0.4.6

There's nothing to change in compose.yaml, and the configuration format is unchanged, so going back to 0.4.5 needs no restore. See UPGRADING.

Work orders

A driver set has a Work orders tab for its Work Order drivers.

• The list: each Work Order driver, its state and the container it checks, then each work order with its status, when it runs, how often it repeats and its description.
• The container: taken from the driver's idv.workorder.container setting, including when the Work Order package keeps it in a linked settings object.
• Create and change: status (pending or on hold), run at the driver's next check or at a set time, repeat interval, content, type, number, contact, a deletion date, the work orders it waits for, and the driver's log.
• Running again: a work order in error shows the driver's log line. If the WorkToDo from its last run is still there, it can be removed from the same dialog so the work order can run again.

E-mail templates

A driver set has an E-mail templates tab for the notification templates in Default Notification Collection.

• The list: filterable by name, subject or package.
• The editor: the subject, the token descriptions, the message (HTML or plain text) and the whole XML. Markers the message uses with no description are pointed out.
• Preview: the message with its $token$ markers highlighted, in a sandboxed frame.
• Create and delete: blank or as a copy of another template; deleting asks for the name to be typed.
• Templates from a package carry a warning that a package upgrade may replace changes.
• Kept as stored: templates come in several shapes. Saving any of a lab tree's 351 templates unchanged gives back exactly the stored text.

Not yet confirmed on a real engine

• The Work orders tab: the commands under it were checked against a Work Order driver on an Identity Manager 4.8 engine, but the tab itself has only run against the demo.

Directory Console 0.4.5

There's nothing to change in compose.yaml, and the configuration format is unchanged, so going back to 0.4.4 needs no restore. See UPGRADING.

Create and change role-based entitlement policies

The driver set's Role-based entitlements tab now edits policies. Use New policy on the tab, or Change in a policy's view.

• Who it covers:
  • A query: a container, a scope, and a filter built or typed. Test the query shows who it finds now.
  • Search as: the identity eDirectory computes the members as. A new policy uses the set's Entitlements Service driver; another object, or nobody, can be chosen.
  • Static members, and exclusions.
• What it grants: the entitlements the set's drivers define, with values where they take them, picked from a list or typed.
• Rights to other objects: objects the policy is a trustee of. Its members get those rights, being security-equivalent to it. eDirectory can't search ACLs by trustee, so Find its rights reads the ACLs under a container you choose.
• Still editable elsewhere: policies are saved as Designer and Identity Console write them, so either can still edit them.

What the Entitlements Service driver needs

Checked on an Identity Manager 4.8.7 engine with test policies the console wrote. The driver granted and revoked through them, and showed:

• Every policy needs a query. One without makes the driver fail for everyone. A policy of static members only now gets a query that matches nobody, shown as "static members only".
• Deleting a policy doesn't revoke what it granted: the driver ignores deletions. Delete now offers Remove everyone first, and the driver revokes as people leave. Deleting a policy that still covers people is refused unless forced, with a warning that its grants stay.
• A restart doesn't re-evaluate anyone. The driver reads the policies when it starts, then grants and revokes person by person as something that decides membership changes. The tab's button is now Restart, not "Re-evaluate membership".
• Changing a policy's query stops the driver until it's restarted; the tab asks for that.

Not yet confirmed on a real engine

• Granting through a query: the test tree computed no members for a query policy.
• Members receiving a policy's rights to other objects: this was not observed, as it needs signing in as a member.

Directory Console 0.4.4

There's nothing to change in compose.yaml, and the configuration format is unchanged, so going back to 0.4.3 needs no restore. See UPGRADING.

Role-based entitlements

A driver set has a new Role-based entitlements tab for its entitlement policies (the Entitlements Service driver's RBE policies).

• The list: policies in priority order, what each grants (driver, entitlement and values) and who it covers (the membership query, static members, exclusions).
• A policy: its query and scope, the identity it searches as, exclusions, grants, and the members eDirectory computes for it.
• For operators:
  • Reorder: saved from the order you read, and refused if someone changed it meanwhile.
  • Delete: type the policy's name; the rest keep their order, renumbered without gaps.
  • Re-evaluate membership: restarts the Entitlements Service driver, which reads the policies only when it starts. After any change the tab prompts for this.
• Warnings: priorities the Entitlements Service driver would refuse (missing, repeated or with gaps) are flagged.

Checked on an Identity Manager 4.8.7 engine with test policies. The driver cached what the console wrote, and accepted its priorities after a reorder and after a delete.

Creating and editing policies comes next.

Fixes from comparing with Identity Console 26.1.2

• A group is never its own member. Adding a group to its own members or memberships is refused, from either side and for agents too.
• Cache events with unusual characters. The cache inspector removes characters XML does not allow (control characters) to show an event, and marks it "cleaned". An entry it still cannot read is listed as "unreadable" with its text, instead of ending the list.

Directory Console 0.4.3

There's nothing to change in compose.yaml, and the configuration format is unchanged, so going back to 0.4.2 needs no restore. See UPGRADING.

Certificate warnings follow your expiry window

Settings > Certificate expiry's warning window used to set only the e-mail and webhook notices and the banner at the top of every page. It now sets how far ahead the console warns everywhere:

• Security > Certificates: the alert at the top of the page.
• Expiry labels: the orange "N days" labels in every certificate table.
• The default-certificate check: a server's default certificate needs replacing when it expires within the window.

Before you widen the window: the default-certificate repair's "Only certificates with a problem, or missing" will also replace certificates that expire within the new window.

The window is 30 days until you change it, as before. Everyone who sees certificates gets it, not only console administrators. Pages already open show a change once reloaded.

Directory Console 0.4.2

There's nothing to change in compose.yaml, and the configuration format is unchanged, so going back to 0.4.1 needs no restore. See UPGRADING.

A warning for characters eDirectory refuses

The driver password dialog now warns when a value has an emoji or another character outside Unicode's Basic Multilingual Plane.

• Why: eDirectory refuses these in every password. An eDirectory account cannot have such a password, so a driver signing in to one would fail.
• Still accepted: other connected systems may take the value, so the console sets it anyway.
• Easy to miss otherwise: the field is masked, so the warning is the only sign that such a character was typed or pasted.

Checked on a real engine

0.4.1's authentication password was checked end to end on an Identity Manager 4.8.7 engine. A test driver signed in to eDirectory with a 36-character password set through the console: accents, Greek, CJK, quotes, a backslash, LDAP special characters and a space.

• Exact match: the same password with one letter written in a different but identical-looking form was refused. Nothing along the way changes the value.
• Repair: a value written straight to the directory, which the engine cannot read, was repaired, and the driver then signed in.

Directory Console 0.4.1

There's nothing to change in compose.yaml, and the configuration format is unchanged, so going back to 0.4.0 needs no restore. See UPGRADING.

Driver authentication password

A driver's Passwords tab can now set and clear its authentication password: the password the driver signs in to the connected system with (Designer's "application password").

• Through the engine: the console uses the engine's SetAppPassword and ClearAppPassword, as Designer and iManager do, never an LDAP write of DirXML-ShimAuthPassword. A direct write stores clear text the engine cannot read, and the driver then starts with no password.
• Repair: if such an unreadable value is there, it is deleted first. The success notice and the audit log say so.
• Never shown: like the other driver passwords, it can be set or cleared but never read back.

Passwords kept exactly as typed

Every password the console sets (driver, driver set and job named passwords, Remote Loader, mutual-authentication and authentication passwords) reaches the engine exactly as typed.

• Not trimmed or normalized: spaces at either end are kept, and a password of only spaces is accepted. Accented letters, symbols, other scripts and emoji are sent as UTF-8.
• Refused rather than changed:
  • A broken character from a bad paste: encoding would turn it into ? and set a different password.
  • A NUL character: the engine may take it as the end of the password.

Also

• Updated core: built on DirXMLDev 0.61.0.

Directory Console 0.4.0

Nothing changes until an administrator turns agent keys on for a directory (Settings > Directory > Agent keys): they are off by default. There's nothing to change in compose.yaml, and the configuration format is unchanged, so going back to 0.3.24 needs no restore. See UPGRADING.

AI agents over MCP

An AI agent can now work in the console as the person who gave it an agent key, through the console's MCP server at /mcp. It works with that person's own eDirectory rights, and at most the roles they give the key. See docs/MCP.md and the screenshots.

• Agent keys: a person makes a key under their name > Agent keys.
  • Confirming it's them: their password, or a recent single sign-on.
  • What it may do: reading always; changing objects or running Identity Manager only if they have those roles; never admin.
  • How long it lasts: 30 days by default (at most the directory's limit, 90 days at most, and 14 days with single sign-on); a key unused for 14 days stops.
  • Shown once, with the setup: the key appears once, with the command to add it to Claude Code. The console keeps only a hash, outside backups.
  • Revoking: a person can revoke their own keys at once, and administrators everyone's.
• Acting as the person: each call acts as the person through the service account, as single sign-on does.
  • The console refuses a key whose person is locked by intruder detection, disabled, expired or without a role, checked on every call.
  • Calls are audited with the key's label.
• Read tools: objects and search, groups, sign-in status, driver sets and drivers, jobs, the association, cache and object inspectors, statistics and versions.
• Change tools: enable, disable and unlock accounts; group membership; start and stop drivers; run and abort jobs; resynchronize; migrate. The key must have the role, reaching the object.
• Approval: a change an agent asks for waits until the person approves it in the console, typing the directory's name on production. They can also decline it, and it expires after an hour. An administrator can turn approval off per directory; then on production the agent passes the directory's name, typed by the person.
• Identity Applications: with its address set (Settings > Directory), a key made with a password also signs its person in to Identity Applications once, keeping only the refresh token.
  • Reads: their approval tasks and requests, who holds a role or resource, and assignments.
  • Changes: approve or deny tasks (with the approval form's fields), request PRDs, roles and resources, revoke roles and resources, and retract requests. These follow the same approval.

Also

• Single sign-on refuses an account locked by intruder detection. eDirectory accepts the proxied-authorization control for such an account, so this check is the console's own.
• Clearer refusals: account changes and unlock report "insufficient rights" where eDirectory answered "no such attribute" under proxied authorization.
• Updated core: built on DirXMLDev 0.60.0, which carries the Identity Applications client.

Before you use agents

• Behind a reverse proxy: forward /mcp, with its Authorization header (DEPLOYING).
• Certificates: the agent's machine must trust the console's certificate. With the console's own certificate, start Claude Code with NODE_EXTRA_CA_CERTS pointing to a copy of it.
• Restarts: changes waiting for approval are kept in memory, so a restart drops them, and the agent asks again.

Directory Console 0.3.24

• Basic search: * is a wildcard. * alone (or an empty name) lists everything of the kind chosen; j*son or *admin match anywhere, with every other character still matched as typed. Before, * was searched for literally and found nothing.

Nothing to change in compose.yaml; the configuration format is unchanged, so going back to 0.3.23 needs no restore. See UPGRADING.

Directory Console 0.3.23

Search and export, brought level with ArborJ.

• Basic search: the start of a name (cn, fullName, givenName, sn, mail, uid), for people, groups, containers or everything.
• Advanced search: a filter built from AND/OR groups nested to any depth with NOT, or RFC 4515 text checked as you type; switch between the two. Three depths (everything below, directly inside, only that object), a column picker that keeps order (* and + too), and recent searches beside saved ones.
• Name autocomplete: attribute and class names are offered as they are typed: in the builder, filter text, sort, columns, Identity Manager migrate conditions and the rights form.
• Export: LDIF (RFC 2849), CSV (separators, quote, line endings, formula guard, Excel mark) or JSON, of search results or, from an object's actions, the object, its children or its subtree. The server writes the file as it reads, page by page with the person's rights, with no 10,000 cap; secrets are never written, and each export is audited (objects.export). Options are remembered in the browser.

Nothing to change in compose.yaml; the configuration format is unchanged, so going back to 0.3.22 needs no restore (searches saved by 0.3.23 do not open in 0.3.22). See UPGRADING.

Directory Console 0.3.22

• Signing out returns to the start page, and signing in to a different directory starts at Browse instead of opening the previous directory's page (which showed "no object with GUID …").
• A container address that no longer resolves shows a notice with a link to the top of the directory instead of a failed request.

Nothing to change in compose.yaml; the configuration format is unchanged, so going back to 0.3.21 needs no restore. See UPGRADING.