Critical changes in this release

Edit online

This topic highlights changes that are made that might impact compatibility with an earlier version in IBM® Verify Identity Access version 11.0.3.

Verify Identity Access Platform

  • OpenShift default SCC compatibility

    All container images are now updated to support OpenShift’s default restricted-v2 Security Context Constraint (SCC). Containers no longer require a fixed user ID and can run securely using the arbitrary UID assigned by the platform. A one-time migration of the persistent volume is required when moving an existing deployment that uses a shared persistent volume to the restrictive-v2 SCC. For more information, see Migrating persistent volumes to restrictive-V2 SCC in OpenShift.

  • Lua HTTP Transformation table indexing
    The following Lua HTTP transformation functions now return tables using 1-based indexing (in accordance with Lua conventions) instead of 0-based indexing. This change ensures compatibility with Lua’s ipairs iterator and standard table operations:
    • Session.getCredentialAttributeNames()
    • Session.getMvCredentialAttribute(string name)
    • Session.getSessionAttributeNames()
    • HTTPRequest.getHeaderNames()
    • HTTPRequest.getCookieNames()
    • HTTPResponse.getHeaderNames()
    • HTTPResponse.getCookieNames()
    Note:
    • If your Lua HTTP transformation scripts access these tables using numeric indices starting at 0, you must update them to use 1-based indexing. For example, replace table[0] with table[1], and table[1] with table[2].
    • Scripts that use the ipairs or pairs iterators do not require modification. These iterators will correctly process all elements, including the first element, which may have been skipped previously.

Advanced Access Control (AAC)

  • JavaScript Mapping Rules Allowed Classes

    The CheckedObjectInputStream and ObjectInputStream classes are no longer available for use in JavaScript mapping rules. Contact support if this change is causing any blocking issues.

  • JavaScript Mapping Rules Blocked Properties

    A new advanced configuration property is now added that allows JavaScript global objects and functions to be blocked from use in mapping rules. The default value for this property blocks the use of eval, uneval and Function. This has the potential to effect existing mapping rules. For more information see Advanced configuration properties.

  • SCIM enablement

    The SCIM configuration can now be configured with an enablement level. On new installs, SCIM is disabled and will not work for any requests until it is enabled in some capacity. This may have an effect on existing configuration scripts. For more information see General SCIM settings.

  • SCIM Response Code

    The SCIM API authorization behavior is now updated so that the unauthorized requests return a 403 Forbidden response instead of 401 Unauthorized. An advanced configuration property is available to restore legacy behavior. When the property scim.legacyAuthzForbiddenResponseCode is set to true, the API returns a 401 Unauthorized response as it did previously. For more details see Advanced configuration properties.