Enhancements

These are new features for this release of PingDataSync Server:
  • The Administrative consoles are extensively used to view and modify the configuration of an existing instance. The console now can display the associated dsconfig command needed to create the current object being viewed.
  • In the previous release, the ability to single sign-on from the the PingOne administration console portal was implemented. Rounding out this functionality, the administrative console can now accept bearer tokens from other OpenID Connect applications or IdPs such as PingFederate.

Critical fixes

This release of the PingDataSync Server addresses critical issues from earlier versions. Update all affected servers appropriately.

  • Fixed an issue in which adding or modifying a server group would result in a 404.
    • DS-41436
    • Fixed in 8.3.0.0
    • Introduced in 7.0.1.4

  • Addressed an issue that could lead to slow, off-heap memory growth. This only occurred on servers whose cn=Version,cn=monitor entry was retrieved frequently.

    • Fixed in: 8.1.0.0
    • Introduced in: 5.2.0.0
    • Support identifiers: DS-41301

  • Fixed a memory leak when performing SCIM queries on the Directory Server.

    • Fixed in: 8.1.0.0
    • Introduced in: 7.2.0.0
    • Support identifiers: DS-41206 SF#00681395

  • Fixed an issue where mirrored subtree polling could produce config archive files that were identical or ignored the configured insignificant attributes list.

    • Fixed in: 8.1.0.0
    • Introduced in: 7.0.0.0
    • Support identifiers: DS-41762 SF#00675207 SF#00683777

  • The following enhancements were made to the topology manager to make it easier to diagnose connection errors:

    - Added monitoring information for all the failed outbound connections (including the time since it's been failing and the last error message seen when the failure occurred) from a server to one of its configured peers and the number of failed outbound connections.

    - Added alarms/alerts for when a server fails to connect to a peer server within a configured grace period.

    • Fixed in: 7.3.0.0
    • Introduced in: 7.0.0.0
    • Support identifiers: DS-38334 SF#00655578

  • The topology manager will now raise a mirrored-subtree-manager-connection-asymmetry alarm when a server is able to establish outbound connections to its peer servers, but those peer servers are unable to establish connections back to the server within the configured grace period. The alarm is cleared as soon as there is connection symmetry.

    • Fixed in: 7.3.0.0
    • Introduced in: 7.0.0.0
    • Support identifiers: DS-38344 SF#00655578

  • The dsreplication tool has been fixed to work when the node being used to enable replication is currently out-of-sync with the topology master.

    • Fixed in: 7.3.0.0
    • Introduced in: 7.0.0.0
    • Support identifiers: DS-38335 SF#00655578

  • Fixed two issues in which the server could have exposed some clear-text passwords in files on the server file system.

    * When creating an encrypted backup of the alarms, alerts, configuration, encryption settings, schema, tasks, or trust store backends, the password used to generate the encryption key (which may have been obtained from an encryption settings definition) could have been inadvertently written into the backup descriptor. This problem does not affect local DB backends (like userRoot), the LDAP changelog backend, or the replication database.

    * When running certain command-line tools with an argument instructing the tool to read a password from a file, the password contained in that file could have been written into the server's tool invocation log instead of the path to that file. Affected tools include backup, create-initial-config, create-initial-proxy-config, dsreplication, enter-lockdown-mode, export-ldif, import-ldif, ldappasswordmodify, leave-lockdown-mode, manage-tasks, manage-topology, migrate-ldap-schema, parallel-update, prepare-endpoint-server, prepare-external-server, realtime-sync, rebuild-index, re-encode-entries, reload-http-connection-handler-certificates, reload-index, remove-defunct-server, restore, rotate-log, and stop-server. Other tools are not affected. Also note that this only includes passwords contained in files that were provided as command-line arguments; passwords included in the tools.properties file, or in a file referenced from tools.properties, would not have been exposed.

    In each of these cases, the files would have been written with permissions that make their contents only accessible to the system account used to run the server. Further, while administrative passwords may have been exposed in the tool invocation log, neither the passwords for regular users, nor any other data from their entries, should have been affected. We have introduced new automated tests to help ensure that such incidents do not occur in the future.

    We recommend changing any administrative passwords you fear may have been compromised as a result of this issue. If you are concerned that the passphrase for an encryption settings definition may have been exposed, then we recommend creating a new encryption settings definition that is preferred for all subsequent encryption operations, exporting your data to LDIF, and re-importing so that it will be encrypted with the new key. You also may wish to re-encrypt or destroy any existing backups, LDIF exports, or other data encrypted with a compromised key, and you may wish to sanitize or destroy any existing tool invocation log files that may contain clear-text passwords.

    • Fixed in: 7.3.0.0
    • Introduced in: 7.0.0.0
    • Support identifiers: DS-38897 DS-38908

  • The following enhancements were made to the topology manager to make it easier to diagnose the connection errors:

    - Added monitoring information for all the failed outbound connections (including the time since it's been failing and the last error message seen when the failure occurred) from a server to one of its configured peers and the number of failed outbound connections.

    - Added alarms/alerts for when a server fails to connect to a peer server within a configured grace period.

    • Fixed in: 7.2.1.0
    • Introduced in: 7.0.0.0
    • Support identifiers: DS-38334 SF#00655578

  • The topology manager will now raise a mirrored-subtree-manager-connection-asymmetry alarm when a server is able to establish outbound connections to its peer servers, but those peer servers are unable to establish connections back to the server within the configured grace period. The alarm is cleared when connection symmetry is achieved.

    • Fixed in: 7.2.1.0
    • Introduced in: 7.0.0.0
    • Support identifiers: DS-38344 SF#00655578

  • The dsreplication tool has been fixed to work when the node being used to enable replication is currently out-of-sync with the topology master.

    • Fixed in: 7.2.1.0
    • Introduced in: 7.0.0.0
    • Support identifiers: DS-38335 SF#00655578

  • Fixed two issues in which the server could have exposed some clear-text passwords in files on the server file system.

    * When creating an encrypted backup of the alarms, alerts, configuration, encryption settings, schema, tasks, or trust store backends, the password used to generate the encryption key (which may have been obtained from an encryption settings definition) could have been inadvertently written into the backup descriptor. This problem does not affect local DB backends (like userRoot), the LDAP changelog backend, or the replication database.

    * When running certain command-line tools with an argument instructing the tool to read a password from a file, the password contained in that file could have been written into the server's tool invocation log instead of the path to that file. Affected tools include backup, create-initial-config, create-initial-proxy-config, dsreplication, enter-lockdown-mode, export-ldif, import-ldif, ldappasswordmodify, leave-lockdown-mode, manage-tasks, manage-topology, migrate-ldap-schema, parallel-update, prepare-endpoint-server, prepare-external-server, realtime-sync, rebuild-index, re-encode-entries, reload-http-connection-handler-certificates, reload-index, remove-defunct-server, restore, rotate-log, and stop-server. Other tools are not affected. Also note that this only includes passwords contained in files that were provided as command-line arguments; passwords included in the tools.properties file, or in a file referenced from tools.properties, would not have been exposed.

    In each of these cases, the files would have been written with permissions that make their contents only accessible to the system account used to run the server. Further, while administrative passwords may have been exposed in the tool invocation log, neither the passwords for regular users, nor any other data from their entries, should have been affected. We have introduced new automated tests to help ensure that such incidents do not occur in the future.

    We recommend changing any administrative passwords you fear may have been compromised as a result of this issue. If you are concerned that the passphrase for an encryption settings definition may have been exposed, then we recommend creating a new encryption settings definition that is preferred for all subsequent encryption operations, exporting your data to LDIF, and re-importing so that it will be encrypted with the new key. You also may wish to re-encrypt or destroy any existing backups, LDIF exports, or other data encrypted with a compromised key, and you may wish to sanitize or destroy any existing tool invocation log files that may contain clear-text passwords.

    • Fixed in: 7.0.1.3
    • Introduced in: 7.0.0.0
    • Support identifiers: DS-38897 DS-38908

  • Fixed an issue with the sync connect and response timeouts being set with incorrect units of time.

    • Fixed in: 6.2.0.0
    • Introduced in: 6.0.0.0
    • Support identifiers: DS-18026 SF#00616763

  • Fixed an issue with the sync connect and response timeouts being set with incorrect units of time.

    • Fixed in: 6.2.0.0
    • Introduced in: 6.0.0.0
    • Support identifiers: DS-18026 SF#00616763

  • The server can now detect an "out of file handles" situation on the operating system, and shut down to prevent running in an unreliable state.

    • Fixed in: 5.1.0.0
    • Introduced in: 2.1.0.0
    • Support identifiers: DS-12579 SF#2655

  • Disabled support for SSLv3 by default in the LDAP, HTTP, and JMX connection handlers, and for replication communication. The recently-discovered POODLE vulnerability could potentially allow a network attacker to determine the plaintext behind an SSLv3-encrypted session, which would effectively negate the primary benefit of the encryption.

    SSLv3 was initially defined in 1996, but was supplanted by the release of the TLSv1 definition in 1999 (and subsequently by TLSv1.1 in 2006 and TLSv1.2 in 2008). These newer TLS protocols are not susceptible to the POODLE vulnerability, and the server has supported them (and preferred them over SSLv3) for many years. The act of disabling SSLv3 by default should not have any adverse effect on clients that support any of the newer TLS protocols. However, if there are any legacy client applications that attempt to communicate securely but do not support the newer TLS protocols, they should be updated to support the newer protocols. In the event that there are known clients that do not support any security protocol newer than SSLv3 and that cannot be immediately updated to support a newer protocol, SSLv3 support can be re-enabled using the newly-introduced allowed-insecure-tls-protocol global configuration property. However, since communication using SSLv3 can no longer be considered secure, it is strongly recommended that every effort be made to update all known clients still using SSLv3.

    It is possible to use the server access log to identify LDAP clients that use SSLv3 to communicate with the server. Whenever an LDAP client establishes a secure connection to the server, or whenever a client uses the StartTLS extended operation to secure an existing plaintext connection, the server will generate a SECURITY-NEGOTIATION access log message. The "protocol" element of a SECURITY-NEGOTIATION access log message specifies the name of the security protocol that has been negotiated between the client and the server, and any SECURITY-NEGOTIATION messages with a protocol of "SSLv3" suggest that the associated client is vulnerable to the POODLE attack. In addition, if any connections are terminated for attempting to use the disallowed SSLv3 protocol, the access log message for that disconnect should include a message stating the reason for the termination.

    • Fixed in: 5.0.0.0
    • Introduced in: 2.1.0.0
    • Support identifiers: DS-11782

  • Change the default behavior of the Synchronization Server to not lock entries across all Sync Pipes when processing changes.

    The Sync Server has a specialized mutex that ensures that changes to the same entry are processed serially. The primary reason for this mutex is to ensure that the server can safely process changes in parallel to achieve high throughput. However, we also use this mutex to ensure that two Sync Pipes don't process the same entry at the same time for deployments that synchronize changes bi-directionally. A consequence of this locking is that if one Sync Pipe is failing (because the destination is unavailable) then it retains the lock on an entry, and when other Sync Pipes try to process changes to that entry they will block that change and all changes that follow it while they wait on the lock.

    This change turns off using a shared mutex by default, but adds a new advanced configuration option on the Sync Pipe, shared-mutex-name, that specifies the name of a mutex that is shared by other Sync Pipes. This gives greater control over the locking so that two Sync Pipes that share end points can ensure that two changes to the same logical user are not processed concurrently, while not impacting other Sync Pipes.

    See the shared-mutex-name property for more information.

    This property is subject to change in a future release.

    • Fixed in: 3.2.0.0
    • Introduced in: 3.0.0.0
    • Support identifiers: DS-4202 SF#1527

Known issues and limitations

  • The option to download collect-support-data or to generate a server profile using the admin console will not work when logged in with single sign-on.

Resolved issues

The following issues have been resolved with this release of the Data Sync Server:

Ticket ID Description
DS-8

The Administrative Console now shows a dsconfig command to create the current object from scratch on the edit page.

DS-15746

Added a passphrase provider mechanism, which can be used to obtain clear-text passphrases, API keys, or other types of secrets that are needed by server components like those that interact with external servers or certificate key stores. Available passphrase provider implementations include:

* A provider that stores an obscured representation of the passphrase directly in the server configuration.

* A provider that reads the passphrase from a file on the server filesystem. The file may optionally be encrypted with a key from the server's encryption settings database.

* A provider that can obtain the passphrase from an environment variable set in the server's process.

* A provider that can obtain the passphrase from a HashiCorp Vault instance.

Components of the server that have been updated to support using passphrase providers include:

* LDAP, JDBC, SCIM, and SMTP external servers. * File-based key and trust manager providers. * The PKCS #11 key manager provider. * The changelog password encryption plugin. * The Twilio alert handler and OTP delivery mechanism. * The UNBOUNDID-YUBIKEY-OTP SASL mechanism handler.

The Server SDK has been updated to provide support for creating custom passphrase provider implementations and to allow extensions to retrieve secrets from passphrase providers configured in the server.

DS-39157,DS-39158,DS-43848

The Server SDK ServerContext class has been updated to provide a new set of methods for writing messages to the server's trace log publishers using various log severity levels. These methods replace an existing API that only supported recording debug messages, which should not be enabled in production environments.

Administrators can configure the server's trace log publishers to enable or disable message types on a per-severity basis using a trace log publisher's extension-message-type property.

DS-41815

Fixed an issue with the copy/paste functionality in the Administrative Console.

DS-41911

In order to reduce the time it takes for "setup" to run the testing of Java options that "setup" does will now be cached and stored in a directory. By default the directory is "logs/option-cache" relative to the server root, but an alternative directory can be specified via setup option "--optionCacheDirectory". If a directory is specified it must be created prior to running setup.

DS-41951, DS-41326

The Administrative Console can now download either a collect-support-data file or a server profile from the managed server. This can be done through the Status page. These operations require that a 'csd-files/' and a 'profile-files/' directory be present in the server root by default, but this can be customized through the ldap.csd-destination-folder and ldap.profile-destination-folder settings, which can be found in the Console's application.yml configuration file.

Downloading collect-support-data files is disabled by default when using the PingDataConsole Docker image. It also strongly recommended to avoid downloading collect-support-data files from servers that are running in a container.
DS-42401,DS-43754

Updated the manage-profile replace-profile subcommand to detect changes to files referenced in setup-arguments.txt when those files are outside of the server profile

DS-42937

The Administrative Console now allows users to specify the LDAP server they wish to bind to using the query parameters 'ldap-hostname' and 'ldaps-port' when the console is configured for SSO. This allows a single console instance to administer multiple PingData servers. Note that an LDAPS scheme is always assumed because an encrypted connection is always required for SSO.

DS-43224

Made a generic OpenID Connect ID token validator available. This change allows single sign-on to the Administrative Console with OIDC providers other than just PingOne.

DS-43435

Fix a bug that prevented offline changes to mirrored configuration with manage-profile replace-profile.

DS-43441

Fixed "Reverse DNS resolution" warning during setup. This warning was a result of performing a reverse DNS lookup on link local addresses, which is now avoided. This is mostly only relevant to IPv6.

DS-43627

Fixed an issue that could prevent Sync loggers from being properly closed during the server shutdown process.

DS-43632

Fixed an issue where the "format" field is omitted from the list of operational attribute schemas in the Directory REST API.

DS-43719

Added the capability to filter JSON field values in constructed values. Including a JSON object filter in parentheses after a JSON field name will indicate that for each attribute value, the named field value will only be extracted if the attribute value matches the provided filter. This allows, for example, when used in a Constructed Attribute Mapping's value-pattern property, for a given field value to only be mapped for values that match a given filter. For information about the syntax and use of this capability, see the config reference guide for Constructed Attribute Mappings.

DS-43817

Fixed an issue where Directory Server sometimes reports erroneous warnings about duplicate jar files.

DS-43890

Fixed an issue with dsjavaproperties --initialize that prevented changing the JVM tuning parameter using the --jvmTuningParameter command line argument.

DS-43916

Added cipher stream provider and passphrase provider implementations with support for the Amazon AWS Secrets Manager service. The Amazon Secrets Manager cipher stream provider can be used to protect the contents of the encryption settings with a key derived from a secret retrieved from the Secrets Manager service. The Amazon Secrets Manager passphrase provider can be used to obtain clear-text secrets needed for processing within the server from the Secrets Manager service.

DS-43935

Updated manage-profile replace-profile to run a shorter process when applying dsconfig changes that require administrative actions.

DS-43941

You can now specify that the Administrative Console use a custom truststore when evaluating OIDC provider certificates by using the oidc-trust-store-file and oidc-trust-store-type settings. Also, you can set the console to skip hostname and/or certification verification through the oidc-strict-hostname-verification and oidc-trust-all configuration settings.

DS-43950

Fixed an issue where Directory Server failed to install on JDKs that lack support for AES-256 encryption.

DS-44010

Updated the server to allow obtaining client secrets from a passphrase provider as an alternative to storing an obscured representation of the secret directly in the configuration. Updated components include:

* The OpenID Connect client secret needed for single sign-on to the admin console

* The OAuth client secret needed to connect to the PingOne service

* The client secret needed in conjunction with the PingFederate access token validator

DS-44025

Addressed an issue where the server was incorrectly displaying an "Unknown vendor" warning when using JDKs obtained on Red Hat and Ubuntu systems.

DS-44054,DS-44091,DS-44100,DS-44104,DS-44135,DS-44239

Added a FIPS 140-2-compliant mode to the server. This mode may be enabled by running setup with the --fips argument, or by including the --fips argument in the setup-arguments.txt file when using manage-profile setup.

Servers running in FIPS 140-2-compliant mode are not compatible with those running in non-compliant mode. FIPS 140-2-compliant mode cannot be enabled after setup (including when upgrading an existing instance, whether using update or manage-profile replace-profile). It can only be enabled when the instance is initially configured. Further, servers running in FIPS 140-2-compliant mode cannot replicate with or participate in the same topology as servers not running in FIPS-compliant mode. If you wish to migrate an existing deployment to use FIPS 140-2-compliant mode, you must install create a new topology of servers running in FIPS-compliant mode and migrate the data into it.

In addition, servers running in FIPS 140-2-compliant mode will not be allowed to use the Argon2, bcrypt, or scrypt password storage schemes, as they rely on non-FIPS-approved algorithms. The PBKDF2 password storage scheme is approved and may be used in FIPS-compliant mode, but it requires passwords to have a minimum length of 14 bytes.

Setup has also been updated to make it possible to initialize the certificate key and trust stores with certificate data read from PEM files. These options are available in both FIPS 140-2-compliant and non-FIPS-compliant modes, and can help make it easier to set up the server with existing certificates that are not available in a key or trust store that setup supports.

DS-44057

Improved the behavior that the server exhibits for attempts to configure it with an invalid set of TLS cipher suites.

Previously, if a connection handler was configured with an explicit set of TLS cipher suites, and if none of those cipher suites was supported by the underlying JVM, the server would log a message for each unsupported suite and would fall back to using a default set of suites. This could lead to cases in which the server ran with a different set of cipher suites than expected, and the warning log messages might be overlooked.

The server will now reject an attempted configuration change that would leave it without any valid cipher suites. For the sake of preserving backward compatibility, and helping to avoid issues around upgrading the server or JVM version, it will still allow attempts to configure the set of cipher suites using one or more invalid suite names as long as the server would still be able to offer at least one valid suite, and it will still log a warning message about each invalid cipher suite referenced in the configuration.

DS-44061

Fixed a NullPointerException that could occur when using manage-profile replace-profile with a server profile that configured a StatsD monitoring endpoint.

DS-44106

Updated the StatsD Monitoring Endpoint to support sending custom tags with each metric message. Custom tags will be appended at the end of each StatsD message as comma-separated key-value pairs.

DS-44120

Fixed an issue in which Sync Failed Ops log publishers could not be deleted.

DS-44122

Fixed an issue that caused cipher stream provider configuration options to be hidden.

DS-44187

Included the Bouncy Castle library with the server, which is needed to support certain cryptographic functionality, like the Argon2, bcrypt, and scrypt password storage schemes. It was not previously not included with the server over concerns around compliance with U.S. export control regulations around strong encryption, but those concerns have been alleviated. You no longer need to obtain the library for yourself if you wish to use any of the functionality that requires it, and the Argon2, bcrypt, and scrypt password storage schemes are now enabled by default in the out-of-the-box configuration.

DS-44192

Updated the default set of TLS protocols and cipher suites that the server will support. As TLSv1 and TLSv1.1 are no longer considered secure (see RFC 8996 for additional information), the server will only support TLSv1.2 and TLSv1.3 (if supported by the JVM) by default. The server will also no longer enable support for TLS cipher suites that use the SHA-1 digest algorithm (which is also no longer considered secure and is not needed for TLSv1.2 or TLSv1.3) or that use the RSA key exchange algorithm (which does not support forward secrecy).

If you need to enable support for legacy TLS protocols or cipher suites, you may do so through the server configuration. This can be enabled on a per-connection-handler basis using the ssl-protocol and ssl-cipher-suite configuration properties. Alternatively, you may use the ssl-protocol and ssl-cipher-suite properties in the crypto manager configuration to set default values that will be used by connection handlers that do not explicitly specify values for those properties.

DS-44316

Reduced the JVM memory requirements for many command line tools. This avoids memory pressure when multiple tools, such as a scheduled collect-support-data task, are run concurrently to the server process. For most tools, the initial heap size has been reduced to 128 MB, and for certain tools the maximum heap size has capped at 512 MB. On systems with larger amounts of memory, these tools previously were allotted unnecessarily large heaps. The maximum heap size has not been reduced for any tool that especially benefits from having more memory.

DS-44390

Fixed an issue where logs from setting up a new server could be lost when running the manage-profile replace-profile subcommand.

DS-44410

When deployed to a web application server such as Apache Tomcat, the Administrative Console will now write log messages to the application server's console output by default.

DS-44436

Addressed an issue in which attempting to add a member that already existed in a non-default server group would cause an error. Adds of duplicate members are now ignored and no errors are thrown.

DS-44531

Updated the manage-profile replace-profile command to avoid printing warnings for offline config changes from the new server profile.