Administration Changelog

The module is now displayed as a frontend module again. This ensures consistent display.

The display of the Security Cockpit has been improved: - In addition to the score, the total score is also displayed - A link to the corresponding documentation page is available - If the check refers to a module instance, you can navigate directly to it - Text is selectable

In addition, the HTTP proxy check has been adjusted so that it does not check for Basic Authentication, as this is not relevant to the security status of the BPC.

A bug in the opensearch-env.bat has been fixed.

The configuration of OIDC and Keycloak backend Connections failed when the BPC homepage was specified as the redirect URL (post-login or post-logout). The cause was the settings validation, which received an HTTP status code 406 when checking the URL of the BPC homepage. As a result, it was not possible to create new OIDC or Keycloak backend Connections or edit existing ones. New cloud deployments that create backend Connections via Custom Resources were also affected.

This issue has been resolved.

The full functionality of the Identity Management user interface is now also available with Keycloak as an identity provider. In addition, the frontend has been expanded to include the tabs “Organizations,” “Roles,” and “Permissions.”

In these tabs, organizations, roles, and permissions can be listed

, created , and deleted .

Furthermore, the users in these groups can be viewed and managed directly.

For organizations and roles (Keycloak as IdP only), role assignments can also be configured.

Further information can be found under Identity Management.

The INUBIT Workflow package now correctly handles BPC 5 calls.

Most workflows are no longer delivered in a protected state.

The attribute names of the records in the payload of Process Actions and Process Starters with context retain their original format and are no longer converted to lowercase.

The attribute names of the records in the payload of process actions and process starters with context retain their original format and are no longer converted to lowercase.

Update OpenSearch according to the update instructions

Fix: During an update, the settings apiKeys (Core) and rendererUrl (Forms) are migrated correctly. apiKeys is converted from a map to an array, and in rendererUrl, "BPC-forms-renderer/index.html" is set as the value.

This update raises the version of Apache Karaf.

Please update Karaf according to the update instructions.

Incorrect behavior in the monitor regarding the data_filter setting has been fixed: If you used the link OR and had not set a base filter, all records were displayed despite the filter rules.

With a AND link, the base filter was negated and combined with the other filter rules via a logical UND. This was incorrect; the base filter is now no longer negated in this case either, and specifies which documents are generally visible. This means that a data record is visible if it satisfies the base filter OR all session-specific filter rules.

Note: If you are using Monitor instances with ` data_filter ` in your BPC deployment, please verify that they still function as intended.

More details on the “ data_filter ” setting can be found here: Restrict the visibility of monitor data

Incorrect behavior in the monitor regarding the data_filter setting has been fixed: If you used OR as a link and did not set a base filter, all records were displayed despite the filter rules.

With a AND link, the base filter was negated and combined with the other filter rules using a logical UND. This was incorrect; the base filter is now no longer negated in this case either, and specifies which documents are generally visible. This means that a record is visible if it meets the criteria of the base filter OR all session-specific filter rules.

Note: If you are using Monitor instances with data_filter in your BPC deployment, please verify that they continue to function as intended.

More details on the “ data_filter ” setting can be found here: Restrict the visibility of monitor data

Data used by OIDC providers for login is stored in an encrypted cookie on the client’s device. This prevents system overload caused by a large number of login requests.

For BPC module developers

If you have developed your own UserFlowIdentityProvider implementation, you must adapt it. The function URI createAuthenticationRequestURI(String requestUrl) has been replaced with UserFlowLoginContext createAuthenticationRequestContext(String requestUrl) and now returns not only the redirect URL to the OIDC login but also a cookie containing the login state. This cookie is set by the frontend during a login attempt.

For BPC administrators

Install the new modules bpc-be-core.jar and bpc-fe-core.war. A restart of the BPC/Karaf is required. If the BPC is still unavailable, please delete the directory karaf/data and restart Karaf. (You may want to back up your log files first)

In Process Monitoring, the settings inubit_referenceEndpoint, inubit_proxyId, and inutbit_baseUrl were consolidated for download via an HTTP proxy and renamed to httpProxy_referenceEndpoint to clarify that they can be downloaded via a generic HTTP proxy connection. The setting inubit_dbTablePrefix was removed because it was only used for legacy scenarios.

Timeseries Management Administrators who do not belong to the "bpcadmin" role and previously only had the "webtsm_admin" permission now need the "webtsm_edit" permission instead. A Timeseries Management Administrator could also be assigned the “WEBTSM_ADMIN” role instead of the specific permission. This would also be more future-proof if, for example, in subsequent versions, finely granular permissions were defined for the endpoints instead of the “webtsm_edit” permission.

The Data Management Module no longer has a standalone backend component (bpc-be-vam.jar). It must be removed during the update.

To perform the update, first remove bpc-be-vam.jar and then install the updated bpc-fe-vam.war.

The Data Management Module has been incorporated into the regular release cycle.

The setting baseUrl is no longer needed, as the value (cxf) is a static part of the API URL and will not be changed.

Not to be confused with bpcBaseUrl. This setting remains unchanged.

The format for index imports has been changed to a ZIP-based format. This is the same format that our OpenSearch tool uses to import and export indexes. In the administration interface under Core Services → Indexes , you can download such index export files.

Note: If you are using the index import functionality for an installation with a preconfigured BPC, the export file must be regenerated.

See also Installation with a preconfigured BPC.

The File Storage Log Service integration has been adapted for the Process Monitor so that it can offer these files for download and viewing: To achieve this, the Log Service creates two additional fields with the suffixes _filename and _contentType for fields of type file-storage when logging to OpenSearch and relational databases.

Files from File Storage can now also be retrieved in the Process Monitor.

The format for index imports has been changed to a ZIP-based format. This is the same format that our OpenSearch tool uses to import and export indexes. In the administration interface under Core Services → Indexes , you can download such index export files.

Note: If you are using the index import functionality for an installation with preconfigured BPC, the export file must be recreated.

See also Installation with a preconfigured BPC.

The configuration of file attachments and downloads in the BPC Monitor has been restructured:

Further information can be found here: Configuring Monitor Columns and File Attachments.

Note: Monitor instances previously used the setting ` column_mimetype ` to specify the column name, which refers to the file content type. However, the column name ` contentType ` was used inconsistently in the backend. Therefore, the setting ` column_mimetype ` was ignored during the migration of the instances. If this setting was used, please check the corresponding monitor instance and adjust it if necessary.

Data used by OIDC providers for login is stored in an encrypted cookie on the client side. This prevents system overload caused by a large number of login requests.

For BPC module developers

If you have developed your own UserFlowIdentityProvider implementation, you must adapt it. The function URI createAuthenticationRequestURI(String requestUrl) has been replaced with UserFlowLoginContext createAuthenticationRequestContext(String requestUrl) and now returns not only the redirect URL to the OIDC login but also a cookie containing the login state. This cookie is set by the frontend during a login attempt.

For BPC administrators

Install the new modules bpc-be-core.jar and bpc-fe-core.war. A restart of the BPC/Karaf is required. If the BPC is still unavailable, please delete the directory karaf/data and restart Karaf. (You may want to back up your log files first)

In Process Monitoring, the settings inubit_referenceEndpoint and inubit_proxyId, and inutbit_baseUrl for downloading via an HTTP proxy have been consolidated and renamed to httpProxy_referenceEndpoint to clarify the possibility of downloading via a generic HTTP proxy connection. The setting inubit_dbTablePrefix has been removed, as it was only used for legacy scenarios.

Timeseries Management Administrators who do not belong to the "bpcadmin" role and previously only had the "webtsm_admin" permission now need the "webtsm_edit" permission instead. A Timeseries Management administrator could also be assigned the “WEBTSM_ADMIN” role instead of the specific permission. This would also be more future-proof if, for example, subsequent versions were to define fine-grained permissions for the endpoints instead of the “webtsm_edit” permission.

The " baseUrl " setting is removed because the value (cxf) is a static part of the API URL and will not be changed.

Not to be confused with bpcBaseUrl. This setting remains unchanged.

The Data Management Module does not have a standalone backend component (bpc-be-vam.jar) . It must be removed during the update.

To perform the update, first remove bpc-be-vam.jar and then install the updated bpc-fe-vam.war.

The Data Management Module has been incorporated into the regular release cycle.

The prometheus-exporter plugin is now included with OpenSearch by default.

The BPC API now also offers authentication via access tokens issued by the configured OIDC provider. Authentication via access tokens must be explicitly enabled in the identity provider configuration. In addition to validating the signature and validity of the access token, you can optionally use the OIDC provider’s introspection endpoint, which also checks whether the session has been terminated (token revocation). Further information can be found here: Access Tokens and Keycloak as an Identity Provider.

Check the HTTP proxy configurations and adjust them if necessary. Previously, a '/' was always appended to the configured connection URL. This is no longer the case. If your HTTP proxy destination requires this and the URL is currently configured without a '/' at the end, please adjust it accordingly.

BPC now supports PKCE (Proof Key for Code Exchange) for OpenID Connect and Keycloak identity providers to enable a hardened login flow. To enable this, you must set the PKCE method in the Identity Provider backend Connection and, if necessary, configure this in your Keycloak client.

During reindexing, the old index is deleted instead of being closed as before. The user is prompted to create a backup before reindexing.

The driver provided via pax-jdbc-mssql is no longer included in the release.

Make sure that the MSSQL driver you are using is at least the following version: 10.2.4, 11.2.4, 12.2.1, 12.6.5, 12.8.2, 12.10.2, 13.2.1

If an older driver is being used, it should be replaced. Remove the old driver by deleting it from the deploy directory or by uninstalling pax-jdbc-mssql or the driver itself. Then install an up-to-date driver (without the " `pax-jdbc-mssql`" feature). See also: Databases

Check the HTTP proxy configurations and adjust them if necessary. Previously, a '/' was always appended to the configured connection URL. This is no longer the case. If your HTTP proxy destination requires this and the URL is currently configured without a '/' at the end, please adjust it accordingly.

If an error occurs during index migration, the index newly created for the migration is removed to prevent subsequent errors or to revert to a stable state.

Effective immediately, access to Karaf via SSH connections to the host localhost is restricted by default. To enable access via external connections, use the central configuration file. See Karaf SSH Access.

Connections to OpenSearch are now configured exclusively via de.virtimo.bpc.core.opensearch.hosts. When updating from an older version, you must add the entry de.virtimo.bpc.core.opensearch.hosts to the configuration file karaf/etc/de.virtimo.bpc.core.cfg. Additionally, it is recommended to to add the following lines to the central configuration file:

or

(using https://localhost:9200 as an example here). You can use the files from the download file server as a guide here.

Java 21 is now required.

These metrics have been renamed:

INUBIT is no longer supported as an Identity Provider.

For Identity Providers (Backend Connections), a large portion was previously configured via a single JSON setting. This has been split into individual settings. Existing configurations are migrated automatically. If older deployment exports of Identity Provider components are being used, it is best to recreate them.

See also: Creating, Configuring, and Using an Identity Provider, Database as Identity Provider, Keycloak as an Identity Provider, Keycloak and Dynamic Redirect URIs, Deployment Constraints

The Status API endpoint /cxf/bpc-core/status/server/{serverUUID}, which queried the status of a remote BPC, has been removed.

The query string parameters gridId, gridExtId, multiRecords, buttonId, and the form parameter tablePrefix have been removed from process action requests. To send additional context or configuration information, “Process Action Metadata” can be configured in the monitor settings.

In process starters, the XML that was sent along with the request has been replaced by JSON. As a result, portletArchiveName, operation, mandant, gridID, key, bpcModule, bpcModuleInstanceId and custom have been removed. key has been uniformly renamed to id. Additional context or configuration information can be reliably included using the "metadata" configuration in the process starter configuration within the monitor settings. The process parameters are grouped under config.parameters in the request payload. File uploads include filename, type, and data. Grids contain a list of their records.

For Change State, tablePrefix, mandant, and changeStatusBox_<Spaltenname> have been removed. command has been uniformly renamed to type and is assigned the value "statusChange". columnsstring has been renamed to column. newStatusCombo_<Spaltenname> has been renamed to newStatus. commentfield has been renamed to comment. childStatus is no longer set to "Info" by default in the Change State configuration and, if configured, will be migrated to metadata. Additional information can be passed in the "metadata" object in the Change State configuration.

See also Migration from BPC 4.* to BPC 5.0 Configuring Process Actions Process Starter

The unused settings inubit_aperakEndPoint, inubit_dbGridId, and inubit_pmMandant have been removed. The settings inubit_actionEndpoint, inubit_changeStateEndpoint, and inubit_VpsEndpoint have been replaced by actionEndpointProcessor, changeStateEndpointProcessor, and vpsEndpointProcessor.

HTTP proxy backend Connections and flow Connections now always filter the session cookie so that a recipient cannot make requests in the BPC within the user’s context. The setting filterSessionCookie is therefore no longer needed. Instead, the new setting sendSessionId allows you to include the user’s session ID, which can be verified at the endpoint GET /cxf/bpc-core/authentication/session/{sessionid}. When the setting injectUserSessionJWT is enabled, a self-generated JWT is no longer sent; instead, the signed ID token from the OpenID Connect provider is sent. For more details, see Backend Connections - HTTP Proxy.

HTTP calls made via an HTTP proxy or Flow connection filter out the BPC API key header (X-APIKey). Note: This could affect existing BPC configurations if, for example, an INUBIT process is triggered that uses the included APIkey to make calls to the BPC API. (In this case, it would be better to store a fixed BPC API key within the INUBIT process.)

Users of the Log Service API must replace all instances of childs with children in their POST data. During a transition period, childs can still be used for incoming requests. This backward compatibility will be removed in a future release. Please also note that the responses from the Log Service endpoints now contain children instead of childs.

The OpenSearch configuration directory can be configured via OPENSEARCH_PATH_CONF. This allows you to move the configuration directory out of the OpenSearch directory. As a result, it will no longer be overwritten during an OpenSearch update. See also Moving the OpenSearch Configuration.

In the bundle installation file, BPC is now shipped with a configuration directory moved to INSTALLATIONSVERZEICHNIS/opensearch_config.

It is recommended to set OPENSEARCH_PATH_CONF in BPC.env.

A new action type, "bulkAction," has been added to allow actions to be performed on all records. See Bulk Actions

If IGUASU is correctly integrated via the Flow module, available processors can be easily selected via the Monitor Actions configuration interface.

A configuration interface for identity providers is now available.

This update requires you to update Karaf.

The BPC provides OpenAPI-compliant specification files for our APIs. These can be found under Downloads and can also be accessed dynamically via the BPC, provided this option is enabled. For more information, see the BPC-API section.

You can use the Log Service API to be redirected directly to the Log Service configuration or to connected monitors. There are two new LogService endpoints for this purpose, which redirect the user to the corresponding BPC pages when called:

See also API documentation: Log Service API

It is now possible to include references to external resources when writing audit information. For example, you can reference the IGUASU instance that generated the entry.

Replication now supports entering an SQL query directly as an alternative to existing database tables/views.

See also sourceCommonTableExpressionQuery in Replication

BPC API requests made via a web browser now redirect to Keycloak (or another OIDC UserFlowIdentityProvider) if authentication is missing. After logging in, the user is redirected to the original API endpoint.

See System Monitoring (Metrics for Prometheus)

If free disk space falls below defined thresholds, shards are distributed to other nodes. Indices may also be set to read-only to prevent the disk from filling up.

The value of ` cluster.routing.allocation.disk.threshold_enabled ` is now ` true`. This corresponds to the OpenSearch default value.

The OpenSearch configuration directory can be configured via OPENSEARCH_PATH_CONF. This allows you to move the configuration directory out of the OpenSearch directory. As a result, you will no longer overwrite it during an OpenSearch update. See also Moving the OpenSearch Configuration.

The bundle installation file now ships with BPC using a configuration directory moved to INSTALLATIONSVERZEICHNIS/opensearch_config.

It is recommended to set OPENSEARCH_PATH_CONF in BPC.env.

Connections to OpenSearch are now configured exclusively via de.virtimo.bpc.core.opensearch.hosts. When updating from an older version, you must add the entry de.virtimo.bpc.core.opensearch.hosts to the configuration file karaf/etc/de.virtimo.bpc.core.cfg. Additionally, it is recommended to to add the following lines to the central configuration file: `

or

(using https://localhost:9200 as an example here). You can use the files from the download file server as a guide here.

These metrics have been renamed:

For Identity Providers (Backend Connections), a large portion was previously configured via a single JSON setting. This has been split into individual settings. Existing configurations will be migrated automatically. If older deployment exports of Identity Provider components are being used, it is best to recreate them.

See also: Creating, Configuring, and Using an Identity Provider, Database as Identity Provider, Keycloak as an Identity Provider, Keycloak and Dynamic Redirect URIs, Deployment Constraints

The Status API endpoint /cxf/bpc-core/status/server/{serverUUID}, which queried the status of a remote BPC, has been removed.

The plugin can now configure a process that is displayed immediately upon triggering. In addition, the text and icon can now be freely configured. See also Process Starter Plugin

The option to group settings is now enabled by default. We recommend using this view, as it displays the settings in a shared context.

The query string parameters gridId, gridExtId, multiRecords, buttonId, and the form parameter tablePrefix have been removed from process action requests. To send additional context or configuration information, "Process Action Metadata" can be configured in the monitor settings.

In process starters, the XML that was sent along with the request has been replaced by JSON. As a result, portletArchiveName, operation, mandant, gridID, key, bpcModule, bpcModuleInstanceId, and custom have been removed. key has been uniformly renamed to id. Additional context or configuration information can be reliably included by using the "metadata" configuration in the process starter settings within the monitor settings. The process parameters can be found grouped under config.parameters in the request payload. File uploads contain ` filename, ` `type `, and ` `data. Grids contain a list of their records. `

` For Change State, tablePrefix, mandant, and changeStatusBox_<Spaltenname> have been removed. command has been uniformly renamed to type and is assigned the value "statusChange". columnsstring has been renamed to column. newStatusCombo_<Spaltenname> has been renamed to newStatus. commentfield has been renamed to comment. childStatus is no longer set to "Info" by default in the Change State configuration and, if configured, will be migrated to metadata. Additional information can be passed in the "metadata" object in the Change State configuration.

See also Migration from BPC 4.* to BPC 5.0 Configuring Process Actions Process Starter

The unused settings inubit_aperakEndPoint, inubit_dbGridId, and inubit_pmMandant have been removed. The settings inubit_actionEndpoint, inubit_changeStateEndpoint, and inubit_VpsEndpoint have been replaced by actionEndpointProcessor, changeStateEndpointProcessor, and vpsEndpointProcessor.

For Boolean values in the settings tables, a combo box is no longer displayed; instead, only the checkbox with the truth value appears. The value can be changed by clicking, pressing the spacebar, or pressing Enter.

Users of the Log Service API must replace all instances of childs with children in their POST data. During a transition period, childs may still be used for incoming requests. This backward compatibility will be removed in a future release. Please also note that the responses from the Log Service endpoints now contain children instead of childs.

By default, access to Karaf via SSHconnections to the host localhost. To enable access via external connections, use the central configuration file. See Karaf SSH Access.

The logging configuration has been changed so that session tokens are masked. For new Karaf installations, this happens automatically. For existing installations, please update the configuration file [KARAF]/etc/org.ops4j.pax.logging.cfg. Replace the old line

with the following lines:

Since session tokens in Keycloak and OIDC are UUIDs that are also used elsewhere, we log the first and last four characters here.

HTTP proxy backend Connections and flow Connections now always filter the session cookie to prevent a recipient from making requests in the BPC within the user’s context. The setting ` filterSessionCookie ` is therefore no longer needed. Instead, the new setting ` sendSessionId ` allows you to include the user’s session ID, which can be verified at the endpoint ` GET /cxf/bpc-core/authentication/session/{sessionid} . When the setting ` `injectUserSessionJWT ` is enabled, a self-generated JWT is no longer sent; instead, the signed ID token from the OpenID Connect provider is sent. For more details, see Backend Connections - HTTP Proxy.

HTTP calls made via an HTTP proxy or Flow connection filter out the BPC API key header (X-APIKey). Note: This could affect existing BPC configurations if, for example, an INUBIT process is triggered that in turn makes calls to the BPC API using the API key provided. (In this case, it would be better to store a fixed BPC API key within the INUBIT process.)

For new backend Connections of the HTTP Proxy and Flow types, the " Filter BPC Session " option is enabled by default.

Java 21 is now required.

If the BPC was initially installed with a version of OpenSearch instead of Elasticsearch, then the [bpc]/opensearch_data directory can be used as-is.

If not, the indices must be migrated first.

See Migration from BPC 4.* to BPC 5.0

This update upgrades the Karaf version to 4.4.8. It is necessary to update the modules bpc-be-core, bpc-be-analysis, bpc-be-forms, and bpc-be-monitor.

For BPC module developers

With the updated Karaf, we are shipping CXF 3.6.8 instead of 3.6.7, which provides Jackson version 2.19.2.

Please update the CXF version (3.6.8) and Jackson version (2.19.2) in your pom.xml. To do this, check whether you have an import package statement for this version. This must be added or updated if you use Jackson functions such as the ` ObjectMapper ` class.

INUBIT is no longer supported as an identity provider.