JIM v0.16.0

[JayVDZ]

What's in JIM v0.16.0

JIM v0.16.0 is about running JIM in more places with less effort, and about trusting what it does once it is running. JIM now deploys on Podman as well as Docker, serves HTTPS out of the box, installs connected and air-gapped from one setup script, and upgrades in place. Schedules gain proper failure handling, Pending Exports are withdrawn when their reason disappears, and a long list of synchronisation and connector fixes close gaps that could leave data out of step.

What's new

Podman, rootful or rootless

JIM can now be deployed with Podman, with no Docker or other extra software. The setup script installs it on RHEL and other Podman hosts, systemd starts JIM at boot, and Ansible can deploy it too. Rootless Podman is supported, so JIM does not need to run as root on the host.

One installer, connected or air-gapped

Air-gapped installs now use the same setup script as connected ones: extract the release bundle, run the script inside it, and it loads the images and installs without an internet connection. setup.sh --upgrade upgrades a Docker installation, online or from a bundle, keeping your settings and your own compose files, refusing to overwrite ones you have edited, and putting everything back if it fails before JIM restarts.

HTTPS by default

JIM now serves the web portal and API over HTTPS on port 443, with your organisation's certificate or one the setup script creates. Sign-in works from any machine without a reverse proxy, and the setup script can renew or replace the certificate later (--renew-certificate, --certificate).

Schedule failure handling

Choose once per Schedule whether it stops or continues when a step fails, and override that per step where it matters (in the portal, or with the new Set-JIMScheduleStep cmdlet). A run that carried on past a failed step now ends Complete With Error, naming the failed steps, so the portal, PowerShell and your monitoring can tell it apart from a clean run. Existing Schedules behave exactly as before.

Feature flags

Capabilities still in preview can be switched on from Service Settings, PowerShell (Get-JIMFeature, Enable-JIMFeature, Disable-JIMFeature) or REST, with every change audited. This lets us put new work in your hands earlier without changing anything for administrators who do not opt in.

Easier auxiliary classes and a cleaner Connected System page

Adding an auxiliary class to a Connected System Object Type now shows the attributes each class would contribute, in a dialog that opens on the suggested classes and applies several at once. The Connected System page has been reorganised: Scope (formerly Partitions & Containers), a Passwords tab holding the Password Channel check and discovered Password Policy, a calmer Schema tab, and a compact Directory Capabilities strip. The Connector Space list gains a Columns menu, and the portal as a whole is more compact.

Fixes

• Active Directory at scale: groups larger than MaxValRange (1,500 members) now import every member, and schema, container and domain controller discovery read page by page, so large forests no longer fail with "size limit exceeded".
• Pending Exports: a queued change is withdrawn rather than exported once nothing authorises it or the target already holds the value; Failed exports clear automatically once an import confirms them; exports interrupted by a worker restart are recovered; and synchronisation no longer reopens Failed or Parked exports.
• Change tracking: a failed or cancelled import no longer moves the watermark on, so the next Delta Import re-reads changes instead of skipping them; a Delta Sync that removes objects no longer leaves others unprocessed.
• Matching: case-insensitive Object Matching Rules and attribute-value filters no longer treat _ and % as wildcards, which could join the wrong object.
• SQL Connector: exact matching for SQL Server datetime columns and correct handling of Oracle TIMESTAMP WITH TIME ZONE watermarks.
• Deployment: several fixes to the bundled PostgreSQL path, the production compose file and the air-gapped bundle, which no longer ships development settings.

Under the hood

Beyond the headline features, this release also included:

• Faster imports and synchronisation. Large imports and synchronisation runs now finish sooner and put less load on JIM's database, which matters most on first loads and full synchronisations of big directories.
• More honest outcomes. A synchronisation that fails while saving its progress is marked Failed straight away; a failed run's Activity stays failed; services exit with a failure code when they stop on an error; and an object that leaves scope but keeps its join is recorded as exactly that.
• Resilient start-up. Services wait for the database instead of restart-looping, and the Worker reports healthy while it upgrades the database or warms its caches.
• Stronger release engineering. The release pipeline now pushes the exact image it tested, a nightly build smoke-tests main, CI boots JIM on both Docker and Podman, and a new Active Directory lab against real Windows Server domain controllers is on its way to becoming a release gate.
• Faster, broader testing. The pre-release integration suite now runs its directory passes side by side, cutting its run time from about four and a half hours to under two.

Upgrade notes

• HTTPS is now the default. Before upgrading, put your certificate in the tls folder beside the compose files (or let the setup script create one). The production compose file now publishes the portal on port 443; set JIM_WEB_PORT to change it.
• Existing Docker installations: delete the JIM_SSO_VALID_ISSUERS line from .env unless you added it yourself; the old template set it to the development identity provider.
• Deselecting an Object Type now takes it out of management: the next Full Import obsoletes its objects, and deselection is refused while an enabled Synchronisation Rule manages the type.

Links

• GitHub Release v0.16.0
• Full changelog