X-Road v7.3.0 Release Notes

Release Info

Version number

7.3.0

Release date

30.06.2023

Supported versions

  • 7.3.0

  • 7.2.2

  • 7.1.3

Supported platforms

Central Server

  • Ubuntu 20.04 LTS

  • Ubuntu 22.04 LTS

Configuration Proxy

  • Ubuntu 20.04 LTS

  • Ubuntu 22.04 LTS

Security Server

  • Ubuntu 20.04 LTS

  • Ubuntu 22.04 LTS

  • RHEL 7

  • RHEL 8

  • Docker

Official documentation

https://github.com/nordic-institute/X-Road/tree/master/doc

Source code

https://github.com/nordic-institute/X-Road/tree/master

Software license

MIT



 

On this page:



Changes in This Release

Summary

  • A new user interface improves the user experience (UX) for Central Server administrators.

    • The new intuitive user interface makes regular administrative tasks easier and supports streamlining the onboarding process of new X-Road members.

    • More information related to the new user interface can be found in Appendix 1.

  • Common maintenance and configuration tasks can be automated using the management API.

    • More information about the management API can be found in the Central Server User Guide.

    • The full OpenAPI 3 description of the API is available here.

  • Remove the requirement for complementary management requests on the Central Server.

    • Authentication certificate registration requests are sent from the Security Server and approved on the Central Server. Creating a complementary request on the Central Server is not required anymore.

    • Client registration requests are sent from the Security Server and approved on the Central Server. Creating a complementary request on the Central Server is not required anymore.

  • Security improvements on the Central Server:

    • Encrypt backup files (opt-in).

    • Verify integrity of backup files on restore.

X-Road 7.3.0 no longer supports JAVA 8. Both the Central Server and Security Server require JAVA 11 to be installed. The JAVA 11 package is now a dependency of the software and will be installed automatically. No action from the user is required if Ubuntu operating system is used and X-Road has been originally installed using version 7.0.0 or later.

If X-Road was originally installed before version 7.0.0, some manual steps are required after the upgrade (otherwise X-Road services don’t start after the upgrade):

  1. Remove the line defining JAVA_HOME from /etc/xroad/services/local.conf.

  2. Make sure that Java 11 is set as the default Java version on operating system level and change it as default if needed.

  3. Restart the X-Road services.

On RHEL7 and RHEL8, regardless of the X-Road version that was originally installed, make sure that Java 11 is set as the default Java version on operating system level and change it as default if needed.

Note: These configuration changes have been automated in X-Road version 7.3.1 that was released in July 2023.

X-Road 7.3.0 contains a known issue, where automatic backups are created 60 times for one backup task. This is due to an issue with the default CRON expression. We are working on a fix, but until then a workaround is to add the following lines to your /etc/xroad/conf.d/local.ini file:

[configuration-client]
proxy-configuration-backup-cron=0 15 3 * * ?

And then restarting the configuration client service with:

sudo systemctl restart xroad-confclient

Completed Issues

Issue ID

Type

Summary

Issue ID

Type

Summary

XRDDEV-1093

Improvement

Improve security and configurability by separating normal and admin database users so that the application user cannot make changes to the database schema.

The migrations user is created on new installs, upgrades are not affected.

XRDDEV-1533

Fix

Replace the GSON library with Jackson so that we only use one JSON library across the project.

XRDDEV-1574

Fix

Migrate Ruby based database migration framework to Liquibase on the Central Server so that we only use one migration framework across the project.

XRDDEV-1575

Fix

Migrate Central Server database entities to Hibernate so that we only use one ORM framework across the project.

XRDDEV-1678

Improvement

Document configuring mTLS authentication with the PostgreSQL database for both the Security Server and Central Server. The documentation can be found here.

XRDDEV-1688

New

Plan out the new member management and authentication certificate registration components and API-s.

XRDDEV-1781

New

Provide information about the current cluster node on the Central Server web UI.

XRDDEV-1885

New

Plan out the new Central Server management REST API. The full OpenAPI 3 description is available here.

XRDDEV-1960

Fix

Unify identifier checks on the Security Server and Central Server so that both follow the same rules. Starting from version 7.3.0, the allowed characters in X-Road identifiers are: a-zA-Z0-9'()+,-.=?. A legacy compatibility mode that allows the creation of incompatible identifiers can be enable by setting the common.strict-identifier-checks property to false in /etc/xroad/conf.d/local.ini. Starting from version 7.3.0, the legacy compatibility mode is disabled in fresh installations (common.strict-identifier-checks=true). Instead, when upgrading to version 7.3.0 from an older version, the legacy compatibility mode is enabled (common.strict-identifier-checks=false).

XRDDEV-2219

Improvement

Improve backup scheduling for automated backups on the Security Server to remove the chance that it would collide with retrieving global configuration, which caused errors when they happened at the same time.

Before version 7.3.0, the Security Server automatic backup schedule was defined in the /etc/cron.d/xroad-proxy file using a cron expression. Starting from version 7.3.0, the Security Server automatic backup schedule can be adjusted in the file /etc/xroad/conf.d/local.ini, in the [configuration-client] section, e.g.:

[configuration-client] proxy-configuration-backup-cron=* 15 3 * * ?

XRDDEV-2279

New

Add support to sign and encrypt Central Server backups. Add integrity verification of Central Server backup files on restore.

XRDDEV-2293

New

Add new registration service package (xroad-center-registration-service) and management service package (xroad-center-management-service) to the Central Server packaging. Both packages are automatically installed when the xroad-centralserver package is intalled.

Log files

Removed log files and directories:

  • /var/log/xroad/jetty/jetty.log

New log files:

  • /var/log/xroad/centralserver-admin-service.log

  • /var/log/xroad/centralserver-registration-service.log

  • /var/log/xroad/centralserver-management-service.log

Services

Removed services:

  • xroad-jetty

New services:

  • xroad-center

  • xroad-center-management-service

  • xroad-center-registration-service

XRDDEV-2233

Improvement

Make global configuration parts validation more robust on the Central Server. Before version 7.3.0, global configuration parts were validated by running the validator via a bash script and it was possible to define the validator in the Central Server configuration. This enabled adding new configuration parts without making changes to the Central Server source code.

Starting from version 7.3.0 the validators are called from JAVA directly and all the configuration is hard-coded. Therefore, adding new custom configuration parts requires changes to the Central Server source code. Also, all the existing custom validators do not work anymore without changes to the Central Server code.

XRDDEV-2312

Fix

Remove support for central services from the new Central Server due to lack of use for the feature.

XRDDEV-2349

Fix

Remove unused code related to security categories from both the Security Server and Central Server.

XRDDEV-2350

Improvement

Include the client Security Server's IP access in the Central Server audit log so the action can more easily be traced to its origin.

XRDDEV-2351

Improvement

Forward management request origin IP addresses (=client Security Server's IP) to the Central Server REST API so that they can be logged in audit logs.

XRDDEV-2352

Fix

During the Central Server version upgrade to version 7.3.0 the old UI's TLS key and certificate are migrated to the new UI.

XRDDEV-2360

Improvement

Create a separate security hardening guide that provides information about hardening the Central Server and Security Server host configuration.

XRDDEV-2381

Fix

Remove unused code related to the security_server_client_names database table from the Central Server.

XRDDEV-2387

Improvement

Implement protection for host header injection for the Central Server UI and Security Server UI.

By default, the host header allows any value which would be a security risk if the Central Server or Security Server admin UI could be accessed by bad actors. To mitigate the issue, it’s suggested to use the allowed-hosts configuration property to configure allowed values for the host header.

More information about the allowed-hosts property is available in the System Parameters User Guide. For Security Server refer to proxy-ui-api and for Central server refer to admin-service.

XRDDEV-2387

Fix

On the Security Server, the following application properties are deprecated:

  • request.sizelimit.regular

  • request.sizelimit.binary.upload

  • ratelimit.requests.per.second

  • ratelimit.requests.per.minute

When the properties are present at the Security Server startup, a deprecation warning is logged in /var/log/xroad/proxy_ui_api.log.

Instead, the following properties for proxy-ui-api should be used:

  • proxy-ui-api.request-sizelimit-regular

  • proxy-ui-api.request-sizelimit-binary-upload

  • proxy-ui-api.rate-limit-requests-per-second

  • proxy-ui-api.rate-limit-requests-per-minute

More information about the properties is available in the System Parameters User Guide.

The Security Server uses proxy-ui-api.* property value if it is provided and defaults to request.*/ratelimit.* if proxy-ui-api.* is not provided.

XRDDEV-2401

Fix

Re-implement the web service endpoint to check the Central Server cluster status.

Old URL: https://<CS_HOST>:4000/public_system_status/check_ha_cluster_status

New URL: https://<CS_HOST>:4000/api/v1/system/high-availability-cluster/status

XRDDEV-2422

Improvement

The Central Server now uses Spring datasource properties instead of the old properties in the database connection configuration. Old properties will automatically be migrated to Spring datasource properties.

The following properties inside db.properties are now deprecated:

  • username

  • password

  • database

  • host

  • port

  • schema

The following properties should be used instead for defining the username, password and schema:

  • spring.datasource.username

  • spring.datasource.password

  • spring.datasource.hikari.data-source-properties.currentSchema

The host, port and database properties are combined as a JDBC URL in the following parameter:

  • spring.datasource.url

As an example, if the host was 127.0.0.1, the port was 5432 and the database was centerui_production, the following URL should be used in spring.datasource.url to configure the same values:

  • jdbc:postgresql://127.0.0.1:5432/centerui_production

XRDDEV-2427

Fix

Make the global configuration generation in the new Central Server implementation configurable.

XRDDEV-2428

New

Make the OpenAPI description of the Central Server management REST API available on the Central Server.