. In this tab: * Admins can write JavaScript to customize user attributes using the built-in editor. * Saving a script requires OTP verification for added security. * Scripts can be tested by clicking **Test User Attributes**, entering a valid username, and viewing the resulting attributes. Additionally, once the `phonenumbers` attribute is added via transformation, admins must map the appropriate AD attribute under **Directory → Attribute Mapping** in AdminX. ### 1.08.00 *February 10, 2024* **Enhancements** * The image name of the `pl_gb` broker has been changed to `gobroker`. * The LDAP filter has been modified to include both `userPrincipalName` and `sAMAccountName` to support authentication via username, password, and OTP when `userPrincipalName` is mapped to both username and uid. This ensures successful login through the AdminX UI using the intended identifier. ### 1.07.06 *November 23, 2023* **Enhancements** * The `license.json` file has been updated to use `tenantDNS` for go-broker configuration. **Fixes** * Fixed an issue where the log directory contained more log files than specified by the Log Rotation Count in the Authmodule configuration. * Fixed an issue where the Linux Broker showed "Broker not configured, waiting for configuration" in the logs and failed to appear in the AdminX UI, despite being properly configured in the Active Directory Authmodule. * Fixed an issue in Go Broker (version `pl_gb_1.07.05`) where passwords containing an asterisk ("\*") were incorrectly rejected with an "Invalid Password" error. ### 1.07.05 *September 7, 2023* **Improvements** * *Improved Logging:* The broker IP address and port are now available in logs. * *Improved Traceability:* Every incoming request is now associated with its request ID. **Fixes** * *Error handling during forced password resets on next logon:* AD users who are flagged to change their password on their next login can now be detected using the `773` error code from AD. When detected, the broker can send signals to prompt a password reset through BlockID. ### 1.07.04 *August 17, 2023* **Fixes** * *Broker DNS Cache:* Resolved a problem where the Broker DNCache was incorrectly storing queries with filters. This led to a gradual degradation in performance due to the cache being filled with incorrect queries and the broker spending time refreshing this erroneous cache. ### 1.07.03 *June 29, 2023* **New Features** * *Certificate Issuance Without NDES:* Introduced a feature that allows the Windows Broker to issue a certificate on behalf of the user without the need for an NDES server. This certificate is presented by the BlockID Credential Provider to authenticate a user at the time of Windows workstation login. * *Synthetic Heartbeat:* Introduced a synthetic heartbeat that allows 1Kosmos to run a diagnostic in case of a connection fault between user management, Kafka, and the broker. The heartbeat helps identify where a connection is dropped and also measures performance by providing insight into how much time a round-trip takes across user management, Kafka, and broker. ### 1.07.02 *June 8, 2023* **Enhancements** * *Broker Service on Windows:* Added the ability to run the broker as a service on Windows machines. The Windows broker is now downloadable from AdminX. ### 1.07.01 *May 18, 2023* **Fixes** * *Log Size and Log Rotation Count:* Minor fix to ensure the log size and log rotation count values are updated without requiring a broker restart. ### 1.07.00.01 *May 1, 2023* **Fixes** * *Custom LDAP Port Number:* Fixed a bug where the broker was not able to fetch users from an LDAP directory when a custom port number was used. ### 1.07.00 *January 26, 2023* **Enhancements** * *Floating Value Support for Broker Maximum File Size:* The maximum file size of the broker can be configured to support floating values for increased flexibility. The default maximum file size is 10 MB. * *Improved Broker Logging:* The request ID is now passed down from the upstream service that requested authentication for a user. ### 1.06.04.02 *January 10, 2023* **New Features** * *Log Rotation:* Added log rotation to prevent broker log size from growing indefinitely. Configuration settings are now available to manage: * `logfilesizemb`: The maximum size the log file can grow before rolling over to a new log. The default size is 10 MB. * `logfilecount`: The maximum number of log files retained in the logs directory. When the count is reached and a new log file needs to be created, the oldest log file in the directory is deleted. The default count is 10. ### 1.06.03 *December 15, 2022* **New Features** * *Password Reset for Active Directory Users:* Active Directory users can now reset their password. ### 1.06.02.01 *August 18, 2022* **New Features** * *Kerberos Support:* Support for Kerberos authentication using Kerberos tokens and keytab files. * *Kafka Topics:* Introduced Kafka topics to ensure continuity if a broker fails, allowing another broker to complete the work. **Enhancements** * *LDAP Query Filter Support:* LDAP query search filters are now supported during user search and authentication. * *Propagation of Broker Request IDs:* Broker request IDs are propagated across different loggers for ease of traceability. * *Search Optimization:* Code optimization to improve performance on search. ### 1.06.01 *April 14, 2022* **New Features** * *SCEP Support for Automatic Certificate Issuing:* Support for issuing SCEP (Simple Certificate Enrollment Protocol) certificates automatically when a user attempts to enroll their authenticator. * *SCEP Agent Password Support for Broker Config:* Ability to provide the SCEP agent password directly from the broker config. * *Upgraded Logging Capability:* Logging capability has been upgraded to capture certificate generation, certificate expiration, and other information for debugging support. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.1kosmos.com/authentication/authentication-broker/release-notes-for-authentication-broker.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.