Skip to main content
Version: 8.2607.x.x LTS

Migration guide from LTS-2024 to LTS-2026

This page lists all the breaking changes that were introduced between the LTS-2024 version (8.2405.x) and the LTS-2026 version (8.2607.x) of nevisIDM.

Read all the items, and execute all manual migration steps that are relevant for your setup and environment.

:warning:The recommended migration path involves two steps:

  1. Migrate to the first LTS-26 (8.2607.x) version.
  2. Migrate to the most recent version of our LTS-26 version.

Do not forget to update your other related Nevis components at the time of migration.

Java version requirement

nevisIDM is compiled and run with Java 25. Java 21 (introduced with 8.2505.3.10) is no longer sufficient - starting nevisIDM with Java 21 or older will fail. Make sure your JVM/JDK is updated before upgrading nevisIDM.

XA transaction management removed

Atomikos-based XA transaction management has been removed from nevisIDM. The database.connection.xa.enabled configuration property no longer has any effect - nevisIDM always uses a non-XA HikariCP datasource now, regardless of this setting.

Breaking changes​

nevisIDM 8.2411.0.11824142812 - 20.11.2024​

  • FIXED: Now default policy values are applied to PASSWORD, CONTEXT_PASSWORD and DEVICE_PASSWORD credentials when validating passwords. This behaviour can be turned off with configuration property application.policy.loadDefaultValues. (NEVISIDM-9598)
    • Startup time check is added to check if there is some policy where it can cause issues. It can be turned of with application.policies.passwordpolicies.checkatstartup configuration property.
    • Policies for credential types PASSWORD, CONTEXT_PASSWORD and DEVICE_PASSWORD are validated when created and modified.

nevisIDM 8.2505.3.10 - 21.05.2025​

  • UPGRADED: nevisIDM is now compiled and run with Java 21. Using Java 17 is no longer supported. (NEVISIDM-9927)
  • CHANGED: Due to upgrading to MariaDB driver 3.5.2 the jdbc url has changed. Either use jdbc:mariadb as protocol or add the permitMysqlScheme query parameter to the URL. (NEVISIDM-9928)

nevisIDM 8.2511.0.4 - 26.11.2025​

nevisIDMDB migration

The 7.31.1 migration in 8.2505.5.4 and 8.2511.0.4 has different checksums for MariaDB databases.

If you run into an issue during migration on a MariaDB database with an error message similar to:

Migration checksum mismatch for migration version 7.31.1
-> Applied to database : -282518784
-> Resolved locally    : 27262105

execute the following SQL command on your nevisIDM database to correct the checksum:

UPDATE TIDMA_DB_HISTORY SET CHECKSUM = 27262105 WHERE VERSION = '7.31.1';

An automated fix was part of the nevisIDM fixpack release 8.2511.2.*.

nevisIDM 8.2607.0.4 - 22.07.2026​

  • UPGRADED: nevisIDM is now compiled and run with Java 25. Using Java 21 is no longer supported. (NEVISIDM-9927)
  • CHANGED: We replaced XA transaction management with the Spring JPA transaction manager to allow configuring an external Provisioning queue without an XA connection factory (e.g. RabbitMQ, Kafka, Azure Service Bus). (NEVISIDM-10603)
    • We removed the Artemis Bridge feature since any kind of external queue can be configured.
    • We introduced a Hikari connection pool, replacing the Atomikos connection pool. See the related configuration changes in Configuration Files.
    • You can activate a read-only database connection pool for Active-Passive database clusters, which improves the effectiveness of multiple region setups.
    • XA rights on the Oracle database are no longer needed.
  • FIXED: Fixed an issue in the SCIM PATCH interface where some validation was not run when modifying users. (NEVISIDM-10820)

Other important changes​

nevisIDM 8.2405.1.9265283332 - 26.06.2024​

  • NEW: FIDO2 Patch now works correctly with Oracle SQL Database. (NEVISIDM-9594)

nevisIDM 8.2405.2.10083030000 - 25.07.2024​

  • FIXED: Added fixed database schema migration 7.10.1 to solve issue where 7.10 failed on MariaDB if TIDMA_UNIT.NAME or TIDMA_USER.NAME was longer than 50 characters. (NEVISIDM-9618)
  • NEW: Modified nevisidmdb tool to be able conditionally use 7.10.1 and 7.10 on MariaDB, depending if 7.10 is already applied. (NEVISIDM-9618)
  • FIXED: Fixed displaying IDM roles in QueryUser role listing if the querying user has restricted application dataroom. (NEVISIDM-9631)
  • FIXED: Added default servlet to handle GET and POST on /nevisidm/admin/ similarly as they were before the jetty 11 update. (NEVISIDM-9611)
  • NEW: Made deviceId modifiable on FIDO UAF credentials. (NEVISFIDO-2140)

nevisIDM 8.2405.3.10630071247 - 31.08.2024​

  • UPGRADE: We updated Spring Framework to 6.0.23. (NEVISIDM-9697)
  • UPGRADE: We updated CXF to 4.0.5. (NEVISIDM-9648)
  • NEW: We introduced a request level cache for unit dataroom so if the same dataroom is checked in one request multiple times, it is only calculated once. (NEVISIDM-9654)
  • NEW: Introduced customer facing settings for OWASP CSRF Guard, configurable with application.owasp.csrfguard.overlay.properties.file. (NEVISIDM-9655)

nevisIDM 8.2405.4.11013907158 - 27.08.2024​

  • UPGRADE: We updated path-to-regexp to 0.1.10. (NEVISIDM-9761)
  • NEW: Audit messages with type AUTHORIZATION_CREATE, AUTHORIZATION_MODIFIY and AUTHORIZATION_CREATE now contain a field applicationName. (NEVISIDM-9777)
  • NEW: We added a new configuration property application.subunits.queryviacte.enabled to configure if subUnit search should use the TIDMA_UNIT_PATH table, or use a Recursive CTE query. (NEVISIDM-9755)
  • CHANGED: The mobile number field of MTan credentials is now updatable. (NEVISIDM-9656)
  • FIXED: The issue where authorization related search queries were not working correctly if the number of roles was larger than database.performance.bindvar.max is fixed. (NEVISIDM-9778)
  • FIXED: UnitDataroomAuthCheckerForUser now does not log a DataInconsistency warning if the user is imported via SCIM. (NEVISIDM-9759)
  • FIXED: Issue where MTan duplication check was finding MobileSignatures as duplicates is fixed. (NEVISIDM-9756)

nevisIDM 8.2405.5.11573780478 - 31.10.2024​

  • FIXED: Issue where RecreateCertificateInfosJob displays the cert credentials correctly is fixed. (NEVISIDM-9821)

nevisIDM 8.2411.0.11824142812 - 20.11.2024​

  • NEW: We added a new configuration property application.is.keep.raw.phone.number to configure if the phone number should be reformatted to E164 or kept raw. (NEVISIDM-9689)
  • UPGRADED: We updated Jetty to 12.0.9. (NEVISIDM-9448)
  • UPGRADED: We updated ws to 8.17.1. (NEVISIDM-9629)
  • FIXED: Added missing dtds to DigesterFactory. (NEVISIDM-9552)
  • FIXED: Fixed mistakenly applied/left out privilege escalation checks for credential related operations. (NEVISIDM-9334)
  • CHANGED: IDM health check now only checks the database version once every database.version.healthcheck.cache.timeout seconds, otherwise it uses the cached value. (NEVISIDM-9563)
  • UPGRADED: We updated Braces lib from 3.0.2 to 3.0.3. (NEVISIDM-9617)
  • UPGRADED: We updated NodeJs from 16.13.2 to 22.9.0. (NEVISIDM-9831)
  • FIXED: The problem with credential login info counters is solved on systems where audit logging is disabled. (NEVISIDM-9886)
  • FIXED: Language calculation for display name now works correctly. (NEVISIDM-10241)
  • CHANGED: Added more detailed logging to authentication to better understand the causes of errors. (NEVISIDM-9783)
  • CHANGED: Moved the Lucene index working directory from /tmp to the working directory of the IDM instance. (NEVISIDM-9719)
  • UPGRADED: We updated commons-io to 2.14.0. (NEVISIDM-9793)
  • UPGRADED: We updated socket.io to 4.7.5. (NEVISIDM-9629)
  • UPGRADED: We updated npm-ip to 2.0.1. (NEVISIDM-9609)
  • CHANGED: On logout (Logout.do at the end of the URL) the runtime user is removed from the cache. This evicts the runtime user from the runtime cache. (NEVISIDM-9779)
  • FIXED: Create history for custom properties when it is modified via REST API. (NEVISIDM-9690)
  • FIXED: For queryRoles, queryProfiles and queryUsers now displaying the nevisIDM roles correctly. (NEVISIDM-9787)
  • FIXED: ModifyCredential now accepts state changes for FIDO UAF credentials with empty credentialFidoUaf tags in the request. (NEVISIDM-9762)
  • FIXED: When displaying credential SOAP services, no longer logs an error if the user's RECOVERY_CODE or FIDO2 credential is not found. (NEVISIDM-9599)
  • FIXED: queryCredentials SOAP request does not throw a NullPointerException if credentialDetailLevel is EXCLUDE. (NEVISIDM-9582)
  • FIXED: Password, DevicePassword, ContextPassword policy parameters are checked for conflicts during creation and modification. (NEVISIDM-9632)
  • NEW: Added new OpenTelemetry metrics number_of_successful_logins_this_month, number_of_successful_logins_past_30_days, number_of_successful_logins_past_90_days and number_of_successful_logins_past_12_months. (NEVISIDM-9637)
  • FIXED: database.connectiom.pool.min and database.read.only.connectiom.pool.min now have the correct default value of 3. (NEVISIDM-9601)
  • FIXED: Property import mechanism now can display encrypted enum property values correctly after first start. (NEVISIDM-9587)
  • NEW: Property import mechanism now handles properties with same name, but different scope correctly. (NEVISIDM-9463)
  • NEW: Introduced new configuration property to control if UserRestService should return credential specific fields. Behaviour can be controlled with show.user.credentials.special.attributes.enabled. (NEVISIDM-9567)
  • FIXED: Added CERTIFICATE_VALUE to TIDMA_CERT_INFO_V table on PostgreSQL database schema. (NEVISIDM-9562)
  • CHANGED: CONTEXT column in TIDMA_CREDENTIAL table is extended to be able to handle up to 4000 characters. (NEVISIDM-9807)
  • CHANGED: Dropped TIDMA_ERROR table from the database schema and modified error raising. (NEVISIDM-9477)
  • CHANGED: STREET column in TIDMA_USER table is extended to be able to handle up to 120 characters. (NEVISIDM-9750)

nevisIDM 8.2411.1.13000734435 - 31.01.2025​

  • FIXED: User search by profile query refactored/corrected. (NEVISIDM-9904)
  • FIXED: Flush deletion to database when selfadmin service deletes a ticket. (NEVISIDM-9920)
  • FIXED: Evict Runtime User from authorization cache after profile, user, certificate and authorization creation/deletion/modification. (NEVISIDM-9925)
  • UPGRADED: LibreOffice libraries updated to 6.4.7. (NEVISIDM-9944)
  • UPGRADED: Hibernate updated to 6.2.3.Final. (NEVISIDM-9945)
  • FIXED: GUI error message corrected for ticket credential state change. (NEVISIDM-9634)
  • CHANGED: Lock the user before update login info for REST calls as well. (NEVISIDM-9953)
    • See new configuration property application.need.user.lock.during.update.login.info for more information.
  • NEW: Case insensitive operators introduced for SCIM. (NEVISIDM-9862)
    • IEQ: case insensitive equals (similar to EQ);
    • INE: case insensitive not equals (similar to NE);
    • ISW: case insensitive starts with (similar to SW);
    • IEW: case insensitive ends with (similar to EW);
    • ICO: case insensitive contains (similar to CO).
  • FIXED: Extended user search on enum property accelerated. (NEVISIDM-9791)
    • Rendered SQL optimized;
    • New composite index IIDMA_PROPVAL_ALD_ENT_PID introduced on table TIDMA_PROPERTY_VALUE.
  • CHANGED: Misleading (SHA1) removed from GUI field label as requested. (NEVISIDM-9550)
  • FIXED: We fixed the SCIM user create with profile properties related issue. (NEVISIDM-9919)
  • FIXED: The application display name is now displayed on Profile Overview correctly. (NEVISIDM-9948)
  • UPGRADED: Apache CXF upgraded to 4.0.6 and 3.5.10 to solve CVE-2025-23184. (NEVISIDM-9984)
  • FIXED: We improved the performance of the properties section on the user history screen. (NEVISIDM-9837)
  • FIXED: We fixed the issue with enum values on the user history screen. (NEVISIDM-9837)
  • CHANGED: We do not prefetch sub-units on adding new authorization via SOAP and SCIM User creation. (NEVISIDM-9988)

nevisIDM 8.2411.2.13988894628 - 26.03.2025​

  • FIXED: URLTicketRestService refactored and fixed. (NEVISIDM-10011)

    • The createURLTicket returns ticket tuple correctly;
    • The getURLTicket regenerates and saves the newly generated URL Ticket.

  • UPGRADED: Netty upgraded to 4.1.118.Final to fix CVE-2025-24970. (NEVISIDM-10018)

  • FIXED: Downgrade Json-Smart from 2.5.1 to 2.4.11 to solve CVE-2024-57699. (NEVISIDM-10017)

  • UPGRADED: Transitive dependency of OpenCSV, BeanUtils upgraded to 1.9.4. (NEVISIDM-10040)

  • UPGRADED: Apache Jetty upgraded to 12.0.16. (NEVISIDM-10070)

  • FIXED: A problem in the nevisFIDO component has been fixed with the dispatch target generic credential states. (NEVISFIDO-2315) Before the fix, nevisFIDO created the generic credentials with INITIAL state instead of ACTIVE. The version 8.2411.0 of nevisFIDO may have created some incorrect generic credentials that can only be fixed by database modification. The following SQL update command can be used to fix the problem in the IDM database:

    update tidma_credential c set state_id = 2 where credential_type_id = 9 and state_id = 1 and exists(select * from tidma_property_value p where c.credential_id = p.entity_id and p.property_id in (select property_id from tidma_property where name = 'fidouaf_app_id'));

nevisIDM 8.2505.3.10 - 21.05.2025​

  • NEW: Attributes soap.service and soap.operation are added to SOAP related OpenTelemetry traces. (NEVISIDM-9612)
    • These new attributes are related to jcanOptrace and help to identify the SOAP service and operation.
  • NEW: We extended core REST services with partial search support (see the REST API documentation for details). (NEVISIDM-9935)
  • NEW: We extended core REST services with ordering/sorting support based on creation date descending. (NEVISIDM-9936)
  • NEW: We extended core REST services with returning the total number of results (see the REST API documentation for details). (NEVISIDM-9937)
  • NEW: We extended core REST services with pagination (see the REST API documentation for details). (NEVISIDM-9940)
  • NEW: Ability added to delete credentials via SelfAdmin API. (NEVISIDM-9985)
  • NEW: We introduced the @Batchsize annotation to improve child record fetching. (NEVISIDM-10022)
  • CHANGED: We modified data loading for our Query Service. (NEVISIDM-10028)
    • The data loading is now done in batches of application.queryservice.dataloading.batchsize records;
    • Client and User entities are separated during data loading, thus when updating clientNames, filtering uses the old name until the next run of the queryservice index updating cron job. Client names displayed in the return DTO are updated instantly;
    • The application.queryservice.dataloading.batchsize property is set to 4000 by default;
    • Fixed the issue where application.queryservice.forcedreindex.enabled disregarded the false value.
  • UPGRADED: Spring Framework upgraded to 6.2.3 and SpringData to 3.4.1. (NEVISIDM-9895)
  • UPGRADED: Numerous third-party dependencies were upgraded as part of the Java 21 migration, including Antlr, AngusMail, AopallianceRepackaged, AssertjCore, AzureServicebus, ReactorNettyHttp, Aspectj, Beanutils, C3p0, Caffeine, CommonsCodec, CommonsConfiguration, CommonsIo, CommonsLang3, CommonsLogging, CommonsText, CommonsValidator, Csrfguard, Cxf, Dbcp2, Gson, Guava, Hamcrest, HateOas, JakartaMail, JakartaXmlBind, AvaJwt, JakartaJsp, JakartaServlet, JakartaValidation, JakartaWsRs, Jandex, JcanSaml, JcanSectoken, Jetty, Slf4j, Snakeyaml, Swagger, QpidJmsClient, XmlSec, Mapstruct, Poi, Jackson, Zxing, Artemis and Apache Jasper Jsp. (NEVISIDM-9927, NEVISIDM-9970, NEVISIDM-9971, NEVISIDM-9975, NEVISIDM-9976, NEVISIDM-9977, NEVISIDM-9983, NEVISIDM-10010)
  • FIX: Credential creation considers policy type as well as policy name. (NEVISIDM-9861)
  • FIX: Configuration parameter daysNoActivitySinceReactivation handling fixed in UpdateUserStateJob. (NEVISIDM-9995)
  • FIX: Field name fixed in user login info history query. (NEVISIDM-9997)
  • FIX: Improved profileless flag set on unit with profile error message. (NEVISIDM-10001)
  • FIX: Certificate duplication issue fixed. (NEVISIDM-10005)
  • FIX: Query service indexing improved with batch fetching to shorten transactions. (NEVISIDM-10028)
  • FIX: We improved performance of property retrieval for the client service's get users endpoint. (NEVISIDM-10079)
  • FIX: Concurrency problem fixed in authentication cache holder. (NEVISIDM-10096)
  • FIX: We are using the -Djava.locale.useOldISOCodes=true JVM flag by default because Locale identifiers changed in ISO639. It is overridable in JAVA_OPTS. (NEVISIDM-10107)
  • FIX: Authentication cache holder synchronization issue solved. (NEVISIDM-10129)
  • FIX: Duplicated display of security questions fixed when the user has multiple profiles. (NEVISIDM-9848)
  • REMOVED: We removed consent screens; we discontinued the use of Angular JS in nevisIDM. (NEVISIDM-10113)
  • NEW: New configuration file atomikos.properties introduced to override transactions.properties. (NEVISIDM-9565)
  • NEW: From now on the nevisIdm Auth states use the HTTP connection timeout setting correctly. (NEVISIDM-10091)
  • NEW: The phone number normalization can be disabled with the normalizePhoneNumber configuration parameter. (NEVISIDM-10094)
    • Affected auth states: IdmGetPropertiesState, IdmPasswordResetState and IdmSetPropertiesState.
  • UPDATED: Some minor improvements introduced for management interface stability. (NEVISIDM-10031)
    • Jetty upgraded from 12.0.9 to 12.0.16;
    • Management interface threads now can be configured (see server.management.max-threads configuration property);
    • Detailed logging messages added to health indicators.
  • NEW: We added support for MariaDB 11.4 and upgraded the MariaDB driver to 3.5.2. (NEVISIDM-9928)
  • NEW: We added support for PostgreSQL version 17 and upgraded the PostgreSQL driver to 42.6.1. (NEVISIDM-9929)
  • NEW: We added support for Oracle version 23AI. (NEVISIDM-9930)
    • Currently, the following Oracle DBMS versions are supported: 19c, 21c and 23ai.
    • The supported (and recommended) Oracle driver version upgraded to com.oracle.database.jdbc:ojdbc11:21.17.0.0.

nevisIDM 8.2505.4.1 - 10.06.2025​

  • FIX: The hardcoded/invalid profile identifier corrected in import-techuser-workaround.sh. (NEVISIDM-10148)
  • FIX: URL path manipulation corrected in unit tree search screen (in the getUnitTreeEndpoint function of unitsearch.js). (NEVISIDM-10162)
  • FIX: Missing library libaio added to the nevisidm-dbschema image as well. (NEVISIDM-10163)

nevisIDM 8.2505.5.4 - 08.08.2025​

  • CHANGED: In TIDMA_FIDO2 the USER_FRIENDLY_NAME column's max length decreased to 250 characters. (NEVISIDM-10229)
  • CHANGED: In TIDMA_FIDO2 the UPPER_USER_FRIENDLY_NAME generated column's max length increased to 250 characters. (NEVISIDM-10229)
  • FIX: URL rewrite for Unit Tree Search View corrected, so it only rewrites the end of the URL. (NEVISIDM-10162)
  • FIX: Audit log now contains correct oldValue and newValue when the credential state for VASCO, SAML_FEDERATION, FIDO_UAF is modified. (NEVISIDM-10199)
  • UPGRADED: We upgraded Cxf to 4.1.1. (NEVISIDM-10224)
  • CHANGED: QueryCredentials SOAP request now handles SAML_FEDERATION, OATH and MOBILE_SIGNATURE specific fields. (NEVISIDM-10196)
  • FIXED: IdmPruneHistoryJob now deletes history records for already deleted entities younger than days days. (NEVISIDM-10234)
  • NEW: Added application.usersearch.casesensitivity and related configuration properties to control case sensitivity of user search. (NEVISIDM-10196)
  • NEW: Added new endpoint to the System REST API, which displays the current timezoneId of the nevisIDM instance. (PAT-929)
  • IMPROVED: Improved performance of SCIM user search: it fetches only the necessary rows from the database. (NEVISIDM-10231)
  • NEW: Modified nevisidmdb tool to be able to conditionally use 7.31.1 and 7.31 on MariaDB, depending on whether 7.31 is already applied. (NEVISIDM-10229)
  • FIXED: Added fixed database schema migration 7.31.1 to solve issue where 7.31 failed on MariaDB if TIDMA_FIDO2.USER_FRIENDLY_NAME was longer than 50 characters. (NEVISIDM-10229)
  • FIXED: Added schema migration 7.35 to fix an index creation issue for QueryService on Oracle. (NEVISIDM-10232)

nevisIDM 8.2505.6.3 - 29.08.2025​

  • CHANGED: Added deleteMode parameter to IdmPruneHistoryJob. If set to HARD it deletes history of already deleted entities without considering the days parameter. (NEVISIDM-10299)
  • FIXED: Reactivated trigger on TIDMA_FIDO2 table after the 7.35 migration. (NEVISIDM-10296)
  • CHANGED: nevisidmdb-schema image now deploys starting data if it finds a nevisIDM database without a nevisidm application. (NEVISIDM-10276)
  • UPGRADED: Spring Framework upgraded to 6.2.10. (NEVISIDM-10272)
  • UPGRADED: Netty upgraded to 4.1.124.Final. (NEVISIDM-10274)
  • UPGRADED: CXF upgraded to 4.1.3. (NEVISIDM-10275)

nevisIDM 8.2505.7.1 - 25.09.2025​

  • NEW: Added Attestation Type property to FIDO_UAF credentials. (NEVISIDM-10334)
    • Note: not supported on SOAP.
  • UPGRADED: netty upgraded to 4.1.125.Final. (NEVISIDM-10329)
  • UPGRADED: angus-mail updated to 2.0.4. (NEVISIDM-10300)

nevisIDM 8.2505.8.0 - 30.10.2025​

  • IMPROVED: Added index on the foreign key column in the TIDMA_CONSENT table to prevent full table locks and reduce locking contention during parent table updates or deletes. (NEVISIDM-10373)
  • IMPROVED: Decreased SQL call count for generic credentials. (NEVISIDM-10398)
  • CHANGED: Reworked User locking for login info update. (NEVISIDM-10374)
    • Modified default value of application.need.user.lock.during.update.login.info to false;
    • IDM now puts a lock in the database for the user if no login info for the user exists;
    • IDM now puts a lock in the database for the user if no login info for the credential exists, or if the Client Policy parameter deactivateWeakCredentialsOnStrongLogin is true.
  • UPGRADED: netty upgraded to 4.1.128.Final. (NEVISIDM-10329)

nevisIDM 8.2511.0.4 - 26.11.2025​

  • UPGRADED: Flyway upgraded to 11.8.2. (NEVISIDM-9969)
  • UPGRADED: Quartz upgraded to 2.5.0. (NEVISIDM-9972)
  • UPGRADED: Hibernate and related artifacts upgraded. (NEVISIDM-9973)
    • Hibernate core upgraded to 7.0.6.Final;
    • Hibernate Commons Annotations upgraded to 7.0.3.Final;
    • Hibernate Validator upgraded to 9.0.0.Final;
    • Hibernate Search upgraded to 8.0.0.Final.
  • UPGRADED: JaxWs and related artifacts upgraded. (NEVISIDM-9990)
    • JaxWs core upgraded to 4.0.3;
    • CXF upgraded to 4.1.2;
    • JaxWs API upgraded to 4.0.3;
    • Jakarta XML Bind API upgraded to 4.0.0;
    • Glassfish Jaxb Runtime upgraded to 4.0.4.
  • NEW: New note introduced for IdmCreateUserState as error.message. (NEVISIDM-10083)
  • FIXED: Now deleted Units are only displayed once. (NEVISIDM-10133)
  • UPGRADED: Bean Utils upgraded to 1.11.0. (NEVISIDM-10158)
  • FIXED: Fixed issue where on the Profile Search page the include sub-units toggle was disregarded. (NEVISIDM-10164)
  • UPGRADED: We upgraded the postgresql driver to 42.7.7. (NEVISIDM-10172)
  • NEW: OpenApi descriptor introduced to REST services and DTOs. (NEVISIDM-10174)
  • IMPROVED: IdmCreateUserState now updates ch.adnovum.nevisidm.user.extId in session if loadUser=true. (NEVISIDM-10181)
  • CHANGED: Modified Database Connection Health Check: now connection is considered healthy if at least one connection is available, so it does not display false down messages if the maintenance interval and health check run at the same time. (NEVISIDM-10193)
  • FIXED: Language codes now conform to standard ISO639. (NEVISIDM-10201)
  • NEW: User Search now accepts an escape character for wildcards, configurable by application.database.escapeCharacter. (NEVISIDM-10213)
  • FIXED: UpdateUserStateJob now does not duplicate the last previous modification comment. (NEVISIDM-10223)
  • CHANGED: Four default values of DB connection related parameters changed. (NEVISIDM-10227)
    • database.connection.pool.size.min is now 10 by default;
    • database.connection.pool.size.max is now 50 by default;
    • database.connection.borrow.connection.timeout is now 3600 by default;
    • database.connection.xa.enabled is now false by default (since provisioning is also OFF by default).
  • FIX: Fixed maximum length validation of FIDO2 credentials for the REST API, and the User friendly name field in the Web GUI. (NEVISIDM-10255)
  • CHANGED: The Hibernate option hibernate.enable_lazy_load_no_trans is now false, which disallows temporary transactions and improves performance. (NEVISIDM-10256)
  • UPGRADED: CXF upgraded to 4.1.3. (NEVISIDM-10275)
  • UPGRADE: We upgraded Spring Framework to 6.2.10. (NEVISIDM-10273)
  • NEW: Added List all Applications endpoint to the Application REST Service. (NEVISIDM-10330)
  • NEW: Introduced configuration database.connection.read.only.maintenance.interval and database.connection.maintenance.interval to make the atomikos maintenance interval configurable. (NEVISIDM-10343)
  • NEW: Introduced a new configuration parameter to declare for which externally validated credential types the temporary and final locks are calculated by IDM: application.externally.validated.credentials.lock.calculation.type. (NEVISIDM-10370)
  • UPGRADE: We upgraded netty to 4.1.128.Final. (NEVISIDM-10387)
  • NEW: Added application.ignore.plain.value.at.password.generation configuration property with default value true. Configures whether the plain value for a password credential should be ignored or throw an exception if the resetCode policy is true. (NEVISIDM-10396)
  • FIX: Unified error handling of history requests when the requested entity does not exist. (NEVISIDM-10407)
  • FIX: Database level lock type corrected for the login Id generator to fix transactional problems on PostgreSQL. (NEVISIDM-10408)
  • FIX: Transactional demarcation problem fixed for the Client loader on startup. (NEVISIDM-10412)
  • NEW: PATCH operation added to our SCIM implementation. See the OpenAPI documentation for more details and sample requests. (NEVISIDM-8374)
  • CHANGED: The field state added to the GetUnit DTO in core REST services. (NEVISIDM-10236)
  • CHANGED: Modification of appID is now allowed for FIDO UAF credentials. (NEVISIDM-10252)
  • NEW: REST API support added for SAML credentials. (NEVISIDM-10263)
  • NEW: REST API support added for Ticket credentials. (NEVISIDM-10264)
  • NEW: REST API support added for Device password credentials. (NEVISIDM-10266)
  • NEW: REST API support is now complete for OATH credentials (the missing PATCH added). (NEVISIDM-10271)
  • NEW: Introduced alternative URL for the Device Password REST Service: https://<your_host>/{clientExtId}/users/{userExtId}/device-passwords. (NEVISIDM-10346)
  • FIX: Unified special attribute handling in credential REST services. (NEVISIDM-10371)
  • FIX: Generic credential creation moved into one transaction. (NEVISIDM-10381)
  • NEW: Bulk endpoints introduced to improve FIDO UAF performance. (NEVISIDM-10286)

nevisIDM 8.2607.0.4 - 22.07.2026​

  • NEW: Added dynamic email protocol handling, enabling SMTPS connections based on configuration settings. (NEVISIDM-10368)
  • NEW: New permission AccessControl.PropertyTypeChange introduced to authorize changing the property type. (NEVISIDM-10795)
  • NEW: We introduced a Client cache to improve performance. (NEVISIDM-10516)
  • NEW: We exposed configurations of possible redelivery attempts and the delay between the attempts for the Artemis messaging server. (NEVISIDM-10557)
    • See the introduced configuration parameters messaging.max.delivery.attempts and messaging.redelivery.delay in the Configuration Files section.
  • NEW: We added policyExtId to credential related audit logging events. (NEVISIDM-10505)
  • CHANGED: We removed the library com.sun.mail:jakarta.mail; we now primarily use org.eclipse.angus:angus-mail. (NEVISIDM-10548)
  • CHANGED: We allowed setting a null value in property patch REST endpoints. (NEVISIDM-10623)
  • CHANGED: Minimized usage of SQL literals in our queries (replaced them with bind parameters). (NEVISIDM-10744)
  • CHANGED: Added STRICT delete mode to the Prune History Job. (NEVISIDM-10409)
  • FIXED: We reduced logging of the DB health check. (NEVISIDM-10490)
  • FIXED: We adjusted the nevisidmdb input-validation regex to allow evaluating ASCII characters for passwords. (NEVISIDM-10471)
  • FIXED: Fixed an issue where creating the loginId for the first user of a new client could fail under concurrent load. (NEVISIDM-10448)
  • FIXED: We corrected the escape character handling. (NEVISIDM-10606)
    • From now on there is no need to double or quadruple the \ character.
    • The escaping now works without a combination of wildcard characters.
    • The % character is also available as an escape character.
  • FIXED: On an existing property definition, the encrypted value is no longer modifiable. (NEVISIDM-10765)
  • FIXED: Sent out URL Tickets now use application.urlticket.replacement.json values correctly. (NEVISIDM-10822)
    • Default of application.urlticket.replacement.json is now [{"original":"+", "replacementValue":"@"},{"original":"/", "replacementValue":"."}].
  • FIXED: We no longer log an exception when a non-FIDO UAF type credential is opened in the GUI. (NEVISIDM-10839)
  • FIXED: We added logging messages on PDF file creation events. (NEVISIDM-10506)
  • FIXED: We optimized property uniqueness checks. (NEVISIDM-10560)
  • FIXED: We fixed unhashed password handling in SCIM credential patch. (NEVISIDM-10619)
  • FIXED: We fixed transactional demarcation (lazy loading issue) for credential search. (NEVISIDM-10693)
  • FIXED: We fixed suboptimal SQL generation of the SOAP queryUser. (NEVISIDM-10739)
    • We removed the unnecessary entity joins; only the filter related ones remain.
  • UPGRADED: We made nevisIDM Java 25 compatible. (NEVISIDM-10442)
  • UPGRADED: We upgraded org.apache.activemq:artemis-* from 2.39.0 to 2.52.0. (NEVISIDM-10442)
  • UPGRADED: We upgraded com.mchange:c3p0 from 0.11.0 to 0.12.0. (NEVISIDM-10613)
  • UPGRADED: We upgraded com.fasterxml.jackson.core:jackson-* from 2.17.2 to 2.21.4. (NEVISIDM-10829)
  • UPGRADED: We upgraded com.auth0:java-jwt from 4.4.0 to 4.5.1. (NEVISIDM-10613)
  • UPGRADED: We upgraded org.eclipse.jetty:jetty-* from 12.0.16 to 12.0.34. (NEVISIDM-10741)
  • UPGRADED: We upgraded io.netty:netty-all from 4.1.125.Final to 4.1.135.Final. (NEVISIDM-10791)
  • UPGRADED: We upgraded org.springframework.data:spring-data-* from 3.1.4 to 3.5.12. (NEVISIDM-10829)
  • UPGRADED: We upgraded org.springframework:spring-* from 6.2.11 to 6.2.19. (NEVISIDM-10829)
  • NEW: We implemented a GUI for Dispatch Targets and App Attestation for FIDO UAF credentials, which replaces generic credentials. (NEVISIDM-10569)
  • NEW: CRUD operations for the Client REST service completed with Create, PATCH and Delete operations. (NEVISIDM-10457)
  • NEW: REST API support added for Property definitions. (NEVISIDM-10547)
  • NEW: We created a REST API for temporary strong password credentials. (NEVISIDM-10267)
  • NEW: We created a REST API for OTP credentials. (NEVISIDM-10265)
  • NEW: We created a REST API for mobile signature credentials. (NEVISIDM-10270)
  • NEW: We created a REST API for PUK credentials. (NEVISIDM-10269)
  • NEW: We enhanced the SCIM result attributes with credential type filtering. (NEVISIDM-10257)
    • E.g. urn:nevis:idm:scim:schemas:v1:extension:User.credentials[PASSWORD] allows only password credentials in the result.
  • NEW: We created a REST API for Vasco Digipass token credentials. (NEVISIDM-10268)
  • CHANGED: We removed the confusing version attribute from REST Get type DTOs. (NEVISIDM-10627)
  • FIXED: We corrected SCIM search attributes handling for special attributes of credentials. (NEVISIDM-10564)
  • NEW: We created a REST API for the template store. (NEVISIDM-10633)
  • NEW: We supplemented login REST services for missing kinds of credentials as well. (NEVISIDM-10518)
    • We added certificate, ticket, temporary strong password, URL ticket, PUK, OATH, security question and VASCO credential types.
  • NEW: We created a REST API for security question credentials. (NEVISIDM-10647)
  • FIX: Fixed an issue where creating a user with an empty template collection name failed to assign the default collection. (NEVISIDM-10459)
  • FIXED: We removed duplicated sequences from the PostgreSQL database schema. (NEVISIDM-10402)