Release Notes
11 July 2024, 11:05
These release notes provide information about the Active Roles 8.0.1 SP3 LTS release. For the most recent documents and product information, see Active Roles Technical Documents on the One Identity support portal.
Active Roles 8.0.1 SP3 LTS (build 8.0.1.304) is a standalone service pack release containing additional resolved issues compared to 8.0.1 LTS (build 8.0.1.91) and its previous service packs.
For more information on other resolved issues fixed in Active Roles 8.0.1 SP3 LTS and the previous 8.0.1 LTS releases, see Resolved issues.
For more information on the list of known issues, see Known issues.
The following is a list of enhancements contained in Active Roles 8.0.1 LTS and its service packs. Newer service packs cumulatively contain the enhancements of previous service packs and the initial Active Roles 8.0.1 LTS release.
Active Roles 8.0.1 SP3 LTS contains no new enhancements compared to 8.0.1 LTS and its previous service packs.
NOTE: The following enhancements are available starting from Active Roles 8.0.1 SP1 LTS (build 8.0.1.102). To check the build of your Active Roles 8.0.1 LTS installation:
In the Active Roles Configuration Center, navigate to 
Alternatively, open the Add or Remove Programs list of the operating system, search for One Identity Active Roles, then click its entry.
| Enhancement | Issue ID |
|---|---|
|
General security enhancements in all Active Roles components. |
444729 |
NOTE: The following enhancements are available starting from Active Roles 8.0.1 LTS (build 8.0.1.91).
| Enhancement | Issue ID |
|---|---|
|
In preparation for the deprecation of the Remote PowerShell (RPS) protocol in Exchange Online PowerShell, Active Roles 8.0.1 LTS is updated to:
For more information, see Announcing Deprecation of Remote PowerShell (RPS) Protocol in Exchange Online PowerShell in the Microsoft Tech Community portal. NOTE: You can continue using cmdlet New-PSSession to connect to on-premises Exchange Server deployments. |
402974 |
| Enhancement | Issue ID |
|---|---|
|
Updated the Generic SCIM Connector with the following enhancements:
For more information, see Configuring data synchronization with the Generic SCIM Connector in the Active Roles Synchronization Service Administration Guide. |
404915 |
|
In preparation for the deprecation of the Remote PowerShell (RPS) protocol in Exchange Online PowerShell, Active Roles Synchronization Service is updated with the following enhancements:
For more information on configuring the updated connectors, see Working with Microsoft 365 and Working with Microsoft Azure Active Directory in the Active Roles Synchronization Service Administration Guide. |
403476 |
|
The Synchronization Service Capture Agent now supports Local Security Authority (LSA). For more information, see Configuring Additional LSA Protection in the Microsoft Windows Server documentation. |
125828 |
| Enhancement | Issue ID |
|---|---|
|
The Active Roles Web Interface was updated to support quick searches for AD LDS and Azure AD objects. These settings are enabled by default: disabling them will result in AD LDS and Azure AD objects not appearing in quick search results. |
412502 |
The following is a list of issues addressed in Active Roles 8.0.1 LTS and its service packs. Newer service packs cumulatively contain the resolved issues of previous service packs and the initial Active Roles 8.0.1 LTS release.
NOTE: The following issues were fixed only in Active Roles 8.0.1 SP3 LTS (build 8.0.1.304). To check the build of your Active Roles 8.0.1 LTS installation:
In the Active Roles Configuration Center, navigate to
Alternatively, open the Add or Remove Programs list of the operating system, search for One Identity Active Roles, then click its entry.
| Resolved Issue | Issue ID |
|---|---|
|
Previously, after creating a group family, the members that were selected during the creation process were not added to the group family. This issue occurred because the wizard was running the process in an incorrect order. Instead of wiping the group members before populating the group with users, the wizard populated the group family first and then wiped it, deleting the newly-added users. The issue is now fixed, and the members that are specified during the creation process are added to the group family. |
459664 |
|
Previously, if a hybrid Azure user was added to cloud-only Azure groups, the deprovisioning procedure did not remove the hybrid user from cloud-only Azure distribution groups (and potentially from other subsequent cloud-only Azure groups either). However, all other deprovisioning steps (such as deactivating the Azure user) continued. The Active Roles Console and Web Interface also did not notify users about the partial deprovisioning failure. This issue is now fixed, so group membership removal now works correctly for all supported cloud-only Azure group types that were assigned manually to the user. The edsvaAzureUserDeprovisionMemberOfList attribute was also updated to include more structured information about the removed role assignments. |
424099 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, when running a workflow that has been configured for Azure BackSync, the synchronization workflow could fail. The issue was caused by a version checking problem and is now fixed. |
457389 |
NOTE: The following issues were fixed starting from Active Roles 8.0.1 SP2 LTS (build 8.0.1.204). To check the build of your Active Roles 8.0.1 LTS installation:
In the Active Roles Configuration Center, navigate to
Alternatively, open the Add or Remove Programs list of the operating system, search for One Identity Active Roles, then click its entry.
| Resolved Issue | Issue ID |
|---|---|
|
Previously, when synchronizing user licenses using the Azure AD or Microsoft 365 connectors, synchronization could fail. The issue was caused by querying the users' licenseDetails attribute as part of the synchronization process. When querying the licenseDetails attribute, in some cases, Microsoft Graph API responded with a 404 Not found error message, causing either the Azure AD or the Microsoft 365 connector to cancel the synchronization process. The issue is now resolved: the users that get stuck in Azure AD are now bypassed during the synchronization process and do not cause any errors. |
422136 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, the Deleted Objects container did not appear if additional Active Directory features (for example, Privileged Access Management) were enabled. This issue is now fixed, and the Deleted Objects container appears regardless of the number of AD features enabled in your environment. |
455321 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, attempting to synchronize the telephoneNumber AD attribute of a hybrid Azure user to the BusinessPhones Azure AD attribute failed with the following error if the BusinessPhones attribute has been empty: Invalid value specified for property 'businessPhones' of resource 'User'. This issue occurred because Synchronization Service could not update the BusinessPhones attribute if it was empty. This issue is now fixed. |
426228 |
|
Previously, when synchronizing Azure user licenses using the Azure AD or Microsoft 365 connectors, the synchronization process could fail with an Access token is expired error message. This issue occurred in case of a very large amount of users because the access token from Microsoft Graph API was only valid for 1 hour, but synchronizing the licenses took longer, and Synchronization Service did not refresh the access token. The issue is now resolved. |
419838 |
|
Previously, if you used the Synchronization Service Console with a different user than the one used for running Synchronization Service, the following errors could occur:
This issue occurred because Active Roles Synchronization Service could not properly access the secret used for authenticating these connections when you accessed Synchronization Service with a user other than the one that runs the service. The issue was fixed by making sure that Synchronization Service can properly access the certification store where the required secret is stored, regardless of the user you use. |
418137 |
|
Previously, when running Azure BackSync (or any Update sync workflow that used the Azure AD Connector) to synchronize group members after making changes to a group, Azure BackSync (or the sync workflow) failed with the following error: One or more added object references already exist for the following modified properties: 'members'. This issue occurred because Synchronization Service used expand queries to retrieve Azure group members (and object reference type attributes in general) with two limitations:
As Synchronization Service retrieved only the first 20 member objects, Azure BackSync or the Update sync workflow could run into data synchronization anomalies, such as trying to assign an object to a group where it was already a member. The issue was fixed by removing the previous limitations of the expand query, so that it can retrieve every member of a group (or every other object reference type attribute). This fix affects the following object reference type attributes:
|
418031 |
|
Previously, when running a sync workflow that used the Azure AD Connector for group object mapping, Synchronization Service could not map the object reference type attributes on Azure group objects, and showed the following error: Synchronization steps aborted. Details: the given key was not present in the dictionary. This issue occurred because the Azure AD Connector was processing the response incorrectly when querying the affected attributes from Graph API. The issue was fixed by updating the mapping for the following object reference type attributes, so that the Azure AD Connector can process Graph API responses correctly:
|
417804 |
|
Previously, the Microsoft 365 Connector (formerly known as Microsoft Office 365 Connector) could only synchronize up to 1,000 mail users. This limitation has been removed. |
405966 |
NOTE: The following issues were fixed starting from Active Roles 8.0.1 SP1 LTS (build 8.0.1.102).
| Resolved Issue | Issue ID |
|---|---|
|
Previously, Active Roles forced rebuilding dynamic groups each time a member was added to or removed from the dynamic group. This issue is now fixed, so Active Roles now rebuilds dynamic groups only if the rebuild is triggered manually or with a Scheduled Task. |
443493 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, the change history for operation types Deprovision, Undo Deprovision and Run Scheduled Workflow remained indefinitely in the Management History database despite running the Change Tracking Cleanup scheduled task. The issue is now fixed and old Management History records are deleted as expected. |
399889 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, the Azure AD Connector could fail to find all objects in Azure during import tasks. This issue could occur if HttpClient timed out during Graph API requests, for example because of network issues. In such cases, Azure AD Connector could not handle the timeout correctly. The issue was fixed by:
|
437816 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, when using Active Roles in a forest topology with:
Then users registered in another child domain of the forest could not log in to the Active Roles Web Interface. This issue was fixed by making sure that if Active Roles does not find the user in the current domain, then it continues searching for them in the forest using wider referral scopes each time it fails. |
447483 |
|
Previously, authentication would fail under the following conditions:
The issue has been resolved. |
437298 |
|
Previously, when creating an Azure or hybrid user, the Licenses tab did not populate even if the Azure tenant had licenses assigned. The issue is now resolved. |
433681 |
NOTE: The following issues were fixed in Active Roles 8.0.1 LTS (build 8.0.1.91) and its service packs.
| Resolved Issue | Issue ID |
|---|---|
|
Previously, scheduled Active Roles operations could fail with the following error if the Active Directory domain controller (DC) assigned to perform the scheduled operation was unavailable: The server is not operational. This issue occurred because Active Roles did not fall back to another working DC in the Disaster Recovery Plan (DRP) process in such cases, and is now fixed. |
407373 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, the Active Roles Configuration Transfer Wizard could not be installed, even if the required Active Roles ADSI Provider was installed. This issue was caused by a version checking problem, and is now fixed. |
389286 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, when applying both an Access Template (AT) using a Full Control permission and another granular AT denying access to certain password-related attributes (such as PasswordNeverExpires, UserCannotChangePassword, UserMustChangePasswordAtNextLogon) to a user, the deny AT did not take effect for the user. This issue was caused by the AT specifying an explicit deny not taking precedence over the AT using the Full Control permission. The issue was fixed by ensuring that explicit deny ATs always take precedence over inherited allow permissions. |
410412 |
|
Previously, in certain environments, Active Roles might not update Dynamic Groups in time when adding a new rule or forcing a rebuild. Also, in case of more than 1,000 changes, the changes were not processed until the nightly scheduled task. To solve this problem, Active Roles features a rebuilt Dynamic Group logic that removes the 1,000 group member limit for normal group membership changes, and also ensures that changes are now always processed immediately. |
405859 |
|
Previously, when configuring the mail configuration in Configuration > Server Configuration > Mail Configuration > Default Mail Settings Properties to use Exchange Web Services with Exchange Online and send approval responses by email, response emails sent by approvers could stuck indefinitely without being processed by Active Roles. This problem did not affect approval workflows using on-premises Exchange Server mailboxes. The issue was caused by approval notifications not supporting Exchange Web Service modern authentication, and is now fixed. |
404659 |
|
Previously, when configuring the mail configuration in Configuration > Server Configuration > Mail Configuration > Default Mail Settings Properties to use Exchange Web Services with Exchange Online and send approval responses by email, the mailto: links of approval workflow notification emails always contained the service account address even if an impersonated account was configured in the mail configuration settings. The issue was caused by approval notifications not supporting Exchange Web Service modern authentication, so Active Roles could not collect emails from the impersonated account. Instead, it was falling back to the service account address. This issue is now fixed, so when you configure an impersonated account address, that email address will appear properly in the approval workflow email messages. |
404217 |
|
Previously, the change history for operation types Deprovision, Undo Deprovision and Run Scheduled Workflow remained indefinitely in the Management History database despite running the Change Tracking Cleanup scheduled task. The issue is now fixed and old Management History records are deleted as expected. |
399889 |
|
Previously, users received an Access denied error in the Web Interface when attempting to create a new cloud-only user if any of the following Access Templates (ATs) were assigned to them in the Active Roles Console:
This issue is now fixed, and assigning these ATs to users now delegate the proper administration permissions. |
392939 |
|
Previously, when adding members to a room mailbox with the Properties > Resource Information > Resource in-policy requests > Selected recipients setting, deleting an added user either via Active Roles or native Active Directory tools resulted in Active Roles failing to load the list of added users. This issue occurred because Active Roles Console could not load the list of assigned users due to the null value of deleted users, and was fixed by filtering out deleted users from the list. |
390095 |
|
Previously, undoing the deprovision of a user object that was originally licensed via group-based licensing would result in the previous license reassigned to the object directly instead of inheriting it from the group. The issue is fixed and now if a user has a license inherited from a group, after deprovisioning and undo-deprovisioning it, the license will be inherited from the group again instead of being reassigned directly. |
388433 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, the Active Roles Management Pack for SCOM showed an incorrect version number. This issue is now fixed. |
405577 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, attempting to install Microsoft OLE DB Driver for SQL Server via the Active Roles installer required users to manually install the prerequisite Microsoft Visual C++ Redistributable for Visual Studio packages, as they were not included in the Active Roles installation package. This issue was fixed by including the packages in the installer. |
411389 |
|
Previously, in the Introduction page of the installer, the Release Notes URL was incorrect and did not work. This issue is now fixed. |
388317 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, when running the Azure BackSync with the Azure AD Connector for several thousand users, Synchronization Service did not indicate the number of processed user objects until all user objects were processed. Because of this, it could appear that nothing happened until the on-screen counter jumped to the total number of processed objects. The issue is fixed, and now the counter of processed objects in the Azure AD Connector increases gradually, as expected. |
401938 |
|
Previously, the Synchronization Service Capture Agent recorded and processed password change events for computer accounts. This behavior was changed so that the Capture Agent no longer logs and forwards password change events for computer accounts to the Synchronization Service. |
307297 |
|
Previously, the SCIM Connector did not support synchronizing data from WorkdayHR via Starling Connect. This issue was fixed by updating the WorkdayHR schema. |
294258 |
| Resolved Issue | Issue ID |
|---|---|
|
Previously, when setting a custom global color scheme in Customization > Global settings > Color scheme, the customized Web Interface scheme could appear incorrectly in the user interface, with the sidebar colors, various selected elements and certain panes not following the base color of the scheme. This issue was fixed by adjusting the management of customized Web Interface themes. |
407336 |
|
Previously, customizing the Web Interface could negatively impact the functionality and performance of object search queries. Following customization, queries in the Web Interface could return too many objects, and query searches could slow down due to performing complex internal filtering before displaying query results in the Web Interface. This issue is now fixed, so customized Web Interface instances now work without the listed problems. |
395064 |
|
Previously, searching for Azure objects took approximately 15-20 seconds. The issue has been resolved by modifying Microsoft Graph API pagination to reduce network traffic. As a result, searching for Azure objects is now significantly faster. |
389314 |
|
Previously, when selecting an AD LDS user, the Web Interface returned an Unable to load contents error instead of listing the available user management actions. This issue is now fixed, and the list of actions is now populated correctly. |
386102 |
|
Previously, using a personal view to open an Organizational Unit (OU) whose name contained special characters resulted in a Directory object not found error. This issue was caused by Active Roles removing these special characters from the OU name when saving the configured personal view, and it is now fixed. |
322727 |
|
Previously, when using the Customization > Directory Objects > Customize Navigation Bar > General option of the Web Interface to open the Item Properties of the Reload button or the Restore Default button, clicking OK to close the dialog without any changes and reloading the configuration resulted in the changed Reload or Restore Default button no longer working. This issue occurred because Active Roles was unable to get the target URL of these buttons, resulting in the Item Properties > URL to open field appearing empty in the Web Interface. If this field was left empty, clicking OK in the dialog to save the button settings broke the button. To fix the issue, the Web Interface now sends a pop-up alert to inform users that the URL to open field cannot be left empty. |
322689 |
|
Previously, when copying a shared, equipment or room mailbox in the Web Interface, the copied mailbox did not inherit the original mailbox type, and was created as a standard User Mailbox instead. In other words, the value of its msExchRecipientDisplayType attribute was always set to 1073741824 instead of inheriting the original value. This issue was caused by a Web Interface infrastructure problem, and was fixed by implementing a switch case to determine the type of mailbox and add the proper attribute during the copy process. |
307164 |
|
Previously, if a user was assigned to a group with a temporary membership, attempting to assign the same group membership again to the user via the Member of > Add command resulted in Active Roles overwriting the temporary group membership of the user. This behavior differed from the Active Roles Console, which returned an error message in this scenario. To ensure that the Web Interface works the same as the Active Roles Console, the Web Interface was updated to filter out already added elements, and return the following message when attempting to assign the user again to the same group: The object 'groupName' is already in the list and cannot be added for the second time. |
289342 |
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Nutzungsbedingungen Datenschutz Cookie Preference Center
