v4.2.1

• #1668 Update top.jsp meta tag for correct closing tag (@gougej88)
• #1660 get the VirtualFile object from the vfs URL (@frett)
• #1657 Handle vfs resource when checking for CAS date/time (@mmoayyed)
• 467f0e6 Identifier too long for Oracle (@ikogan)
• #1665 Auto-generate keys for webflow/TGC

v4.1.7

• #1668 Update top.jsp meta tag for correct closing tag (@gougej88)
• #1664 Auto-generate keys for webflow/TGC

v4.2.0

For a complete list of changes, please refer to the change log for each preceding release candidate, and/or refer to the CAS documentation at http://jasig.github.io/cas/4.2.x

v4.1.6

• #1635 Correctly access unauthorizedRedirectUrl in the webflow (@jtgasper3)
• #1623 Ensure proxy authN is taken into account when using ssoEnabled=false (@mmoayyed)
• #1615 Allow ssoEnabled=false to activate only if TGT is used once (@mmoayyed)

v4.2.0-RC3

• 99653d5 Remove "All Rights Reserved "from UI (@mmoayyed)
• 6bd0cfc TokenAuthenticationHandler should retrieve the right token encryption setting from properties. (@mmoayyed)
• #1547 OAuth: Use the provided service for the access token, no the callback one (@leleuj)
• 2702610 Expose AbstractTicketExceptions to webflow (@frett)
• 29bb759 Always use the root TGT for checking the AuthenticationPolicy (@frett)
• 9c4630b Drop connections early for ldap service registry (@mmoayyed)
• 78dd0fd Mark putTicketGrantingTicketIntoMap() public (@mmoayyed)
• #1524 disallow double authN when ST is generated (@mmoayyed)
• 7cdb5d2 Add an extra space before header text (@mmoayyed)
• 714f0e7 JPA: Mark getTicket() calls not readonly (@frett)
• 0f3191a Enhance hazelcast configuration; allow support for loading settings from an external file (@dima767)
• 1e44152 Allow alternative logger selection (@mmoayyed)

v4.1.5

• #1548 Expose TicketExceptions to webflow (@frett)
• 4f08ea7 always use the root TGT for checking the AuthenticationPolicy (@frett)
• #1537 Updating Javadocsc (@PetrGasparik)
• 82ad309 Mark putTicketGrantingTicketIntoMap() public (@mmoayyed)
• #1530 Drop search connection early for ldap service registry during updates (@mmoayyed)
• #1523 Disallow double authN when generating STs (@mmoayyed)
• 302c542 Update docs for Google Apps (@mmoayyed)
• 029cc3c Disable readonly for the getTicket method of JPA service registry (@frett)

v4.2.0-RC2

• 0500e5a 23664fa Allow better control over WS-FED principal resolver; Fix infinite redirect loops (@mmoayyed)
• #1480 Log4j2 reconfiguration of shut downs (@frett)
• 0789bc5 34e9b0e SAML1 ResponseTo field as valid cname (@mmoayyed)
• 9900352 Represent assignedId as a String for Services Management (@frett)
• 3481b4c Change name of the property to be more consistent with the rest of CAS (@dima767)
• cc436cd Added oauth-core module (@mmoayyed)
• fd3cf3a Refactor executor thread pool for httpclient (@mmoayyed)
• 0179a4f Remove HTML escaping from the URL (@mmoayyed)
• #1462 Quartz shutdown on 4.2 (@frett)

v4.1.4

• #1459 Wait for Quartz threads to shutdown (@frett)
• 66defc3 Allow CAS cookie paths to be overridden (@mmoayyed)
• #1454 Fix url for ba-debug JS dependency (@nicolasmoreira)
• ef08efe Disable SAML external entities, includes, and entity reference expansion (@mmoayyed)
• #1437 Fixing typo in RegisteredServiceThemeBasedViewResolver bean def (@jtgasper3)
• 2730fd0 Update the OAuth error view name (@mmoayyed)
• #1435 Update X.509 Authentication Guide (@jbjonesjr)
• #1430 Management webapp docs; time-based access strategy UI changes (@mmoayyed)
• #1427 Ensure SAML UI extensions are not null (@mmoayyed)
• f6eaa29 Allow attribute values for access strategy to support regex (@mmoayyed)
• 7bb4e77 Allow the pac4j credential to ignore the typedid if configured (@mmoayyed)
• #1412 Fixed typo in PAC4J documentation (@jtgasper3)
• #1410 Login throttling using JdbcAuditTrailManager won't work (@mateofacu)
• #1409 Registered Service properties (@mmoayyed)
• #1407 Allow the logout manager to use CAS local truststore (@mmoayyed)
• #1407 Update Kryo serializers (@smicyk)

v4.2.0-RC1

• #1343 Decouple authentication from CASImpl (@dima767)
• #1385 private methods that don't access instance data should be "static" (@kirill-vlasov)
• #1383 Update to gradle 2.10 (@mmoayyed)
• 60085d7 fixed checkstyle issues (@mmoayyed)
• #1381 Dead stores should be removed (@DevFactory)
• #1380 Ensure CAS attributes are encoded (@mmoayyed)
• #1382 Unused private fields should be removed (@DevFactory)
• ea7a2c2 Fixing squid:S1068 - Unused private fields should be removed (@kirill-vlasov)
• 4c3b646 Remove protocol constants from webflow action (@mmoayyed)
• 0fe35cf Allow SLO messages to reach into the CAS truststore (@mmoayyed)
• #1372 Allow the warning cookie to be set conditionally in non-interactive actions (@mmoayyed)
• #1366 Allow oauth services to be verified against services manager (@mmoayyed)
• #1368 Ticket registry based on Infinispan cache (@mmoayyed)
• #1369 Doc correction - header level (@PetrGasparik)
• #1354 JWT/Token authentication support (@mmoayyed)

v4.1.3

• #1363 Serialize/Deserialize the registered service for memcached (@mmoayyed)
• 2e6ea05 Allowed the use of Inspektr's ClientInfo when running JDBC throttling queries (@mmoayyed)
• 7c854e3 Allowed JPA registry to detect PGTs (@frett)
• #1349 Added @JsonIgnore annotation when configuring salt for username attribute providers (@frett)
• #1341 Added authZ strategy by date/time (@mmoayyed)
• c25d7df Fixed issue with missing JPA transactional entity manager (@mmoayyed)
• #1330 Fixed issue with Google Apps SAML2 timezones (@agaikwad)
• 8d5f45b Use static loggers for expiration policy (@frett)
• d42f436 Extended JPA field length for lobs (@mmoayyed)
• 6fabe3d Fixed skew allowance for google apps (@agaikwad)
• 265a7ad Allowed management app to reload services (@mmoayyed)
• #1320 Added missing namespace declaration into doc for JPA (@robertoschwald)
• 0237fe0 Allowed rest credentials to be extracted via a pluggable strategy (@dima767)
• #1303 Create a new Array for modified CAS logging arguments (@frett)