OPENIDM-3559 - Moving policy details for managed objects into json schema Adjusting authz rules for self-service requests (taking CSS-28 into account) Including kbaInfo in default user schema Progress with adding new properties to json editor for managed objects Aligning the Admin UI and authz rules with backend, removing default configs Using external/email endpoint in access.js authz rule

OPENIDM-3223 CR-7161 Implement policy to prevent duplicate Managed User role assignments

Readding telephone policy

OPENIDM-3090 and OPENIDM-3078 (CR-6428) - Fixed two work flow issues casuing errors.

[OPENIDM-1713][CR-3292] Updated policy.json to include the "system" role in the configured "exceptRoles" parameters for various properties (missed in commit 3034).

http://sources.forgerock.org/cru/CR-3209 - OpenIDM various policy validation clean-up

Adding back in the default empty array for additionalPolicy entries, so it is more obvious how to configure it.

http://sources.forgerock.org/cru/FR-47 - Updates to UI and script to align with recent script query changes and merging in list-based role updates from trunk

IDME-68 change user "email, familyName, phoneNumber" properties to "mail, sn, telephoneNumber" respectively

OPENIDM-1583 OpenIDM should not enforce the REAUTH_REQUIRED policy for openidm-cert role

OPENIDM-1583 OpenIDM should not enforce the REAUTH_REQUIRED policy for openidm-cert role

Changed "name" to "file" in script configs

[OPENIDM-1256][CR-1444] Additional policy files will now load from project directory, unless full path is specified. Added default "additionalFiles" entry to config.

OPENIDM-1231 - Migrate the Policy service

http://sources.forgerock.org/cru/CR-1157 - Commons UI: Updating patch actions to try using add when replace fails These changes allow for the possibility of a non-existent password property on the managed/user object as a valid state. This could arise when, for example, a record was create via recon from a source system which doesn't expose a cleartext password. Code changes to policy and onCreate script to make this more sensible, and within the UI code to do an "add"-type of patch rather than a "replace" patch (which would fail, since the property doesn't exist).

merging trunk 1773-1783

http://sources.forgerock.org/cru/CR-1097 - Removing policy for repo/internal/user/userName https://bugster.forgerock.org/jira/browse/OPENIDM-1054 - Validating repo/internal/user/openidm-admin fails

merging trunk r1735-1772

https://bugster.forgerock.org/jira/browse/OPENIDM-1031 - Username can be exploited with arbitrary HTML code http://sources.forgerock.org/cru/CR-1073 - OpenIDM - prevent embedded HTML from rendering in the UI

merging ui branch r1634-1654 Using new validateOnlyIfPresent flag to solve https://bugster.forgerock.org/jira/browse/OPENIDM-934 Modifying apache configuration to reverse proxy for all requests to openidm/ rather than just to openidm/managed misc trivial cleanup

Removing old references to "admin" role

Merging trunk r1582-1607 http://sources.forgerock.org/cru/CR-912 Tag, you're it QA!

Adding "admin" to list of roles which do not have to provide certain user attributes

Adding policy to prevent managed users from having the same names as internal users

add special privilages to 'admin' role

Moving scripts to bin/defaults and updating references in conf

UI branch changes, r1480-1529 http://sources.forgerock.org/cru/CR-891 This also includes global rename of _query-id to _queryId and _query-expression to _queryExpression. Note for documenters: there are several changes expected to be made soon; review the code review (linked above) and note Andi's comments

Updates to policy and default settings for new users - allows admin to create users New authz entries to work with workflow endpoints

Using new version of i18next (1.5.8) Using new reauth policy for passwords and security answers New (blank) translation entry for reauth rule

Merging UI branch, r1455-1477 Updates for UI: Corrected policy, max security answer attempts, task/workflow updates. http://sources.forgerock.org/cru/CR-862

Using new, proper policy path for validation. Note - there is a known issue with creating users from the admin screen, a result from conflicting policy and default scripts. See here for details: https://bugster.forgerock.org/jira/browse/OPENIDM-848 Also a start on using a policy to enforce the maximum number of security answer attempts within a given timeframe.

Merging in changes from UI branch, r1420-1452 http://sources.forgerock.org/cru/CR-851

settings users roles; changing password by internal user

CR-824 Merging in changes from UI branch to trunk

[OPENIDM-741/765/766/811] [CR-809] Phase 2 of Policy Service: client side execution of policies, server side enforcement of policies, support for "required" policy, support for policy config inside component configs, policy request/response format changes, support for additional policy scirpts, other minor fixes.

Changing validation to use new server-based policy resource

Inital commit of Policy Service component