2022.10.5

Erratum: Added 16 January 2024

The SAML SSO Configuration page displayed an incorrect Assertion Customer Service URL. As a workaround, you had to manually configure the Assertion Customer Service URL in the IDP without the partition ID. The Assertion Customer Service URL is now correctly displayed, and the manual workaround is no longer necessary. Upon upgrading to 2022.10.5 or subsequent 2022.10 patches, you will need to change the Assertion Customer Service URL to include the partition ID (can be found in the SAML configuration page).

Release date: 13 June 2023

.NET upgrade

Orchestrator now uses .NET 6.0.16.

API key authentication for Elasticsearch

You can now log in to Elasticsearch through an API key that you generate and store yourself in a key vault. All you need to do is retrieve the key, store it in your Azure key vault, and connect Orchestrator to this vault by following our instructions.

Bug fixes

Security vulnerability fixes

We have fixed an issue that affected Swagger UI versions 3.14.1 to 3.37.2, allowing their libraries to fetch potentially malicious specification files linked through Swagger UI. Note that the issue is not directly exploitable, and it requires an authenticated user to actually open the malicious link.

To overcome this, we strongly advise you to update to the latest possible version (major or cumulative update).

Please see the security advisory for details.

Miscellaneous fixes

This version includes various accessibility fixes.
When you uploaded a new custom logo, the preview functionality no longer worked. Now, you can preview the new logo in the header, just like before.
When you exported a folder role, the tenant-level permissions of that role were also exported. This issue is now fixed.
Executions were not properly assigned to available robots. This happened when a large number of robots were called for the same template, and assigned to the same job.
Using the latest version of the BeyondTrust Server or upgrading to it would sometimes cause integration issues. Now, everything works as expected.
Editing a postpone date for a queue item used the UTC value instead of the tenant time zone value.
Retrieving queue item events and comments returned a list from all the folders in the tenant. Now, you get the list of queue item events and comments only for the folders that you have access to.
Closing the Orchestrator maintenance mode through Swagger UI did not succeed due to an authentication error. This issue is now fixed.
The Next Run Time column for time triggers sometimes displayed a past date, despite the trigger being enabled and its tooltip showing the correct future run time.
The runtime used by a robot to run an automation was not released once the robot service stopped. This was caused by an inaccuracy in the succession of activities, which has been fixed. Now, when the robot is disconnected, its runtime is released into the tenant pool.
The keyboard shortcut to close pop-up messages (Delete + X) did not work.
When you used the Platform Configuration Tool to update URLs, the [dbo].[UserLogins] records were not updated accordingly, thus causing login issues.