Changelog

6. Changelog#

This changelog documents all notable changes to the ICS app. Keep a Changelog is the format and this project adheres to Semantic Versioning.

6.1. v2.25.0#

Released: 16. October 2026

6.1.1. Changed#

  • The app version now follows the version of the ICS container image and Helm chart. The version after 1.12 is 2.25.0. You can upgrade from 1.12 as usual.

  • ICS now gets the Matrix token for a user from the Matrix OpenID request_token endpoint and no longer uses the deprecated m.login.application_service login. It forwards the token to the Meetings bot, so that the meeting creation in the OX App Suite calendar works with the Matrix Authentication Service.

  • ICS answers unauthenticated requests to its API routes with 401 instead of a redirect to the identity provider. Only /silent and /login start a login.

  • ICS logs to the console only and no longer writes the file intercom-service.log in the container, which grew without limit.

6.1.2. Security#

  • The back-channel logout now checks the audience and the jti, events and nonce claims of the logout token. Before, any token that the realm signed in the last 10 seconds ended the session of the user, for example an ID token for another client in the same single sign-on session.

  • ICS no longer logs the request data of failed requests to Matrix and Keycloak. On the debug log level, the log contained the application service secret, the client secret and the token of the user.

  • ICS runs in production mode. Error responses no longer contain stack traces, the X-Powered-By header is gone, and ICS sets the X-Content-Type-Options and Referrer-Policy headers.

  • CORS no longer exposes the Authorization header to other origins.

  • Update the base image and dependencies to fix CVEs.

6.1.3. Fix#

  • An invalid back-channel logout request no longer terminates ICS. It answers missing, invalid or expired logout tokens with 400.

  • Requests to /nob no longer terminate ICS when the session has no Matrix token, for example a session from before the upgrade.

  • The renewal of the Matrix token takes the Matrix user ID from the ID token, the same as the login. Before, the renewal failed if the claim was only in the ID token, and ICS forwarded the request with the old token. Requests to /nob without a Matrix token now get 502.

  • ICS tries the silent login again after a failed attempt. Before, one failed attempt turned off the silent login for the rest of the browser session.

  • A Redis password with the characters @, :, /, # or % no longer makes ICS crash at startup.

  • The mapping of the session state for the back-channel logout now expires in Redis. Before, the keys of all sessions that didn’t end with a back-channel logout stayed in Redis forever.

  • ICS forwards URL-encoded request bodies to the backends. Before, the backends got no body and waited until they timed out.

6.2. v1.12#

Released: 17. July 2026

6.2.1. Add#

6.2.2. Changed#

  • The app’s container image is now pulled from artifacts.software-univention.de instead of docker.software-univention.de. Operators who restrict outbound traffic with a firewall or proxy must, before upgrading, allow both artifacts.software-univention.de and s3.de-west-1.psmanaged.com: the registry answers image blob downloads with an HTTP 307 redirect to the latter (its S3 backing storage), so pulls fail if only the registry host is reachable. See Allowing artifacts.software-univention.de in firewalls and proxies for guidance.

6.3. v1.11#

Released: 20. March 2026

6.3.1. Security#

  • Update dependencies to fix critical and high CVEs.

6.3.2. Fix#

6.4. v1.10#

Released: 9. December 2025

6.4.1. Add#

6.4.2. Security#

6.5. v1.9#

Released: 28. January 2025

6.5.1. Add#

  • Access Tokens are now attempted to be fetched from an integration if the integration is enabled but a current session does not have a token for the service. This allows for XWiki and Matrix integrations to become healthy in a user session once a user has used those services once, thus the account exists in the respective service.

  • The Redis connection now supports TLS. Also, mTLS authentication can be configured.

  • UCR variables to configure SSL connection to Redis.

6.5.2. Change#

  • Better log formatting in JSON for proxied routes.

6.5.3. Fix#

  • Missing imports in the XWiki proxy caused the service to crash under certain circumstances.

  • Wrong logger configuration caused some log messages to not be correctly formatted.

6.6. v1.8#

Released: 15. December 2024

6.6.1. Add#

6.6.2. Change#

  • Load all the configuration during initialization to improve asynchronous performance.

  • Updated base image to UCS 5.2-0 December 2024 build.

6.6.3. Fix#

6.7. v1.7#

Released: 15. November 2024

6.7.1. Add#

6.7.2. Change#

  • Order of middlewares for Nextcloud proxying caused authentication prompts in some cases.

6.8. v1.6#

Released: 22. April 2024

6.8.1. Add#

6.8.2. Change#

  • Image is now based on UCS base image.

6.8.3. Fix#

  • AppCenter settings are now correctly applied during after installation.

6.9. v1.5#

Released: 20. June 2023

6.9.1. Add#

  • UCR variables to set the path to external self-signed certificates.

6.9.2. Security#

  • Updated dependencies.

6.10. v1.4#

Released: 13. December 2022

6.10.1. Change#

  • Refresh Nextcloud token when expired before proxying the request.

  • Improved logging messages with JSON formatting.

6.10.2. Add#

  • UCR variable to set the log level.

  • Logging to files and standard output.

6.10.3. Security#

  • Intercom service requests Nextcloud tokens with the Nextcloud audience, instead of the audience of OX App Suite.

6.11. v1.3#

Released: 28. October 2022

6.11.1. Change#

  • Treat expired refresh tokens as no token, triggering a silent login attempt.

  • Matrix login type set to m.login.application_service and is not configurable any more.

  • Switch to v3 Matrix client API.

6.12. v1.2#

Released: 29. September 2022

6.12.1. Add#

  • Various debug logs

6.12.2. Change#

  • Apply firewall rules during installation to make ICS accessible from outside of UCS.

  • Set Docker DNS based on the UCR variables nameserver1, nameserver2 and nameserver3.

6.12.3. Security#

  • The Filepicker functionality of ICS now fetches a separate token for authenticating with the file hosting application Nextcloud. The OX OIDC-client in the IdP must be allowed, to fetch a token for the Nextcloud OIDC-client. This was always intended, but not correctly enforced in earlier versions.

6.12.4. Fix#

  • Update deprecated usage of express.urlencoded.

  • ICS health check failed because of Nordeck URL returning 404.

  • Video conferences created as the wrong user.

  • Central navigation returning navigation.json for the wrong user under certain circumstances.

6.13. v1.1#

Released: 16. September 2022

6.13.1. Add#

Stability

  • ICS split the cookie headers by a logic that didn’t consider certain cases. Now, ICS uses a standard cookie library for the handling cookie headers.

  • During app installation, ICS tests the URLs of the required services Keycloak, Nextcloud, Nordeck, and UCS Portal, if it can reach them. The installation shows a warning, if the test can’t reach the services. Additionally, ICS runs a health check within the Docker container every 60 seconds to test, if it can reach the services.

Refreshing Access Tokens

A middleware that automatically refreshes access tokens when they expire.

6.13.2. Change#

  • Improve the readability of user documentation.

6.13.3. Security#

  • The Redis database provides persistence for app sessions. The update applies the following security fixes to Redis:

    • Password protection provided in /etc/intercom-redis.secret.

    • The Redis container is only accessible from the docker-compose internal network (external: false).

  • Verify the JWT (JSON Web Token) access or ID token with the public key of the Keycloak issuer.

  • Enable backchannel-logout and remove the appropriated app-session from ICS.

6.13.4. Fix#

  • Convert the uppercase value for the environment variable PROXY to lowercase. Using the variable in JavaScript requires the value in a lowercase string.

6.14. v1.0#

Released: 22. August 2022

6.14.1. Add#

  • Endpoint for OIDC silent login against Keycloak on /silent.

  • Endpoint to securely proxy requests from Open-Xchange to Nordeck on /nob, allowing the creation of Element videoconferences from Open-Xchange.

  • Endpoint to securely proxy requests from Open-Xchange to Nextcloud on /fs, allowing to use the email Filepicker with Nextcloud.

  • Endpoint to securely proxy requests from Open-Xchange to UCS Portal /navigation.json, allowing for use of UCS Portal central navigation from Open-Xchange.

  • Session storage with Redis.

On this page