News

Agate 5.0 Released

We are pleased to announce that Agate 5.0 is now available. Agate is OBiBa’s central user profile server.

This is a security-focused major release, with the following key changes:

• Argon2id password hashing: user passwords and application keys are now hashed with Argon2id and a per-hash salt, replacing the shared-salt SHA hashing. Existing hashes are upgraded transparently on the next successful authentication of each user and application; no database migration runs at startup.
• Two-factor authentication order: the password is now verified before the 2FA code is requested. A wrong password is refused right away and counts toward the login ban, and a wrong code keeps the 2FA step open with a dedicated message. Users of external realms (LDAP, Active Directory, SQL) with 2FA enforced can no longer sign in without a registered authenticator.
• OAuth2 hardening: authorization codes are single-use and short-lived (300 seconds by default), and redirect URIs are matched on their scheme, host, port and path components instead of a plain string prefix.
• HTML auto-escaping in templates: every interpolated value is now HTML-escaped in web pages and notification e-mails, protecting against injection through user-provided or identity-provider-provided values.
• Other security improvements: the password policy is now also applied to the password reset and account confirmation flows.

Breaking Change: If you have overridden Agate's page or e-mail templates, they must be revised because of the HTML auto-escaping: libs/head.ftl must be replaced with the new version, and interpolations inside <script> blocks or on… attributes need the ?js_string built-in. Registered applications should also have their redirect URIs reviewed to match the new component-based matching.

Upgrading from Agate 4.x requires some attention from the system administrator: back up the MongoDB database before starting (a rollback to 4.2 requires restoring it), keep the existing shiro.password settings until all hashes have been upgraded, and warn your users about the 2FA changes. Please read the Agate upgrade notes before upgrading. Agate should be upgraded before Mica 7.0 and Opal 6.0, whose sign-in pages assume the new 2FA order.

See also Agate documentation for installation and operation instructions.