Changelog

The base colors from the BPC frontend theme are now automatically passed to the form renderer. See Renderer Style.

CSS can now be used much more precisely in the Forms context. Components now have standard CSS classes, and additional ones can be defined. See CSS Classes.

The Label is now bindable for all components. See Label.

“ Flow / Backend Connection ” has been added as a possible data source in the Data Set Editor. Here, you can select an existing connection from Backend Connections (HTTP Proxy) or Flow (IGUASU / INUBIT). See Dataset Editor

Google Cloud File Storage connections can optionally set a custom host to use a different API-compatible Service.

The module is now displayed as a frontend module again. This ensures consistent display.

When creating resources, the corresponding lists and combo box selections are updated

S3 file storage backend Connections can now be configured using the "Automatic AWS Authentication" setting. This automatically reads access credentials from the pod or system.

In addition, all file storage backend connections now include the "Default Bucket" setting, which is selected when no bucket is specified in API calls or in the log service. Furthermore, this default bucket is selected for connection testing if it is configured.

The display of the Security Cockpit has been improved: - In addition to the score, the total score is also displayed - A link to the corresponding documentation page is available - If the check refers to a module instance, you can navigate directly to it - Text is selectable

In addition, the HTTP proxy check has been adjusted so that it does not check for Basic Authentication, as this is not relevant to the security status of the BPC.

Monitor views created with a very old version of BPC were not loading correctly. The internal format is now automatically updated to the latest version.

A bug in the opensearch-env.bat has been fixed.

The tablePrefix was not read correctly from metadata.

When using the INUBIT Workflow Package, an error occurred if the user attempted to view a file attachment directly in the monitor. File downloads were not affected.

The configuration of OIDC and Keycloak backend Connections failed when the BPC homepage was specified as the redirect URL (post-login or post-logout). The cause was the settings validation, which received an HTTP status code 406 when checking the URL of the BPC homepage. As a result, it was not possible to create new OIDC or Keycloak backend Connections or edit existing ones. New cloud deployments that create backend Connections via Custom Resource were also affected.

This issue has been resolved.

Previously, a value for a combobox with multiselect could only be set via binding. Now it is also possible to specify an array directly in the value.

The page Selective Access to Administrative Interfaces has been added to the documentation with links to the user, organization, role, and permissions overviews.

An additional alias has been set for the user overview to ensure compatibility with previous versions.

The settings for the following pages have been revised:

The full functionality of the Identity Management user interface is now also available with Keycloak as an identity provider. In addition, the frontend has been expanded to include the tabs “Organizations,” “Roles,” and “Permissions.”

In these tabs, organizations, roles, and permissions can be listed

, created , and deleted .

Furthermore, the users in these groups can be viewed and managed directly.

For organizations and roles (Keycloak as IdP only), role assignments can also be configured.

Further information can be found under Identity Management.

The " autoGrow " option is now available for textarea.

The issue where the selection is lost when editing the endpoint field (for HTTP proxies or IGUASU processors) has now been resolved.

When migrating BPC 4 settings, the inubit_dbTablePrefix is now set httpProxy_referenceEndpoint as a URL parameter.

This step is only performed when migrating from BPC 4 to BPC >= 5.0.7.

The error occurred when the primary key field on the monitor contained a field name with mixed case. In this case, monitor actions could not be executed because the associated data could not be found.

fieldset now automatically insert scroll bars. Previously, scrollbars were automatically set only for container.

An invalid value in the " linkedModules " setting no longer prevents the picker from opening.

Endpoints in the Monitor, as well as HTTP proxy URLs, now support additional query parameters.

This can be useful, for example, to httpProxy_referenceEndpoint pass additional parameters to the INUBIT workflow.

Documentation updated to include the option to use query parameters at httpProxy_referenceEndpoint. See also Configuration: Downloading via HTTP Proxy Connections

The INUBIT Workflow package now correctly handles BPC 5 calls.

Most workflows are no longer delivered in a protected state.

The attribute names of the records in the payload of Process Actions and Process Starters with context retain their original format and are no longer converted to lowercase.

If Keycloak is configured as an identity provider, users can now be assigned and removed from new and existing roles in the BPC frontend. When creating new roles, they are created as realm or client roles, depending on the configuration. When managing users, the required Keycloak roles must be taken into account .

The File Storage API can now create entries by passing a cloud reference, even if the referenced file does not yet exist. To do this, the query parameter ` check-file ` must be passed with the value ` false ` to the endpoint POST /cxf/bpc-core/file-storage/existing-file. This flag can also be included when passing files as a cloud reference in the Log Service.

This can be useful if you plan to upload the file to the cloud provider at a later time or asynchronously.

Further information can be found under “POST in the Log Service with Cloud Storage Reference” and at File Storage API.

New window for resolving conflicts when enlarging cells in the table layout, where decisions can be made regarding the removal, movement, and resizing of widgets.

Similar to BPC-9821, in addition to the BPC core, a Bad Request (400)error is now returned in the REST endpoints of the corresponding modules if the HTTP body cannot be successfully deserialized.

The state of the action buttons on replication jobs has been corrected. In some cases, changes to replication jobs did not affect the availability of functions.

The cache configuration was accessing Services that no longer exist, which was causing errors. These references have been removed.

In some cases, the navigation display was not updated correctly when modules were called up.

When exporting child data via the monitor, only those children of the parent entries that are visible according to the configured filters and views are exported.

The menu for Monitor Views no longer displays an empty placeholder when no view is selected.

The attribute names of the records in the payload of Process Actions and Process Starters with context retain their original format and are no longer converted to lowercase.

Previously, the OpenSearch internal field _id was always added to the Monitor data. This is an unexpected extension of the actual document.

If this field is used in the monitor configuration, it should be changed to the correct primary key of the data. When using the Log Service, it can be found at https://docs.Virtimo.net/de/BPC-docs/5.0/core/admin/modules/log_service.html#parentKeyFields. When using replication, see https://docs.Virtimo.net/de/BPC-docs/5.0/core/admin/modules/replication.html#idColumns.

Under certain circumstances, an error Failed to process event could occur when starting Karaf.

Update OpenSearch according to the update instructions

During export, duplicate warnings and errors are logged only once and not for each exported entry

In WebTSM, the user interface texts were revised to ensure consistent, uniform support for multiple languages.

Under certain circumstances, the Backup Manager might fail to start when Karaf is launched due to an error.

The display of text in the user interface has been revised so that text is fully visible.

If, when loading the BPC Web GUI, the browser accessed the index page due to incorrect URLs for resources (images, scripts, stylesheets, etc.), the browser would load the index page, which could lead to problems verifying the login. This could only occur with OIDC-based identity providers.

A possible cause could be, for example, a faulty theme.

The configuration org.apache.karaf.shell.cfg in Karaf has been revised.

Host Key & Signatures: Switch to RSA 4096 and modern SHA-2 algorithms (rsa-sha2-512/256); Disabling insecure NIST curves (ECDSA).

Protocol hardening: Restriction to secure key exchange schemes (Curve25519), AES-GCM encryption, and Encrypt-then-MAC (EtM).

Important —If Karaf is not fully updated, but only the configuration file is applied, then the file etc/host.key must be deleted.

The form submission payload now once again contains the actionConfig and thus also the process action ID

Fix: During an update, the settings apiKeys (Core) and rendererUrl (Forms) are migrated correctly. apiKeys is converted from a map to an array, and in rendererUrl, "BPC-forms-renderer/index.html" is set as the value.

An issue has been resolved where large amounts of data were only partially transferred in HttpProxy.

After a BPC update to version 5.0.4 or 5.0.5, the error " HTTP ERROR 500 javax.servlet.ServletException: javax servlet.ServletException: java lang.NoSuchMethodError: 'java lang.String de.virtimo.bpc.api.service.CoreBundleService.getUserFlowIdentityProviderLoginRedirectUrl(javax.servlet.http.HttpServletRequest)' " could occur when accessing the BPC interface. This error has now been fixed.

The error occurred when a part of the interface (index.jsp) was not directly updated by the update and an OIDC/Karaf Identity Provider was being used.

If an update to this version is not possible, the error can be resolved by deleting the directory <BPC-INSTALL-DIR>/karaf/data/pax-web/ and restarting Apache Karaf.

Fix: Secure decoding prevents the loading of processors in monitor settings from failing

Radiogroups caused the application to crash on startup if a hard-coded value was used instead of data binding. This issue has been resolved.

Error messages are now displayed correctly again when starting processes. File downloads via Action Responses are working again. The issue with loading value lists for Process Starter combo boxes has been resolved. The " success`" field in the response now supports regular Booleans (`true/false) as well as strings ("true"/"false")

The Storage API’s GET endpoint can now also filter by value and customFields using the parameters query and filter. To filter by subfields, use dot-separated syntax: value.name:Alicia filters entries where the name field in value has the value Alicia.

Since Storage indexes do not contain timestamp fields, the parameters timezoneOffset and timezoneName have been removed from the GET endpoint.

For BPC Module Developers If you use the ` StorageService class and its ` `getItems functions in your BPC modules, please note that these have been marked as deprecated and have been replaced with a variant that does not include the ` `timeZoneId` Parameter.

The developer documentation has been restructured: Developer Documentation

The monitor’s caching mechanism (state in local storage) and its interaction with the monitor settings have been described in detail.

Correction to the Replication documentation regarding the Replication_AdjustUpperDateLimitInSeconds setting, which is not limited to specific database management systems.

The documentation on monitor views has been updated. See Manage Process Views

This update upgrades the version of Apache Karaf.

Please update Karaf according to the update instructions.

Incorrect behavior in the monitor regarding the data_filter setting has been fixed: If you used OR as a link and did not set a base filter, all records were displayed despite the filter rules.

In the case of a AND link, the base filter was negated and combined with the other filter rules using a logical UND. This was incorrect; the base filter is now no longer negated in this case either, and specifies which documents are generally visible. This means that a data record is visible if it meets the base filter OR all session-specific filter rules.

Note: If you are using Monitor instances with ` data_filter ` in your BPC deployment, please verify that they continue to function as intended.

More details on the ` data_filter` setting can be found here: Restrict the visibility of monitor data

A JSON schema has been defined for the function_gridMultipleViewsConfig monitor setting. This provides guidance during configuration and helps prevent incorrect configurations.

The database connection was not closed correctly during Tailsync. This causes all connections in the connection pool to become blocked over time.

Column headers and, in some cases, content were unintentionally centered. The background of the filters on checkbox columns was sometimes not displayed correctly.

Incorrect behavior in the monitor regarding the data_filter setting has been fixed: If you used the link OR and had not set a base filter, all records were displayed despite the filter rules.

With a AND link, the base filter was negated and combined with the other filter rules using a logical UND. This was incorrect; the base filter is now no longer negated in this case either, and specifies which documents are generally visible. This means that a data record is visible if it meets the base filter OR all session-specific filter rules.

Note: If you are using Monitor instances with ` data_filter ` in your BPC deployment, please verify that they continue to function as intended.

More details on the ` data_filter` setting can be found here: Restrict the visibility of monitor data

See Flow

The use of Flow for Forms has been described in detail. See Integrating IGUASU with BPC

See BPC OpenSearch Tool

The documentation on multiple grid settings (function_gridMultipleViewsConfig) has been updated. See Configuring Multiple Grids/Views

See OpenSearch

Example of a dynamic filter value using #user.loginName# added. See Restrict the visibility of monitor data

Data used by OIDC providers for login is stored in an encrypted cookie on the client’s device. This prevents system overload caused by a large number of login requests.

For BPC module developers

If you have developed your own UserFlowIdentityProvider implementation, you must adapt it. The function URI createAuthenticationRequestURI(String requestUrl) has been replaced with UserFlowLoginContext createAuthenticationRequestContext(String requestUrl) and now returns not only the redirect URL to the OIDC login but also a cookie containing the login state. This cookie is set by the frontend during a login attempt.

For BPC administrators

Install the new modules bpc-be-core.jar and bpc-fe-core.war. A restart of the BPC/Karaf is required. If the BPC is still unavailable, please delete the directory karaf/data and restart Karaf. (You may want to back up your log files first)

In Process Monitoring, the settings inubit_referenceEndpoint, inubit_proxyId, and inutbit_baseUrl were consolidated for download via an HTTP proxy and renamed to httpProxy_referenceEndpoint to clarify that they can be downloaded via a generic HTTP proxy connection. The setting inubit_dbTablePrefix was removed because it was only used for legacy scenarios.

Timeseries Management Administrators who do not belong to the "bpcadmin" role and previously only had the "webtsm_admin" permission now need the "webtsm_edit" permission instead. A Timeseries Management Administrator could also be assigned the "WEBTSM_ADMIN" role instead of the specific permission. This would also be more future-proof if, for example, subsequent versions were to define finely granular permissions for the endpoints instead of the “webtsm_edit” permission.

The Data Management Module no longer has a standalone backend component (bpc-be-vam.jar). It must be removed during the update.

To perform the update, first remove bpc-be-vam.jar and then install the updated bpc-fe-vam.war.

The Data Management Module has been incorporated into the regular release cycle.

The setting baseUrl is no longer needed, as the value (cxf) is a static part of the API URL and will not be changed.

Not to be confused with bpcBaseUrl. This setting remains unchanged.

The format for index imports has been changed to a ZIP-based format. This is the same format that our OpenSearch tool uses to import and export indexes. In the administration interface under Core Services → Indexes , you can download such index export files.

Note: If you are using the index import functionality for an installation with a preconfigured BPC, the export file must be recreated.

See also Installation with a preconfigured BPC.

In addition to direct uploads, files in File Storage can now also be created via a reference to a file in the cloud storage provider. A new endpoint is provided for this purpose in the File Storage API. In the Log Service, files (for fields of type file-storage) can also be transmitted as file references to the cloud storage provider.

In addition, the content type is set during upload and download for all supported cloud providers.

File Storage Backend Connections can now be configured to route downloads through the BPC. See core:/admin/modules/backend_connections.adoc#file_storage. Downloads via the File Storage Service are now documented in the audit log.

The File Storage Log Service integration has been adapted for the Process Monitor so that it can offer these files for download and viewing: To achieve this, the Log Service creates two additional fields with the suffixes _filename and _contentType for fields of type “ file-storage ” when logging to OpenSearch and relational databases.

Files from File Storage can now also be retrieved in the Process Monitor.

The format for index imports has been changed to a ZIP-based format. This is the same format that our OpenSearch tool uses to import and export indexes. In the administration interface under Core Services → Indexes , you can download such index export files.

Note: If you are using the index import functionality for an installation with a preconfigured BPC, the export file must be recreated.

See also Installation with a preconfigured BPC.

Using the WebTSM setting module_apis, you can define additional HTTP headers that will then be set with every WebTSM API call. To do this, enter the HTTP headers to be set in the field additionalHttpHeaders (see example). Variables, such as the one shown below ${config.de.virtimo.bpc.core.karaf.uuid}, can be set to the same values as those used with the BPC HTTP Proxy.

The configuration of file attachments and downloads in the BPC Monitor has been restructured:

Further information can be found here: Configuring Monitor Columns and File Attachments.

Note: Monitor instances had provided the setting column_mimetype to specify the column name, which refers to the content type of the files. However, the column name contentType was used inconsistently in the backend. Therefore, the setting column_mimetype was ignored during the migration of the instances. If this setting was used, please check the corresponding Monitor instance and adjust it if necessary.

Sharing links for Monitor processes have been shortened. The link now only contains information about the active view, filters, and sorters.

Form versions and forms can now be deleted in the Forms Repository.

"disabled " and "readOnly " are available for table columns. "disabled," " readOnly," and "required " are now only inherited for configuration in group components. Attributes are not overwritten in this process.

You can now configure the initial sort order for groups in the monitor settings. See setting column_groupDirection

Data used by OIDC providers for login is stored in an encrypted cookie on the client side. This prevents system overload caused by a large number of login requests.

For BPC module developers

If you have developed your own UserFlowIdentityProvider implementation, you must adapt it. The function URI createAuthenticationRequestURI(String requestUrl) has been replaced with UserFlowLoginContext createAuthenticationRequestContext(String requestUrl) and now returns not only the redirect URL to the OIDC login but also a cookie containing the login state. This cookie is set by the frontend during a login attempt.

For BPC administrators

Install the new modules bpc-be-core.jar and bpc-fe-core.war. A restart of the BPC/Karaf is required. If the BPC is still unavailable, please delete the directory karaf/data and restart Karaf. (You may want to back up your log files first)

Only the WebTSM backend communicates directly with Hakom.

The WebTSM front end now works exclusively with the WebTSM back end. This means that a "HTTP Proxy" type backend Connection is no longer required, and the "tsm_backendConnectionId" setting for the WebTSM Viewer components has been removed.

If "useRendererValues" is true during a process status change, the fallback values "" and "*" are no longer displayed in the status combo box.

In Process-Monitoring, the settings inubit_referenceEndpoint, inubit_proxyId, and inutbit_baseUrl have been consolidated for download via an HTTP proxy and renamed to httpProxy_referenceEndpoint to clarify the possibility of downloading via a generic HTTP proxy connection. The setting inubit_dbTablePrefix has been removed, as it was only used for legacy scenarios.

Multilingual support has been improved. The languages cs, da, de, en, es, fi, fr, it, js, ko, nl, pt, ru—in accordance with the ISO 639-1 language codes—are now available. If a language is unavailable or incomplete, English is used instead.

Please remove the values with the key "authorization". This value contains the username and password in plain text (Base64-encoded) and is no longer needed.

Timeseries Management Administrators who do not belong to the "bpcadmin" role and previously only had the "webtsm_admin" permission now need the "webtsm_edit" permission instead" instead. A Timeseries Management Administrator could also be assigned the "WEBTSM_ADMIN" role—instead of the specific permission . This would also be more future-proof if, for example, future versions were to define finely granular permissions at the endpoints instead of the “webtsm_edit” permission.

This change allows for better automated testing of tables in the GUI.

The setting baseUrl is no longer used, as the value (cxf) is a static part of the API URL and will not be changed.

Not to be confused with bpcBaseUrl. This setting remains unchanged.

Duplicate setting groups are merged into a single group

If multiple columns are configured in a monitor instance that use the same dataIndex but are displayed differently by custom renderers, this is now correctly handled during export. In addition, mappings for empty values and fallback values in custom renderers are taken into account during export. (Entries "!" and "*")

An error in schema generation for some DTO classes has been fixed.

When exporting child data via a monitor, the " `data_filter`" setting is applied to the corresponding parent entries.

Filtering by column is now possible again. An additional option has also been added to set a different template for the filter. This may be necessary if the column template accesses fields other than the one specified in dataIndex.

See also Configuring Monitor Columns

targetModule is automatically converted to a string in the viewConfiguration

Safeguard for BPCCommon.Api.getTranslation: If a translation incorrectly returns an object (e.g., for "config"), the system now falls back to the key string to avoid [object Object].

When the process status changes, "preselectState": "_first" is now also possible if "useDistinctValues" is false and custom states are used. See also Process Status Change Configuration

The spacing issue with checkboxes within a checkbox group has been resolved.

Previously, only columns in the child data were exported for which there were corresponding columns in the parent monitor using a dataIndex with the same name.

An export in the Process Monitor now works even if instance_data_view_limit or monitor_data_view_limit is less than 2500.

The documentation on binding in Forms has been expanded.

See:

See Status Change - Syntax

Update OpenSearch according to the update instructions

This update upgrades Apache Karaf to version 4.4.10. In connection with this, the following modules must be updated: bpc-be-core, bpc-be-analysis, bpc-be-forms, and bpc-be-monitor.

Please update Karaf according to the update instructions.

Adjusting the Logging Configuration

The configuration file etc/org.ops4j.pax.logging.cfg was modified as part of an Log4J update. Important: Do not copy this file unchanged from an existing (old) Karaf installation. If you have made any customizations, please transfer them manually to the new configuration file.

Note for BPC module developers

If your BPCbackend module uses the dependency ` jackson-annotations ` and has previously used the variable ` ${jackson.version} ` (to reference the same version as in the BPC core modules), this must be updated. Use ` ${jackson.annotations.version}` instead.

The Data Management Module does not have a standalone backend component (bpc-be-vam.jar) . It must be removed during the update.

To perform the update, first remove bpc-be-vam.jar and then install the updated bpc-fe-vam.war.

The Data Management Module has been incorporated into the regular release cycle.

The URL to Flowendpoints can be copied directly from the Flow Manager to the clipboard and reused, for example, for Forms submit URLs.

The prometheus-exporter plugin is now included with OpenSearch by default.

The BPC API now also offers authentication via access tokens issued by the configured OIDC provider. Authentication via access tokens must be explicitly enabled in the identity provider configuration. In addition to validating the signature and validity of the access token, you can also optionally use the OIDC provider’s introspection endpoint, which additionally checks whether the session has been terminated (token revocation). Further information can be found here: Access Tokens and Keycloak as an Identity Provider.

In the frontend, the global event beforeShowModule is fired before switching to a new view (module or module component). The following parameters are passed: the module ID of the current view, the module ID of the new view to be displayed, and additional options. If an event listener returns ` false `, the transition to the new view is canceled. If this behavior is implemented, the user should also receive feedback explaining why the transition was canceled.

Since BPC 4.2.13 and 4.1.25, process actions were no longer displayed in child grids. This has been fixed, and process starters are no longer incorrectly displayed in the child grid.

The behavior introduced in BPC 4.2.16 and 5.0.2, where the connection is explicitly closed in the backend connection, sometimes led to issues where responses from the server were not transmitted at all or were transmitted incompletely.

BPC Breadcrumb Plugin is displayed again

The Forms Live Editor now offers AI support for creating forms. This support will be extended to additional areas in future releases.

To use the AI Assistant, please add the plugin to your application toolbar, for example.

See also: AI Assistant AI Assistant Rio Virtimo AI Services Generating BPC Forms (AI Generation)

The BPC FileStorage Service now supports Azure Blob Storage and Google Cloud Storage in addition to AWS S3.

To use the file storage functionality, the corresponding module for the respective cloud provider must be installed; see File Storage Modules. (This is also required if File Storage was previously used with AWS S3.) If File Storage is already being used with AWS S3, the AWS S3 File Storage module must also be installed accordingly.

A security check has been introduced that verifies that HTTPS is used for the bpcBaseUrl setting.

It is now possible to set additional headers on the HTTP proxy that are sent along with the request to the server.

Similar to importing module settings, we now offer the option to import preconfigured OpenSearch indexes; see Installation with a preconfigured BPC.

A command-line tool is available for listing, deleting, and exporting/import of indexes. It is called “ bpc-opensearch-tool.jar ” and can be downloaded from the file server (https://files.Virtimo.net/BPC/). The help documentation can be accessed via java -jar bpc-opensearch-tool.jar --help.

When creating a Log Service instance, the "External Reference" field is now included in the default configuration. Additionally, the field types " object " and " flat_object " have been added.

A security check has been introduced to verify that BPC is accessible only via HTTPS.

The delivered configuration file de.virtimo.bpc.core.security.checks.cfg contains corrected default settings that have been adapted to the current checks.

Tooltips containing URL links can be hovered over with the cursor without them disappearing.

When creating a monitor instance, export in JSON format is now enabled by default and is therefore available as an option in the Monitor Export window

Fix for a potential DoS attack that leads to high memory consumption when there are a very large number of concurrent login requests.

The configured limit (max. number of records) for XLSX is now taken into account again when exporting data via the monitor. For CSV and JSON, a limit can now also be configured in the export dialog. An upper limit applies only to XLSX, not to other file formats.
See also Configuring Monitor Data Export
Exporting Processes

The following issues have been resolved when exporting monitor data with configured custom renderers: - Custom renderers were only applied to string-type data. Now, custom renderers are also applied to integer, long, and boolean types during export. - For a column, you can set the custom renderer to the value true. In this case, a custom renderer with the same name as the one at dataIndex is used. If this does not exist, the "defaultRenderer" custom renderer is used. During export, only "defaultRenderer" was used in this case. This has been fixed.

For GUI modules that offer types, components with types can now be created again. Translations for a type’s name no longer require the "CORE_" prefix. The schema for the translation keys is "<MODULID>_INSTANCE_TYPE_<WERT>".

Fix for an exception during a configuration update if the Security Cockpit was not yet open.

Security check measurements now record a timestamp again.

The HttpProxySecurityCheck is executed only once per instance.

The default instances in the Analysis module are now initialized correctly, so that the data modifier is immediately available.

An incorrect plugin configuration is now ignored during migration and logged as a warning.

The "Users" section on the "BPC Administration" documentation page is described in more detail. See BPC Administration

Detailed description of the process action configuration. See Configuring Process Actions

Detailed documentation of the process status change configuration. See Process Status Change

See Configuring Monitor Data Export

The documentation for column formatters and export formatters has been improved.

The lists of the respective module settings have been revised or are now generated automatically. This ensures that the labels and description texts match those in the GUI. See Configuring Data Analysis Core Services Settings Configuring the Process Dashboard Forms Configuration Configuring Process Monitoring

See Chart Editor

Check the HTTP proxy configurations and adjust them if necessary. Previously, a '/' was always appended to the configured connection URL. This is no longer the case. If your HTTP proxy destination requires this and the URL is currently configured without a '/' at the end, please adjust it accordingly.

Two new plugins have been added to link to internal or external content. See also External Link and Internal Link

The frontend now includes the option to manually start a tail sync for replication jobs. In addition, a manual tail sync can also be started via the REST API; see Replication API.

BPC now supports PKCE (Proof Key for Code Exchange) for OpenID Connect and Keycloak identity providers to enable a hardened login flow. To enable this, you must set the PKCE method in the identity provider backend Connection and, if necessary, configure this in your Keycloak client.

Tail Sync runs can now be logged. When logging is enabled, entries are written to the index bpc-tailsync-log. Additionally, the monitor Tail Sync Log Monitor is created. You can be found under Replication.

The way settings with values different from the default are marked has been changed.

In the form for sending notifications, the " bpcuser " role is preselected as the recipient group. It is no longer possible to send a notification without specifying a recipient group.

During reindexing, the old index is deleted instead of being closed as before. The user is prompted to create a backup before reindexing.

The values of the various options in combo boxes are no longer uniformly appended with "  ." This makes it easier to automate UI testing.

Code that was marked as deprecated has been removed from BPC.

The driver provided via pax-jdbc-mssql is no longer included in the release.

Ensure that the MSSQL driver you are using is at least the following version: 10.2.4, 11.2.4, 12.2.1, 12.6.5, 12.8.2, 12.10.2, 13.2.1

If an older driver is being used, it should be replaced. Remove the old driver by deleting it from the deploy directory or by uninstalling pax-jdbc-mssql or the driver itself. Then install a current driver (without the feature pax-jdbc-mssql). See also: Databases

A bug has been fixed where an incorrect process starter was displayed when exactly two process starters were configured, one of which is hidden.

Check the HTTP proxy configurations and adjust them if necessary. Previously, a '/' was always appended to the configured connection URL. This is no longer the case. If your HTTP proxy destination requires this and the URL is currently configured without a '/' at the end, please adjust it accordingly.

If an error occurs during index migration, the index newly created for the migration is removed to prevent subsequent errors or to revert to a stable state.

Buttons that discard local changes now have a clearer text description.

Changes to the valid value range directly affect the validation of the default value.

In the configuration file, the value for deleteCheckResultsOlderThan must be changed from 10 days to 10 days ago.

Effective immediately, access to Karaf via SSH connections to the host localhost is restricted by default. To enable access via external connections, use the central configuration file. See Karaf SSH Access.

Connections to OpenSearch are now configured exclusively via de.virtimo.bpc.core.opensearch.hosts. When updating from an older version, you must add the entry de.virtimo.bpc.core.opensearch.hosts to the configuration file karaf/etc/de.virtimo.bpc.core.cfg. Additionally, it is recommended to add the following lines to the central configuration file:

or

(using https://localhost:9200 as an example here). You can use the files from the download file server as a guide here.

Java 21 is now required.

These metrics have been renamed:

INUBIT is no longer supported as an identity provider.

Until now, a large portion of the Identity Provider (Backend Connections) configuration was handled via a single JSON setting. This has been split into individual settings. Existing configurations will be migrated automatically. If older deployment exports of Identity Provider components are being used, it is best to recreate them.

See also: Creating, Configuring, and Using an Identity Provider, Database as Identity Provider, Keycloak as an Identity Provider, Keycloak and Dynamic Redirect URIs, Deployment Constraints

The Status API endpoint /cxf/bpc-core/status/server/{serverUUID}, which queried the status of a remote BPC, has been removed.

The query string parameters gridId, gridExtId, multiRecords, buttonId, and the form parameter tablePrefix have been removed from process action requests. To send additional context or configuration information, "Process Action Metadata" can be configured in the monitor settings.

In process starters, the XML that was sent along with the request has been replaced by JSON. As a result, portletArchiveName, operation, mandant, gridID, key, bpcModule, bpcModuleInstanceId, and custom. key has been uniformly renamed to id. Additional context or configuration information can be reliably included using the "metadata" configuration in the process starter settings within the monitor settings. The process parameters can be found grouped under config.parameters in the request payload. File uploads contain ` filename, ` `type `, and ` `data. Grids contain a list of their records. `

` For Change State, ` tablePrefix`, ` mandant , and ` `changeStatusBox_<Spaltenname> ` have been removed. ` command ` has been uniformly renamed to type and is assigned the value "statusChange". columnsstring has been renamed to column. newStatusCombo_<Spaltenname> has been renamed to newStatus. commentfield has been renamed to comment. childStatus is no longer set to "Info" by default in the Change State configuration and, if configured, is migrated to metadata. Additional information can be passed to the "metadata" object in the Change State configuration, additional information can be passed.

See also Migration from BPC 4.* to BPC 5.0 Configuring Process Actions Process Starter

The unused settings inubit_aperakEndPoint, inubit_dbGridId, and inubit_pmMandant have been removed. The settings inubit_actionEndpoint, inubit_changeStateEndpoint, and inubit_VpsEndpoint have been replaced by actionEndpointProcessor, changeStateEndpointProcessor, and vpsEndpointProcessor.

HTTP proxy backend Connections and flow Connections now always filter the session cookie, so that a recipient cannot make requests in the BPC within the user’s context. The setting “ filterSessionCookie ” is therefore no longer used. Instead, the new setting “ sendSessionId ” allows the user’s session ID to be included, which can be verified at the endpoint GET /cxf/bpc-core/authentication/session/{sessionid}. When the “ injectUserSessionJWT ” setting is enabled, a self-generated JWT is no longer sent; instead, the signed ID token from the OpenID Connect provider is sent. For more details, see Backend Connections - HTTP Proxy.

HTTP calls made via an HTTP proxy or Flow connection filter out the BPC API key header (X-APIKey). Note: This could affect existing BPC configurations if, for example, an INUBIT process is triggered that in turn makes calls to the BPC API using the API key provided. (In this case, it would be better to store a fixed BPC API key within the INUBIT process.)

Users of the Log Service API must replace all instances of childs with children in their POST data. During a transition period, childs may still be used for incoming requests. This backward compatibility will be removed in a future release. Also, please note that the responses from the Log Service endpoints now contain children instead of childs.

The OpenSearch configuration directory can be configured via OPENSEARCH_PATH_CONF. This allows you to move the configuration directory out of the OpenSearch directory. As a result, you will no longer overwrite it during an OpenSearch update. See also Moving the OpenSearch Configuration.

The bundle installation file now ships with BPC using a configuration directory moved to INSTALLATIONSVERZEICHNIS/opensearch_config.

It is recommended to set OPENSEARCH_PATH_CONF in BPC.env.

A new action type, "bulkAction," has been added to allow actions to be performed on all records. See Multiple Actions

If IGUASU is correctly connected via the Flowmodule, available processors can be easily selected via the Monitor Actions configuration interface.

A configuration interface for identity providers is now available.

This update requires you to update Karaf.

The BPC provides OpenAPI-compliant specification files for our APIs. These are available under Downloads and can also be retrieved dynamically via the BPC, provided this option is enabled. For more information, see the BPC-API section.

A Security Cockpit is now available in the administration area, providing an overview of application security.

For details, see Security Cockpit

A new API endpoint /cxf/bpc-core/collaboration/online-users allows you to retrieve all logged-in users. (See Collaboration API). A new plugin, "List Online Users," allows you to display all logged-in users in the frontend. (See Online User List))

A chat plugin has been added. The chat is stateless, so messages are lost when you log out, reload, or close the page. You can only receive new messages while you are logged in. See also Chat

You can use the Log Service API to be redirected directly to the Log Service configuration or to connected monitors. There are two new LogService endpoints for this purpose, which redirect the user to the corresponding BPC pages when called:

See also API documentation: Log Service API

It is now possible to include references to external resources when writing audit information. For example, you can reference the IGUASU instance that generated the entry.

Replication now supports entering an SQL query directly as an alternative to existing database tables/views.

See also sourceCommonTableExpressionQuery in Replication

A JSON schema describing the payload for the Log Service can now be requested via the Log Service API. This can be used to perform validation in advance.

A new setting has been added that allows you to select the endpoints or processors for Flow & Backend Connections. The selection generates a BPC URL following the schema BPC://<FLOW/backendconnection>/<instanceId>/<endpointOrProcessor>. There are separate settings for Process Actions, Process Starters, and Change State.

Messages can be sent to individual users. Messages can be time-limited. Messages can have a topic. It is possible to delete all messages for a single topic. The status indicating whether a message has been read is now persisted in the backend instead of being stored in the browser’s local storage.

See also Notifications to Users and Notification API for changes to the API.

The backend connections are being extended to include a 'file_storage' type to configure connections to AWS S3 and S3-compatible file storage systems.

A File Storage API is provided that enables the uploading, downloading, and management of files. These are stored in a file storage system configured via a file storage backend connection.

See File Storage API.

Under Settings→Overview→File Storage, a UI is provided to view, download, and delete files from File Storage. In addition, files can be uploaded to File Storage.

File Storage Integration into the Log Service

Further details can be found in the File Storage section of the Log Service.

In the frontend, a redirect to a BPC URL via the query parameter redirectPostAuth is possible after the login process. This works for all OIDC identity providers.

Validation results are now stored in state. This means they can also be used for binding, for example. See also validate

A new setting has been added that allows you to select the endpoints or processors for Flow & Backend Connections. The selection generates a BPC URL following the schema BPC://<FLOW/backendconnection>/<instanceId>/<endpointOrProcessor>. There are separate settings for Process Actions, Process Starters, and Change State. During a POST request, the URL is always included in the payload and passed to the monitor’s httpProxy endpoint. The monitor endpoint uses the Core Action Service to process the data and ultimately returns the response.

BPC API requests made via a web browser now redirect to Keycloak (or another OIDC UserFlowIdentityProvider) if authentication is missing. After login, the user is redirected to the original API endpoint.

API keys are now masked in the frontend, just like passwords. When viewing existing API keys in Settings, “ ” is now displayed instead of the API key.

If a new API key is created, it is displayed once.

See System Monitoring (Metrics for Prometheus)

If free disk space falls below defined thresholds, shards are distributed to other nodes. It may also happen that indices are set to read-only to prevent the disk from filling up.

The value of ` cluster.routing.allocation.disk.threshold_enabled ` is now ` true`. This corresponds to the OpenSearch default value.

The OpenSearch configuration directory can be configured via OPENSEARCH_PATH_CONF. This allows you to move the configuration directory out of the OpenSearch directory. This prevents you from overwriting it during an OpenSearch update. See also Moving the OpenSearch Configuration.

In the bundle installation file, BPC is now shipped with a configuration directory moved to INSTALLATIONSVERZEICHNIS/opensearch_config.

It is recommended to set OPENSEARCH_PATH_CONF in BPC.env.

Connections to OpenSearch are now configured exclusively via de.virtimo.bpc.core.opensearch.hosts. When updating from an older version, you must add the entry de.virtimo.bpc.core.opensearch.hosts to the configuration file karaf/etc/de.virtimo.bpc.core.cfg. Additionally, it is recommended to to add the following lines to the central configuration file: `

or

(using https://localhost:9200 as an example here). You can use the files from the download file server as a guide here.

The setting Common Table Expression Abfrage in replication can now be edited in an editor that supports SQL syntax.

These metrics have been renamed:

The default mapping (Mapping of Organizations, Roles, and Permissions) for identity providers has been adjusted so that every user (via the default role bpcuser) is granted the right to use all standard BPC modules. In addition, the right to view the list of logged-in users is granted.

This change does not affect existing configurations.

For Identity Providers (Backend Connections), a large portion was previously configured via a single JSON setting. This has been split into individual settings. Existing configurations will be migrated automatically. If older deployment exports of Identity Provider components are in use, it is best to recreate them.

See also: Creating, Configuring, and Using an Identity Provider, Database as Identity Provider, Keycloak as an Identity Provider, Keycloak and Dynamic Redirect URIs, Deployment Constraints

ID columns are now set via combo boxes in the Log Service configuration interface. The configuration can only be saved if at least one ID column is defined. Additionally, the system checks whether all ID columns are included in the field configuration. If this is not the case, the form is marked as invalid and saving is prevented.

The HTTP proxies configured in BPC now also forward OPTIONS and PATCH requests.

The 'link' type no longer exists for notifications; instead, all notifications can now specify links. The field linkData is used for this (previously typeSpecificData). The ` url ` field is still used for links to external websites; for internal BPC navigation, the hash component of the BPC URL is now specified in the ` navigation ` field. For more information, see " Notification Types " and the " Notification API."

In the notification interface (BPC → Configuration → Overview → Notifications), you can now also configure a link (see Notifications to Users).

The Submit feature has been revised. Some changes are now required here. See Migration from BPC 4.* to BPC 5.0. The structure and possible actions for the messages have been adjusted.

The Status API endpoint /cxf/bpc-core/status/server/{serverUUID}, which queried the status of a remote BPC, has been removed.

The plugin can now configure a process that is displayed immediately upon triggering. In addition, the text and icon can now be freely configured. See also Process Starter Plugin

The option to group settings is now enabled by default. We recommend using this view, as it displays the settings in a shared context.

Settings groups now have multilingual Labels.

Log Services can now be enabled or disabled individually. The term “maintenance mode” was misleading in this context.

The query string parameters gridId, gridExtId, multiRecords, buttonId, and the form parameter tablePrefix have been removed from process action requests. To send additional context or configuration information, "Process Action Metadata" can be configured in the monitor settings.

In process starters, the XML that was sent along with the request has been replaced by JSON. As a result, portletArchiveName, operation, mandant, gridID, key, bpcModule, bpcModuleInstanceId, and custom have been removed. key has been uniformly renamed to id. Additional context or configuration information can be reliably included by using the "metadata" configuration in the process starter settings within the monitor settings. The process parameters are grouped under config.parameters in the request payload. File uploads contain ` filename, ` `type `, and ` `data. Grids contain a list of their records. `

` For "Change State," ` tablePrefix`, ` mandant , and ` `changeStatusBox_<Spaltenname> ` have been removed. ` command ` has been uniformly renamed to ` type ` and is assigned the value "statusChange." ` columnsstring ` has been renamed to column. newStatusCombo_<Spaltenname> has been renamed to newStatus. commentfield has been renamed to comment. childStatus is no longer set to "Info" by default in the Change State configuration and, if configured, will be migrated to metadata. Additional information can be passed in the "metadata" object in the Change State configuration.

See also Migration from BPC 4.* to BPC 5.0 Configuring Process Actions Process Starter

The unused settings inubit_aperakEndPoint, inubit_dbGridId, and inubit_pmMandant have been removed. The settings inubit_actionEndpoint, inubit_changeStateEndpoint, and inubit_VpsEndpoint have been replaced by actionEndpointProcessor, changeStateEndpointProcessor, and vpsEndpointProcessor.

An invalid JSON payload in an HTTP request body is now responded to by API endpoints with the error " 400 Bad Request."

The " modelVersion " is now also displayed if the user does not have admin rights.

A migration is required for the Forms module when moving from BPC 4.x to BPC 5. Information on this can be found here.

For Boolean values in the settings tables, a combo box is no longer displayed; instead, only the checkbox with the truth value appears. The value can be changed by clicking, pressing the spacebar, or pressing Enter.

The appearance of the BPC has been updated.

The classes arrow-spacing-sm (small) and arrow-spacing-xs (extra small) can now be used on buttons to reduce the arrow spacing.

For BPC module developers:

If a ` feature/feature.xml ` is used in the module sources, please remove the following resource block from ` pom.xml `:

This entry defined ` feature.xml ` as a resource and embedded it in the JAR file. This is not necessary.

However, ` maven-resources-plugin ` must still be used to replace placeholders in ` feature.xml `.

To do this, add the following plugin call:

When migrating installations that were already using Elasticsearch, an additional migration step may be necessary when switching to OpenSearch 3. A tool is provided for this purpose. For further details, see Migration from BPC 4.* to BPC 5.0

Index cleanups are performed 60 seconds after BPC starts, and then run at the configured interval.

It is now possible to use the value 0 in the valueMap of a CustomRenderer and to see this value as a Label in the monitor. Previously, 0 values were not displayed.

The icon for accessing notifications and displaying the number of unread notifications is now a plugin. Therefore, it can now be placed in various locations within the interface, just like other plugins.

Notifications now include an additional option to send the message only to logged-in users. The filters by roles and organizations remain active. See also Notifications. For notifications with the "Users" recipient group, the recipients are no longer displayed.

Users of the Log Service API must replace all instances of childs with children in their POST data. During a transition period, childs may still be used for incoming requests. This backward compatibility will be removed in a future release. Please also note that the responses from the Log Service endpoints now contain children instead of childs.

The unused identityProvider_ussUrl setting has been removed.

JSON Schema validation of the data to be written can be enabled for each Log Service component. The default setting is 'Off'. The JSON schema is automatically generated based on the configured Keys and Fields and can be retrieved via the Log Service endpoint if needed.

For event handling, use Map instead of Dictionary.

Any path information is ignored to prevent path traversal attacks.

Effective immediately, access to Karaf via SSH connections is restricted to the host localhost by default. To enable access via external connections, use the central configuration file. See Karaf SSH Access.

The logging configuration has been changed so that session tokens are masked. For new Karaf installations, this happens automatically. For existing installations, please update the configuration file [KARAF]/etc/org.ops4j.pax.logging.cfg. Replace the old line here:

with the lines:

Since session tokens in Keycloak and OIDC are UUIDs that are also used elsewhere, we log the first and last four characters here.

HTTP proxy backend Connections and flow Connections now always filter the session cookie to prevent a recipient from making requests in the BPC within the user’s context. The setting ` filterSessionCookie ` is therefore no longer needed. Instead, the new setting ` sendSessionId ` allows you to include the user’s session ID, which can be verified at the endpoint ` GET /cxf/bpc-core/authentication/session/{sessionid} . When the setting ` `injectUserSessionJWT ` is enabled, a self-generated JWT is no longer sent; instead, the signed ID token from the OpenID Connect provider is sent. For more details, see Backend Connections - HTTP Proxy.

HTTP calls made via an HTTP proxy or Flow connection filter out the BPC API key header (X-APIKey). Note: This could affect existing BPC configurations if, for example, an INUBIT process is triggered that, in turn, makes calls to the BPC API using the API key provided. (In this case, it would be better to store a fixed BPC API key within the INUBIT process.)

For new backend Connections of the HTTP Proxy and Flow types, the " Filter BPC Session " option is enabled by default.

If you use the file custom.java.security, you should adjust the property jdk.tls.disabledAlgorithms to make the TLS configuration stricter and thus more secure.

Instructions for migrating old indices when migrating to OpenSearch 3. See also Migration from BPC 4.* to BPC 5.0

The use of Java 21 is now required.

If the BPC was initially installed with OpenSearch instead of Elasticsearch, then the [bpc]/opensearch_data directory can be used as-is.

If not, the indices must be migrated first.

See Migration from BPC 4.* to BPC 5.0

This update upgrades the Karaf version to 4.4.8. It is necessary to update the modules bpc-be-core, bpc-be-analysis, bpc-be-forms, and bpc-be-monitor.

For BPC module developers

With the updated Karaf, we are shipping CXF 3.6.8 instead of 3.6.7, which provides Jackson version 2.19.2.

Please update the CXF version (3.6.8) and Jackson version (2.19.2) in your pom.xml. To do this, check whether you have an import package statement for this version. This must be added or adjusted if you use Jackson functions such as the ` ObjectMapper ` class.

The Core is no longer transpiled to legacy ECMAScript, and polyfills are no longer added. This enables support for newer language features. This means that ExtJS packages should also have the following content in their ` packages/local/PACKAGENAME/package.json ` file:

INUBIT is no longer supported as an identity provider.

See OpenAPI Specification for Process Actions, Process Starters, Process Status Changes, and Multiple Actions

The Forms module’s renderer is no longer included in bpc-fe-forms but is provided separately as bpc-forms-renderer. This makes it possible to update the renderer independently. During a BPC update, the URL of the Forms Module renderer is automatically changed to bpc-forms-renderer/index.html.

The renderer is available via Downloads.

The "taskPanel" element type in the detail views has been removed along with the associated settings function_interactionColumn and function_interactionFormId.

During a transition period, the use of childs instead of children is still permitted. This does not affect the data structure when reading data.