.. SPDX-FileCopyrightText: 2022-2026 Univention GmbH .. .. SPDX-License-Identifier: AGPL-3.0-only .. _app-changelog: ********* Changelog ********* This changelog documents all notable changes to the |ICS| app. `Keep a Changelog `_ is the format and this project adheres to `Semantic Versioning `_. v2.25.0 ======= Released: 16. October 2026 Changed ------- * The app version now follows the version of the |ICS| container image and Helm chart. The version after 1.12 is 2.25.0. You can upgrade from 1.12 as usual. * |ICS| now gets the *Matrix* token for a user from the *Matrix* OpenID ``request_token`` endpoint and no longer uses the deprecated ``m.login.application_service`` login. It forwards the token to the Meetings bot, so that the meeting creation in the *OX App Suite* calendar works with the *Matrix* Authentication Service. * |ICS| answers unauthenticated requests to its API routes with ``401`` instead of a redirect to the identity provider. Only ``/silent`` and ``/login`` start a login. * |ICS| logs to the console only and no longer writes the file ``intercom-service.log`` in the container, which grew without limit. Security -------- * The back-channel logout now checks the audience and the ``jti``, ``events`` and ``nonce`` claims of the logout token. Before, any token that the realm signed in the last 10 seconds ended the session of the user, for example an ID token for another client in the same single sign-on session. * |ICS| no longer logs the request data of failed requests to *Matrix* and *Keycloak*. On the debug log level, the log contained the application service secret, the client secret and the token of the user. * |ICS| runs in production mode. Error responses no longer contain stack traces, the ``X-Powered-By`` header is gone, and |ICS| sets the ``X-Content-Type-Options`` and ``Referrer-Policy`` headers. * |CORS| no longer exposes the ``Authorization`` header to other origins. * Update the base image and dependencies to fix CVEs. Fix --- * An invalid back-channel logout request no longer terminates |ICS|. It answers missing, invalid or expired logout tokens with ``400``. * Requests to ``/nob`` no longer terminate |ICS| when the session has no *Matrix* token, for example a session from before the upgrade. * The renewal of the *Matrix* token takes the *Matrix* user ID from the ID token, the same as the login. Before, the renewal failed if the claim was only in the ID token, and |ICS| forwarded the request with the old token. Requests to ``/nob`` without a *Matrix* token now get ``502``. * |ICS| tries the silent login again after a failed attempt. Before, one failed attempt turned off the silent login for the rest of the browser session. * A *Redis* password with the characters ``@``, ``:``, ``/``, ``#`` or ``%`` no longer makes |ICS| crash at startup. * The mapping of the session state for the back-channel logout now expires in *Redis*. Before, the keys of all sessions that didn't end with a back-channel logout stayed in *Redis* forever. * |ICS| forwards URL-encoded request bodies to the backends. Before, the backends got no body and waited until they timed out. v1.12 ===== Released: 17. July 2026 Add --- * *UCR* variables to enable support for Keycloak Token Exchange v2. * :envvar:`intercom-service/settings/token-exchange-v2` to enable support for Keycloak Token Exchange v2 in the Intercom service Changed ------- * The app's container image is now pulled from ``artifacts.software-univention.de`` instead of ``docker.software-univention.de``. Operators who restrict outbound traffic with a firewall or proxy must, before upgrading, allow both ``artifacts.software-univention.de`` and ``s3.de-west-1.psmanaged.com``: the registry answers image blob downloads with an HTTP 307 redirect to the latter (its S3 backing storage), so pulls fail if only the registry host is reachable. See `Allowing artifacts.software-univention.de in firewalls and proxies `__ for guidance. v1.11 ===== Released: 20. March 2026 Security -------- * Update dependencies to fix critical and high CVEs. Fix --- * Enforce lowercase usernames for *Matrix* login as per `Matrix specification `_. v1.10 ===== Released: 9. December 2025 Add --- * *UCR* variables to allow configuration of session cookies. * :envvar:`intercom-service/settings/enable-session-cookie` to enable session cookie (transient cookie). * :envvar:`intercom-service/settings/session-rolling-duration` in seconds. The duration for which the session will be reset if the user is active within this time. Security -------- * Critical CVE :uv:cve:`2025-49844` in :program:`redis-server`. v1.9 ==== Released: 28. January 2025 Add --- * Access Tokens are now attempted to be fetched from an integration if the integration is enabled but a current session does not have a token for the service. This allows for *XWiki* and *Matrix* integrations to become healthy in a user session once a user has used those services once, thus the account exists in the respective service. * The *Redis* connection now supports TLS. Also, mTLS authentication can be configured. * *UCR* variables to configure SSL connection to *Redis*. * :envvar:`intercom-service/redis/ssl` to activate or deactivate the SSL connection to the *Redis* server. * :envvar:`intercom-service/redis/mtls` to activate or deactivate the mTLS authentication to the *Redis* server. * :envvar:`intercom-service/redis/certificates/mtls/cert` to specify the path to certificate used during mTLS. * :envvar:`intercom-service/redis/certificates/mtls/key` to specify the path to certificate secret key used during mTLS. Change ------ * Better log formatting in JSON for proxied routes. Fix --- * Missing imports in the *XWiki* proxy caused the service to crash under certain circumstances. * Wrong logger configuration caused some log messages to not be correctly formatted. v1.8 ==== Released: 15. December 2024 Add --- * Endpoint to securely proxy requests from *Univention-Portal* to *XWiki* on ``/wiki``, allowing to load *RSS* feeds from *XWiki*. * *UCR* variables to configure *XWiki*. * :envvar:`intercom-service/xwiki/enabled` to activate or deactivate *XWiki* integration. * :envvar:`intercom-service/xwiki/url` to set the URL of the *XWiki* instance. * :envvar:`intercom-service/xwiki/audience` to configure the |OIDC| client. * *UCR* variable :envvar:`intercom-service/settings/username-claim` to configure the claim in the identity token that contains the username. * *UCR* variable :envvar:`intercom-service/nextcloud/enabled` and :envvar:`intercom-service/matrix/enabled` to activate or deactivate the respective services. Change ------ * Load all the configuration during initialization to improve asynchronous performance. * Updated base image to *UCS 5.2-0* December 2024 build. Fix --- * *Univention-Portal* navigation crashed the application if the :envvar:`intercom-service/settings/username-claim` Keycloak mapping was missing in the access token. v1.7 ==== Released: 15. November 2024 Add --- * *UCR* variable :envvar:`intercom-service/settings/user-unique-mapper` to configure the unique user claim name for the *Keycloak* OIDC client. Change ------ * Order of middlewares for *Nextcloud* proxying caused authentication prompts in some cases. v1.6 ==== Released: 22. April 2024 Add --- * Reconnect to *Redis* after the service was down. * *UCR* variables to allow users to configure an external *Redis* server. * :envvar:`intercom-service/redis/host` to set the hostname of the *Redis* server. * :envvar:`intercom-service/redis/port` to set the port of the *Redis* server. * :envvar:`intercom-service/redis/user` to set the password of the *Redis* server. Change ------ * Image is now based on *UCS* base image. Fix --- * AppCenter settings are now correctly applied during after installation. v1.5 ==== Released: 20. June 2023 Add --- * *UCR* variables to set the path to external self-signed certificates. Security -------- * Updated dependencies. v1.4 ==== Released: 13. December 2022 Change ------ * Refresh *Nextcloud* token when expired before proxying the request. * Improved logging messages with JSON formatting. Add --- * *UCR* variable to set the log level. * Logging to files and standard output. Security -------- * Intercom service requests *Nextcloud* tokens with the *Nextcloud* audience, instead of the audience of *OX App Suite*. v1.3 ==== Released: 28. October 2022 Change ------ * Treat expired refresh tokens as no token, triggering a silent login attempt. * Matrix login type set to `m.login.application_service` and is not configurable any more. * Switch to `v3` Matrix client API. v1.2 ==== Released: 29. September 2022 Add --- * Various debug logs Change ------ * Apply firewall rules during installation to make |ICS| accessible from outside of |UCS|. * Set Docker DNS based on the *UCR* variables `nameserver1`, `nameserver2` and `nameserver3`. Security -------- * The *Filepicker* functionality of |ICS| now fetches a separate token for authenticating with the file hosting application *Nextcloud*. The *OX* OIDC-client in the IdP must be allowed, to fetch a token for the *Nextcloud* OIDC-client. This was always intended, but not correctly enforced in earlier versions. Fix --- * Update deprecated usage of `express.urlencoded`. * |ICS| health check failed because of *Nordeck* URL returning `404`. * Video conferences created as the wrong user. * Central navigation returning `navigation.json` for the wrong user under certain circumstances. v1.1 ==== Released: 16. September 2022 Add --- Stability * |ICS| split the cookie headers by a logic that didn't consider certain cases. Now, |ICS| uses a standard cookie library for the handling cookie headers. * During app installation, |ICS| tests the URLs of the required services :program:`Keycloak`, *Nextcloud*, *Nordeck*, and *UCS Portal*, if it can reach them. The installation shows a warning, if the test can't reach the services. Additionally, |ICS| runs a health check within the Docker container every 60 seconds to test, if it can reach the services. Refreshing Access Tokens A middleware that automatically refreshes access tokens when they expire. Change ------ * Improve the readability of user documentation. Security -------- * The *Redis* database provides persistence for app sessions. The update applies the following security fixes to *Redis*: * Password protection provided in :file:`/etc/intercom-redis.secret`. * The Redis container is only accessible from the :command:`docker-compose` internal network (``external: false``). * Verify the JWT (JSON Web Token) access or ID token with the public key of the *Keycloak* issuer. * Enable ``backchannel-logout`` and remove the appropriated app-session from |ICS|. Fix --- * Convert the uppercase value for the environment variable :envvar:`PROXY` to lowercase. Using the variable in JavaScript requires the value in a lowercase string. v1.0 ==== Released: 22. August 2022 Add --- * Endpoint for OIDC silent login against :program:`Keycloak` on ``/silent``. * Endpoint to securely proxy requests from *Open-Xchange* to *Nordeck* on ``/nob``, allowing the creation of Element videoconferences from *Open-Xchange*. * Endpoint to securely proxy requests from *Open-Xchange* to *Nextcloud* on ``/fs``, allowing to use the email *Filepicker* with *Nextcloud*. * Endpoint to securely proxy requests from *Open-Xchange* to *UCS Portal* ``/navigation.json``, allowing for use of *UCS Portal* central navigation from *Open-Xchange*. * Session storage with *Redis*.