Subscribe to Help Center RSS FeedInterested in previous years' release notes? See last year's ADI Release Notes 2023. Alternately, see JumpCloud's Feature Release Notes.
2024-10-03 ADI Release Notes
AD Sync Agent v4.19.0
Bug Fix
- In the Manage users and passwords in JumpCloud, AD or both (bi-directional sync) and Manage users and passwords in JumpCloud (one-way sync from JumpCloud to AD) deployment configurations, users can now be removed from any security group except the main ADI group (e.g., “JumpCloud” or “JumpCloud (mydomain1)”)
2024-09-20 ADI Release Notes
Admin Portal
Users page
- Password status is “Delegated” with sub-text “Managed by AD” when the user’s delegated authority is set to Active Directory
2024-09-04 ADI Release Notes
Admin Portal
Bug Fixes
- Delete confirmation is shown after clicking the delete button for an ADI domain configuration:
- Delete button on the ADI domain configuration screen was updated to have a red outline
- Users page More Actions menu option for setting the delegated authority on a user record was renamed to Set Delegated Authority
ADI Service
- User login no longer fails once the user is disassociated (unbound) all but one delegation-enabled ADI domain
AD Sync Agent v4.17.0
Bug Fixes
- In the Manage users and passwords in JumpCloud, AD or both (bi-directional sync) and Manage users and passwords in JumpCloud (one-way sync from JumpCloud to AD) deployment configurations, users that are in a nested OU can now be added to security groups in AD from JumpCloud. These users can only be removed from an ADI specific security group named “JumpCloud” and security groups nested underneath that security group
2024-08-19 ADI Release Notes
Admin Portal
- New UI and experience for adding, managing, and using the ADI:
- Provides guidance through the installation process, better visibility into the configuration settings, and greater prominence of the information needed to monitor and manage the integration
- New ADI configuration settings:
- Delegated Password Validation - default setting for enabling and disabling delegated authentication to AD for users imported from AD to JumpCloud (applicable in the Manage users and passwords in either system or both and Manage users and passwords in Active Directory deployment configurations)
- Externally Managed Password and Attributes - default setting for restricting and unrestricting changes to ADI synced user attributes and user password within the JumpCloud Admin Portal and the JumpCloud User Portal. This is a read-only setting
- Enable groups and memberships management - default setting controlling whether a groups and group memberships are synced from JumpCloud to AD when a sync agent is installed on an AD server (applicable in the Manage users and passwords in either system or both and Manage users and passwords in JumpCloud deployment configurations). This is a read-only setting
- Provision Staged Users - default setting controlling whether a staged user is synced from JumpCloud to AD when a sync agent is installed on an AD server (applicable in the Manage users and passwords in either system or both and Manage users and passwords in JumpCloud deployment configurations). This is a read-only setting
- Option to automatically update the delegated authority setting for user(s).
- This option is presented when the following actions are taken and includes a list of important factors to consider when making your selection:
- on save after delegated authentication is enabled or disabled in the ADI configuration
- when an ADI AD domain is deleted
- when a user has direct access granted to or removed from a delegation-enabled AD domain
- when a user has access granted to or removed from a user group that has access to a delegation-enabled AD domain
- when a user group has access granted to or removed from a delegation-enabled AD domain
- This option is presented when the following actions are taken and includes a list of important factors to consider when making your selection:
- Agent download options in the ADI Configuration:
- Update Existing Agent downloads the agent installer without generating a new agent connect key
- Install New Agent downloads the agent installer and provides a new connect key which must be used within 7 days
- Ability to set a delegated authentication Delegated Authority for an individual user.
- New Delegated Authentication section with a Delegated Authority setting in the User Security Settings and Permissions section on the Details tab of the User page
- Confirmation modal explaining the implication of the change shows when the Delegated Authority is changed.
- Delegated Authentication shows under Security status in the left pane of the User panel when the Delegated Authority setting is Active Directory
- Ability to set a delegated authentication Delegated Authority for multiple users at once:
- New Set Delegated Password Authority option in the More Actions menu on the Users Page
- Visibility into which users have delegated authentication enabled from the Users page:
- Password status shows “Delegated” for users that have a Delegated Authority set to Active Directory
- New Delegation ENABLED label added when delegation is enabled and active for an ADI AD Domain:
- Directories List - Label added to the AD domain name in Directories lists
- User groups - Resources list in the User group drop down in Users page
- Staged user - resources section showing AD delegation enabled label
- New and updated DI events
| Event | Description | Change |
|---|---|---|
| user_login_attempt | Logs every time a user tries to log in to a JumpCloud managed resources | JSON includes a new field “password_delegated_authority” in the auth_context when the user’s login is delegated to AD for authentication |
|
"auth_context": { "auth_methods": { "password": { "success": true } }, "password_delegated_authority": "ActiveDirectory"
}, |
||
| association_change | Logs every time two resources are associated (bound) or disassociated (unbound). | Logged when a user is associated (bound) to or disassociated (unbound) from a delegation-enabled AD domain. |
| Logged when a user group is associated (bound) to or disassociated (unbound) from a delegation-enabled AD domain. | ||
| user_delegated_authority_update | Logs when a change is made to the Delegated Authority setting on the User record. | New DI event |
| activedirectory_domain_delegated_password_change | Logs when the delegated authentication setting Delegated Password Validation in the ADI configuration is changed | New DI event |
End User experience
- Existing AD users imported from AD to JumpCloud no longer have to reset their password in AD to log in to JumpCloud managed resources when delegated authentication is enabled for them:
- If the import agent is installed on DCs, the password is stored in JumpCloud after the initial log in. The stored password is synced to other resources and can be used to log in to resources that don’t support delegated authentication to AD, such as Cloud RADIUS and Cloud LDAP, and
- If the import agent is installed on AD member servers, the password is never stored in JumpCloud
- User associated with a delegation-enabled ADI AD domain and their Delegated Authority set to Active Directory will receive the a new AD welcome email
ADI Service
- When multiple AD import agents are installed, one is designated as the primary agent by the ADI service. All delegated authentication requests are sent to that agent. If that agent becomes unavailable, another active import agent is automatically designated as the primary agent by the ADI service
JumpCloud v2 API
- Updated the Create a new Active Directory Integration /activedirectories endpoint to support setting and unsetting delegated authentication as well as setting and changing the deployment configuration in the ADI configuration for a specific AD domain. The newly added parameters are:
- delegationState
- useCase
- Updated the Update Active Directory /activedirectories/{id} endpoint to support setting and unsetting delegated authentication as well as setting and changing the deployment configuration in the ADI configuration for a specific AD domain. The newly added parameters are:
- delegationState
- useCase
End user schema model
- Added delegated_authority to the systemuser schema
- Delegated authentication set on the user: delegatedAuthority":{"name": "ActiveDirectory"}
- Delegated authentication unset on the user: "delegatedAuthority" : null
AD Import Agent v3.0
Installer changes
- Reordered the installer screens
- Added support for new format of the API key
- Added a new step for entering the import agent connect key
- An import agent connect key is now required when installing the import agent on a new AD server.
- Upgrades to import agent v3.0 and higher upgrades will not prompt for the connect key. The stored connect key will be used.
- A connect key is required when upgrading from import agent v2.6.0 or lower
Logs
- New delegated authentication specific log file JumpCloud_AD_Import_Grpc.log. The log file is located in the AD import agent installer folder that was specified during installation. The default location for the installer folder is JumpCloud\AD Integration\JumpCloud AD Import
Functionality
- Added support for delegated authentication from JumpCloud to AD using mTLS
- Connect key is stored in the registry Computer\HKEY_LOCAL_MACHINE\SOFTWARE\JumpCloud\AD Integration Import Agent\connect_key
AD Sync Agent v4.15.0
- No functionality changes
- Minor changes related to the agent deployment process
2024-03-21 ADI Release Notes
AD Sync Agent v4.11.1
Bug fix
- AD Sync Agent replaced sAMAccountName (SAM) with UserPrincipalName (UPN) even when the AD Import Agent was configured to use the UPN instead of the SAM for the username value
Installer changes
- Logo update
2024-02-06 ADI Release Notes
Admin Portal
New ADI Directory Insights (DI) Events
| DI Event | Description | Notes |
|---|---|---|
| activedirectory_agent_inactive | Logged when an agent is marked as inactive. This occurs when the agent stops responding to the heartbeat check or the agent service being stopped on the server. | New event |
| activedirectory_agent_active | Logged when an agent successfully registers for the first time. | New event |
| activedirectory_primary_agent_switch | Logged when an agent is marked as the primary agent if a primary doesn’t exist or the agent that was primary becomes inactive. | Updated to include hostname, version, source_ip, host_type, host_os_version |
| activedirectory_agent_activate | Logged when an agent becomes active from an inactive state. | Updated to include hostname, version, source_ip, host_type, host_os_version |
Additional information captured in ADI Directory Insights (DI) Events
- host_type and host_os_version logged in all ADI import and sync agent DI events
AD Import Agent v2.6.0
Installer changes
- The installation wizard no longer prompts for selecting LDAPS or LDAP when installing the agent on a domain controller (DC)
Logging changes
- LDAPS error suppressed in event log when LDAP allowed
AD Sync Agent v4.10.0
Installer changes
- The installation wizard no longer prompts for selecting LDAPS or LDAP when installing the agent on a domain controller (DC)
Logging changes
- Email and username added back to the sync agent logs
- LDAPS error suppressed in event log when LDAP allowed
Back to Top
In this Article