4.6.3

WinHTTP usage

Updated connectors that use WinHTTP calls to log both the HTTP method and the URL, so it is clearer which API calls are being made during troubleshooting.

Security cleanup on account changes

Updated the Google Apps connector to support clearing app‑specific passwords, backup verification codes, third‑party tokens and disabling two‑step verification as part of the reset, disable, delete and update operations. This helps ensure sessions and related credentials are cleaned up when an account is changed or deactivated.

Group create operation

Enabled and fixed the Google Applications connector’s groupcreate operation so that creating groups on Google Apps targets now works as documented.

Roles with empty descriptions

Fixed the list‑groups‑as‑roles operation so that roles with empty descriptions no longer cause the connector to crash.

CUA user systems

Updated the SAP Server (Netweaver 7.5+) connector to comment out reading the ZMT_USER_SYSTEMS_READ function for CUA systems, improving stability for those environments.

Local roles and profiles

Added the LOCACTIVITYGROUPS and LOCPROFILES table lookups and their account attributes so the SAP Server (Netweaver 7.5+) connector supports SAP / CUA systems that use local ACTIVITYGROUPS and PROFILES.

Memory usage

Ensured that RfcDestroyFunction is always called when using the SAP connector, reducing memory usage during large account listings, especially when account‑attribute listing is enabled.

Salesforce SOAP API version 65.0 support

Support has been added for version 65.0 of the Salesforce SOAP API.

Updated the Palo Alto Networks firewall with PAN‑OS (SSH) connector so that auto‑discovery (listing objects) and password reset operations function reliably during onboarding.

Account names with dots

Updated the unixssh.py script for the Python‑based connectors to allow a dot/period (.) in user/account IDs, matching what modern Linux distributions permit.

Updated Active Directory (agtaddn) computer attribute listing to exclude msDS-RevealedUsers and msDS-AuthenticatedToAccountList, as these lengthy multi-valued attributes exceed the discovery queue size limit.

The onPremisesSyncEnabled attribute is now listed for accounts

The Azure Active Directory connector (agtazure) now lists the onPremisesSyncEnabled attribute for accounts, as it already did for groups. Previously, auto-discovery left the attribute empty in the discobjattr table, so load scripts could not filter accounts on it.

Support for Entra Temporary Access Pass

The Azure Active Directory connector (agtazure) now issues, lists, and revokes Entra Temporary Access Passes. You can set default values for pass lifetime, one-time use, and start time on the target. Using this capability requires the UserAuthenticationMethod.ReadWrite.All application permission on your Azure app registration.

HTTPS support for on-premises connections

The Exchange connector previously hardcoded http:// in the New-PSSession -ConnectionUri for on-premises Exchange PowerShell connections, meaning port 80 was required. A new useSSL boolean parameter was added to the target address configuration that toggles the connection URI between http:// and https://. The default remains http:// for backward compatibility. The Exchange Online (ConnectCloud) code path is unaffected. Upgrade note: when enabling useSSL, the Exchange server must have a valid SSL certificate bound to the PowerShell virtual directory.

Exchange connector longid output for create operations

Updated the Exchange 2007+ Server connector (agtexg2k7) to add the longid for the agent output for the create operation and for when users already exist.

Exchange connector OAuth 2.0 authentication support

Exchange connector now supports OAuth 2.0 authentication for Exchange Online (list operations only; on-premises Exchange continues to use Basic Authentication).

Logging level

Updated the PowerShell connector so that variable conversion messages are logged at Debug level instead of Info, reducing noise in normal logs.

New option to leave empty attributes out of account creation requests

The SCIM connector (agtscim) has a new target address option, omitempty, labeled Do not send attributes without values when creating accounts. When you select it, the connector leaves attributes that have no value out of the account creation request. The option is off by default, so existing SCIM targets keep the legacy create payload. Select it on Oracle ERP Cloud targets, which reject the whole create request with HTTP 400 when it contains any property that the User model does not accept, even an empty one.

Fixed an issue in the DUO Authentication connector where challenge‑response authentication could intermittently crash when a user had no DUO authentication methods configured.

Notice log spam from empty timestamps

Eliminated repeated "not a valid format []" notices when Okta timestamp fields are missing.

Okta Verify OTP with multiple devices

Modified the Okta connector to show a single challenge‑response option for the Okta Verify OTP method. The single option now accepts OTP codes from multiple registered Okta Verify factors (for example Okta Verify and Google Authenticator), avoiding confusion when several OTP factors exist for the same user.

Fixed an issue with the Okta connector (agtokta) to ensure that when methods from the "Authentication methods order" target address configuration are not configured that the matching Okta methods are not shown for the user on authentication for Okta challenge response.

Plaintext password in logs

Ensured logs no longer display plaintext passwords when a password reset fails due to comment‑like sequences in the password.

Resolved an issue with the SAP Server (Netweaver 7.5+) connector (agtsapnw) when listing users filtered with a selection range to add more than one selection criterion. This was previously causing an issue to only list from one selection range.

Fixed an issue with the SAP Hana Database connector (agthana) when encryption is used for the target address configuration.

Siteminder connector list override setting

Fixed an issue in the Siteminder connector (agtsm) so that it now correctly saves the list override setting.

Windows Server connector default global attributes with overrides

Fixed an issue to include default global attributes when an attribute override is used.

Active Directory connector – expired password/account handling

Restored the documented behaviour for how expired passwords and accounts affect login checks via registry options.

New user creation falsely reported as failed

Fixed a bug where Azure user creation succeeded but was reported as failed because subsequent attribute updates immediately after creation returned HTTP 404 "resource does not exist". The connector now recognises this as a temporary propagation delay, retries PATCH operations for newly created users, and uses the user's object ID when checking for resource existence, so template attributes and post‑creation changes are applied reliably without manual intervention.

Azure AD query URL construction with empty attributes

Updated the Azure Active Directory connector (agtazure) to correctly construct the query URL when attributes are empty and a filter is used, which was previously causing listing to fail.

Corrected the spelling of the OAuth2 authentication port address parameter

Fixed a misspelling in the label for the OAuth2 authentication port address parameter, which read "Autentication" when you defined address parameters.

Fixed session handling in the PeopleSoft 8.49 connector to prevent crashes during the list‑groups operation.

Correct handling of includeInGlobalAddressList

Fixed an issue where create operations could default includeInGlobalAddressList to true (and log "Warning: Error occurred when setting attributes: [Resource Not Found: userKey]"); the connector now treated the attribute as a boolean (not a string) and corrected the read/write paths, including a copy-paste error where the read path returned a different attribute's value.

Account creation failure on strict SCIM 2.0 targets

The agtscim connector now posts account creations to the /Users collection endpoint, as RFC 7644 requires. Previously it posted to an item URL such as /Users/<id>, which strict SCIM 2.0 targets, including Oracle ERP Cloud, rejected with HTTP 405.

Error details from compressed target responses are now reported

The SCIM connector (agtscim) now decompresses gzip-encoded response bodies, so the connector log shows the actual error that the target returned. Previously, compressed error responses, such as those from Oracle ERP Cloud, produced a generic message.

Invalid multi-valued attribute values now fail cleanly

The SCIM connector (agtscim) now reports an error when the value of a multi-valued attribute is not valid JSON. Previously, the connector could crash.

Google Apps connector cleanup defaults

After upgrading, review existing Google Apps targets to confirm whether app‑specific passwords, backup verification codes, third‑party tokens and two‑step verification should be cleared or disabled during reset, disable and delete operations. The connector now defaults to performing this cleanup; if you do not want this behaviour, uncheck the corresponding address‑line attributes on your Google Apps targets.

Exchange useSSL parameter (4.7.1 / 4.8.1 / 4.9.0)

Existing on-premises Exchange target systems are unaffected — the default remains HTTP. To enable HTTPS, add useSSL=true to the target address configuration. Ensure the Exchange server has a valid SSL certificate bound to the PowerShell virtual directory before enabling.

Oracle ERP Cloud account creation (4.6.3 / 4.7.1 / 4.8.1 / 4.9.1 / 4.10.0)

To create accounts on an Oracle ERP Cloud target after upgrading, select Do not send attributes without values when creating accounts on each target. The option is off by default, and other SCIM targets keep their existing behavior.