4.7.1

Updated the Google Apps connector (agtgapps) to add support for clearing app-specific passwords, backup verification codes, third-party tokens, and to disable two-step verification as part of the reset, disable, delete and update operations.

Roles with empty descriptions

Fixed the list‑groups‑as‑roles operation so that roles with empty descriptions no longer cause the connector to crash.

Account names with dots

Updated the unixssh.py script for the Python‑based connectors to allow a dot/period (.) in user/account IDs, matching what modern Linux distributions permit.

Host key verification options now enforced for Unix and Linux SSH targets

The Unix/Linux SSH connector now honors the Host keys file and Action for host keys options for the agtlinux, agtsolaris, and agtaix targets. Previously, these targets relied on Paramiko's default host key handling, which did not let you enforce custom verification policies.

Salesforce SOAP API version 65.0 support

Support has been added for version 65.0 of the Salesforce SOAP API.

CUA user systems

Updated the SAP Server (Netweaver 7.5+) connector to comment out reading the ZMT_USER_SYSTEMS_READ function for CUA systems, improving stability for those environments.

Local roles and profiles

Added the LOCACTIVITYGROUPS and LOCPROFILES table lookups and their account attributes so the SAP Server (Netweaver 7.5+) connector supports SAP / CUA systems that use local ACTIVITYGROUPS and PROFILES.

Memory usage

Ensured that RfcDestroyFunction is always called when using the SAP connector, reducing memory usage during large account listings, especially when account‑attribute listing is enabled.

Updated the Palo Alto Networks firewall with PAN‑OS (SSH) connector so that auto‑discovery (listing objects) and password reset operations function reliably during onboarding.

Updated Active Directory (agtaddn) computer attribute listing to exclude msDS-RevealedUsers and msDS-AuthenticatedToAccountList, as these lengthy multi-valued attributes exceed the discovery queue size limit.

The onPremisesSyncEnabled attribute is now listed for accounts

The Azure Active Directory connector (agtazure) now lists the onPremisesSyncEnabled attribute for accounts, as it already did for groups. Previously, auto-discovery left the attribute empty in the discobjattr table, so load scripts could not filter accounts on it.

Support for Entra Temporary Access Pass

The Azure Active Directory connector (agtazure) now issues, lists, and revokes Entra Temporary Access Passes. You can set default values for pass lifetime, one-time use, and start time on the target. Using this capability requires the UserAuthenticationMethod.ReadWrite.All application permission on your Azure app registration.

HTTPS support for on-premises connections

The Exchange connector previously hardcoded http:// in the New-PSSession -ConnectionUri for on-premises Exchange PowerShell connections, meaning port 80 was required. A new useSSL boolean parameter was added to the target address configuration that toggles the connection URI between http:// and https://. The default remains http:// for backward compatibility. The Exchange Online (ConnectCloud) code path is unaffected. Upgrade note: when enabling useSSL, the Exchange server must have a valid SSL certificate bound to the PowerShell virtual directory.

Exchange connector longid output for create operations

Updated the Exchange 2007+ Server connector (agtexg2k7) to add the longid for the agent output for the create operation and for when users already exist.

Exchange connector OAuth 2.0 authentication support

Exchange connector now supports OAuth 2.0 authentication for Exchange Online (list operations only; on-premises Exchange continues to use Basic Authentication).

Logging level

Updated the PowerShell connector so that variable conversion messages are logged at Debug level instead of Info, reducing noise in normal logs.

New option to leave empty attributes out of account creation requests

The SCIM connector (agtscim) has a new target address option, omitempty, labeled Do not send attributes without values when creating accounts. When you select it, the connector leaves attributes that have no value out of the account creation request. The option is off by default, so existing SCIM targets keep the legacy create payload. Select it on Oracle ERP Cloud targets, which reject the whole create request with HTTP 400 when it contains any property that the User model does not accept, even an empty one.

SSH protocol version 1 support deprecated

The Force SSH v1 option, referenced internally as enable_ssh_1 and enable_ssh_v1, is deprecated. This legacy option has no effect because SSH protocol version 1 is obsolete and insecure.

Fixed an issue in the loadcvagents utility that previously prevented existing Customer‑Verified connectors from being upgraded when newer versions were loaded for an instance.

Intermittent crashes

Fixed intermittent crashes during DUO challenge‑response authentication when users had no DUO methods configured.

Plaintext password in logs

Ensured logs no longer display plaintext passwords when a password reset fails due to comment‑like sequences in the password.

Resolved an issue with the SAP Server (Netweaver 7.5+) connector (agtsapnw) when listing users filtered with a selection range to add more than one selection criterion. This was previously causing an issue to only list from one selection range.

Fixed an issue with the SAP Hana Database connector (agthana) when encryption is used for the target address configuration.

Siteminder connector list override setting

Fixed an issue in the Siteminder connector (agtsm) so that it now correctly saves the list override setting.

Windows Server connector default global attributes with overrides

Fixed an issue to include default global attributes when an attribute override is used.

Active Directory connector – expired password/account handling

Restored the documented behaviour for how expired passwords and accounts affect login checks via registry options.

New user creation falsely reported as failed

Fixed a bug where Azure user creation succeeded but was reported as failed because subsequent attribute updates immediately after creation returned HTTP 404 "resource does not exist". The connector now recognises this as a temporary propagation delay, retries PATCH operations for newly created users, and uses the user's object ID when checking for resource existence, so template attributes and post‑creation changes are applied reliably without manual intervention.

Azure AD query URL construction with empty attributes

Updated the Azure Active Directory connector (agtazure) to correctly construct the query URL when attributes are empty and a filter is used, which was previously causing listing to fail.

Corrected the spelling of the OAuth2 authentication port address parameter

Fixed a misspelling in the label for the OAuth2 authentication port address parameter, which read "Autentication" when you defined address parameters.

Notice log spam from empty timestamps

Eliminated repeated "not a valid format []" notices when Okta timestamp fields are missing.

Okta Verify OTP with multiple devices

Modified the Okta connector to show a single challenge‑response option for the Okta Verify OTP method. The single option now accepts OTP codes from multiple registered Okta Verify factors (for example Okta Verify and Google Authenticator), avoiding confusion when several OTP factors exist for the same user.

Fixed an issue with the Okta connector (agtokta) to ensure that when methods from the "Authentication methods order" target address configuration are not configured that the matching Okta methods are not shown for the user on authentication for Okta challenge response.

Fixed session handling in the PeopleSoft 8.49 connector to prevent crashes during the list‑groups operation.

Adds additional error handling to Python Dayforce connector (agtdayforce) to handle more errors on connect and add more retriable error cases when listing

Correct handling of includeInGlobalAddressList

Fixed an issue where create operations could default includeInGlobalAddressList to true (and log "Warning: Error occurred when setting attributes: [Resource Not Found: userKey]"); the connector now treated the attribute as a boolean (not a string) and corrected the read/write paths, including a copy-paste error where the read path returned a different attribute's value.

Account creation failure on strict SCIM 2.0 targets

The agtscim connector now posts account creations to the /Users collection endpoint, as RFC 7644 requires. Previously it posted to an item URL such as /Users/<id>, which strict SCIM 2.0 targets, including Oracle ERP Cloud, rejected with HTTP 405.

Error details from compressed target responses are now reported

The SCIM connector (agtscim) now decompresses gzip-encoded response bodies, so the connector log shows the actual error that the target returned. Previously, compressed error responses, such as those from Oracle ERP Cloud, produced a generic message.

Invalid multi-valued attribute values now fail cleanly

The SCIM connector (agtscim) now reports an error when the value of a multi-valued attribute is not valid JSON. Previously, the connector could crash.

Google Apps connector cleanup defaults

After upgrading, review existing Google Apps targets to confirm whether app‑specific passwords, backup verification codes, third‑party tokens and two‑step verification should be cleared or disabled during reset, disable and delete operations. The connector now defaults to performing this cleanup; if you do not want this behaviour, uncheck the corresponding address‑line attributes on your Google Apps targets.

Salesforce OAuth token

An OAuth token must be configured on the Salesforce side and set on the Bravura Security Fabric side.

The system ID corresponds to the client_id and the system password corresponds to the client_secret.

Exchange useSSL parameter (4.7.1 / 4.8.1 / 4.9.0)

Existing on-premises Exchange target systems are unaffected — the default remains HTTP. To enable HTTPS, add useSSL=true to the target address configuration. Ensure the Exchange server has a valid SSL certificate bound to the PowerShell virtual directory before enabling.

Oracle ERP Cloud account creation (4.6.3 / 4.7.1 / 4.8.1 / 4.9.1 / 4.10.0)

To create accounts on an Oracle ERP Cloud target after upgrading, select Do not send attributes without values when creating accounts on each target. The option is off by default, and other SCIM targets keep their existing behavior.