Skip to main content
Version: 26.2

Release Notes

This section is the primary reference for updates to the Authorization Hub platform.

Version 26.2.0​

What's new​

  • Graphical Policy Editor

    A visual canvas for navigating and editing ALFA policies is now available alongside the existing code editor. The canvas renders the policy package as an interactive tree with automatic layout. Navigation between the canvas and the code editor is bidirectional, and all canvas edits support full undo and redo. Canvas edits, such as adding or deleting a node, are persisted only when you explicitly save, consistent with the code editor.

    A node editor panel lets you edit the selected node without leaving the canvas, including its metadata, target, condition, and obligations and advice.

  • Activity feed

    Changes to project artifacts (attributes, attribute connectors, cache profiles, policies, domains, etc.) are now captured in an activity log. A summary widget on the Dashboard shows recent activity within the project, and a full log page accessible from the side navigation provides the complete history with filtering capabilities.

  • My workspace

    Changes to attributes, attribute connectors, policies, and cache profiles are now saved to a personal, private workspace instead of being applied immediately to the shared project state. Review all your staged changes in one place, compare policy changes against the current project state, and save everything to the project in a single action once you're ready to share your work. If someone else changed the same artifact in the meantime, conflicts are detected when you save and you can resolve them before saving. You can view the details of any staged change and discard the changes of a single artifact or all your changes at once. A persistent indicator in the top bar and count badges in the left navigation panel help you track staged changes at a glance. Read My workspace for details.

  • AI assistant (experimental)

    An AI assistant that explains in plain language, validates, tests, and proposes changes to ALFA policies is now available on every page. It is disabled by default and is connected to a model provider of your choice. Read AI assistant for details.

  • Tenant admin role delegation

    Tenant admins can now invite additional users to the Tenant admin role and promote or demote existing platform users as needed. Previously, only the single bootstrap Tenant admin account could hold this role.

  • Policy Insights: mocked attributes in templates

    Attributes in the Policy Insights template builder can now be marked as mocked. Mocked attributes are simulated rather than retrieved from external sources, enabling authorization queries to run without a real subject.

  • In-app feedback

    You can now submit product feedback directly from within Authorization Hub using a form accessible from the application header.

  • Attribute XACML ID can differ from the FQN

    You can now set an attribute's XACML ID to a value different from its FQN. Set a Custom URI when creating an attribute, or change the XACML ID of an existing attribute. XACML ID changes are shown in My workspace and in the conflict comparison. Read Add a new attribute and Dictionary for details.

  • Column selection in list views

    You can now choose which columns each list view displays and resize them. Your choices are remembered per list in your browser, but they are not shared across other browsers, devices, or users.

  • HTTP Attribute connector: msGraphApiEscape support

    The HTTP attribute connector configuration form now includes the msGraphApiEscape property. When enabled, this option escapes special characters in Microsoft Graph API requests.

  • Import and export functionality

    You can now import and export attributes, attribute connector configurations, and policies directly from the Authorization Hub interface. Imported files are validated and invalid files are rejected with a reason displayed in the UI. Everything created by an import arrives in My Workspace as pending changes, allowing it to be reviewed and saved to or discarded from the project like any other change.

  • Domain instance history and rollback

    You can now view the history of a domain to see what changed and when, or roll back to a previous instance to restore a known good state.

  • Policy editor: ALFA code snippets

    The code editor now offers ALFA code snippets to speed up policy authoring.

  • Airgapped installation support

    Authorization Hub can now be installed and operated in airgapped environments with no connectivity to the public internet. All required container images and chart artifacts are provided as a bundle that you can transfer into your environment through your approved channels and publish to your own container registry.

Improvements​

  • Consistent session and logout behavior

    Authenticated sessions and logout now behave consistently offering an improved experience without unexpected re-authentication prompts or delayed logouts.

    User sessions are now stored in a Redis instance shared by all API gateway pods, instead of in the memory of each pod. A logout is honored immediately regardless of which pod receives the request, rolling restarts no longer force unexpected logouts, and sticky sessions on the load balancer are no longer required.

  • Project creation: cancel confirmation

    A confirmation dialog is now displayed when you attempt to cancel project creation with unsaved input, preventing accidental loss of data.

  • Project member permissions in the project library

    Projects now display each member's role directly in the project library card, giving immediate visibility into access levels without opening the project settings.

  • Password rule validation feedback

    The password creation and reset flows now display real-time feedback against password complexity rules, reducing failed submission attempts.

  • Documentation link

    A link to the Authorization Hub documentation is now accessible directly from within the application in the sidebar.

  • Improved messaging for deactivated and uninvited users

    Users who attempt to log in with a deactivated account or who have not yet received an invitation now see a clear, descriptive message explaining their account state and the recommended next step.

  • Clearer error messages when domain creation fails

    When domain creation fails due to policy errors, the UI now displays specific, detailed error information instead of a generic message, so you no longer need to use the browser developer tools to find the cause.

  • Policy entry point validation in domains

    When you create or edit a domain, the Policy entry point is now selected from a list of the entry points available in the policy package, preventing you from saving an entry point that cannot be resolved.

  • AuthZEN default attributes

    The default attributes now include subject.Id and subject.Type, alongside resource.Id and resource.Type. These attributes can be used in policies for AuthZEN requests, where the AuthZEN standard requires a subject and resource ID and type in every request. In addition, the XACML ID of the default attribute resource.Id is now resource.Id instead of the OASIS resource-id URN, consistent with the other default attributes.

Fixed issues​

Known issues​

The following items have been identified as known issues and we are actively working on resolving them. Fixes will be included in upcoming releases of Authorization Hub.

  • Attribute connector shows the old deprecated attribute

    When an attribute's type or category is changed in the Dictionary, existing attribute connectors that reference it flag the attribute as deprecated. After you select the newest version of the attribute in the attribute connector and save it to My workspace, reopening the connector still shows the deprecated version until you save your changes to the project.

    Workaround: Reopen the attribute connector after saving your changes to the project.

  • Adding an attribute or attribute connector with an existing name updates the existing one

    When you add an attribute or an attribute connector using a name that already exists, no error is returned. Instead, the change is staged in My workspace as an update to the existing item and overwrites it when saved.

  • Attribute connectors page fails for attribute connectors with missing optional fields

    An attribute connector that is valid according to its JSON schema but omits optional fields, for example mappings[].keys, can cause the Attribute connectors list page or the connector's edit dialog to crash when the connector was created through the API or an import.

  • Project viewers cannot export policies

    The Export action is not available on the Policies page for users with the Viewer role, even though they have read access to the policy package.

    Workaround: Ask a project Admin to export the policies.

  • Incorrect API path for the domain APIs in Swagger UI

    The Swagger UI shows the domain API paths, such as /api/namespaces/{namespace}/names, without the adm prefix. Requests to these paths return 403 FORBIDDEN with the error code MISSING_PROJECT_ID.

    Workaround: Add adm to the path, for example /api/adm/namespaces/{namespace}/names.

  • "Back to Login" redirect loop

    Following a period of inactivity, you may encounter an error screen that prevents clean re-authentication, resulting in a continuous loop back to the error state.

    Workaround: Clear the site data or browser cache.

  • Domain creation failure by unrecognized attributes after dictionary update

    By design, changes to the attribute Dictionary do not automatically affect existing policies and a policy author must explicitly review and re-save the policy package for the updated Dictionary to be reflected. This preserves the immutability of the attribute Dictionary within policies.

    However, if a policy references an attribute that does not yet exist in the Dictionary, the Policy editor reports a validation error. After navigating to the Dictionary to create the missing attribute and returning to the Policies page, the error indicator disappears. However, the policy is not automatically re-validated against the updated Dictionary. As a result, attempting to create a domain using that policy entry point fails with an attribute-related error.

    Workaround: After creating the missing attribute in the Dictionary, return to the Policies page, make a minor edit to the affected policy, such as adding a space, and click Save All. This triggers re-validation and allows the domain to be created successfully.

  • Node editor does not reflect target, obligation and advice, or condition changes made elsewhere

    While the node editor is open on a node, changes made outside the panel, such as an edit in the code editor or an undo, are reflected in the node's name, effect, and combining algorithm, but not in its target, obligations and advice, or condition. Clicking Update in this state writes the older value from the panel over the newer one in the code.

    Workaround: Close and reopen the node editor after editing in the code editor.

  • False error after a canvas edit

    After you edit a node in the node editor and click Update, the Policy editor may report the error "Cannot determine type of expression" on target clauses that compare an attribute, for example clause user.role == "manager", even though the ALFA is valid. The issue occurs when the policy package contains a namespace that is also used by attributes in the Dictionary, such as user. In projects with several files, files you did not edit that contain such targets can also be flagged. Edits made in the code editor do not trigger the error.

    Workaround: Save the changes using Save or Save all. The error is removed after saving.

  • First policy created in a new project is not shown as a draft

    In a new project, the first policy you create on the Policies page does not appear as a draft, so My workspace shows one change fewer than expected. The second and subsequent policies are shown as drafts. If you discard your changes in My workspace, the first policy remains in the list.

  • AI assistant limitations

    The following issues affect the AI assistant (experimental):

    • Draft attributes are ignored when proposing a change

      When you ask the assistant to change a policy using an attribute that exists only as a pending change in My workspace, the assistant may report that the attribute is not declared. It might then propose a different attribute that serves a different purpose, without mentioning the substitution. For example, a request that names user.department may result in a rule that checks userRole instead.

      Workaround: Name the attribute explicitly in your request and state that it is in your My workspace draft Dictionary. Review the proposed change before you click Apply.

    • Undeclared obligations can result in a whole-file rewrite that removes comments

      When you ask the assistant to add an obligation that is not declared, it may first refuse and then retry with a proposal that rewrites the whole file. Comments and blank lines outside the requested change can be removed, and the summary does not mention it.

      Workaround: Ask the assistant to declare the obligation and its attributes in the file and attach it to the relevant policy. For example, "Declare the obligation and the reason attribute in this file and attach it on deny to the admin policy". Review the proposed change before you click Apply.

Version 26.1.7​

Fixed issues​

Version 26.1.6​

Fixed issues​

Version 26.1.5​

Fixed issues​

Version 26.1.4​

What's new​

  • Improved domain validation performance

    The validation process for storing large domains was optimized resulting in significantly faster processing times when saving or updating complex and large domain configurations.

Fixed issues​

Version 26.1.3​

Fixed issues​

Version 26.1.2​

What's new​

  • Framework and dependency upgrades

    Upgraded to Spring Boot 4 and Keycloak 26.6.2, incorporating the latest security patches and performance improvements.

Improvements​

  • Attribute connector retrieval optimization

    Optimized the GET api/attribute-connectors/by-attributes endpoint, improving performance when retrieving attribute connectors by their associated attributes.

  • Log level configuration

    Added the option to configure the log level setting for each service individually.

  • Various improvements

    This release introduces several UX and performance enhancements, along with key security upgrades

Fixed issues​

Version 26.1.1​

Fixed issues​

Version 26.1.0​

Authorization Hub is the successor to the Axiomatics Services Manager (ASM), rebuilt using modern frameworks and a cloud-native architecture. Version 26.1.0 is the first official release of the platform. It introduces an API-first approach to managing Attribute Based Access Control (ABAC) and enforcing zero-trust principles.

What's new​

  • Cloud-native architecture and deployment

    Authorization Hub is a Kubernetes-native application deployed using Helm charts and is fully compliant with Kubernetes RESTRICTED security profiles. The backend is built as a modular monolith, combining the operational simplicity of a single deployable unit with clean internal service boundaries.

  • Audit logging

    All services produce audit logs that record who performed each action and when. This provides a consistent record across the platform to support compliance and governance requirements.

  • API-first design

    Every capability in Authorization Hub is exposed through documented REST APIs with a unified OpenAPI/Swagger UI. This enables full automation and CI/CD integration for authorization management workflows, including operations that were previously only available through the ASM UI.

  • User management

    Authorization Hub uses a tiered role system to control administrative permissions across the platform. Users are onboarded through an in-app invitation flow with email notifications, removing the need for direct identity provider administration. Additionally, the platform supports integration with external Identity Providers for extended enterprise identity federation.

  • Projects

    Teams work within Projects, which serve as isolated workspaces that contain their own policies, attributes, connectors, and domains. Access to these environments is governed by project-specific roles assigned to users. Machine-to-machine (M2M) API clients utilize these same roles to operate within projects just as human users do, which enables CI/CD pipelines to function within defined boundaries. This model replaces the "All" and "Read-only" permissions previously available in ASM.

  • Dictionary and attribute caching

    The Dictionary area in Authorization Hub allows you to define and organize the attributes used in authorization policies. Supporting all ALFA data types and categories, attributes can be organized by namespace and managed through the UI or REST API. The dictionary also provides clear visibility into which attributes are utilized across various attribute connectors.

    Additionally, the platform supports attribute caching to optimize Access Decision Service (ADS) performance. Caching is configured on a per-attribute basis and is automatically included during domain creation.

  • Attribute connectors

    Attribute connector configuration has been modernized with a guided, form-based UI for all supported attribute connectors (LDAP, SQL, Table, Parser, and HTTP). Notably, the HTTP attribute connector now features a structured form for connection settings, attribute mappings, authentication, and payload templates, replacing the manual text editing required in ASM. All operations are accessible both through the UI and REST API, with full import and export support for easier promotion across environments.

  • Policy editor

    Authorization Hub features a web-based code editor for authoring authorization policies in the ALFA (Abbreviated Language for Authorization) language. The editor provides an IDE experience, including syntax highlighting, code completion from the Dictionary, go-to-definition across files, and real-time error diagnostics. Policies are organized as multi-file ALFA packages with independent per-file saving.

    This transition to a "policy as code" framework allows authorization policies to be managed as plain-text assets which are naturally suited for version control, collaborative code reviews, and seamless CI/CD integration.

  • Domains

    Domains serve as logical containers that aggregate policies, attributes, and attribute connectors into a deployable authorization configuration for the Access Decision Service (ADS). Authorization Hub utilizes domain version 2.1, a YAML-based format designed to align with the ALFA policy structure and the updated attribute connector configurations.

  • Policy insights

    Policy insights is a new feature, previously unavailable in ASM, that enables the analysis of deployed authorization policies through reusable query templates and reports. It leverages the Contextual Authorization Query (CAQ) engine to answer questions, such as "Under what conditions can a user perform a specific action?".

What's coming​

Upcoming releases of Authorization Hub will continue to expand the platform's capabilities. Highlights include a new graphical Policy Editor to simplify authoring, additional deployment options, and a migration path for existing ASM deployments.

Known issues​

The following items have been identified as known issues and we are actively working on resolving them. Fixes will be included in upcoming releases of Authorization Hub.

  • Intermittent policy validation inconsistencies

    Under rare conditions, policy code validation may stop functioning. You may notice the Problems panel highlighting resolved issues as still active or failing to report new errors in the code.

    Workaround: Perform a full page reload.

  • [✅Resolved in 26.1.2] Incorrect XACML IDs for default environment attributes

    Authorization Hub assigns incorrect xacmlId values to the three default environment attributes (currentDate, currentTime, and currentDateTime). This prevents ADS from evaluating policies that use them.

    Workaround: Manually update domain.yaml with the correct URIs and push it to ADS.

  • "Back to Login" redirect loop

    Following a period of inactivity, you may encounter an error screen that prevents clean re-authentication, resulting in a continuous loop back to the error state.

    Workaround: Clear the site data or browser cache.