The most recent patch for this version is 26.2.1.  Learn more

Skip to main content
Version: 26.2

Release notes

This page lists new features, bug fixes, and known issues by release.

Version 26.2.1​

Fixed issues​

Version 26.2.0​

What's new​

  • AuthZEN Authorization API support

    ADS now supports the OpenID AuthZEN Authorization API 1.0Opens in a new tab specification, providing a standardized, JSON-based authorization API that enables interoperability with any AuthZEN-compliant client.

    Key capabilities include:

    • Single access evaluation (POST /access/v1/evaluation): Accepts an AuthZEN-format request with subject, resource, action, and optional context, and returns a JSON decision response with optional XACML obligations, advice, status, and included attributes.
    • Batch access evaluation (POST /access/v1/evaluations): Evaluates multiple AuthZEN requests in a single call, returning responses in the same order. Batch requests are included in evaluation logs and metrics.
    • PDP discovery (GET /.well-known/authzen-configuration): Promotes supported AuthZEN capabilities as defined by the specification.
    • Attribute mapping: The AuthZEN required fields (subject and resource type and id, and action name) are mapped internally to the standard attributes subject.Id, subject.Type, resource.Id, resource.Type and action.name. Other attributes use the matching dictionary entry if one exists. Otherwise they’re mapped by name and category and treated as strings. As in /authorize, attributes the policy doesn’t use are ignored rather than rejected. Array values are sent as multi-valued attributes.
    • Request validation: All required fields and their mandatory inner fields must be present, and unsupported fields are rejected. Invalid requests return HTTP 400 with a descriptive error message.
    note

    AuthZEN endpoints are available when ADS is running in ads or ads_caq mode.

    By default, AuthZEN endpoints are disabled. Read the AuthZEN Authorization API page to learn more about AuthZEN endpoints and how to enable them.

Fixed issues​

Other​

  • {pbkdf2} password hashes generated by earlier versions no longer work

    Because of a change in an underlying Spring Security dependency, ADS 26.2.0 uses a 16-byte salt for {pbkdf2} password hashes instead of an 8-byte salt. Hashes generated by earlier ADS versions (80 characters after the {pbkdf2} prefix) fail authentication after the upgrade. Regenerate them (96 characters) before you upgrade, or switch to {bcrypt}. Other hash formats are not affected. For details, see section PBKDF2 password hash compatibility in the Migration guide.

Version 26.1.8​

Fixed issues​

Version 26.1.7​

Fixed issues​

Version 26.1.6​

Fixed issues​

Version 26.1.5​

Fixed issues​

Version 26.1.4​

Fixed issues​

Version 26.1.3​

What's new​

  • TLS bundle configuration for OIDC token retrieval

    ADS now supports configuring a dedicated TLS bundle for OAuth token retrieval. Previously, the TLS bundle applied only to ADM calls, while token retrieval from the identity provider (Keycloak) fell back to the default JVM truststore. A separate TLS bundle can now be configured specifically for token retrieval, and the same bundle can be reused for both token and domain retrieval when they share the same trust configuration.

  • JVM TLS trust options in Kubernetes Helm deployment

    ADS Helm charts now support passing JVM-level TLS trust properties at startup in Kubernetes deployments. This provides an alternative to Spring TLS bundle configuration by allowing TLS trust to be centralized at the JVM level.

  • HTTP Attribute Connector Microsoft Graph API single-quote escaping

    The new msGraphApiEscape configuration attribute controls the escaping of single quotes in URL parameters when querying the Microsoft Graph API. This prevents malformed query strings when attribute values contain single quotes.

Fixed issues​

  • Helm Chart: Service targetPort name mismatch

    Fixed a mismatch between the service targetPort name in service.yaml and the container port name in deployment.yaml. This prevented Kubernetes from resolving service endpoints correctly, resulting in empty endpoints and HTTP 503 responses.

Version 26.1.2​

Fixed issues​

Version 26.1.1​

Improvements​

  • ADS API security hardening

    ADS now returns additional response headers to protect against common web-based attack vectors.

Fixed issues​

  • Attribute connector exception messages missing diagnostic details

    Fixed an issue where error parameters were lost when an error code's message template lacked the necessary placeholders, causing exception messages to omit important diagnostic information.

  • Parser Attribute Connector build failure

    Resolved a thread-safety issue in Parser Attribute Connector that could cause build failures when multiple connectors were initialized concurrently.

  • XML schema inconsistencies in attribute connectors

    Corrected typos in the XML schema element names (connnection / connnectionMap) for Table, LDAP, and SQL Attribute Connector configurations. Backward compatibility with existing configurations is maintained.

  • Security fixes

    Several third-party libraries were updated to address the following security vulnerabilities:

    Details

Version 26.1.0​

ADS 2.x has been renamed to ADS 26.1 to align with the new versioning strategy, which introduces annual major releases. ADS 26.1 is a fully backwards-compatible continuation of ADS 2.2, incorporating bug fixes and new features. Upgrading from ADS 2.2 requires minimal effort and no migration.

What's new​

  • Contextual Authorization Query (CAQ) functionality

    ADS now includes built-in CAQ functionality for performing reverse queries. Bundling CAQ with ADS delivers a more consistent runtime experience and reduces the number of components required for configuration and monitoring. CAQ functionality is available only when ADS runs in caq or ads_caq mode. For details, see Engine modes and Migration guide.

  • Attribute Connectors integrated into ADS

    Attribute Connectors are now fully integrated into ADS. This integration simplifies the system architecture by eliminating separate service hops for attribute retrieval, and makes monitoring and configuration of attribute retrieval more efficient.

  • Spring Boot 4

    ADS 26.1 runs on Spring Boot 4, delivering improved runtime performance and alignment with the latest security patches and framework enhancements.

  • OpenTelemetry (OTEL) tracing

    ADS now generates OpenTelemetry (OTEL) spans for all Attribute Connector calls. Spans use clear, consistent naming conventions and capture start times, end times, and durations. Span content excludes sensitive data while providing full visibility into Attribute Connector cache performance and call success or failure rates.

  • Improved Kubernetes deployment

    Helm charts now support JDBC connection pool configuration for Kubernetes deployments. You can define minimum and maximum pool sizes directly in values.yaml, eliminating the need to modify Helm templates or hardcode values within the chart.

Fixed issues​

  • Clean startup without misleading WARN logs

    ADS now starts without erroneous WARN-level messages for valid, out-of-the-box configurations.

  • Invalid JSON in audit logs for obligations/advice with quotes

    Fixed an issue where evaluation audit logs could emit invalid JSON when obligation or advice values contained double quotes, causing downstream parsing and ingestion to fail.

  • Invalid JSON in audit logs for embedded JSON attributes

    Fixed an issue where authorization requests containing attribute values that were themselves JSON strings produced invalid JSON in the request section of evaluation audit logs. ADS now correctly escapes and encodes these values.

  • Documented JVM truststore configuration for outbound TLS

    Updated documentation to describe configuring outbound TLS trust through the JVM truststore as a supported global trust option alongside ADS TLS bundle configuration.