X-Road v7.3.0 Release Notes
- Raido Kaju
- Petteri Kivimäki
- Andres Rosenthal
Release Info
Version number | 7.3.0 |
|---|---|
Release date | 30.06.2023 |
Supported versions |
|
Supported platforms | Central Server
Configuration Proxy
Security Server
|
Official documentation | |
Source code | |
Software license |
Changes in This Release
Summary
A new user interface improves the user experience (UX) for Central Server administrators.
The new intuitive user interface makes regular administrative tasks easier and supports streamlining the onboarding process of new X-Road members.
More information related to the new user interface can be found in Appendix 1.
Common maintenance and configuration tasks can be automated using the management API.
More information about the management API can be found in the Central Server User Guide.
The full OpenAPI 3 description of the API is available here.
Remove the requirement for complementary management requests on the Central Server.
Authentication certificate registration requests are sent from the Security Server and approved on the Central Server. Creating a complementary request on the Central Server is not required anymore.
Client registration requests are sent from the Security Server and approved on the Central Server. Creating a complementary request on the Central Server is not required anymore.
Security improvements on the Central Server:
Encrypt backup files (opt-in).
Verify integrity of backup files on restore.
X-Road 7.3.0 no longer supports JAVA 8. Both the Central Server and Security Server require JAVA 11 to be installed. The JAVA 11 package is now a dependency of the software and will be installed automatically. No action from the user is required if Ubuntu operating system is used and X-Road has been originally installed using version 7.0.0 or later.
If X-Road was originally installed before version 7.0.0, some manual steps are required after the upgrade (otherwise X-Road services don’t start after the upgrade):
Remove the line defining
JAVA_HOMEfrom/etc/xroad/services/local.conf.Make sure that Java 11 is set as the default Java version on operating system level and change it as default if needed.
Restart the X-Road services.
On RHEL7 and RHEL8, regardless of the X-Road version that was originally installed, make sure that Java 11 is set as the default Java version on operating system level and change it as default if needed.
Note: These configuration changes have been automated in X-Road version 7.3.1 that was released in July 2023.
X-Road 7.3.0 contains a known issue, where automatic backups are created 60 times for one backup task. This is due to an issue with the default CRON expression. We are working on a fix, but until then a workaround is to add the following lines to your /etc/xroad/conf.d/local.ini file:
[configuration-client]proxy-configuration-backup-cron=0 15 3 * * ?
And then restarting the configuration client service with:
sudo systemctl restart xroad-confclient
Completed Issues
Issue ID | Type | Summary |
|---|---|---|
Improvement | Improve security and configurability by separating normal and admin database users so that the application user cannot make changes to the database schema. The migrations user is created on new installs, upgrades are not affected. | |
Fix | Replace the GSON library with Jackson so that we only use one JSON library across the project. | |
Fix | Migrate Ruby based database migration framework to Liquibase on the Central Server so that we only use one migration framework across the project. | |
Fix | Migrate Central Server database entities to Hibernate so that we only use one ORM framework across the project. | |
Improvement | Document configuring mTLS authentication with the PostgreSQL database for both the Security Server and Central Server. The documentation can be found here. | |
New | Plan out the new member management and authentication certificate registration components and API-s. | |
New | Provide information about the current cluster node on the Central Server web UI. | |
New | Plan out the new Central Server management REST API. The full OpenAPI 3 description is available here. | |
Fix | Unify identifier checks on the Security Server and Central Server so that both follow the same rules. Starting from version 7.3.0, the allowed characters in X-Road identifiers are: | |
Improvement | Improve backup scheduling for automated backups on the Security Server to remove the chance that it would collide with retrieving global configuration, which caused errors when they happened at the same time. Before version 7.3.0, the Security Server automatic backup schedule was defined in the [configuration-client]
proxy-configuration-backup-cron=* 15 3 * * ? | |
New | Add support to sign and encrypt Central Server backups. Add integrity verification of Central Server backup files on restore. | |
New | Add new registration service package ( Log files Removed log files and directories:
New log files:
Services Removed services:
New services:
| |
Improvement | Make global configuration parts validation more robust on the Central Server. Before version 7.3.0, global configuration parts were validated by running the validator via a bash script and it was possible to define the validator in the Central Server configuration. This enabled adding new configuration parts without making changes to the Central Server source code. Starting from version 7.3.0 the validators are called from JAVA directly and all the configuration is hard-coded. Therefore, adding new custom configuration parts requires changes to the Central Server source code. Also, all the existing custom validators do not work anymore without changes to the Central Server code. | |
Fix | Remove support for central services from the new Central Server due to lack of use for the feature. | |
Fix | Remove unused code related to security categories from both the Security Server and Central Server. | |
Improvement | Include the client Security Server's IP access in the Central Server audit log so the action can more easily be traced to its origin. | |
Improvement | Forward management request origin IP addresses (=client Security Server's IP) to the Central Server REST API so that they can be logged in audit logs. | |
Fix | During the Central Server version upgrade to version 7.3.0 the old UI's TLS key and certificate are migrated to the new UI. | |
Improvement | Create a separate security hardening guide that provides information about hardening the Central Server and Security Server host configuration. | |
Fix | Remove unused code related to the | |
Improvement | Implement protection for host header injection for the Central Server UI and Security Server UI. By default, the host header allows any value which would be a security risk if the Central Server or Security Server admin UI could be accessed by bad actors. To mitigate the issue, it’s suggested to use the More information about the | |
Fix | On the Security Server, the following application properties are deprecated:
When the properties are present at the Security Server startup, a deprecation warning is logged in Instead, the following properties for
More information about the properties is available in the System Parameters User Guide. The Security Server uses | |
Fix | Re-implement the web service endpoint to check the Central Server cluster status. Old URL: New URL: | |
Improvement | The Central Server now uses Spring datasource properties instead of the old properties in the database connection configuration. Old properties will automatically be migrated to Spring datasource properties. The following properties inside
The following properties should be used instead for defining the
The
As an example, if the
| |
Fix | Make the global configuration generation in the new Central Server implementation configurable. | |
New | Make the OpenAPI description of the Central Server management REST API available on the Central Server. | |