Important or Breaking Changes

Theme Colors are required

Starting from version 12.0.4,  all colors in Themes are required. In rare cases,  when someone removes color from the Theme manually, or imports theme generated on 12.0.2 or earlier versions to 12.0.3/12.0.4 without newly added colors (for example Base Layout color is not defined), theme may look as corrupted.  Direct fix in such situation requires setting a value for all colors in the Theme. For extension owners, it is recommended  to update extensions with Themes so they include all colors set and are supported with 12.0.4.  

File/Attachments Security 

Starting from version 12.0.4, operations for uploading and downloading files stored in the configured File Storage now consider the Configuration Item (CI) permissions granted to the interactive user. Access to reading or adding files to the Object is governed by security permissions assigned to the Object for each user. This mechanism is fully aligned with the security framework used for displaying the Object in the UUX (User Experience).

The access conditions is one of following:

1. The user must possess "Read" CI permissions for the object.
2. A Data Query with Audience must exist for the user, and the Data Query filter must match the Object.

If errors occur after an update when attempting to download or upload files, it is essential to reassess whether the user truly has permission to access the file. If necessary, extend the CI permissions for the User Role or introduce a Data Query to the affected Data Definition with the appropriate Audience.

Parametrized Filter Expressions

Starting from version 12.0.3 REST API for generically reading data supports the Parametrized Filter Expressions. The controls and Additional Data Sources in the Layout Designer that support the filtering mechanism (Picker Controls, Grids, and Charts)  also have been extended to utilize the Parametrized Filter Expressions.

Due to performance and security reasons, all standard Layouts where the data filtering mechanism had been configured either for control or for Data Source were migrated to the Parametrized Filter Expression. The update could cause the breaking change for cases when the default Filter expression delivered with the core Product was customized on the Customer side.

Legacy Component Removal in Update 12.0.2

As part of our efforts to maintain a modern and efficient platform, certain legacy components that have been previously discontinued and are no longer supported will be permanently removed. We recommend that you review the list of legacy components that will be affected in this update and prepare for the transition.

• Classic UI
  The Web Application "Web" is removed.  All the images from the folder "Web/Images" are replaced under UUX Web Application to folder "WM/Images"
• Data Gateway
   
• Alerting notification Engine

License Management Background Processing

The background processing in license management is set to "Workflow" for new installations as well as for updates. You can find this parameter in the "Licenses" application settings. Up to now, the creation of license requirements via Workflow was a selectable option. The advantage of this new processing is a much faster creation and consolidation of license requirements. 

The classic calculation of the effective license requirements is still available in this version, but it is now an option that is also considered " deprecated" as of now. With the next product version, the classic background calculation will no longer be available. Accordingly, we recommend that you no longer use it.

Changes in Data Queries

With an update, we introduce the Set Audience action for Data Queries. All Data Queries audiences were migrated to inherit related Navigation Item Audience. You may need to review Audience configuration for specific Data Queries when:

1. Data Query is not assigned to any Navigation Item
2. Data Query is directly used in some Dialogs, Previews, or Wizards

For both cases, the solution is to Set Audience manually.  For more details, see also How to Set Audience in SolutionBuilder page. 

All non-system Data Queries that were created before the update get unrestricted audience, adjust them if necessary.

After the update, when you create a new Data Query, it is initially restricted to Administrators only. Use the added Set Audience action to modify the access.

Data Queries based on the Data Definition have new configurable properties that affect data displayed to the end-users:

• Priority
• Primary Filter

For more details, see Data Query page.

After the update, in rare cases, your data results might have changed due to the following reasons: 

1. Other Data Query with a higher priority is currently applied. To fix the issue, change the Data Query Priority. See Data Query page.
2. You are using one of the default Data Queries that received a Primary Filter:
   • Announcements_Portal
   • Changes_Portal
   • Changes_Portal_Approvals
   • Changes_Portal_Overview
   • Changes_Portal_MyChangeRequests
   • Tickets
   • Portal My Hardware
     If the Primary Filter is the reason why you received an unexpected result, please, verify the use case. A possible solution would be to duplicate the Data Query for your purposes and adjust the settings accordingly. 

     Removing Primary Filters from the default Data Queries is not recommended.

Data Query Column to Display

After the update, "Display Expression" is replaced with "Data Query Column to Display” property in Object Links and Object Pickers controls.

All existing static expressions are substituted with Display Expression from Data Definition. 

All static expressions are highlighted by the System Diagnostics and must be replaced with Data Query Column to Display property. To restore the same expression in your Layout as it was before the update, create a column in the Data Query with the same Display Expression and select it in the new Data Query Column to Display property in the Layout as described here. 

License Certificates Monitoring Dashboard

Implemented License Certificates monitoring dashboard allows you to be sure that you always have up-to-date information about the use of your licenses. This includes a monitoring panel and several new system diagnostic rules. All messages regarding License Certificates monitoring in the system diagnostics are displayed for informational purposes only and the system continues running as before.
If your system encounters issues with licenses, please contact Sales Administration.

For more details, see also License Certificates page.

UUX Session Lifetime

For security reason, the maximum possible UUX Session lifetime period is 48 hours. In case the System configuration exceeds the maximum value, on Update it is automatically reset to 48 hours.

Contract Management

The application "Contracts" requires a certificate for "Contract Management" for activation as of version 12.0. The incorrect certificate check in previous versions has been corrected.

UUX Session Lifetime

Session lifetime configuration has been moved from Root/bin/Matrix42.Auth.STS.dll.config to the Global System Settings: Security area.

Authorization with PKCE Flow

To increase the application security, the DWP from version 11.0.2 supports only the secure authorization flow based on OAuth 2.0 Authorization Code Flow with the Proof Key for Code Exchange (PKCE). 

Attachment Storage

The meta info content of the table Files was moved to the new table DWPFileInfo. Especially the column "Folder" was removed and all the meta info of attachments can now be found in the new table DWPFileInfo. This table is a part of the product Schema and can be queried by ASQL.

Replacing the Data Gateway Technology 

The Data Gateway Service is being discontinued and no more supported.

The Data Gateways are being replaced with new technology based on the Matrix42 Worker Technology. 

The migration will happen automatically in the background for all Data Gateways except Remote Data Gateways. Remote Data Gateways have to be replaced until they are discontinued.

New Workflow Engine 

The Workflow Execution Engine based on Microsoft AppFabric is being discontinued and no more supported. 

 For more details please check Workflow Engine.

Reference Database is obsolete

The Reference Database <MAIN DB>_REF (by default M42Production_REF) is obsolete and the update will try to delete the database during the update. If the Reference database is part of a High Availability Group you should remove it from the HA group before the update. For more details on a High Availability Group, see also SQL Cluster Support page.
The reference Schema is now a part of the production database.

Authorization with PKCE Flow

To increase the application security, the DWP from version 10.1.1 supports a new more secure authorization flow based on OAuth 2.0 Authorization Code Flow with the Proof Key for Code Exchange (PKCE). PKCE provides dynamic client secrets, meaning your app’s client secrets can stay secret. PKCE is better and more secure than the implicit flow. 

To guarantee no negative effects on authorization approach transition, version 10.1.1 still use the old authorization mechanism (OAUTH Implicit Flow) by default. The PKCE can be activated in the WM/config.json file:

  "authentication": {
      "auth_with_pkce": "true"
   }

For version 11.0.1 use the SQL query to activate the PKCE:

update PDRDwpFrontendConfigurationClass
set Value = 'true'
where [Key] = 'authentication.oauth2.auth_with_pkce'

In the version (11.0.2) the PKCE flow becomes the default authorization mechanism.

New Dependency control (Infrastructure Forensics)

Please note that with Matrix42 Enterprise Service Management release 10.1 the new dependency control used for Infrastructure Forensics needed to be changed as well.

The control itself will be provided as an extension and was extracted from the core product. In case you update or install the new extension version of Infrastructure Forensics version starting 1.1.x) the dependency control will be automatically installed thus resulting in resetting all custom set up dependencies and icon / display string over writes.

In addition to the system changes the administration settings have been moved to the application 'Assets'.

Workflow activity "Export to SQL Lite" is deprecated

Workflow activity "Export to SQL Lite" does NOT support Worker technology but AppFabric only. This activity is declared as deprecated and will be removed with next release. Accordingly support for Worker is not planned.

Security improvements for accessing Custom SSRS Reports

The System requires to implicitly grant access permissions for the custom Reports which are deployed to the custom SSRS Folder. If after Update you start receiving a message "The report could not be loaded!" on an attempt to open the Report in UUX, then follow the instructions provided in article Reports Security to provide missing security configurations

Azure Active Directory & Active Directory Data Providers 

With 10.0 Update 3, we have changed the matching mechanism for Persons and Accounts to avoid duplicates. When Active Directory and Azure Active Directory are connected with AD Sync, and both Data Providers are activate - the system will create only one Person for both Accounts. Because of that change, custom settings for matching Accounts and Users will be overwritten and needs to be configured again.

It is highly recommended to configure a list of extended attributes in configurations of Active Directory Data Provider and Azure Active Directory Data Provider at the same time when both data providers are in use! 

Background processing after running EMPIRUM Connector 

EMPRIUM Connector does NOT trigger background processing for license management anymore. This was redundant and could have caused unnecessary work load for the system. Background processing for license management is solely made by "License Management - Batch Processing" activation.

Make sure you check your engine activation schedules.

The system stops publishing Worker-ready Workflows

For improving the Product performance the Workflows which are ready to be executed on Matrix42 Worker are not published anymore, and the Workflows previously published to folder "svc/WF" are also removed on Product update. In the case of an emergency, the Workflows can be manually rollbacked to legacy AppFabric Workflow Engine by implicitly setting the engine using Workflow action "Set Execution Engine" and then publishing the Workflow  

Mandatory Category on Enterprise Queue Profiles

In order to set up a category tree for each Enterprise Queue the Queue Profiles have been extended with a mandatory root category.
Child categories can later be assigned to Activities. Please note that the root category itself will not be available for Activity processing.
In case Queue Profiles are already in place the category needs to be defined as well, otherwise workflows for assignment will fail. 

The Secure Token Service is the only available option for authentication

The Secure Token Service is the only available option for authentication. STS will be automatically enabled for existing installations. There will be no possibility to deactivate the option. In addition,  Force SSL option will be set. It means that when someone opens the console or the portal with the HTTP URL, they will be redirected to the HTTPS URL.

Default Workflows starts executing on Matrix42 Worker Engine

All Workflow delivered out-of-the-box by default starts executing on Matrix42 Workflow Engine. All custom workflows have to be evaluated and marked for compatibility with the Worker Engine. See Workflows Migration for more details.

Default Level for Workflow Monitoring changed to Error Only

All Workflows that are executed using Matrix42 Workflow Workers  are configured for log only Errors.  Enabling Troubleshooting mode can be done  Settings

Workflow Infinite Loops Protection enabled

  If the Workflow is badly designed it can lead to infinite loops on Workflow Instance execution and overall blocking of the Workflow Engine, as some instances are always running and there is no capacity to execute new Workflow commands. To disable such negative impacts of the Infinite loops the System uses the protection mechanism which automatically terminates the Workflow Instances in case the infinite loop detected, and the amount of iterations exceeds the configured number in the Production database SPSGlobalConfigurationClassWorkflowEnginetableActivityLoopLimitattribute. 

By default, the System supports 10000 iterations in Workflow Instance before it will be classified as an infinite loop.

Data Gateway tasks run on Matrix42 Worker

Data Gateway tasks (except Inventory of Citrix XenServer, Inventory of Microsoft Hyper-V, Inventory of VMware vCenter, LIS - Online Update,  Unix Inventory, Windows Inventory) assigned to the local Data Gateway (App Server) are executed on the local Matrix42 Worker.

Ticket only mode for new installations

Due to the latest changes with ITIL4 the Incident only function will no longer be available on new installed environments. From now on Tickets need to be classified as either Incident or Service Request.
In case disaster recovery needs to be performed Version 10.0.0 needs to be installed followed by an update to 10.0.1

Service Level Agreement (SLA) only support

To reduce overall complexity ITIL4 did change the handling of Underpinning Contracts (UCs) and Operational Level Agreements (OLAs). Service Level Agreements (SLAs) will substitute OLAs and UCs which have been migrated automatically. In order to identify the origin of the initial Configuration Item a dropdown showing the type was introduced. The corresponding CIs have been removed from the schema.

API Tokens Invalidation 

Due to Security reasons in some particular cases, the Product Update automatically regenerates the Client Secret used for encoding the Security Token, what could lead to invalidation of the used API Token. If your Environment(-s) implement any Integration which based on API Token Authentication, please ensure right after the Update it still operates, otherwise, you need to generate a new API Token and use it in all related Clients.

Changes in OAUTH2 authentication endpoint

Changes need to be applied in case you did connect Matrix42 Service, Software & Asset Management and a 3^rd party application using OAUTH2 authentication.
Until version 10.0.0 this endpoint '.../M42Services/Authorize/OAuth2Reply' was used.
Starting with version 10.0.0 the endpoint has changed and needs to be adjusted to: '.../M42Services/api/sts/oauth2reply'.

UEM-Mode

The system no longer manages mobile devices as a separate type of asset. One type of object is used for managing both computers and mobile devices. It is known as Unified Endpoint Management. If you update from an earlier version, all mobile device records will be merged into the computer entity. This way you can manage all endpoint devices under one navigation item and using the same dialog.

After you install the update, you can see that all existing mobile devices have been transformed into computers.

Changes in User Interface

The following changes in the user interface have been made:

• Dialog and preview for mobile devices as well as the Create Mobile Device and Import Mobile Devices actions will disappear
• Mobile devices imported via data providers and created manually will be copied as computers
• The computer dialog and preview will be extended with attributes specific for mobile devices

Changes in Database

The system creates a computer record for each mobile device and moves all related objects to the computer record.

The following data gets reassigned:

• Ownership (organizational unit, cost center, and location)
• Principal User
• Stock Keeping Unit
• Workplace
• Environment
• Installed Profiles and Applications
• Purchase Data (Contract, Supplier, Internal Contact, Contract Item, Cost Plans)
• Attachments, Comments, Journal, Tasks, and Appointments
• SIM Cards
• Licensing Information (License Requirements, Restricted and Reserved Licenses)
• AD Groups
• Dependencies
• Services, primary and indirectly affected Incidents, Problems, Change Requests, and Outages

Provisioning of Catalog Services

Silverback and AirWatch services are automatically adjusted to a computer target. Therefore, provisioning of services is now made for computers that represent imported mobile devices (you can filter them by management type Mobile Device Management). All previously assigned services get reassigned to new computer records.

Check your Customizing

As for the standard product, all necessary changes will be made automatically preserving all your data. However, if you have any customizing around "Mobile Device" in your environment, you will need to review and possibly adjust them, e.g.:

• Attributes, Relations or Data Definitions
• Non-standard Data Providers
• Import Definitions
• Compliance Rules
• Workflows
• User Interface
• Search Queries
• ...

Discontinue Alerting Email Engine

According to the Alerting Engine Discontinue Plan, which was presented in 9.1.3 release,  in version 10.0.0 all email notifications, including custom, use the new Email Engine. If for some reason the Email Notification was not properly migrated, it could be manually fallback to use the legacy Alerting Engine, using Compliance Rule action "Switch Mailing Engine".

UUX Security Vulnerability Eliminated

The potential security issue, related to XSS attacks, has been discovered and eliminated in version 10.0.0. All weaknesses of the standard Product have been removed. But, there is a possibility the System customizations (configurations) could open other vulnerabilities that cannot be automatically detected and resolved.

To protect the System proceed with the following steps:

1. Find the Custom Schema Attributes which stores the HTML
   Usually, such attributes bound to RichTextbox control.
2. Edit the corresponding Data Definition, and set the flag "Contains HTML" for such attribute
   For more details check Data Definition Attributes

.NET Framework Version Update to 4.7.2 

The Product .NET framework version is elevated to the latest released version 4.7.2.  This change could impact the custom assemblies which have been previously installed on Product and reference the Product assemblies of the strict version. To avoid potential problems it is recommended to at least to check the custom assemblies still working on a version 10 and above, or better, rebuild all such assemblies with .NET 4.7.2 Framework.

Also in a new Product version, some 3d Party libraries (Nuget packages) have been updated to a newer version.  If you using these libraries in your Projects please recompile these assemblies to guarantee they are compatible with the new Product. 

Powershell scripts, that uses CMDLETs referencing mentioned dlls, must be also checked for compatibility

Name	Previous Version	Version in 10.0.0
Microsoft.Owin.Cors.dll Microsoft.Owin.Diagnostics.dll Microsoft.Owin.dll Microsoft.Owin.Host.SystemWeb.dll Microsoft.Owin.Security.Cookies.dll Microsoft.Owin.Security.dll Microsoft.Owin.Security.Jwt.dll Microsoft.Owin.Security.OAuth.dll	3.0.40213.64	3.1.60405.82
Newtonsoft.Json.dll	7.0.1.18622	12.0.l2.23222
nlog.dll	3.1.00	4.6.7.10445

Migrating Workflows from AppFabric to Matrix42 Worker Engine

Matrix42 Worker Engine is in a pre-released state (Technical Preview) and will be fully released in version 10.0.1.  Please check the schedule of the Workflow Engines transition plan.

Starting from version 10.0.0 the compatibility of the Custom Workflows and Workflow Activities with the Matrix42 Worker Engine can be evaluated on Testing Environment. See Workflows Migration for more details.

 

Matrix42 Worker

Matrix42 Worker is a Windows Service introduced in the version 9.1.2 as Technical Preview. More details can be found in Workflow Engine.

By default, the Matrix42 Worker is not installed by the Setup, and in case it was not installed manually the breaking change is not affected, and the actions list can be ignored. Otherwise, the Worker needs to be manually updated.

1. Stop "Matrix42 Workers" Windows Service before Matrix42 Workplace Management update.
2. Update Matrix42 Workplace Management.
3. Clean up Matrix42 Worker directory
4. Follow the Install Worker instructions to  install new version of the Worker

The concept of the Matrix42 Worker presumes the Matrix42 Worker is self updated whenever the relevant resources on the Application Server are updated,  means in future Product updates the Workers will be updated automatically regardless of the way they have been installed. 

License Metering

With this new release, our software supports you in auditing your Matrix42 software licenses. The software now has a function that requests information about the licensing of the Matrix42 software at regular intervals and transmits the number of licenses used (by devices and users) to us. Personal data is not collected. The data transmitted with each process can be viewed on the server in the 'metering' sub-directory.

Further details can be found in the product documentation.

SaaS Compliance Data Provider

Installed data provider from SaaS Compliance subscription (Office 365 and Adobe Creative Cloud) needs to be updated after upgrading your environment to version 9.1.1.

Configuration of Remote Usage Tracking

Configuration of Remote Usage Tracking Agent is now made in settings for "License" application and not directly in config-files anymore. Accordingly make sure that your settings are correct, if you are using Remote Use Tracking Agent in your environment.

Please refer to online help for details about configuration.

Compatibility of Empirum SDK

Due to a breaking change in Empirum SDK v1.20 compatibility with earlier versions is affected.

Since Software Asset & Service Management 9.1 Update 1 installs Empirum SDK version 1.20 coexistence with previous version may lead to execution errors!
Don't be confused if your scripts run nicely inside PowerShell IDE. This is misleading.

Solution: 

1. Adjust your PowerShell scripts to match with SDK 1.20 and remove old SDK-version (recommended!)
2. Manually remove SDK 1.20 after updating to Software Asset & Service Management 9.1 Update 1

.NET Framework changed

Please note that this version was compiled with .NET Framework 4.6.1 for the first time. Please ensure it is available on your server prior to installing the product. Setup of the .NET Framework is contained in the REDIST file provided with this release. Please note that users of Workflow Studio need this .NET version also on their client device.

Service Desk – 2 new configurations added

Two new configuration settings have been added to allow better information handling on new received data. The two options, defined in the Service Desk – Settings area, are

1. Mark ticket as "New information received" when adding Journal entry (enabled by default)
2. Mark ticket as "New information received" when adding Journal entry by responsible person (disabled by default)

Especially the second option might result in changed behavior on filters checking the new information status.

Removed Exception (for Developers only)

“PandoraException” was moved from Matrix42.Pandora.Contracts to Matrix42.Common. If you have already used “PandoraException” in your projects, please change the namespaces in all usages.

User Profile

"Users are not able to change their data in User Profile"

This change comes from a bug fix. Setting, that was always present, saying "Allow Users to Change Personal Data" was not working in UUX. Now it is considered, and can be changed by customer

Workflows will be validated during update

Setup contains new feature validating existing workflows to avoid unexpected failures during their execution. This validation checks if workflows have references to components that are missing on the environment or have a wrong version.

If validation detects a corresponding issue, a message is displayed:

There are two options to deal with this issue:

• Instant Fix
  • Keep small message box with caption “Skip” open
  • Deploy required but missing component
  • Click ‘No’ on small message box to repeat validation
• Subsequent Fix
  • Click ‘Yes’ on small message box with caption “Skip” to skip validation
  • Continue with the setup
  • Deploy required but missing component after the setup has finished

We recommend first option.

More details can be found in online help.

Office 365 Data Provider

In case you have installed the data provider for Office 365, please download new version of this data provider from Matrix42 Marketplace and install it after updating your environment.

Auto-Migration of Volume License Agreements

Please note that with upgrading your environment to this version, existing volume license agreements of following types are automatically migrated to CI “Volume License Agreement”:

• Microsoft Enterprise Agreement
• Microsoft Enterprise Enrolment
• Microsoft Select Agreement
• Microsoft Select Enrolment
• Adobe CLP Agreement
• General Volume License Agreement

Automatic migration will not copy data records, but just change the type (Configuration Item). Object-ID and any other data remains untouched.

SQL Server 2008 R2 not supported anymore

With product version 9.0 we do not support SQL Server 2008 R2 anymore. If you operate your environment on this SQL Server make sure you update your SQL Server to one of the supported versions prior to updating your environment to this product version.

Also please check system requirements in our online help.

Workflow Activity "UpdateObjects"

Implementation of workflow activity "UpdateObjects" was changed. Parameters validation becomes stricter so custom workflows that use this activity may fail in case of passed "Object IDs" is not related to specified "CI Type". Please review your custom workflows before updating to version 8.1.7 or higher.

Filter in UUX Navigation

With previous product version 8.1.7 we changed behavior of filters in UUX navigation.

New Behavior:

If a user, who belongs to Administrators role, creates new navigation filter:

• This user will not be set as Owner of this filter anymore
• This user will now be added to the Audience that is able to see that filter

Previous Behavior:

• Any user sees all filters in navigation that are marked as “to-be-shown in navigation” where user has access through the Audience setting or the user is the owner of respective filters.
• If a user creates a new filter for navigation, this user was previously automatically set as “Owner” of that filter.
• In case that a user creates a filter as an administrator and shares it with all other users – there was previously no way to hide this filter from his personal navigation.
• Migration:

If you update an existing system with product version 8.1.7, all owners are removed from those navigation filters where the current owner is in role Administrators. In addition, the corresponding user will be added to the audience entry. As a result, member of role Administrator will still see same filters in navigation as before update, but he will be able to hide for himself specific one using action Audience.

In addition, Administrator can use Administration => Search Filters to create new or configure existing filters.

CI Approval and ChangeApproval

With previous product version 8.1.4, the structure of “Approval” and “ChangeApproval” CI have been changed for performance improvement reasons. Both CI do not include Data Definition SPSActivityClassBase anymore.

Relevant attributes have been moved to SVCApprovalTaskClassBase instead: 

Data Definition	Attribute
SVCApprovalTaskClassBase	ClosedDate
SVCApprovalTaskClassBase	CreatedDate
SVCApprovalTaskClassBase	Creator
SVCApprovalTaskClassBase	Recipient
SVCApprovalTaskClassBase	RecipientRole
SVCApprovalTaskClassBase	TicketNumber
SVCApprovalTaskClassBase	WorkflowID

Deny Logon

Since product version 8.1.0, only accounts with a status that is equal to Active (2001) and with the unselected Deny Workspace Management Logon checkbox are allowed to log in toMatrix42 Workspace Management. Prior to that version, all accounts with a status value other than Deleted (2004) and with the unselected Deny Workspace Management Logon checkbox were allowed to log in to Matrix42 Workspace Management.