12.10.1

Hangfire QueuePollInterval changed from zero to 2 seconds

Hangfire previously polled SQL Server ~60–100 times/second even with no jobs queued, creating constant database load. The poll interval is now 2 seconds, reducing SQL queries by ~99.4 %. Async provisioning jobs may start up to 2 seconds later on average (below the threshold of perceptible delay).

Added an overwrite-avoidance option to the migratedata utility

The migratedata utility adds a new -avoid_overwrite option so it imports Q&A data only for profiles that don't already have Q&A data on the target instance.

Reduced IIS app pool cold-start delays

Bravura Security Fabric enables AlwaysRunning mode and application initialization for the fox-api and fox-identity IIS app pools, eliminating the 10 to 30 second cold start that previously occurred after the periodic app pool recycle.

Enabled IIS dynamic compression for JSON API responses

Bravura Security Fabric enables IIS dynamic compression and adds the application/json MIME type to the dynamic compression list, reducing JSON API response size.

Added cache-control headers for static assets

Bravura Security Fabric adds Cache-Control headers for content-hashed static assets, so browsers no longer re-download unchanged files on every visit.

Added ASP.NET Core response compression

Bravura Security Fabric adds ASP.NET Core response compression middleware with Brotli and gzip support for dynamic content.

Guarded against a missing CGI variable in authentication chain matching

The check_match_cgi function no longer raises a TypeError when a CGI variable such as HTTP_REFERER is absent, for example when stripped by a Referrer-Policy: no-referrer header, during a contains or notcontains match.

Fixed a self-resync timeout caused by missing schema in dump procedures

The dump procedures for the OpenIddictCertificate and UserSetting REST tables now include the schema, resolving a timeout in the self-resync utility.

Added a Higher Education affiliation engine to the base product.

The affiliation engine calculates role assignments from Higher Education affiliation data using configurable criteria groups, and is now shipped and maintained as a standard component instead of per-customer custom code.

Mass password reset result messages report operation duration

The mass password reset and mass onboard operations now report the measured end-to-end duration in their agent result messages. Previously, operators had to correlate log timestamps to determine run time. Return codes and result classification are unchanged.

Azure AD cached credential refresh after password reset

On Azure AD-joined and hybrid Azure AD-joined Windows 10 1607+ devices, the Local Reset Extension now refreshes the TPM-backed Azure AD cached credential after a Bravura Pass password reset, so offline Windows sign-in works with the new password. The refresh runs automatically on Azure AD-joined and hybrid-joined devices, with no configuration required. If the Azure AD refresh cannot complete (for example, the device is offline or the identity provider is unreachable), Bravura Pass warns, surfaces the _LOCALR_AAD_WARN status, and skips the optional workstation lock so the user keeps their current session. New status messages: _LOCALR_AAD_REFRESHING, _LOCALR_AAD_SUCCESS, and _LOCALR_AAD_WARN.

Configurable default user interface

Added a system variable that sets which Bravura Pass user interface, current or previous, users see by default when they have no saved preference. Administrators set the default from the system-management console instead of using URL suffixes. A one-time coach mark now highlights the version toggle on first login.

Individual account selection for password changes

Users can now select specific individual accounts when changing passwords, rather than only target groups. The account list supports multi-select, search, and filtering, and applies authorization checks per account.

Added automatic opening of the password requirements panel

In the new user interface, clicking or tabbing into the New password field now opens the password requirements panel beside the form at screen widths of 900px and wider. The form and panel slide to stay centered. A closed panel stays closed. On smaller screens, the panel opens from its toggle and appears under the form.

Fixed data race on clipboard field in HIDSessmon ParseMessage()

The clipboard boolean field in HIDSessmon.java is now declared volatile to ensure proper memory visibility across threads per the Java Memory Model.

Removed legacy branding from one-time disclosure file names

One-time disclosure downloads no longer include legacy "hitachi" branding in the file name.

Fixed the hid_authchain_recaptcha component upgrade path

The Functional.hid_authchain_recaptcha component now upgrades correctly from version 1.0 to 1.1 during an in-place upgrade; previously the component upgrade task failed and left the component stuck at version 1.0.

Added an OIDC-based MFA module with Duo Universal Prompt

Bravura Security Fabric adds a new OIDC-based multifactor authentication module, fedidp_oidcauth, with Duo Universal Prompt as the first supported provider, including HS256 and HS512 JWT signing and verification, an admin UI with a test-connection button, and audit logging for authentication events.

Added support for Azure Temporary Access Passes

The Azure connector, agtazure, now issues, lists, and revokes Temporary Access Passes (TAP) for Microsoft Entra ID accounts. Bravura Security Fabric exposes these operations through new REST API v2 endpoints under /api/rest/v2/accounts(<accountKey>)/temporaryAccess.

Fixed Group ID and group description search in Role app entitlement members

The managed-group conditional search on the Role app entitlement-members step now sources Group ID and group description from the correct fields; previously it compared the wrong field for Group ID and pulled the wrong field for group description, so searches did not return correct results.

Cache-Control headers on sensitive API responses

Cache-Control: no-store and Pragma: no-cache response headers are now added to sensitive API endpoints (account details, user profiles, OAuth userinfo) so browsers do not cache authenticated responses to local disk. Static assets (SVGs, localization JSON) remain cacheable. Addresses pentest finding "Cacheable HTTPS response."

Updated .NET 8 packages to 8.0.31 and re-enabled NuGet vulnerability auditing

Bravura Security Fabric now references version 8.0.31 of the ASP.NET Core, Entity Framework Core, and related Microsoft .NET 8 packages, and NuGet vulnerability auditing is enabled again. Vulnerabilities such as CVE-2025-55315 affect the .NET 8 runtime installed on the host. Installing .NET 8 runtime 8.0.31 or later resolves them.

sessionLogs endpoint ACLs enabled for authenticated users

Authenticated users can now query the /api/rest/v2/sessionLogs endpoint filtered by their own requester ID. OData $filter, $top, and $orderby are supported. The React dashboard uses this endpoint to display "last login" on the user profile card.

OpenIddict token introspection caching (30 s TTL)

Every authenticated API request previously made an HTTP round-trip to the identity server for token validation, adding 500–1000 ms per call. Introspection results are now cached in IMemoryCache keyed by SHA-256 of the token, with a TTL of min(30 s, time-until-token-expiry). This eliminates redundant introspection calls during page navigation, reducing per-page auth overhead from 2.5–10 s to near zero. Session-extension logic remains piggybacked on real introspection calls and self-heals on the next cache miss.

React UI npm audit vulnerabilities resolved (1 critical, 14 high, 6 moderate)

Security vulnerabilities in handlebars, vite, lodash/lodash-es, brace-expansion, defu, flatted, and tar dependencies are resolved.

In-flight API queries are canceled during logout to prevent 401 errors

The dashboard's user profile query is now canceled during session teardown, preventing unnecessary 401 console errors.

Deduplicated users() API calls by sorting $select parameters deterministically

Multiple callers requesting the same user fields now produce identical React Query cache keys, eliminating duplicate network requests on page load.

AppBar decluttered: language and theme controls moved into user menu

The language selector and theme toggle are moved from the top-level AppBar into the user menu dropdown, reducing visual noise in the header.

OData controller query performance: server-side filtering before materialization

Multiple controllers (Attributes, SessionLogs, Credentials, Settings, Operations, Users, Groups, Accounts — 21 occurrences across 8 controllers) previously called ToListAsync() to load entire tables into memory before applying OData $filter/$top/$skip. A request for $top=10 on a 50 000-row table now loads only the matching rows at the database level instead of materializing the full table.

Default OData pagination (MaxTop=500)

EnableQueryFeatures() now enforces MaxTop=500. Endpoints that previously returned all records when the client omitted $top are now capped. The React frontend already sends $top=25 and is unaffected. See Upgrade Actions for compatibility details.

Translation pre-loading at application startup

The TranslationService static Translate() method (called by AutoMapper) previously used .GetAwaiter().GetResult() on async database calls, blocking thread-pool threads. On cold cache with 100 entities this could cause thread-pool starvation. All translations from the Language table are now pre-loaded into a static cache during ApplicationInitializationService startup, eliminating runtime database round-trips for translations.

React dashboard query consolidation

The "At a Glance" dashboard section previously issued 7 separate API calls (4 of which independently scanned the accounts table). These have been consolidated into 1–2 navigation-property calls with client-side aggregation, reducing total API time from ~4.7 s to ~500 ms and API round-trips by 75 %.

Navigation-property pattern for user-scoped account queries

User-scoped account queries now use /users({id})/accounts instead of /accounts?$filter=user/id eq X, which is 4–5× faster (241–327 ms vs 1 233–1 628 ms) because it starts with a PK lookup and follows the FK index rather than scanning the accounts table.

$select added to OData queries

All useApiData calls now include $select to limit returned fields to what the component actually uses, reducing response sizes by 73–90 % (e.g., user profile from ~2 KB to ~200 B).

Keyboard navigation and accessibility features

Focus management, tab order, keyboard shortcuts, skip links, landmark regions, proper ARIA attributes, and screen-reader compatibility have been implemented in the React application.

Performance: Cache OpenIddict token introspection results

Every authenticated API request previously made a full HTTP round-trip to the identity server for token validation. A 30-second in-memory cache (keyed by SHA-256 of the token) now eliminates redundant introspection calls, reducing auth overhead from 2.5–10 s per page load to near zero for cached tokens.

Performance: Change Hangfire QueuePollInterval from zero to 2 seconds

With QueuePollInterval=Zero, Hangfire polled SQL Server 60–100 times per second even with no queued jobs. Setting the interval to 2 seconds reduces idle SQL polling by approximately 99.4%. Background jobs may start up to 2 seconds later on average.

Angular: Refactor cgi.service.ts custom-link parameter passing

Duplicated COMPONENT_ID and CUSTOM_LINK_TITLE parameter-passing logic in cgi.service.ts has been extracted to a shared helper and covered with unit tests, reducing fragility in future updates.

Side menu auto-expand when single item present

Side menus with only one top-level item that has children now auto-expand on load, eliminating an unnecessary extra click.

Added action categorization, filtering, and search to the dashboard

The dashboard adds action categories and tags, filtering controls, search, and a personalized recommended-actions section.

Upgraded Node.js and Angular for security compliance

Bravura Security Fabric upgrades the bundled Node.js from 18.12.1 to 22.22.2 and Angular from 15 to 19 for security compliance.

Added a React configuration interface for customer branding

The customer branding configuration interface adds logo upload with client-side validation, color selection, and live preview, built in React.

Fixed the language switcher to reflect installed languages

The React language switcher now queries the instance for installed language packs instead of showing a hardcoded list of English, Spanish, and French.

Fixed a misleading session error on the idle login page

The login page no longer shows "The session is invalid. Please log in again" when left idle before the user has logged in.

Fixed dark theme visual inconsistencies

Bravura Security Fabric corrects color, contrast, and styling inconsistencies in the React UI dark theme.

Optimized vendor chunk splitting for delivery performance

The React UI splits its single vendor chunk into four chunks grouped by update frequency, improving parse time and download performance for SaaS and mobile delivery.

Consolidated duplicate notification provider wrappers

The React UI consolidates the duplicate NotificationProvider and NotificationsProvider wrappers into a single provider.

Fixed the pre-login spinner color

The loading spinner shown before the login page appears now uses the theme's primary color instead of white.

Fixed the secondary branding color in the Angular UI

The secondary color defined in branding.json now overrides the default secondary color in the Angular UI; previously only the primary color applied from the branding file, and the secondary color required a manual edit to _common.scss.

Moved the Angular UI build output to the /v1/ path

The Angular UI build output and base href move to the /v1/ path.

Hid the legacy side menu on React-embedded pages

The Angular layout-side-menu is now hidden on React-embedded pages, so it no longer renders alongside the React sidebar.

Added German, Japanese, Portuguese, and Chinese to the React UI

The React UI adds German, Japanese, Portuguese (Brazil), and Chinese (Simplified) to its supported languages, in addition to English, French, and Spanish.

Fixed the dev proxy leaking the backend host on redirects

The Vite development and preview proxy now rewrites the host in upstream redirect Location headers, preventing the backend host from leaking to the browser and causing a CORS failure.

Fixed a white login page background in Dark Mode after upgrade

After upgrading, the login page background now matches the Dark Mode setting instead of appearing white.

Fixed legacy side menu theme mismatch in dark mode

The legacy Angular side menu now matches the light theme of legacy page content instead of rendering dark when the React UI is set to dark mode.

Added a modern footer with a visible version number to the React UI

The React UI adds a footer that keeps the version number visible while showing secondary content, such as copyright and links, unobtrusively.

Fixed relative timestamps that stopped updating in background browser tabs.

Relative timestamps in the new user interface now keep listening for visibility and language changes even when a component mounts while its browser tab is in the background, so timestamps resume updating correctly when the tab becomes visible again.

Redesigned the authentication method selector on the login screen

The authentication method selector on the login screen now appears as a list of cards with sentence-case labels and a chevron. The help-desk Skip authentication control is now an outlined secondary button. Light and dark themes follow the browser color scheme.

Removed extra padding and a stray bullet from the notification dialog

The notification dialog no longer shows a stray bullet or extra padding. The title, tabs, and gray area now span the full width of the dialog.

Cleaned up the URL when the React UI starts

The React UI now reads query parameters such as USERID and removes them from the URL before the hash route, so the address bar no longer shows a muddled URL.

Fixed inconsistent data across report output formats

Downloading a saved report after changing its search condition previously returned the updated results only in CSV format, with PDF and HTML formats showing the original condition's results; all formats now reflect the current condition.

Immediate WebSocket reconnect on tunnel disconnect

The TunnelClient now retries the WebSocket connection immediately upon disconnect before applying TunnelRetryDelay (default 5 minutes). The backoff delay only kicks in after the immediate retry fails. This significantly reduces downtime for proxy-dependent operations (logins, password verifications, PAM sessions) during transient network interruptions.

Fixed an unhandled WebSocket exception in TunnelHost that could crash the IIS worker process.

An unhandled exception in TunnelHost's WebSocket handling could crash w3wp.exe, disrupting proxy tunnel sessions. TunnelHost now handles this exception without crashing the worker process.

Targetsync.exe now correctly updates password expiry data

Previously, targetsync.exe created a separate _exp.db file containing outdated expiry values, causing incorrect password expiration emails. A full discovery would fix the values, but subsequent targetsync runs reverted them.

DB_REPLICATION_QUEUE_DELAY_PAST_THRESHOLD false positive during system reboot suppressed

The alert was triggered during normal service initialization when the queue_delay is initialized to INT_MAX before any records are processed. The alert is now suppressed when the value is INT_MAX within 10 minutes of system boot. No functional impact to data consistency or replication.

Fix a missing index causing replication delays

A missing filtered index on wstnpwdchkout_full that caused PolicyRuleComputerPrepare to run a full table scan, blocking database replication on large environments, is fixed.

Fixed a self-resynchronization timeout caused by missing schema qualifiers in REST table dump procedures.

The dump procedures for REST tables, including OpenIddictCertificate and UserSetting, omitted the schema qualifier, causing the resynchronization utility to time out after 120 seconds. The dump procedures now include the schema qualifier.

React UI: hid_password_policy_haveibeenpwned plugin rejects all passwords

In the React UI, the hid_password_policy_haveibeenpwned password policy plugin evaluated passwords successfully (confirmed by logs) but did not return the pass/fail status to the UI. All passwords appeared rejected regardless of whether they were compromised. The legacy (v1) interface was unaffected. The plugin result is now correctly propagated to the React UI.

Fixed the forgot-password email link failing in the classic (v1) interface

Clicking the emailed password-reset token link in the classic (v1) interface re-ran the email-generation step and returned a Failed to send email error. Users can now complete self-service password reset from the emailed link.

Updated the link to the Bravura Security Browser Extension in the Chrome Web Store

The Install chrome extension link now opens the current Chrome Web Store listing for the Bravura Security Browser Extension. Previously, it opened an outdated listing.

Fixed a blank error for failed per-account password changes

On the Change password page in the new user interface, a failed password change for one account showed an error with no details. The page now shows an error code when no other message is available.

Fixed the plugin rule showing as passed when a plugin check failed

On the Change password page in the new user interface, the plugin rule now fails if any of several plugin checks fails. Previously, only the first check counted, so the page could show a passing rule for a password that the server rejected.

Fixed the password requirements panel ignoring the description-only option

The password requirements panel in the new user interface now honors the showDescriptionOnly option and shows the custom description. The toggle labels for screen readers are now translated.

Fixed the forgot-password email link opening a page with no navigation

The emailed forgot-password link now signs the user in and opens the Change password page inside the main application with the usual navigation. The page opens in the new or classic interface, according to the default or the user preference. Previously, the link opened a full-screen classic page with no way to navigate.

Fixed the Change password page showing only display names for accounts

The Change password page in the new user interface now shows the account identifier on each account row. It shows the long ID when DISPLAY_ALIAS_SIMPLIFIED is unset or 0, and the short ID when it is 1. A long ID that is a GUID falls back to the short ID. The identifier is part of the screen-reader label, and search matches the long ID. The REST API endpoint GET /v2/applicationSettings/ui now returns displayAliasSimplified, and that value stays anonymous.

Fixed the Update role wizard showing a disabled role as enabled

The Update role wizard showed a disabled role as enabled and assignable. Submitting the wizard without changes re-enabled the role and reset its enforcement and deficit action settings. The wizard now shows and keeps the stored values of the role.

Guacamole HIDSessmon clipboard data race

Fixed a data race on the clipboard boolean field in HIDSessmon.java where concurrent access by HIDSessmonReader and HIDSessmonWriter threads lacked synchronization. The field is now declared volatile to ensure proper memory visibility per the Java Memory Model.

SSH session recording playback with Guacamole 1.6 fixed

SSH session recordings previously showed a gray/black screen during playback in the Sessmon App, although live viewing worked correctly. The issue was specific to the Guacamole 1.6 SSH recording/playback pipeline. RDP sessions were not affected.

Lost guacamole-rdp access disclosure plugin attributes resolved

When ARCHIVE_ONBOARDED_SYSTEM processed a DELETE action, the WstnClean stored procedure could inadvertently delete all guacamole-rdp disclosure attributes for unrelated systems. The cleanup logic is now scoped correctly.

Fixed disclosure plugin launch from Checkouts > Active

Clicking Login on a saved session from the Checkouts > Active screen now launches the disclosure plugin, such as Remote Desktop, instead of downloading a file named download.htm.

Fixed a TypeError when creating a saved session for a disclosure plugin

Creating a saved session for a disclosure plugin with override-allowed attributes no longer throws a JavaScript TypeError in _cloneUserDisclosure.

Removed a legacy branding reference from one-time disclosure file names.

One-time disclosures were automatically named with a legacy brand-name prefix. Generated file names no longer reference the legacy brand name.

Fixed a credential-validation bypass on the system onboard wizard

Editing the admin password to a different incorrect value after a failed submission on the system onboard wizard no longer bypasses credential validation. The wizard now re-runs credential checks on every submission, regardless of which field changed.

Fixed session recording playback failing in load-balanced deployments

Session recording video playback failed with a cross-origin resource sharing (CORS) error in load-balanced, multi-node deployments. The player requested the video from a node host instead of the load balancer address, and the default ALLOWED ORIGINS list did not include the node external address, the HTTPS scheme, or the BASE_IDSYNCH_URL origin. If ALLOWED ORIGINS is not set, the default list now includes these origins, so playback works without manual configuration. A value you set explicitly continues to override the default.

Fixed loss of OTP account associations when an account returned from historic_data_grp

Accounts moved from the historic_data_grp managed system policy (MSP) back to an active MSP lost their OTP account associations and metadata attributes. These associations and attributes now remain after the move.

Fixed password randomization failing when ignore_incomplete_subscribers is True

Password randomization failed on managed accounts with linked, unreviewed subscribers, even when ignore_incomplete_subscribers was True. Randomization entered orchestration mode and deferred the password change. It now skips incomplete subscribers and proceeds with regular randomization.

iOS and Android metrics and data points fail to load

On Fabric 12.10.0 build 42390 with Cloud Proxy CGI, metrics and data points failed to load on both iOS and Android devices. On iOS, login after authentication took several minutes. Android displayed net::ERR_TOO_MANY_RETRIES. This has been resolved.

False user lockouts from proxy communication failures

The auth chain no longer increments the invalid password lockout counter when a proxy tunnel communication failure (agent error code 25 / PLUGIN_ERROR_PROCESS) occurs. Previously, transient proxy outages during WebSocket reconnect cycles caused agtaddn.exe failures to be treated as failed password attempts, locking out users whose passwords were never validated. Users now receive a system connectivity error instead of "incorrect password."

Fixed the Duo Universal Prompt showing the wrong tag name on mobile devices.

When users authenticate through an OIDC-based authentication chain configured with Duo Universal Prompt, the prompt now displays the chain's actual tag name instead of a generic label on mobile devices.

Clarified the Redirect URI field description for the Duo Universal Prompt authentication chain.

The OIDCAUTH authentication chain configuration page now includes clearer guidance for the Redirect URI field, helping administrators complete Duo Universal Prompt setup correctly.

Fixed OpenIddict client secret mismatches that blocked v2 login and REST calls

Bravura Security Fabric now reconciles a stored OpenIddict client secret against the instance's current RestApiKey at startup, updating it when the two values diverge. This resolves 401 invalid_token errors on v2 REST calls and login failures that could follow an upgrade, install, or database restore.

Fixed the remote API network address check rejecting valid clients behind a reverse proxy or on IPv6

The allowed network addresses check for remote API access now splits multi-address X-Forwarded-For headers and evaluates bare IPv6 client addresses intact. The check also honors CIDR entries that contain a space after the comma. Previously, valid API clients failed to log in with rc 61 when traffic passed through a reverse proxy or arrived over IPv6.

Fixed SAML sign-on from the new user interface being blocked by the Content Security Policy

The new (React) user interface now sends SAML authentication requests to the external identity provider from the top-level window, matching the OIDC flow. Previously, the request was issued inside the application iframe, and the Content Security Policy frame-src directive blocked it, so SAML sign-on could not start.

Fixed SAML service provider signature-verification failures reporting the wrong cause

Previously, one terminal error reflected only the configured signing mode, and a missing signature surfaced a raw xmlsec XPath error. The error messages now identify the actual failure, distinguishing a missing signature on the expected element from a signature that fails verification.

Fixed the Functional.hid_authchain_recaptcha component upgrade failing on upgrade installs

On upgrade installs, the component upgrade task from 1.0 to 1.1 failed and left the component at version 1.0. Fresh installs were not affected. The upgrade script now completes and the component reaches version 1.1.

Fixed users being signed out immediately with an invalid token error on load-balanced installations

Users on installations with more than one node behind a load balancer could be signed out immediately after signing in, with an Invalid token error. The REST API validated session tokens through the load-balanced address, so a node that had not issued a token could reject it. Validation requests now go to the node handling the request, and signing in on an individual node's own address works again in replicated installations. Session affinity on the load balancer remains a requirement.

Fixed rehire requests stuck pending approval for AD account creation

A rehire whose profile and Active Directory account had been deleted, but who had a new source-of-record change, could generate a request that stayed stuck pending approval instead of routing as a new-employee request. This has been fixed.

Fixed entitlement search failures in the Role app's update-entitlements step

Selecting certain specific drop-down options when searching entitlement members while creating or updating a role caused the search to fail. Entitlement search now returns results correctly for these options.

Fixed duplicate approval emails for phase-2 authorizers with delegates

Bravura Security Fabric no longer sends duplicate "please approve" emails when a phase-2 authorizer also delegates for another authorizer in the same phase.

REST API v2 unit test failures for SessionLogs and TargetSystems

Fixed 20 failing unit tests (14 in v2, 6 in v1) in the REST.Test suite that were failing since the c270987d commit.

OTP account creation API regressions

Resolved breaking behavior changes where WFRequestActionsGet returned F after PDR completion (instead of S) and WFRequestAttrsGet did not return created PAM UTIL account information, impacting integrations such as DTCC's PAMUtil automation.

Fixed a cacheable HTTPS response finding

HTTPS responses that could contain sensitive information are no longer cacheable by the browser, resolving a moderate-severity penetration test finding.

Fixed inconsistent HTML encoding of the DESC field in listing and table views

The user group listing view rendered stored description values without HTML encoding, so injected HTML links rendered as clickable (link injection, CWE-74). Bravura Security Fabric now applies HTML encoding to the DESC field in all rendering contexts, including listing and table views.

Removed partial passwords from the Change passwords debug log

Password validation on the Change passwords page in the new user interface no longer writes the first three characters of the password, followed by ***, to the debug log. The raw response from the generate-password call is also no longer logged.

System onboard PDR displays "request not submitted" for Cisco IOS devices despite successful processing

When system verification took longer than expected (e.g., 64 seconds for agtssh), the batch record lookup returned before the batch was created, causing the UI to display a false failure message. The timing/polling logic is now corrected.

Fix refresh loop causing unexpected logout in React UI

Eliminated the infinite refresh loop between /#/__refresh and /#/ that eventually caused session timeouts and unexpected logouts. Dashboard cache clearing now uses React Query's invalidateQueries() method.

Momentary spinner flash during page navigation eliminated

A loading spinner that appeared on the current page before navigation completed has been removed, and the sidemenu now prevents additional clicks during navigation.

PAM refbuild "Manage Resources" custom link now displayed on React PSF screens

When RefBuild.pam_team_management is installed, the "Manage Resources" custom link now appears correctly on the React PSF screens, matching the legacy (Angular/CGI) behavior.

Iframe reference race condition during logout

Fixed a race condition where the Angular legacy app sent a postMessage to show the iframe before the React iframe ref was mounted, producing "Cannot show iframe: no iframe reference" warnings during logout transitions.

MUI anchorEl warning in UserMenu during logout transition

The UserMenu's anchorEl reference became stale when the component tree unmounted during logout, causing MUI's Popover to attempt positioning against a removed DOM element.

Angular header and sidebar flash during login page load

The Angular header and sidebar briefly flashed on the login page during initial load and every ~75 s session refresh because the body[data-transaction="C_AUTHCHAIN_LOGIN"] CSS selector was not applied until Angular bootstrapped. The data-transaction attribute is now set in index.html so the header starts hidden by default.

Double headers intermittently shown on UI pages

A duplicate header bar was sometimes rendered when clicking through pages or performing a browser refresh.

Duplicate session-expiry error messages

When a session expired, both the Angular and React session-expiry handlers fired, producing two overlapping error messages. A single handler now owns the notification.

Login page idle session-expiry error

The login page displayed "The session is invalid. Please log in again." when left idle. This spurious error is now suppressed so the login page remains clean after idle periods.

Double headers sometimes shown in UI pages

Navigating between pages or performing a browser refresh intermittently caused duplicate page headers to appear. This rendering issue has been resolved.

Left side menu remains on login prompt after session timeout

When a session timed out, the left navigation menu persisted on the login prompt page. The menu is now correctly hidden on the login screen.

PAM RefBuild.pam_team_management "Manage Resources" custom link not displayed on React PSF screens

When RefBuild.pam_team_management was installed, the "Manage Resources" custom link appeared on legacy (Angular/CGI) screens but was missing on React PSF screens. The link now renders on both.

Fix the profile picture not displaying

The profile picture now displays correctly in the React UI.

Fix delayed language updates on the dashboard

The dashboard All Actions and Other Actions sections now update their translated text immediately when the display language changes.

Fix the side menu remaining visible on the login prompt after a session times out.

When a user's session expires, the new user interface now hides the left side menu along with the rest of the authenticated layout while the login prompt is shown.

Fixed a privileges error when opening linked requests from the request details view

Users granted the "viewworkflow" ACL can now open parent requests, child requests, and the View automatically assigned entitlements link. Previously, these links failed with the error You do not have the required privileges.

Fixed the home page Profile tile displaying the profile GUID instead of the user's name

The Profile tile now resolves the user's name from the same identity query as the user menu instead of displaying the raw profile GUID. The View Profile link now checks the sign-in name, so a user whose display name is superuser keeps their profile link.

Fixed the command palette showing no loading or error state

The Ctrl+K command palette in the new console showed no loading indicator and displayed an empty "No results" message when items failed to load. It now shows a loading indicator with progress messages, and it shows "Couldn't load items" when loading fails. A load failure from before sign-in no longer appears after login.

Fixed the Manage the system menu overflowing when groups were expanded

In the new console, the Manage the system menu overflowed when groups were expanded, so lower options such as Security and Maintenance were unreachable. The menu now scrolls.

Fixed a flash of the previous page when navigating between legacy pages

In the new interface, moving from one page of the previous interface to another briefly showed the page that the user had just left, with a blank or black area where the left menu goes. A loading indicator now covers the page until the new page has loaded.

Fixed the Home link and logo doing nothing on the legacy dashboard

On the legacy Angular dashboard, clicking Home or the logo from a sub-page did nothing. It now returns to the dashboard, including when DEFAULT LEGACY UI is enabled.

Fixed dashboard metric cards missing their title when loading failed

When a dashboard metric card failed to load, it showed only the error message. The card title now stays visible above the error.

Fixed inconsistent membership report data across report types.

Running a saved membership report with a different condition and then returning to the original saved report could show inconsistent data between the two report types. Membership reports now return consistent data regardless of report type.

Fixed an unhandled exception in the proxy tunnel that could crash the web server process.

Bravura Security Fabric no longer crashes w3wp.exe when a WebSocket connection through TunnelHost.dll is disposed unexpectedly; the tunnel now handles the exception gracefully.

IDPM GetClientIP() now respects X-Forwarded-For

The GetClientIP() function in idpmactcgi.cpp has been aligned with the AJAX code path (ajax.cpp) to honour X-Forwarded-For and TRUSTED_REVERSE_PROXY configuration. Previously, audit logs for IDPM events (e.g., pss_reset_success) recorded the ALB/proxy IP instead of the real client IP in reverse-proxy environments (Cloudflare → ALB → IIS → BSF).

Cache-Control headers on API responses

Sensitive API responses now include Cache-Control: no-store. HTTP clients or proxies that relied on caching authenticated API responses will no longer be served from cache. Static assets remain cacheable.

Install .NET 8 runtime 8.0.31 or later on each host

The .NET 8 runtime is installed on the host and is separate from the Bravura Security Fabric packages. Install .NET 8 runtime 8.0.31 or later on every host that runs Bravura Security Fabric to resolve vulnerabilities such as CVE-2025-55315.

Hangfire poll interval increased to 2 seconds

Asynchronous REST mutation jobs (Users, Settings, Credentials, TargetSystems, Policies, Platforms, Groups, Accounts, ManagedAccounts/Secrets, ApplicationSettings, PasswordPolicies) may now start up to 2 seconds after submission instead of near-instantly. Average added latency is ~1 s, well below the perceptible threshold for admin operations. No client-side changes are required.

Verify the serveraddress registry value and node-local addresses

Each node now validates the serveraddress registry value at startup. A value carrying a scheme, port, or path prevents the node from starting; previously it was silently ignored. The requirement is unchanged: the value must be a bare host name. Where nodes do not answer on the same protocol and port as the client-facing address, set the new optional serverlocalurl registry value per node. It specifies the address at which the node's own web endpoints are reachable, and should use HTTPS or a node-local address. On HTTPS installations, each node must be able to reach itself by a name its certificate covers.

OData pagination cap (MaxTop=500)

OData endpoints now enforce MaxTop=500. The React frontend already sends $top=25 and is unaffected. However, Angular legacy UI pages, customer integrations, and admin scripts that expect unbounded result sets from the REST API v2 may need to implement client-side pagination. This is a potentially breaking change for consumers that omit $top or set $top above 500.

Update bookmarks and integrations that reference the interface's build path.

The interface's build output and base href moved from /fox/ to /fox/v1/. Update any saved bookmarks, scripts, or integrations that reference the previous path.

Review login ID display on the change-password page.

The React change-password page now respects the DISPLAY_ALIAS_SIMPLIFIED system variable. If the variable is set to 1, the page shows the short ID under each display name. To show long IDs, set the variable to 0 or leave it unset.

Connector Pack upgrade procedure

Review the updated Connector Pack upgrade documentation for clarified guidance on whether to use the upgrade option or uninstall/reinstall.

Grant the Graph permission required for Temporary Access Pass support

To use Temporary Access Passes, add the UserAuthenticationMethod.ReadWrite.All application permission to the Azure app registration that agtazure uses. Grant admin consent for the permission.

TunnelClient immediate reconnect behavior change

The TunnelClient now retries immediately on disconnect. The default TunnelRetryDelay (5 minutes) remains unchanged but now only applies after the first immediate retry fails. No configuration changes are required, but administrators who set very low TunnelRetryDelay values to work around the previous behavior may wish to restore defaults.