Version 2.21.4, 2018-01-29

  Features:

• Allow export of tokens to PKSC file (#790)
  
• Implement two-step enrollment of HOTP/TOTP tokens (#797, #863, #865, #866)
  
•  Allow WebUI customization via policies (#795)
  

  Enhancements:

• Add script to decrypt safeword tokens
  
• Allow using tags in the tokenissuer of smartphone tokens
  
• Try to re-establish lost HSM connections (#787)
  
• Allow to rotate audit log based on multiple conditions (#780, #833)
  
• Add dry-run option to audit log rotation (#801)
  
• Allow dots in realm names (#808)
  
• Mark empty but required fields in WebUI (#810)
  
• Display success information after PIN is set (#822)
  
• Add further tags to the user notification event handler (#824)
  
• Add number of users to the subscription view (#800)
  
• Add HTTP/HTTPS proxy settings to HTTP SMS Provider (#835)
  
• Federation Handler allows to forward the authorization token (#838)
  
• Use token janitor to export a user list (#852)
  
• Use HSM for random key generation if possible (#783)
  
• HTTP SMS Provider now takes TIMEOUT parameter into account
  
• Allow to configure length of generated serial numbers (#583)

  Fixes:

• Fix handling of only_realm option in token event handler (#809)
  
• Fix scrollbar issues in WebUI (#806, #823)
  
• Fix OTP counter of offline token (#840)
  
• Fix conflicts between check_tokentype and passthru policies (#846)
  
• Properly reset tab tile after session has been locked (#850)
  
• Fix handling of fixed key size during enrollment (#820)
  
• Make sure that only active policies are honored (#825)
  
• Fix various bugs with non-ASCII data (#754)
  
• Fix failcounter_clear_timeout (#831)
  
• Only remove apache host definitions on first installation (#834)
  
• Remove console.log from webui
  
• Allow to use TLS1.1 and TLS1.2 for LDAP Resolver (#876)
  

 
Version 2.20.1, 2017-11-23

Features:

• New Token-Type OCRA and DisplayTAN to support transaction signing for online banking (#767)
• Federation Handler allows to forward authentication requests and other REST API requests to a child privacyIDEA system (#711)
• Improved Subscription Handling 
• Allow to login with multiple loginnames (#713)
• Authentication Cache policy (#729)

Enhancements:

• !!!NOTE!!! following policies now also honor the resolvers, which they did not previously:
  
• (AUTH, challenge_response), (AUTH, otppin), 
• (AUTHZ, auth_max_success), (AUTHZ, auth_max_fail),
• (AUTHZ, last_auth), (WEBUI, login_mode),
• (ENROLL,losttoken_pw_contents), (ENROLL,losttoken_validity),
• (ENROLL, losttoken_pw_len) (#736)
• User can regenerate the QR Code during enrollment of smartphone app (#766)
• Administrator can define remote privacyIDEA servers centrally (#711)
• Events can now be ordered. This is important for the federation handling (#711)
• Specify the hash algorithm that is used to save SQL users passwords (#745)
• Add welcome dialog for administrator (#716)
• Allow creating oracle DB (#752)
• Event Handler can use timestamps and time offsets in conditions (#741)
• Use challenge/response token to unlock the screen of the web UI (#702)
• Support multiple challenge/response token at the same time (#722)
• GPG keys are generated during package installation and show the GPG key in the import dialog (#742)
• Failcounter clearing timeout in UI (#719)
• Allow to send challenge data (like banking transaction) in email text and SMS text.

Fixes:

• Set default loglevel from DEBUG to INFO (#765)
• Fixed PIN logging, which could lead to exceptions
• Fixed unicode handling in log messages
• Make LDAP Resolver work with utf8 (#738)
• User can only choose hash algo according to policy (#723)
• Add time period 30/60s to rollout URI (#744)
• Fix deprecation warning for flask_migrate (#734)
• Allow multiple tries for challenge/response (#708)
• Fix problem with certificate serial number (#737)
• /token/init allows to pass otpkey AND genkey=false (#793)
• Cast date to string, to fix audit search for postgresql (#786)
• Optimize the LDAP Resolver Redundancy to avoid LdapServerPoolExhaustedErrors (#802)
• Preset default realm in token enrollment (#804)
• Fix PassOnNoUser and PassOnNoToken (#798)
• Fix genkey=0 error during token enrollment (#793) 

Version 2.19.1, 2017-07-02

Enhancements:

• Add "pi-manage policy load" and "pi-manage policy export". (#721)
• Allow customization via pi.cfg file.
• Add {username} and {realm} as tags for the tokenhandler. (#735)

Fixes:

• Fix pi-manage file permission for backup
• Fix search for resolver in audit log
• Allow to read old legacy time from validity period
• Fix wrong enddate with lost_token
• Fix typos
• Improve documentation for yubikey
• Improve documentation for cache decorator
• Improve documentation for webui policy

Version 2.19, 2017-05-25

Features:

• Add generic User Cache to speed up authentication (#670, #683)
• Support multiple challenge-response tokens with the same PIN (#654)
• Restrict U2F registration based on assertion certificte (#648)
• Restrict authentication with U2F devices based on assertion certificate (#648)
• Add privacyidea-token-janitor script, that can clean orpaned or expired tokens (#692) 
• Add API for mutual key generation during enrollment for easy Smartphone App development by introducing a generic 2-step-rollout process (#627) 
• Add /validate/radiuscheck which works with rlm_rest and only uses HTTP return codes. (#703)
  

Enhancements:

• Allow to unset token validity period and other tokeninfo fields (#691)
• Add a quick-resolver test for LDAP resolvers (#688)
• Add additional tokeninfo tags {client_ip}, {ua_browser}, {ua_string} in token handler (#687)
• Allow to set decription of U2F tokens during enrollment (#685)
• Reduce the number of LDAP requests to increase authentication performance (#664, #655, #650)
• Realm administrator is only allowed to see actions on this allowed user realms (#663)
• Add audit rotation to pi-manage (#657)
• Speed up Audit Log calls by adding a second index (#656)
• Allow to either lock und logout the UI after timeout (#653)
• Allow string format {user}, {realm}, {serial}, {surname} in tokenlabel policy (#646)
• Move to a consistent time format for validity period and all other user specific times also containing the timezone (#644)
• Add TLS certificate check to LDAP machine resolver (#638)
• Make TLS certificate the default option in LDAP resolvers (#639)
• Allow to use privacyIDEA ownCloud App without subscription file with up to 50 users.

Fixes:

• Fix the datepicker for the token validity period (#644 / #693) 
• Fix LDAP resolver to respect all boolean configuration options (#658) 
• Fix serial number in challenge response validation response (#649)
  

Version 2.18

  Features

• Allow to disable the WebUI (#605)
  
• The WebUI will lock the screen after a timeout instead of   logging out the user. This allows to easily continue configuration work. (#621)
• Improve the creation and handling of local CAs (#630, #632, #633)
  
• Allow certificate template for certificates with different runtime and x509v3 extensions.

  Enhancements
  Enhancements in Policies:

• Allow regular expressions in usernames in policies. (#581)
  
• Improve Policy creation with pi-manage from JSON formatted file.
  
• WebUI: Add action grouping in policies.
  
• WebUI: Add action filter in policy view.
  
• Allow token specific PIN policies: The SPASS token can now have dedicated PIN policies.
• Add PIN policies for administrators during enrollment and during assignment.
• Add WebUI policy: only search on enter being pressed (#617)
  

 Enhancements in Event Handlers:

• Add token_validity_period condition to event handlers. (#618)
  
• Add additional options in token handler when creating  SMS, Email or mOTP tokens.
• Allow tokenhandler to set tokeninfo field.
  
• Allow tokenhandler to set syncwindow.
  
• Add event handler condition for count_auth_success and cound_auth_fail
• Add event handler condition for last_auth.
  
• Improve Audit Log for Event Handler. Each triggered action  will now also create an audit entry. (#609)
• Allow the use of {current_time} in tokenevent handler. (#628)

  Enhancements in LDAP Resolver:

• Upgrade dependency to ldap3 version >=2.1.1 to improve LDAP  performance in regards to redundancy and security
• LDAP Resolver: Use get_info in bind requests to avoid querying  of subschema. (#585)
• LDAP Resolver: Support StartTLS over Port 389.
  
• Simplify LDAP Resolver: Remove username from Attribute Mapping.
  
• Simplefy LDAP Resolver: Remove reverse filter.

  Misc Enhancements:

• Automatically add user's mobile number if tokentype is SMS.
  
• Add example configuration for GTX messaging SMS gateway.
  
• Add a script "privacyidea-get-unused-tokens" to find unused tokens
• WebUI: Add a busy indicator spinner.
  
• Improve the pi-manage script in regards to backup and restore. 
• Let you choose whether to backup encryption key or not.
• Better handling for individual pathes. (#626, #623)
  

Fixes

• LDAP Resolver: Verify SSL Certificate (Security)
  
• LDAP Resolver: Allow special characters in NTLM password
  
• LDAP Resolver: Allow searching for users with German umlaut
  
• Remove the "unsafe" notation in the QR-Code link, so that a smartphone may import the key during HOTP/TOTP token enrollment  by clicking the link. (#620)
• Use defusexml to avoid XML bombs on token import (Security)
  
• Replace eval with ast.literal_evel (Security)
  
• Add missing attributes for U2F tokens in validate/triggerchallenge API
• Let /validate/triggerchallenge write to audit log.
  
• Fix mangle policy for users and realms
  
• Avoid logging of password in check_user_pass in debug level  (level=10)
• Set encrypted PIN on enrollment for certificate tokens (#625)
  
• Remove unused policy action "motp_webprovision"
  
• Allow emailtext policy in triggerchallenge API (#642)
  

ChangeLog for Version 2.17

• Token Handler. Using the token handler the administrator can defined actions in response to events, to modify tokens like deleting, modifying, initilizing... tokens (#532)
• Script Event Handler or Shell Event Handler allows to trigger an external shell script, if some event occurs. (#536)
• Add additional endpoint to trigger a challenge response like the sending of an SMS, if the token PIN is not available (#531)
• Policy Handling to also check for secondary resolvers of a user. This way a user can authenticate with his primary resolver but policy will also work for secondary resolvers (#543)

• The event handler conditions also determine a serial number even if there is no serial number in the request: If the user from the request only has one token assigned. (#571)
• Allow event definitions to be disabled (#537)
• Allow event to be addressed by a destinct name (#522)
• Improving LDAP performace by addressing different functionality of ldap3 version 1.x and 2.x. (#549)
• Improve SQL Audit by adding the SQL Audit table to the schema. Table is not created during HTTP request. (#557)
• Limit audit log entry age. Users may only view audit log entries up to a certain age. (#541)
• Add checkbox to only display used actions in a policy (#573)
• In event handler: Use serial number of a user's token if the user has only one token (#571)
• Download a filtered audit log (#539)

• Add missing token serial number to audit log if token is deletes (#546)
• Fix event handler saving (#551)
• HttpSMSProvider accepts status codes 201 and 202 in addition to 200 (#562)
• Fix checkbox bug in NOREFERRALS of LDAP resolver (#563)
• Add documentation for SMS provider (#566)
• Remove 301 redirects from WebUI (#576)

ChangeLog for Version 2.16

• Add HSM support via AES keys (#534)
• Improved Event Handler for flexible notification (#511)
• Signed subscription files for adding and checking for extra functionality during authentication request (#502)

• Allow additional filter attributes in the Audit Log (#519)
• Show or hide realms in the login dialog via policy (#517)
• Improve UI if admin is not allowed for certain actions (#516, #512)
• Disable OTP PIN during enrollment via policy (#439)
• Allow automatic sending of registration code via email (#514)

• Allow compatibility with ldap3 >= 2.0.7 (#533 #535)
• Fix problem with Notification when no tokenowner is available (#528)
• Fix confusion of client HTTP parameters (#529)
• Fix enabled flag with certain database types (#527)
• Catch error in case of faulty overrideClient definition (#526)
• Truncate Audit lines, that are too long for the DB table (#525)

ChangeLog for Version 2.15

• Client Overview.
• Display the type of the requesting authenticating clients (#489)
• Support for NitroKey OTP mode (admin client)

• You can edit arbitrary user attributes in privacyIDEA. Such user attributes can be mapped to any RADIUS attribute.
• Performance enhancements using Caching singletons for Config, Realm, Resolver and Policies
• Allow configuration of the registration email text (#494)
• Return SAML attributes only in case of successful authentication (#500)
• Policy “reset_all_user_tokens” allow to reset all failcounters on successful authentication (#471)
• Client rewrite mapping also checks for X-Forwarded-For (#395, #495)

• Fixing RemoteUser fails to display WebUI (#499)
• String comparison in HOSTS resolver (#484)

ChangeLog for Version 2.14

• Import PGP encrypted seed files
• Allow UserNotification for user actions
• Allow UserNotification on validate/check events, to notify the user on a failed authentication or a locked token.

• Add thread ID in REST API Response
• Performance improvement: Cache LDAP Requests #473
• Performance improvement: Optimize resolver iteration #474
• Add "Check OTP only" in WebUI
• Improve "get serial by OTP" in WebUI
• Add script to get serial by OTP

• Restrict GET /user for corresponding admins #460

ChangeLog for Version 2.13

• Allow central definition of SMS gateways to be used with tokens. #392
• User SMS for User Notificaton Event Handler. #435
• Add PIN change setting for each token. #429
• Force PIN change in web UI. #432

• Performence enhancements
  • speed up loading of audit log in web UI.
  • avoid double loadin of tokens and audit entries in web UI. #436
• Additional log level (enhanced Debug) to even log passwords in debug mode.
• Add new logo. #430
• Add quick actions in the token list: reset failcounter, toggle active. #426
• REST API returns OTP length on successful authentication. #407
• Add intelligent OverrideAuthorizationClient system setting, that allows defined proxies to reset the client IP. #395

• Display token count in web UI. #437
• Use correct default_tokentype in token enrollment. #427
• Fix HOTP resync problems. #412

ChangeLog for Version 2.12.1