Active Roles 8.2 - Release Notes

Previously, in environments where multiple Active Roles service instances were configured, if the Execute on setting of the Dynamic Group Checker built-in scheduled task has been set to its default All servers value instead of a specific service in the Active Roles Console, then the value of the edsaDGOriginatingService attribute of dynamic groups was set to Unknown.

Because of this:

• The Dynamic Group Updater built-in scheduled task could not update and rebuild the memberships of dynamic groups.

• If the dynamic groups were updated so that their edsaDGOriginatingService attribute was set to a specific Active Roles service, the Dynamic Group Updater scheduled task reverted the value of the attribute to Unknown.

This issue is fixed, so that selecting All servers for the Execute on setting of the Dynamic Group Checker scheduled task now correctly assigns the Active Roles service instance running the scheduled task, allowing the Dynamic Group Updater scheduled task to correctly rebuild the membership list of dynamic groups.

Previously, Active Roles kept the entries of deprovisioning and undo deprovisioning operations in the change history database indefinitely, even if a Change Tracking Cleanup scheduled task was configured to delete older change tracking log entries. Keeping Deprovision and UndoDeprovision entries indefinitely caused the leftover data to grow in size over time.

This issue is now fixed, so the Deprovision and UndoDeprovision entries of the management history database are now also deleted during cleanup.

Previously, importing a configuration database from a previous Active Roles version created on a different computer resulted in the following error, when configuring the settings of the Source database step in the Import configuration wizard:

Object reference not set to an instance of an object.

This issue is now fixed.

Previously, the Deleted Objects container did not appear if additional Active Directory features (for example, Privileged Access Management) were enabled.

This issue is now fixed, and the Deleted Objects container appears regardless of the number of AD features enabled in your environment.

Previously, during undo deprovisioning, if a virtual attribute could not be restored because it had been deleted and no longer existed, undo deprovisioning failed.

The issue is now fixed: if a virtual attribute cannot be restored because it was deleted, in the undo deprovisioning report, an error message will appear for that virtual attribute. After the other virtual attributes are restored, the remaining undo deprovisioning actions will be performed.

Previously, approving a workflow caused it to fail with the following error message:

Activity name: approvalActivity1
Activity type: ActiveRoles.Workflow.Activities.ApprovalActivity
This activity has terminated this workflow instance.
Approval rule activity has terminated this workflow instance.
Administrative Policy returned an error.
Specified method is not supported.

The issue was caused by the integrated Change Auditor. When an approver accepted a workflow request, the Active Roles Service attempted to set the dynamic directory control value of the Change Auditor in sub-requests (sent by the Active Roles Service) where they were not applicable, causing the workflow operation to run into an error.

The issue is now resolved.

Previously, when using Full Control inside an access template created for moving computer objects, permission precedence was not honored, which caused policy errors.

The issue is now fixed, and the following permission precedence is honored, the first being the highest precedence:

1. Explicit Deny

2. Explicit Allow

3. Inherited Deny

4. Inherited Allow

Previously, if an approval workflow was pending approval, assigning either the subject AD object or the approver group of the request to a different Organizational Unit resulted in the following error when attempting to approve the workflow:

Administration Service encountered an error when retrieving properties of the object. Directory object not found.

This error occurred because Active Roles always attempted to find the subject AD object or the approver group of the workflow via their DN, which changed if the object was moved to a different Organizational Unit.

This issue was fixed by improving the fault tolerance of approver search operations.

Previously, Active Directory users who had permissions to run Active Roles workflows could modify AD objects via workflows, even if they had no permission to any AD objects.

This issue was fixed by adding a new check in the Access Check policy to verify the permissions of the workflow's parent initiator. Now, if the user has permission to run workflows but no permission to the objects that would be modified by running that workflow, the workflow activity will fail with an error message in the Active Roles Console and/or the Web Interface.

To prevent potential memory leaks, the following built-in Script Modules in the Configuration/Script Modules/Builtin/ container were updated to use the $context.O365RemoveAllModulesSessions() method:

• Create Office 365 Shared Mailboxes

• Enabling Azure Roles

• Sample Azure Hybrid Migration

• Search Azure Users and Assign License

Previously, when querying Azure users in a Managed Unit with the edsvaOnPremisesSyncEnabled attribute as the filtering condition, filtering did not work and the query did not return any results.

The issue is now fixed.

Previously, if a hybrid Azure user was added to cloud-only groups, the deprovisioning procedure did not remove the hybrid user from cloud-only distribution groups (and potentially from other subsequent cloud-only groups). However, all other deprovisioning steps (such as deactivating the Azure user) continued. The Active Roles Console and Web Interface also did not notify users about the partial deprovisioning failure.

This issue is now fixed, and group membership removal now works correctly for all supported cloud-only Azure group types that were assigned manually to the user. The edsvaAzureUserDeprovisionMemberOfList attribute was also updated to include more structured information about the removed role assignments.

Previously, when configuring the membership rules of a Managed Unit, the Include Group Members > Select objects window incorrectly listed not just groups, but Azure users as well. Selecting an Azure user and saving your change then resulted in a This Managed Unit has invalid membership rules error.

This issue was fixed by making sure that Azure users are no longer listed in the Include Group Members > Select objects window, and that you can only select groups.

Previously, when adding members to a room mailbox with the Properties > Resource Information > Resource in-policy requests > Selected recipients setting, deleting an added user either via Active Roles or system-provided Active Directory tools resulted in Active Roles failing to load the list of added users.

This issue occurred because Active Roles Console could not load the list of assigned users due to the null value of deleted users, and was fixed by filtering out deleted users from the list.

Previously, if you linked one or more Access Templates to an Azure tenant, changing the Azure tenant type in the Active Roles Configuration Center resulted in the Access Templates losing all their directory object links to the modified Azure tenant.

This issue is now fixed.

Previously, the Microsoft 365 Connector (formerly known as the Office 365 Connector) could fail with a Task was cancelled error message when importing M365 data.

This issue could occur if HttpClient timed out during Graph API requests, for example because of network issues. In such cases, the Microsoft 365 Connector could not handle the timeout correctly.

The issue was fixed by implementing a new retry policy which retries the request up to 3 times before timeout, minimizing the chance of the issue occurring.

Previously, attempting to synchronize the telephoneNumber AD attribute of a hybrid Azure user to the BusinessPhones Azure AD attribute failed with the following error if the BusinessPhones attribute was empty:

Invalid value specified for property 'businessPhones' of resource 'User'.

This issue is now fixed.

Previously, the Microsoft 365 Connector could only retrieve a single service plan instead of the complete list of service plans. For example, in case of an Enterprise license containing 30 service plans, the connector retrieved only the first service plan.

This issue is now fixed, so the Microsoft 365 Connector retrieves all service plans of a license plan.

Fixed a performance issue affecting sync workflows between One Identity Manager and Active Roles Synchronization Service if Active Roles was connected to any Azure tenants.

Previously, attempting to synchronize (add) a group member from a plain-text source to the members attribute of a group with the Azure AD Connector failed with the following error:

Invalid property 'members'.

This error occurred because the Azure AD Connector was not prepared to handle modifying various group types: while certain Azure groups can be modified via Graph API, others can only be modified via the ExchangeOnlineManagement PowerShell module.

The issue was solved by updating the Azure AD Connector to properly identify the member attribute to synchronize and the type of Azure group to update.

Previously, in the Exchange admin center, after logging in to your tenant, when you added a mail-enabled security group as a member to a distribution group, then in the Active Roles Web Interface, you navigated to the distribution group and opened its Members, the following error message appeared:

Error: Object reference not set to an instance of an object.

The issue is now resolved, so in the Web Interface, opening the Members list of a distribution group that contains a mail-enabled security group as a member does not cause any errors.

Previously, if you have specified a value of 150,000 KB (or higher) for the Shared Mailboxes > Email settings > Sent message maximum size or Received message maximum size setting, the text box of these settings showed a different value than what you have set for them.

This issue has been fixed.

Previously, when clicking Menu > Choose columns, moving an advanced attribute from the Hidden columns list to the Displayed columns list and saving it, the previously hidden advanced attribute still did not appear in a new column for users.

The issue is resolved: columns added to the Displayed columns list are displayed for users, and you can also remove previously added columns individually.

Previously, when a group was assigned to the managedBy attribute of another group and adding a member to this first group required approval, the subgroup members of the managedBy group were not notified of the approval task. Consequently, the task did not appear among the approval tasks on the Self-Service Site of the Web Interface for members of subgroups.

The issue is now resolved by expanding the approval task so that members of subgroups within the group designated in the managedBy attribute are now included.

Previously, when creating a hybrid Azure user, the Create Azure Account form was not validated against the policies that administrators set, and let users proceed even if the policies failed.

The issue is now fixed by adding the option to customize or skip validation to every form that validates policies.

Previously, when using the Customization > Directory Objects > user - (My Account) > Create New Command menu of the Active Roles Self-Service Portal, saving and reloading your changes, then opening the new command via the User Profile Editor resulted in the page of the new command appearing in a nested Active Roles Self-Service Portal instance.

This issue was fixed by removing all unnecessary elements from the custom command page, so that no element appears twice on the page.

Previously, after creating a new hybrid Azure user, the Azure Properties > Settings > Usage Location field of the user was always empty, even if a usage location was specified when creating the user. Selecting a value from the Azure Properties > Settings > Usage Location drop-down and saving the change then fixed the problem.

This issue is now fixed, so that the configured usage location appears in the Azure Properties > Settings > Usage Location drop-down immediately after creating the user.

Previously, when selecting an AD LDS user, the Web Interface returned an Unable to load contents error instead of listing the available user management actions.

This issue is now fixed, and the list of actions is populated correctly.

Previously, when using an approval workflow to extend the expiration time of the accountExpires parameter for users, the notification email and the workflow form showed the old and new expiration times in a non-human readable LDAP format until double-clicking the values.

This issue was fixed by implementing a converter to show the expiration times in a readable date and time format by default.

Previously, users who had the Users - Help Desk Access Template assigned to them could not perform bulk password resets when selecting multiple users at once. Instead, they could reset passwords for single users only.

The issue was fixed by adding the edsva-Bulk-Operation-Object-List (Write Bulk Operation Objects) permission to the Users - Help Desk Access Template.