LinOTP 3.2.6

Fixes

• Show serial and token type in audit log in case of an error; e.g. if a token exceeded its failcounter

LinOTP 3.2.5

Release 3.2.5 patches a session handling vulnerability in the Self Service API. This patch is necessary for all versions newer than LinOTP 3.0. See https://linotp.org/security-update-linotp3-selfservice.html for more details.

Fixes

• Ensure that userservice login results in exactly one session cookie per response.
• Avoid a race condition in userservice request method setup which could lead to a user being erroneously authenticated as a different user.

Features

• Use entirely random values for userservice session cookies.

Packaging

• Debian postinst now correctly restarts the LinOTP service again to ensure running the latest version without the need for manual intervention.

LinOTP 3.2.4

Features

• when using the forward token and a challenge is triggered, the response detail contains information about the target token
• forward tokens do not count for license
• the forward token now supports the offline capability of the qr token

Fixes

• forward token supports forwarding to a qr and push token

LinOTP 3.2.3

Fixes

• ensure all types of token will be migrated
• ensure that dbconfig-common triggers the linotp database migration
• Customisation of /manage and /selfservice-legacy was broken due to url path changes with LinOTP 3

LinOTP 3.2.2

Fixes

• Challenge database is reset once to ensure that Backups pre LinOTP 3 correctly restore existing challenge-response tokens.
• Migrate encypted data 'password' with legacy proprietary padding (LinOTP 2.9)
• Fix migration of yubico token to LinOTP 3.2

LinOTP 3.2.1

Fixes

• Audit key verification errors solved by using newer version of pycryptodomex.
• Remove weak file permissions in config dir.
• Solved migration of QR-tokens which broke backup-restore from SVA-2.12.5 to SVA-3.0
• Database re-encoding during database migration now also migrates managed users that were previously not correctly migrated.
• Debian postinst trying to add admin users via htdigest. This is no longer supported and therefore removed. Use the linotp CLI manually instead.
• Ensure that inactive policies are not evaluated. Previously, inactive policies were being evaluated in certain situations, leading to wrongly attributed permissions to logged-in administrators.

LinOTP 3.2

Enhancements

• Added grace to license volume exceeding and display accordingly a message in the the web ui.
• Added extended information in HOTP/TOTP CSV import UI.
• The CLI now uses a common time format for all backup filenames. The format is configurable via config BACKUP_FILE_TIME_FORMAT.
• CLI command linotp audit cleanup now writes a backup file of the deleted audit entries by default. Export dir defaults to the LinOTP backup dir. Exporting can be disabled with a new flag --no-export.
• Added the configuration option for the HttpSmsProvider to define the server certificate verification option.
• Added a jwt based admin authentication into LinOTP, so that configuring apache to protect admin access to linotp is not needed any more. Linotp therefore uses a special realm, the admin realm, which contains the resolvers that are allowed to adminstrate LinOTP. For bootstraping, an internal reserved managed resolver is used for which users could be added via the linotp command line tool (s. README.md). The Manage-ui and the corresponding interfaces have been extended to indicate if a realm or resolver is used for administration.
• Prevent overwriting of the local admin resolver via the user import.
• New linotp admin cli command to set support license, get support info and verify the current support status.
• Endpoint delRealm does not cause Error if no realm argument is passed
• Added configuration settings JWT_SECRET_KEY, JWT_SECRET_SALT, and JWT_SECRET_ITERATIONS. The latter two control the PBKDF2 function that is applied to the default secret (the first key from SECRET_FILE) if JWT_SECRET_KEY is not given or is empty. Refer to linotp config explain for details.
• Email challenge can have a custom message for the user which can be set in the config by the EMAIL_CHALLENGE_PROMPT entry.
• Extended sms provider logging
• Added TIMEOUT parameter for all networking providers
• SMS blocking time is now configurable in the SMS token configuration dialog. The blocking time (in seconds) is the period that needs to pass before another challenge can be triggered by the same user.
• Admin policies now support resolver defintion for admin users
• A new API endpoint /manage/context provides context information for logged in Manage-UI users.
• Reimplement additional getToken safeguard by defining the settings DISABLE_CONTROLLERS and ENABLE_CONTROLLERS - by default the DISABLE_CONTROLLERS contains the 'gettoken' controller.

Breaking Changes

• The helpdesk controller has been removed.
• Apache-based admin authentication is no longer supported.
• Audit Trail export is now ordered descending (latest logs first) when done from the Manage-UI.
• Admin authentication: 'Cross site scripting request forgery (CSRF)' is no longer handled via the session request parameter. Instead, a CSRF-protection token, which is available via cookies, must be sent in the request header. Non-modifying requests can be requested via 'GET' and do not need to send the CSRF token. The session parameter that was used before should be omitted. API endpoints restricted to accept only via 'POST' must use the new header. See the Migration guide for further details.
• Some API endpoints are now restricted to the specific HTTP method which they can be used with. Endpoints requiring an admin authentication are now restricted to the POST method if they are modifying data. The allowed HTTP methods are highlighted in the API documentation.
• Logging has more configurations now whose config variables are starting by LOG like LOG_FOO. Different formatting or log level can be set for the LOG_FILE or the LOG_CONSOLE. Some of the older config variables for logging are renamed for consistency.

Deprecations

• In the future, all API endpoints will only allow certain HTTP methods. Data-modifying endpoints - that are not restricted yet- will only allow POST requests in the future, and read-only endpoints will only allow GET requests. The now deprecated HTTP methods are also highlighted in the API documentation.

Bug Fixes:

• License limits are now enforced during userservice token enrollment.
• Prevent creating or importing OATH (HOTP, TOTP, Ocra2) tokens with malformatted seeds.
• License monitoring shows license usage for user-based licenses.
• User-based license reporting now filters for date and realm correctly and supports wildcards in realm and status.
• In a Debian environment with a MySQL database, it is not anymore required to set the charset=utf8 parameter as otherwise, resolvers would not correctly display imported users if they contain utf-8 characters. Using flask- mysqlalchemy connection solved this problem.
• License exception messages are improved and in case of the user service the message suggests asking the system administrator.
• Comprehensive message after importing tokens.
• Adjusted functional_special tests to become regular tests.
• Porting issue for radius token with forwarding transactions.
• Reply to sms challenge with pin+otp.
• User import now always deletes users in the correct managed resolver.
• The linotp support cmd can now install demo licenses.
• The linotp cli commands would not break anymore if localization is involved.
• Resolver names are now always treated case-sensitive.
• setConfig is now called from the UI only once to save all parameters in one api call.
• Audit key verification errors solved by using newer version of pycryptodomex.

Dependencies:

• Update jQuery and jQuery-Migrate

Packaging

• The linotp package now Suggests: python3-smpplib.

LinOTP 3.1

Enhancements

• ManageUI policy editor utilizes full window width for improved layout.
• Inform the admin via audit log if there is a challenge integrity error.
• Userservice allows enrollment of HOTP tokens with the webprovisionGOOGLE policy.
• Userservice allows enrollment of TOTP tokens with the webprovisionGOOGLEtime policy.
• RestSMSProvider allows access to nested JSON request data structure items by path.
• Use database config value to enable get_otp feature
• Simplify the HMAC acountname and tokenissuer fallback rules for a more predictable behavior in the google authenticator url.
• Token monitoring now better sanitizes the status parameter
• Improved Manage-UI error message if something fails in the initial config load phase.
• sqlite can be used as audit database - the response of audit/search now skips streaming the response data for sqlite audit databases.
• The server now checks whether the audit table exists or not on start.

Breaking changes

• No longer support AUDIT_POOL_RECYCLE configuration setting.
• Sqlite audit databases can no longer share the same file with LinOTP. If configured to share the same file, LinOTP will add a suffix to the audit database file name.
• Audit database timestamp is now ISO 8601 formatted. The timestamp is saved in UTC timezone instead of server local time.

Bug Fixes

• mOTP tokens can now be used in challenge response mode
• Adjust yubico token config text to make it clear that a dedicated API key from yubico is required.
• An error message is now shown in the Manage UI if a token import fails
• API /admin/testconnection accepts only the name of an existing resolver as parameter. Other parameters are ignored. This fixes the ability to submit unauthorized ldap connection requests.
• Manage-UI no longer hangs on failed resolver save requests.
• Token monitoring now correctly counts tokens that are assigned to multiple realms only once in mysql and sqlite databases.
• Dynamic user data (e.g. e-mail addresses and phone numbers) are always refreshed during resolver lookups triggered by the authentication workflow. The policies sms_dynamic_mobile_number, dynamic_email_address, and voice_dynamic_mobile_number therefore directly reflect external user data changes.
• Legacy Selfservice now correctly recognizes type=yubikey tokens in MFA login.
• Manage-UI no longer gets stuck in the interface initializtaion if the logged in user is missing required system permissions. Now, it is guaranteed that a logout is always possible.
• support the assignment of multiple tokens within one request to prevent race conditions for example with token_count policies
• getotp view is now working with python3
• Token validity period (stored in UTC) is now compared against current time in UTC instead of the server's timezone.
• Log username, realm, serial and token type in audit table when performing a validate/check_status request.
• Fix padding of crypted data by migrating to pkcs7 padding via the linotp init database command.
• Validate no longer wrongly references autoenrollment for users that do not own any tokens as the error message.

LinOTP 3.0

Enhancements

• LinOTP is ported from Python 2.7 to Python 3.6.
• LinOTP is ported from Pylons to Flask.
• Managed resolvers (Internally stored users) now use the LinOTP database connection session to work with replicated databases and after db restores on different database connection parameters.
• New Token Selfservice user interface is installed as a recommended dependency for "/selfservice". The existing SelfService is deprecated but still available under /selfservice-legacy.
• New config value SITE_ROOT_REDIRECT allows to customize the redirect path if the user requests the site root path ("/"). If not set, the browser is redirected to the legacy selfservice. The new Selfservice will pick priority over the deprecated Selfservice if installed.
• Support reencoding of LinOTP 2 databases from ISO 8859-1 (Latin1) to UTF-8 via the LinOTP CLI. Latin1 used to be the default for Python 2 against mysql but is no longer valid for Python 3.
• Selfservice supports testing tokens after enrollment via the policy verify. This feature only works in the new Selfservice.
• Selfservice improved handling of expired sessions.
• A new 'linotp' CLI installed on the path provides:
  • admin - administrative commands to manage the linotp application server.
  • audit - administrative commands to manage the audit log.
  • backup - manage database backups.
  • config - configuration file diagnostics.
  • dbsnapshot - Manage system-independent database 'snapshots'.
  • init - key generation and database initialisation/migration.
  • ldap-test - extensive testing of LDAP backends.
  • routes - show the available URL endpoints of LinOTP.
  • run - run a development server.
  • shell - run a shell in the app context.
• Settings can now be configured using environment variables LINOTP_<SETTING_NAME>.
• Improved config file handling via LINOTP_CFG environment variable:
  • LINOTP_CFG env allows to set a custom search path for config files.
  • /usr/share/linotp/linotp.cfg contains distribution default settings.
  • Support for wildcard paths.
  • By default, /etc/linotp/linotp.cfg and /etc/linotp/conf.d/*.cfg are configured for adminsistrator configuration overrides.
  • LINOTP_CFG env treats directory /foo like /foo/*.cfg.
  • Read config file list from file if LINOTP_CFG doesn't exist.
• Support for SoftHSMv2.
• Migration of standalone scripts to linotp CLI subcommands:
  • linotp-backup is now available as linotp backup create.
  • linotp-restore is now available as linotp backup restore.
  • linotp-create-enckey is now available as linotp init enc-key.
• Improved path settings. See DEVELOP.md on how the new options ROOT_DIR, CACHE_DIR, DATA_DIR, and LOGFILE_DIR are used and how they are configured by default.
• Improved error code separation to differentiate between different problems preventing token enrollment.
• The /userservice/enroll API now honors default values for hotp and totp tokens defined by the folowing selfservice policies:
  • hmac_otplen, totp_otplen: for the number of digits of an OTP.
  • hmac_hashlib, totp_hashlib: the HMAC hashing algorithm used.
  • totp_timestep: the time stepping for totp tokens.
• Customization of Selfservice information fields via policies:
  • footer_text: Can be used to display e.g. copyright notices.
  • imprint_url: URL to an imprint/ legal notice page.
  • privacy_notice: URL to a privacy notice page.

Removed and no longer supported

• Support for Debian versions before Buster.
• Apache 2.2 configuration.
• linotp.ini configuration file format.
• non-systemd init script.
• OCRA token.
• Vasco token.
• OSIAM SCIM UserIdResolver.
• The following tools scripts are no longer part of LinOTP:
  • linotp-auth-radius
  • linotp-convert-gemalto
  • linotp-convert-token
  • linotp-convert-xml-to-CSV
  • linotp-create-ad-users
  • linotp-create-auditkeys
  • linotp-create-certificate
  • linotp-create-database
  • linotp-create-pwidresolver-user
  • linotp-create-sqlidresolver-user
  • linotp-decrypt-otpkey
  • linotp-enroll-smstoken
  • linotp-fix-access-rights
  • linotp-pip-update
  • linotp-qrtoken-shell.py
  • linotp-setpins
  • linotp-sql-janitor
  • linotp-token-usage
  • linotp-tokens-used
  • testRadiusChallResponse.sh
  • totp-token

Breaking changes

• Translations fr, it, es, and zh are removed because of their bad state.
• LinOTP no longer accepts custom LDAP trusted certificates in the UserIDREsolver interface. Instead, it now fully relies on the system trusted certificates.
• LDAP resolver connections to "ldap://" URLs with encryption switched off no longer attempt "stealth" encryption behind the user's back with an optional fallback to a plain connection. Instead, the encryption state can be explicitly controlled. (In the UI, the LDAP resolver dialog now defaults to "use STARTTLS" when an "ldap://" URL is specified, but if the user deselects this then TLS will not be used at all.)
• LinOTP 3.0 removes all existing audit log entries during automatic database migrations because signatures from old audit log entries - written in LinOTP 2.x (using Python 2) - can not be validated with python 3.
• Replace unmaintained mysql driver with mysqlclient driver.
• LinOTP no longer works with ISO 8859-1 (Latin1) encoded databases. LinOTP provides a migration path if it detects a database that might require reencoding.
• LinOTP no longer initilizes all required data automatically on startup to increase server speed. Instead, the server now only performs a simple database check at startup; the linotp init database command must be run manually if the database check fails. The postinst script will still initialize the database though.

Bug Fixes

• /gettoken/getotp now works on tokens that are not in a realm.
• LinOTP legacy Selfservice authorization is now correctly responding with an "unauthorized" http response instead of an internal server error.
• After enrollment, Push- and QR-Token enrollment status will stay completed even when these tokens are disabled.
• CSV user import now works correctly with files using quote escaping.
• Ensure consistent policy behaviour in all scopes:
  • Specific policies override wildcard policies. This ensures that actions can be restricted for a subset of users.
  • Fix quoting of actions such as sms_text="Hello, your otp='<otp>'".
  • All actions are matched for a given user if some of the actions are less explicitly defined regarding user and realm fields.
• User based license evaluation now correctly only counts distinct users.
• Translate maxtoken errors correctly.
• Changing the TOTP time step for an existing token now adjusts the otp counter to allow the token to keep working. The otp counter is used to prevent replay attacks.
• Unintentional inclusion of file config values in Config database is removed to not have security critical information API accessible.

Packaging

• Include README.md in packaging artifacts.
• Ensure configuration files and generated directories are owned by the linotp service user.
• Support added to set up linotp with postgres in postinst through migration to dbconfig-common for database setup.
• Downgrade mysql dependency to Recommends. The system administrator should install the package for their database or allow apt to install recommended packages.

LinOTP 2.12.5

Dependencies:

• Server: Debian buster, update jQuery and jQuery-Migrate

LinOTP 2.12.4

Bug Fixes:

• Include Readme.rst in packaging artifacts
• Tool to import users now enforces system write permission, which is required because resolvers are created or updated
• Import User dialog layout fix
• Improve help text output of linotp-create-htdigest script
• No longer deploy obsolete who.ini config file
• Forward tokens support multiple challenges
• HMAC enrollment QR-code correctly URL-encodes tokenissuer

LinOTP 2.12.3

Enhancements:

• Server: Add API /reporting/period to query reporting for a period in a Range between 'from' and 'to', where the 'from' date is included in the range and the 'to' date is not included. If a range defined and the 'to' date is not included. The API will search for the last repoting entry before the period if no entry for the given period is found.

LinOTP 2.12.2

Enhancements:

• Make rollout token behavior consistent when also used for general validation.

LinOTP 2.12.1

Bug Fixes:

• Policies: Consistent evaluation of policies is ensured in the "enrollment" scope. Evaluation is adjusted to match all actions for a given user if some of the actions are less explicitly defined regarding user and realm fields
• Selfservice: MFA login with Push Token and QR Token is correctly processed
• Incorrect max token count evaluation is fixed if a different, more specific (not user:'*') policy with other actions is defined.

Documentation:

• Update Readme.rst with latest installation instructions for PIP

LinOTP 2.12

Enhancements:

• Server and UI: Add three new columns to the token table, they can be viewed under the admin/show endpoint, and in the Manage UI under TokenInfo. The system settings dialog in the Manage UI provides an option to enable and configure their visualisation
  • LinOtpCreationDate - contains the date of creation of the token
  • LinOtpLastAuthSuccess - last successful login with this token
  • LinOtpLastAuthMatch - last use of the token with several tokens and otppin is not PIN or the tokens have identical PIN
• Server: Expired or wrong cookies in userservice requests will return a HTTP 401 (session abort) error
• UI: Browser tab icons match the current LinOTP logo
• UI: Browser tab titles start with the name of the web application, to make it easier to distinguish between Manage and Selfservice UI in small tabs
• UI: Challenge validity time for SMS and email tokens can now be set via the Manage UI

Bug Fixes:

• Server: Failed userservice 2nd factor logins increase the fail counter of the respective token
• Server: Replication setups on the SVA no longer fail due to faulty userservice cookie handling

LinOTP 2.11.2

Enhancements:

• Server: email token accept a new challenge as soon as the previous challenge is correctly answered
• Server: Update LinOTP Apache configuration to include additional configuration supplied by a related package such as the Selfservice

Bug Fixes:

• Server: respect maxtoken policy when creating new token in selfservice frontend
• Server: in Selfservice cookie expiration date now reflects timezone
• Server: IE11 Browser rendering fixed, where content height was not respected before

LinOTP 2.11.1

Enhancements:

• Server: add support for autoenrollment enrollment notification

LinOTP 2.11

Enhancements:

• Server: add api endpoint for helpdesk support
• Server: support for dynamic email address for email token submission

LinOTP 2.10.7.2

Bug Fixes:

• Server: /manage - search for tokens with /:no user info:/

LinOTP 2.10.7.1

Bug Fixes:

• Server: yubikey token import for otp length 8
• Server: get otp calculation by using utc as base

LinOTP 2.10.7

Enhancements:

• Server: Support for Atlassian’s PBKDF2-based passwords in sqlresolver
• Server: Support for BCrypt based passwords in sqlresolver

Bug Fixes:

• Server: Fix php password support in sqlresolver

LinOTP 2.10.6.1

Bug Fixes:

• Server: Double failcounter increment fixed
• Server: Add the last access info also for tokens which failed to verify

LinOTP 2.10.6

Enhancements:

• Server: Emailprovider supports now ssl/tls and start_tls

LinOTP 2.10.5.3

Bug Fixes:

• Server: Hotfix for the autoresync vulnerability

LinOTP 2.10.5.2

Bug Fixes:

• Server: Preserve leading zeros of QR Token offline TAN

LinOTP 2.10.5.1

Enhancements:

• Server: Prevent dirty cache if resolver is not available
• Server: Resolver and realm cache is wiped when the cache is switched off

LinOTP 2.10.4

Enhancements:

• Server: SMSProvider failover (https://www.linotp.org/doc/latest/part-management/policy/authentication.html#sms-provider-failover)

LinOTP 2.10.3.1

Bug Fixes:

• Server: Using the rollout token outside of the selfservice scope should not increment the failcounter

LinOTP 2.10.3

Enhancements:

• Server: Public release of rollout token

LinOTP 2.10.2

Enhancements:

• Server: Support for rollout token declaration, so that a token can only be used for the selfservice login - the token will have the default description 'rollout token'. According to the declared policy, the rollout tokens will automatically be removed after the first authentication with a different token, which will be annotated in the audit log.

Bug Fixes:

• Server: Fix the sqlalchemy warnings about unicode conversion
• Server: Fix for missing translation function pointer in exception
• Server: Fix for passwd files with empty lines

LinOTP 2.10.1.4

Bug Fixes:

• Server: Fix a problem regarding the ldap connection- and response timeouts

LinOTP 2.10.1.3

Bug Fixes:

• Server: Support database migration from any previous version
• Server: fix for Yubico verification URL to be configurable, by default use the new https:// verification URLs and support connection fallback and blocking

LinOTP 2.10.1.2

Enhancements:

• Server: Make the Push Token enrollment more robust in case that the challenge service callback would fail
• Server: Support large challenges

Bug Fixes:

• Server: Show serial and token type in audit log for Push Token enrollment
• Server: Several fixes for the initial config handling

LinOTP 2.10.1.1

Bug Fixes:

• Server: validate/check_status query with user parameter now returns token serial
• Server: Use userid instead of user name to identify open challenges. This mitigates the usage of capitals in user names with Active Directory as UserIdResolver backend.

LinOTP 2.10.1

Enhancements:

• Server: LDAPUserIdResolver failover: stay with working LDAP-Servers for an incrementing time before retrying the first server
• Server: Add charset/collate clauses to database generation commands: ensures compatibility with recent versions of MariaDB
• Server: New policy 'forward_on_no_token' to forward request to server if user has no token
• Server: Allow configuration of the challenge prompt via system/setConfig?SMS_CHALLENGE_PROMPT=MESSAGE
• Server: New policy 'enforce_smstext' to ignore request param data
• Server: Support to configure HTTP headers in Rest SMS Provider
• API: Show token enrollment status in userservice/usertokenlist
• API: Support check_status without user parameter
• Web UI: Add hint about timezones to manage tokeninfo
• Web UI: Update visuals for manage tokeninfo
• Selfservice Portal: Support optional landing page for selfservice portal
• Selfservice Portal: Show token details in selfservice portal

Bug Fixes:

• Server: Fix LDAPUserIdResolver failover
• Server: Search token list with userPrincipalName
• Server: Fix RADIUS Forward Token
• Server: String 'ignore_pin' instead of '3' is now correctly processed for 'otppin' policy action
• Server: LinOTP server now handles forward proxy definition correctly
• Server: Fix storing of timeout tuples within the DefaultPushProvider
• Server: Fix backend for setExpiration UI dialog which failed in some cases
• Server: Provide error message if the setup of a license fails
• Server: Set default time zone to make time-based tokens work in all setups
• Server: Support for SQLUserIdResolvers where the user id is defined as int. This fixes actions in the selfservice portal.
• Web UI: Default for splitAtSign is now correctly displayed in the UI

LinOTP 2.10.0.6

Bug Fixes:

• Fix handling of multiple active challenges for KeyIdentity Push Token
• Policy: Correction of an index error when evaluating the wildcard value list

LinOTP 2.10.0.5

Enhancements:

• Add redundant challenge service configuration
• Add new SMS Provider which supports HTTP REST interface

LinOTP 2.10.0.4

Bug Fixes:

• Use utc time as base for cookie expiration

LinOTP 2.10.0.3

Enhancements:

• Move customisation files location (CSS, logos) to /etc/linotp2/custom-style (http://linotp.org/doc/latest/part-installation/customization/index.html)
• Replace crypto/pbkdf2 with more uptodate version
• Add German translations

Bug fixes:

• Fix /auth/pushtoken test page

LinOTP 2.10.0.2

Bug Fixes:

• Tools: Fix exception in linotp-token-usage/tokens-used

LinOTP 2.10.0.1

Bug Fixes:

• Server: Restrict the userservice/context API

LinOTP 2.10

Token changes:

• Introduce new token: Voice Token
• Enhance Push Token (incompatible with previous Push Token version)

Server changes:

• Adjust default TransactionId length to 17
• Implement explicit-deny for pushtoken
• Add token type specific enrollment limits
• Support loading provider via configuartion in linotp.ini
• Enable new policy engine by default
• Moved tokens to new location in src tree
• Support shorter lost token duration (days, hours, and minutes added)
• Autoassign a token if a request arrives with only username (without password)
• Document the otppin policy 3=ignore_pin in the policy UI
• Removed IE compatibility mode from templates
• Take the already stored mobile number of a token owner (available from UserIdResolver) if it exists, otherwise take the number stored in the token info
• Autoassignment without password
• OATH csv import with sha256 + sha512

Web UI changes:

• Add Auth Demo pages for challenge-response and push token
  • /auth/challenge-response
  • /auth/pushtoken
• Add expiration dialog for tokens
• Refactor dialog button icon generation
• Performance improvement by removing mouseover effects on Manage-UI
• Extract custom form validators into seperate files
• Removed IE compatibility mode from templates
• Update favicon to follow company rename
• Add UI in manage and selfservice for "static password" token
• Improved Selfservice login with MFA support

Other changes:

• SMSProvider: Moved the SMSProviders to become part of linotp
• UserIdresolver: Moved UserIdresolvers into linotp package

Bug Fixes:

• Server: Fix evaluation of forward policy to match most specific user definition
• Server: Fix password comparison of password token
• Server: Adjust location of token makos for translation
• Server: Fix typo in getUserFromRequest in case of basic auth
• Server: Fix missing 'serial' for audit and policy check in selfservice.enroll
• Server: Fix for loading active token modules
• Server: On LDAP test connection always close dialog
• Server: Fix encoding error that prevented Token View from being displayed in the web interface.
• Server: Fix challenge validation to check only one request at a time. Prevent (positive) double authentication with the same transaction ID and OTP. This used to happen when a user submitted the OTP for a transaction ID more than once within a very short timeframe
• Server: Fix for missing LDAP uft-8 conversion
• Server: Fix default hash algorithm. This was causing issues in the YubiKey import
• Server: Fix wrong audit log entries where "failcounter exceeded" was incorrectly being replaced with "no token found"
• Server: Fix QRToken to use the tan length defined at enrollment
• Server: Fix password and lost token password comparison
• Server: Fix to show deactivated policies in Manage UI again.
• Server: Fix for better user/owner comparison
• Server: Fix to show inactive policies
• Server: Fix import of policies with empty realm
• Server: Verify that only active policies are used
• Server: Fix for policy export to export inactive too
• Server: Fix for target realm handling on token import
• Server: Fix select only active policies for admin policies
• Server: Fix getResolverClassName
• Web UI: Fix UI crash check if backend response is array in ldap testconnection
• Selfservice: Fix QR token enrollment and activation

LinOTP 2.9.3.4

Bug Fixes:

• Server: Fix encoding error that prevented Token View from being displayed in the web interface
• Server: Fix Hashlib heuristic on token import (support sha265 when key length is 64 hex chars)

LinOTP 2.9.3.3

Bug Fixes:

• Server: Fix HMAC-based tokens:
  • prevent (positive) double authentication with the same OTP. This used to happen when you submitted the OTP more than once within a very short timeframe.

LinOTP 2.9.3.2

Bug Fixes:

• Server: Fix YubiKey import, Authentication error corrected after import and assign
• Server: Give realm parameter priority over @user@realm if not @split@sign

LinOTP 2.9.3.1

Enhancements:

• Server: Accept DB2 format database urls

Bug Fixes:

• Policy: Fix support for filtering on <UserIdResolver>: in user field
• Web UI: Simplify user import dialog by removing realm section
• Server: Fix OTP counter for email token
• Server: Remove user related data from logs:
  • Password hash from SQL resolver
  • User information from user.py

LinOTP 2.9.3

Enhancements:

• Server: Add support for QR Token unpairing via API
• Server: Support for deleting / disabling token if usage exceeded
• Server: Logging enhancements including unique request IDs and timestamps
• Server: Logging message cleanup to remove unecessary messages
• Server: Support Ocra token with current LinOTP
• Server: Prefer HTTP_X_FORWARDED_HOST to HTTP_HOST for logout_url
• Server: Use HTTP_AUTHORIZATION to determine login name for Basic auth
• Server: Support rfc7239 HTTP_X_FORWARDED_FOR to determine client IP
• Server: Add token issuer to 'otpauth' URLs
• Server: Add FIPS security provider to comply with some operations
• Server: Add experimental new policy engine implementation (off by default)
• Server: Refactor lib.user
  • changed isEmpty into a property
  • removed methods getRealm, getUser
  • getUserFromParam signature
• Server: Refactor resolvers
  • setResolver and testresolver
  • configuration handling
• Server: Email provider added support for SMTP port configuration
• Server: Add support for read only (managed) provider configurations

• Web UI: Version static resources to bust browser caching
• Web UI: Add support for importing users via flat CSV file
• Web UI: Add limited support for setting the admin password via the UI
• Web UI: Improvements to LDAP edit dialog

• API: Support dynamic logging via new maintainence controller
• API: Add server healthcheck: maintainence/ok
• API: Support filtering by token type using token_type parameter

• Tools: Add CI Jenkins build pipeline
• Tools: Add central makefile with targets for Docker, packages, tests
• Tools: Add Docker image build infrastructure

• Packaging: Soften hard dependency on libapache2-mod-wsgi
• Packaging: Split auth modules into separate repositories on Github
• Packaging: Move LinOTP client GUI into separate repository on Github

• Config examples: Add example Logstash configuration
• Config examples: Modify logging configuration to prevent duplicate lines

Bug Fixes

• Server: Fix challenge response authentication (Yubikey)
• Server: Fix enroll of QR Token when username in multiple realms
• Server: Allow utf-8 filenames in FileSMSProvider configuration
• Server: fix for HSM migration problems
• Server: Fix reusing OTP counter for email token if challenge timed out
• Server: Fix typo in error message

• Web UI: Allow more than 80 characters in user field
• Web UI: Fix filtering in policies tab
• Web UI: Fix parsing of duration configuration fields
• Web UI: Fix link to https://keyidentity.com

• API: Add validation of resolver name in defineResolver
• Tools: create-pwidresolver-user: Fix phone fields

LinOTP 2.9.1.4

Bug Fixes

• Vasco: Fix token import from file
• Vasco: Fix authentication
• Web UI: Fix error if token configuation dialog is cancelled
• Manage: Remove broken wildcard search using '.' in UserIdResolver searches
• Migration: Fix migration handling routine
• Authentication: Fix behaviour of check_status with empty pass and otppin=2

LinOTP 2.9.1.3

Bug Fixes

• Server: Fix realm configuration reset when renaming resolvers

LinOTP 2.9.1.2

Bug Fixes

• Server: Fix saving issues with long configuration values

LinOTP 2.9.1.1

Bug Fixes

• Server: Fix LDAP configuration issue with long certificates
• Server: Fix empty user list returned by LDAP backend
• Server: Allow unicode characters in provider configuration
• Packaging: Fix openssl installation issue caused by Pre-Depends relationship

LinOTP 2.9.1

Enhancements

• Server: New token type: KeyIdentity PushToken
• Server: Add optional caching of resolver lookups
• WebUI: Show welcome and update screens
• WebUI: Add dialog for duplicating resolvers
• WebUI: Better password handling in resolver dialogs
• Reporting: Add paging and CSV output for reporting/show
• API: Use semicolon as CSV column separator by default
• UserIdResolver: Add StartTLS support

Bug Fixes

• Server: Fix remote token
• Server: Fix evaluating policies for non-existent realms
• API: Don't localize monitoring json output
• SMPPSMSProvider: Fix encoding issues for non-ascii characters

LinOTP 2.9.0.5

Bug Fixes

• Server: Prefer specific policies over wildcard policies
• Server: Fix QRToken's CT_AUTH case
• Server: Fix combination of policies 'passthru' and 'passOnNoToken'
• WebUI: Reject inequal PINs in set PIN dialogs in addition to the visual
• WebUI: Display certificate in QRToken configuration

LinOTP 2.9.0.4

Bug Fixes

• Server: In case of a matching PIN and wrong OTP, increment fail counters of PIN-matching tokens only
• Server: Fix maxtoken policy
• Server: Fix import of vasco tokens using transport encoding
• WebUI: Remove policy search bar

LinOTP 2.9.0.3

Bug Fixes:

• WebUI: Fix realm creation and editing for IE
• Server: Various small QRToken changes
• Server: Fix tokencount handling during assignment

LinOTP 2.9.0.2

Bug Fixes

• Server: Fix token enrollment using the API directly after a server restart

LinOTP 2.9.0.1

Bug Fixes

• Server: Make constant time comparison compatible with python<=2.7.6

LinOTP 2.9

Enhancements

• Server: Add support for offline authentication
• Server: Add QRToken
• Server: Add forwarding token
• Server: Add reporting controller
• Server: Add support for multiple SMS/e-mail providers
• Server: Add support for long config values
• Server: Add issuer label to OATH tokens
• Server: Allow one-time simplepass tokens
• Server: Allow multiple users with same username in one realm
• Server: Support migration of resolvers for assigned tokens
• Server: Add authorization policies for monitoring controller
• Server: Allow named otppin policies ('token_pin', 'password' and 'only_otp')
• Server: Add SSL/TLS abilities to SMTPSMSProvider
• UserIDResolver: Add class registry and class aliases
• WebUI: Slightly polished look and feel

Bug Fixes

• WebUI: Hide 'Get OTP' button if getotp is deactivated in config
• WebUI: Several bug fixes in different dialogs and elements
• Server: Fix generating transactionids which failed in rare circumstances
• Server: Handle timestamp rounding instead of truncating in MySQL 5.6
• Server: Do not copy old PIN on lost simplepass token
• Packaging: Remove debconf entry 'linotp/generate_enckey'
• WebUI: Validate resolver configuration on resolver definition
• WebUI: Alert in realm dialog if no resolvers are selected

LinOTP 2.8.1.7

LnOTP 2.8.1.6

LinOTP 2.8.1.5

LinOTP 2.8.1.4

LinOTP 2.8.1.3

LinOTP 2.8.1.2

LinOTP 2.8.1.1

LinOTP 2.8.1

LinOTP 2.8.0.3

LinOTP 2.8.0.2

LinOTP 2.8.0.1

LinOTP 2.8

LinOTP 2.7.2.2

LinOTP 2.7.2.1

LinOTP 2.7.2

LinOTP 2.7.1.2

LinOTP 2.7.1.1

LinOTP 2.7.1

LinOTP 2.7.0.2

LinOTP 2.7.0.1

Updating from LinOTP 2.6.1.1 to LinOTP 2.7

LinOTP 2.7 is a major release that contains some big package structure changes.

In our effort to be completely open source we have removed our EE (Enterprise Edition) packages and merged them into the old CE (Community Edition) packages leaving you with packages that contain all the features. The CE/EE terminology is obsolete.

If you had previously edited your linotp.ini to activate the audit trail please update the file and replace:

linotpAudit.type = linotp.lib.Audit.SQLAudit

with:

linotpAudit.type = linotp.lib.audit.SQLAudit

apt-get update && apt-get upgrade

apt-get install linotp-smsprovider

apt-get remove linotp-ee linotp-useridresolver-ee
dpkg -i linotp linotp-useridresolver linotp-smsprovider

sudo apt-get install linotp-adminclient-gui linotp-adminclient-cli

pip uninstall LinOTP-EE LinOtpUserIdResolverEE

pip uninstall LinOTPAdminClientCE LinOTPAdminClientEE
pip install LinOTPAdminClientCLI LinOTPAdminClientGUI

Updating from LinOTP 2.6.1 to LinOTP 2.6.1.1

LinOTP 2.6.1.1 is a patch release for LinOTP 2.6.1

SMSProvider 2.6.1.1 has one new dependency:

• socksipy, either contained in httplib2 >= 0.7 or from its own package.

apt-get install python-socksipy

dpkg -i linotp_2.6.1.1-1_all.deb \
        linotp-smsprovider_2.6.1.1-1_all.deb \
        libpam-linotp_2.6.1.1-1_all.deb

pip install --upgrade /path/to/SMSProvider-2.6.1.1.tar.gz

Updating from LinOTP 2.6.0.3 to LinOTP 2.6.1

LinOTP 2.6.1 has two new dependencies:

• python-migrate for additional client information in the Audit trail and
• python-httplib2.

apt-get install python-migrate python-httplib

dpgk -i linotp_2.6.1-1_all.deb \
        linotp-ee_2.6.1-1_all.deb \
        linotp-useridresolver_2.6.1-1_all.deb \
        linotp-useridresolver-ee_2.6.1-1_all.deb \
        linotp-smsprovider_2.6.1-1_all.deb

pip install --upgrade linotp
pip install /path/to/LinOtpUserIdResolverEE-2.6.1.tar.gz
pip install /path/to/LinOtpUserIdResolver-2.6.1.tar.gz
pip install /path/to/SMSProvider-2.6.1.tar.gz

pip freeze

Updating from LinOTP 2.6 to LinOTP 2.6.0.3

LinOTP 2.6.0.3 is a patch release for LinOTP 2.6 and 2.6.0.x.

dpkg -i linotp_2.6.0.3-1_all.deb \
        linotp-useridresolver-ee_2.6.0.3-1_all.deb

pip install --upgrade /path/to/LinOtpUserIdResolverEE-2.6.0.3.tar.gz

Updating from LinOTP 2.6 to LinOTP 2.6.0.1

LinOTP 2.6.0.1 is a patch release for LinOTP 2.6.

dpkg -i linotp_2.6.0.1-1_all.deb \
        linotp-useridresolver_2.6.0.1-1_all.deb \
        linotp-useridresolver-ee_2.6.0.1-1_all.deb \

pip install --upgrade /path/to/LinOtpUserIdResolverEE-2.6.0.1.tar.gz

Updating from LinOTP 2.5.2 to LinOTP 2.6

LinOTP 2.6 introduces a common challenge response mechanism. For this a new table "challenges" was added to the database model.

dpkg -i linotp_2.6-1_all.deb \
        linotp-ee_2.6-1_all.deb \
        linotp-useridresolver_2.6-1_all.deb \
        linotp-useridresolver-ee_2.6-1_all.deb \
        linotp-doc_2.6-1_all.deb \
        linotp-smsprovider_2.6-1_all.deb

pip install --upgrade /path/to/LinOTP-EE-2.6.tar.gz
pip install --upgrade /path/to/LinOtpUserIdResolverEE-2.6.tar.gz
pip install --upgrade /path/to/LinOtpDoc-2.6.tar.gz
pip install --upgrade /path/to/Smsprovider-2.6.tar.gz

paster setup-app <your-path-to>/etc/linotp2/linotp.ini

Updating from LinOTP 2.5.1 to LinOTP 2.5.2

dpkg -i linotpuseridresolver_2.5.2-1_all.deb \
        linotpuseridresolveree_2.5.2-1_all.deb \
        linotpdoc_2.5.2-1_all.deb \
        smsprovider_2.5.2-1_all.deb \
        linotp_2.5.2-1_all.deb \
        linotp-ee_2.5.2-1_all.deb \
        linotp-useridresolver_2.5.2-1_all.deb \
        linotp-useridresolver-ee_2.5.2-1_all.deb \
        linotp-doc_2.5.2-1_all.deb \
        linotp-smsprovider_2.5.2-1_all.deb

dpkg -r linotpdoc linotpuseridresolver linotpuseridresolveree smsprovider

pip install --upgrade /path/to/LinOTP-EE-2.5.2.tar.gz
pip install --upgrade /path/to/LinOtpUserIdResolverEE-2.5.2.tar.gz
pip install --upgrade /path/to/LinOtpDoc-2.5.2.tar.gz
pip install --upgrade /path/to/Smsprovider-2.5.2.tar.gz

Updating from LinOTP 2.5.0 to LinOTP 2.5.1

dpkg -i linotp_2.5.1_all.deb linotp-ee_2.5.1_all.deb linotpuseridresolveree_2.5.1_all.deb \
    linotpdoc_2.5.1_all.deb python-qrcode_2.4.2_all.deb

pip install -–upgrade linotp

pip install qrcode
pip install –-upgrade /path/to/packages/LinOTP-EE-2.5.1.tar.gz
pip install –-upgrade /path/to/packages/LinOtpUserIdResolverEE-2.5.1.tar.gz
pip install –-upgrade /path/to/packages/LinOtpDoc-2.5.1.tar.gz

Updating from LinOTP 2.4.4 to LinOTP 2.5.0

dpkg -i linotp_2.5.0-8_all.deb linotp-ee_2.5.0_all.deb linotpuseridresolveree_2.5.0-2_all.deb

paster setup-app /etc/linotp2/linotp.ini

pip install –-upgrade linotp

pip install –-upgrade /path/to/packages/LinOTP-EE-2.5.0.tar.gz
pip install –-upgrade /path/to/packages/LinOtpUserIdResolverEE-2.5.0-2.tar.gz