PingDataSync Server 6.2.0.0 Release Notes - PingDataSync - PingDirectory - 8.0

Updated the installer to discourage the use of weak root passwords.

When run in interactive mode, setup displays the following list of quality recommendations before prompting for the initial root password:

• Make the password at least 12 characters in length.
• Verify that the password is not contained in the following dictionary types:
  • English words
  • Commonly used passwords

If the proposed password does not meet these constraints, the user is given the option of proceeding with the provided weak password or choosing a different password.

When run in non-interactive mode, setup exits with an error if the proposed initial root password does not satisfy these constraints, unless the command line also includes the --allowWeakRootUserPassword argument.

In either mode, when a strong initial root password is supplied, setup configures a root user's password policy to ensure that subsequent root user passwords are also required to satisfy these constraints.

Updated the Server SDK to provide methods for obtaining a single LDAP connection or an LDAP connection pool with connections established to a specified LDAP external server defined in the server configuration.

Also updated the server configuration to add support for obscured values. An obscured value is a general-purpose string that is stored in an obscured form in the configuration so that its plaintext value is not readily discernible to anyone viewing the configuration file. Consequently, the value is not displayed in administrative interfaces.

The Server SDK provides a method for obtaining the plaintext representation of an obscured value. This mechanism can be used to store potentially sensitive values in the configuration for use in Server SDK extensions without the need to store those values in the clear.

Replaced the ldapsearch and ldapmodify tools with new, backward-compatible versions that offer many new features, including the following examples:

• Improved connection handling
• Improved output formatting
• Improved support for bulk operations
• Support for referrals
• Support for additional request and response controls
• Rate limiting

The ldapsearch tool also offers the following abilities:

• Output results in the following formats as an alternative to LDIF:
  • JSON
  • CSV
  • Tab-delimited text
• Supports multiple data transformations

Additionally, the ldapmodify tool now supports the LDIF control syntax, as well as writing to output and reject files.

Updated the logic that selects which TLS cipher suites to enable by default, and the logic that prioritizes the cipher suites. Also updated the selection process to use the guidelines that the OWASP "Transport Layer Protection Cheat Sheet" document provides.

The following changes are included:

• The server already preferred cipher suites that support forward secrecy over suites that do not. It now prefers DHE over ECDHE, and avoids suites that use non-RSA keys.
• The server already avoided cipher suites that used known-weak cryptographic weaknesses, including null encryption, the RC4 symmetric cipher, and the MD5 digest algorithm. It now also avoids anonymous encryption, the single-DES symmetric cipher, the IDEA symmetric cipher, and any suite using export-level encryption.
• The server now prefers cipher suites that use the Galois/Counter Mode (GCM) over the Cipher Block Chaining (CBC) mode.
• The server now prefers AES-based cipher suites with 256-bit keys over those that use 128-bit keys. For suites with equivalent key sizes, it prefers suites with a stronger message digest algorithm over suites with a weaker digest algorithm (for example, SHA384 over SHA256 over SHA).
• The server now provides improved support for selecting and prioritizing ciphers when running on the IBM JVM. The IBM JVM uses a different naming convention for its cipher suites than does the Oracle implementation, which previously allowed certain desirable suites to be excluded from the selected set.

Updated the server to reduce the use of the SHA-1 message digest. The server now uses a 256-bit SHA-2 digest instead of a SHA-1 digest in all of the following cases:

• Hashing or signing a backup
• Signing an LDIF export
• Signing log data
• Generating MACs for an encrypted collect-support-data archive
• Generating unique identifiers for encryption settings definitions
• Determining whether the configuration changed with the server offline

In all of these cases, the server includes metadata in the output of the cryptographic processing to indicate the digest or MAC algorithm used for that processing, which ensures that the output remains compatible across server versions. For example, an LDIF export that uses a signature generated with the SHA-2 digest can be successfully imported into earlier versions of the server.

The fingerprint certificate mapper has also been updated to use the 256-bit SHA-2 digest when mapping a client certificate to the corresponding user entry. The previous MD5 and SHA-1 digests remain supported.

Additionally, the example enhanced password-storage scheme that the UnboundID Server SDK provides has been updated to use the 256-bit SHA-2 digest instead of a SHA-1 digest.

Constructed attribute mappings now support modifiers that alter the value of referenced source attributes when added to the end of source attribute references. For example, if the attribute mail is to be included in a constructed JSON value, the modifier jsonEscape can be specified, resulting in {{"userMail":{mail:jsonEscape} }} or, if a regular expression is used, {{"userMail":{mail:/regex/replacement/flags:jsonEscape} }}.

The following modifiers are available:

• jsonEscape — Escapes text for use in a JSON value.
• ldapFilterEscape — Escapes text for use in an LDAP filter.
• lowerCase — Converts text to lowercase.
• trim — Removes leading and trailing whitespace.
• upperCase — Converts text to uppercase.

A license key is required when setting up a server for the first time.