Re: What approach to do this in Syncope?

2020-05-02 Thread ohaya
Hi, For the scenario that I described (I have a pull task that is pulling an attribute from an LDAP user into the realm, and I want to process the value of that attribute and populate 2 other attributes that are the results of the processing), how does my code in the pull action class access

Re: What approach to do this in Syncope?

2020-05-02 Thread ohaya
Hi, I can accept that and move on :)... FYI, the reason that I was aware of, and was able to find the Javadocs is that, as you probably know, we have already worked with, and have several, ItemTransformers. And that was also the reason that led me to that dead end (because they only return

Re: What approach to do this in Syncope?

2020-05-02 Thread Francesco Chicchiriccò
On 02/05/20 17:06, oh...@yahoo.com wrote: > Hi, > > Thanks. I did read that information and also some information that we had > gathered by another person, but you know, it is not easy to comprehend some > of the Syncope functionality/concepts via just the documentation, and mind > you, I have

Re: What approach to do this in Syncope?

2020-05-02 Thread ohaya
Hi, Thanks. I did read that information and also some information that we had gathered by another person, but you know, it is not easy to comprehend some of the Syncope functionality/concepts via just the documentation, and mind you, I have been doing this kind of work for a long time with

Re: What approach to do this in Syncope?

2020-05-02 Thread Francesco Chicchiriccò
Hi, for some reason it seems that it's easier for you to find Javadocs than documentation :-O Anyway, take a look at: PullActions (to inject Java or Groovy logic during Pull) http://syncope.apache.org/docs/2.1/reference-guide.html#pullactions PropagationActions (to inject Java or Groovy logic

Re: What approach to do this in Syncope?

2020-05-02 Thread ohaya
Hi, I was looking at the ItemTransformer (https://syncope.apache.org/apidocs/2.0/org/apache/syncope/core/provisioning/api/data/ItemTransformer.html) but it looks that is applied to/bound to an individual attribute, and returns the transformed attribute value, but in my use case, I want to

Re: 2.1.6 and/vs. 2.0.15 ?

2020-05-02 Thread Francesco Chicchiriccò
On 02/05/20 14:57, oh...@yahoo.com wrote: > Hi, > > I saw the announcements this morning about 2.1.6 and 2.0.15. Are you all > simultaneously supporting two different branches/versions of Syncope? Yes, sir. Regards. > Or are 2.1.6 and 2.0.15 different "products"? > > Thanks, > Jim --

2.1.6 and/vs. 2.0.15 ?

2020-05-02 Thread ohaya
Hi, I saw the announcements this morning about 2.1.6 and 2.0.15. Are you all simultaneously supporting two different branches/versions of Syncope? Or are 2.1.6 and 2.0.15 different "products"? Thanks, Jim

[CVE-2020-1961] Server-Side Template Injection on mail templates

2020-05-02 Thread Francesco Chicchiriccò
Description: Vulnerability to Server-Side Template Injection on Mail templates enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered. Severity: Important Vendor: The Apache Software Foundation Affects: 2.0.X releases prior to 2.0.15

[CVE-2020-1959] Multiple Remote Code Execution Vulnerabilities

2020-05-02 Thread Francesco Chicchiriccò
Description: A Server-Side Template Injection was identified in Syncope enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR 380) custom constraint validators. When

[CVE-2019-17557] Enduser UI XSS

2020-05-02 Thread Francesco Chicchiriccò
Description: It was found that the EndUser UI login page reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string. Severity: Medium Vendor: The Apache Software Foundation Affects: 2.0.X releases prior to 2.0.15

[ANN] Apache Syncope 2.0.15

2020-05-02 Thread Francesco Chicchiriccò
The Apache Syncope team is pleased to announce the release of Syncope 2.0.15 Apache Syncope is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology . The release will be available within 24h from:

[ANN] Apache Syncope 2.1.6

2020-05-02 Thread Francesco Chicchiriccò
The Apache Syncope team is pleased to announce the release of Syncope 2.1.6 Apache Syncope is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology . The release will be available within 24h from: https://syncope.apache.org/downloads