X-Road v7.5.0 Release Notes

Owned by Raido Kaju, created
Last updated: Sept 18, 2024 by Petteri Kivimäki
8 min read

Release Info

Version number

7.5.0

Release date

05.07.2024

Supported versions

  • 7.5.0

  • 7.4.2

  • 7.3.2

Supported platforms

Central Server

  • Ubuntu 20.04 LTS

  • Ubuntu 22.04 LTS

  • Ubuntu 24.04 LTS

Configuration Proxy

  • Ubuntu 20.04 LTS

  • Ubuntu 22.04 LTS

  • Ubuntu 24.04 LTS

Security Server

  • Ubuntu 20.04 LTS

  • Ubuntu 22.04 LTS

  • Ubuntu 24.04 LTS

  • RHEL 7

  • RHEL 8

  • RHEL 9

  • Docker

Official documentation

https://github.com/nordic-institute/X-Road/tree/master/doc

Source code

https://github.com/nordic-institute/X-Road/tree/master

Software license

MIT

 

On this page:

 

Changes in This Release

Summary

  • Support for automated certificate management on the Security Server through ACME.

  • Support for adding / removing Central Server cluster nodes without having to distribute a new version of the configuration anchor.

  • Support for Ubuntu 24.04 LTS.

    • Central Server, Security Server and Configuration Proxy can be migrated from Ubuntu 22.04 LTS to the latest Ubuntu 24.04 LTS version.

    • Ubuntu 24.04 LTS support includes installation packages, and instructions for fresh install and migration from Ubuntu 22.04 LTS.

    • NB! Ubuntu 20.04 is only supported to provide an easier upgrade path to Ubuntu 24.04, we suggest production environments use Ubuntu 22.04 or Ubuntu 24.04

  • Support for Red Hat Enterprise Linux 9 (RHEL9).

    • Security Server can be migrated from RHEL8 to the latest RHEL9 version.

    • RHEL9 support includes installation packages, and instructions for fresh install and migration from RHEL8.

    • NB! RHEL7 is only supported to provide an easier upgrade path to RHEL8 or RHEL9, we suggest production environments use RHEL8 or RHEL9.

  • Minor enhancements and bug fixes based on user feedback.

NB! For the Finnish meta-package version of X-Road (xroad-securityserver-fi), ACME is enabled by default. This applies to the Finnish variants (-fi) of the Security Server Sidecar Docker image too.

For Ubuntu users, who have been running the Security Server since before version 7.4.0, it means that you will likely encounter a port conflict. This is due to versions prior to 7.4.0 using port 80 as the default client information system port for HTTP and ACME now requiring the same port for accepting HTTP challenges.

Fresh installs on Ubuntu starting from 7.4.0 are not affected and neither are the RHEL based installations, as those all use port 8080 by default.

To resolve the issue, you have two options:

  1. If you are not using ACME, it can be disabled by setting the acme-challenge-port-enabled flag to false in your configuration for the proxy-ui-api module: https://docs.x-road.global/Manuals/ug-syspar_x-road_v6_system_parameters.html#39-management-rest-api-parameters-proxy-ui-api. This will disable the HTTP challenge and everything will work as before after the services have been restarted.

  2. Remove the overrides (client-http-port, client-https-port) from the file /etc/xroad/conf.d/local.ini for ports 80 and 443: https://docs.x-road.global/Manuals/ug-syspar_x-road_v6_system_parameters.html#32-proxy-parameters-proxy. After restarting the services, the ports will then default to 8080 and 8443 respectively. Important: This change will also require changing the Security Server URL in any information system in client/consumer role using the Security Server to use either port 8080(HTTP) or 8443(HTTPS/HTTPS NO AUTH). In addition, the firewall configuration regarding ports 80, 443, 8080 and 8443 must be updated accordingly. The list of required firewall configurations can be found in the Security Server Installation Guide.

Completed Issues

Issue ID

Type

Summary

Issue ID

Type

Summary

XRDDEV-918

Improvement

Improve parsing of OpenAPI descriptions when adding a service to the Security Server to provide a similar level of warnings to the WSDL parsing.

XRDDEV-2496

New

Introduce support to add ACME enabled CAs to the Central Server with additional configuration. ACME-related configuration items can be added to the existing CAs too which means that enabling ACME for a CA does not require adding a new CA. Information on how to manage ACME-related certification service setting on the Central Server is available in the Central Server User Guide.

XRDDEV-2505

New

Support Ubuntu 24.04 on the Central Server and Configuration Proxy components. Migration guides from Ubuntu 22.04 to Ubuntu 24.04 are available in the X-Road Knowledge Base:

XRDDEV-2507

New

Support Ubuntu 24.04 on the Security Server components. Migration guides from Ubuntu 22.04 to Ubuntu 24.04 are available in the X-Road Knowledge Base.

XRDDEV-2511

New

Support RHEL9 on the Security Server components. Migration guides from RHEL8 to RHEL9 are available in the X-Road Knowledge Base.

XRDDEV-2523

Improvement

Update the Kubernetes Security Server Sidecar User Guide and Kubernetes Security Server Sidecar Security User Guide to provide instructions to run the Security Server Sidecar using Azure Kubernetes Service (AKS). Now the user guides cover AKS and Amazon Elastic Kubernetes Service (Amazon EKS).

XRDDEV-2532

Improvement

Improve dialog navigation and interactions in the Central Server web interface. Add support for closing dialogues using the Escape key and activating dialogues' primary action (e.g., save, search, next, etc.) using the Enter key.

XRDDEV-2534

New

Introduce capability to request a sign certificate from a trusted CA via the ACME protocol on the Security Server. Information on how to configure ACME on the Security Server can be found in the Security Server User Guide.

XRDDEV-2535

New

Introduce capability to request an authentication certificate from a trusted CA via the ACME protocol on the Security Server. Information on how to configure ACME on the Security Server can be found in the Security Server User Guide.

XRDDEV-2539

Fix

Fix an issue in the signer component that caused HSM connection recovery to be delayed by 20 minutes after restarting the signer.

XRDDEV-2554

Improvement

Support for adding / removing Central Server cluster nodes without having to distribute a new version of the configuration anchor. Improve the global configuration so that node information is correctly passed to the Security Servers and used by them to allow for adding and removing of Central Server nodes without needing a new configuration anchor to be uploaded.

XRDDEV-2561

Fix

Fix an issue on the Security Server that caused dangling database entries to be left after deleting a client.

XRDDEV-2580

Fix

Fix an issue in the Security Server sidecar Docker image that caused a Kubernetes deployment to fail when the PostgreSQL data directory was stored in a volume using a persistent volume claim.

XRDDEV-2581

Fix

Fix a delete button placement issue on the certificate view in the Security Server web interface.

XRDDEV-2584

Fix

Update the Jetty library used in the Security Server proxy component.

XRDDEV-2585

Fix

Update the Spring Boot library used in the Security Server and Central Server components.

XRDDEV-2586

New

Allow defining additional options for PostgreSQL CLI tools used in the Security Server and Central Server processes.

Information on how to use this new configuration is available in the Security Server and Central Server user guides.

XRDDEV-2609

Improvement

Bump the Security Server sidecar Docker images to Ubuntu 24.04.

NB! Upgrading to version 7.5.x requires additional steps, please refer to the following manuals for the details:

XRDDEV-2613

Fix

Fix an issue that caused cleaning up global configuration V2 and V3 temporary files to fail if global configuration generation failed.

XRDDEV-2614

Fix

Fix an issue where a user in the Registration Officer role on the Central Server was not able to add a member due to the member classes endpoint having too strict role requirements.

XRDDEV-2619

Improvement

Improve the Central Server flow when a Security Server adds a subsystem or member that is not yet registered on the Central Server. Now the member can automatically be created when the management request related to it is approved.

 

XRDDEV-2620

Fix

Fix an issue that caused the Security Server to return too much information in an error message in case of a database misconfiguration.

XRDDEV-2621

Improvement

Update the timestamping acceptable failure period ("message-log.acceptable-timestamp-failure-period") from 5 hours to 48 hours in the Finnish meta package ("xroad-securityserver-fi"). After the change, Security Servers that have installed the Finnish meta package remain operational up to 48 hours when the timestamping service is unavailable.

XRDDEV-2623

Fix

Fix an issue that caused the Security Server to incorrectly show a success message when changing the soft-token PIN even if the operation actually failed.

XRDDEV-2649

Fix

Fix an issue that caused a wrong identifier type to be shown in the Central Server UI.

XRDDEV-2653

Fix

Fix an issue that caused deleting a member, unregistering a subsystem and deleting a Security Server to fail on the Central Server.

Issue types: fix (bug fix or technical debt), improvement (improvement to an existing feature), new (a new feature).

New/Updated Dependencies

Dependency

Old Version

New Version

Notes

Dependency

Old Version

New Version

Notes

io.dropwizard.metric

4.1.26

4.2.26

 

org.eclipse.jetty

11.0.17

12.0.7

 

org.glassfish.jaxb

4.0.3

4.0.5

 

org.hibernate

6.2.9.Final

6.5.2.Final

 

com.fasterxml.jackson

2.15.2

2.17.1

 

com.zaxxer:HikariCP

5.0.1

5.1.0

 

org.postgresql:postgresql

42.5.4

42.7.3

 

org.springframework.boot

3.1.5

3.3.1

 

org.springframework.cloud

2022.0.4

2023.0.2

 

com.google.guava

32.1.3-jre

33.0.0-jre

 

org.bouncycastle

1.69

1.78.1

 

org.slf4j

2.0.9

2.0.13

 

ch.qos.logback

1.4.11

1.4.14

 

org.liquibase:liquibase-core

4.19.0

4.28.0