Okta Access Gateway Release Notes

• Oracle VirtualBox is only supported for development and testing and is not intended for production use.
• An upgrade to the Access Gateway Admin UI components is causing the text in the topology view to be enlarged on some browsers. This will be resolved in a future release.
  

• Access Gateway worker instances can now be synchronized on demand. See High Availability configuration operations.
• Administrators can now use the Access Gateway Admin UI console to control log verbosity as well as view current log and disk usage statistics. See About logging levels and Manage log verbosity

Enhancements

• New documentation has been added for implementing SAML pass through applications. See Add SAML pass-through application for more information.
• The Oracle EBS, Oracle JD Edwards, Oracle PeopleSoft and generic Kerberos application integration documentation has been updated and now includes reference architecture diagrams, step clarification and overall process flow improvements.
• Added and extended documentation about managing SSL/TLS termination and load balancers. See Managing SSL/TLS termination for more information.
• The Access Gateway support VPN has been updated to perform additional validation during initial connection setup. See Managing the Access Gateway support VPN for details.

Fixes

• OKTA-322679 - When Access Gateway had multiple network interfaces, some interfaces didn’t return the instance hostname, and localhost was reported in corresponding log messages.

• OKTA-350471 - When Access Gateway 2020.11.2 was deployed to VMWare vSphere on a DHCP-disabled network, the instance became unusable if an invalid IP/netmask combination was specified.

• The Access Gateway Management console can now specify a proxy username and password in support of proxy authentication. See the Network > Proxy in the Command Line Management Console reference.

Enhancements

• The Access Gateway Management console now displays a security banner prior to login.
• New documentation has been added on working with Dynamic application attributes.
  See Adding dynamic application attributes for more information.
• New documentation has been added on creating portal based applications.
  See Add portal application for more information.
• New documentation has been added on creating applications which support WebSockets.
  See Add WebSocket based application for more information.
• Additional advanced access policy examples have been added.
  See Advanced Access Gateway policy examples.

Fixes

• OKTA-301413 -Access Gateway returned the default Access Gateway icon instead of the protected web resource icon.
• OKTA-340130 - When Access Gateway was not assigned a DHCP IP address, the network service failed to start and the Access Gateway Management console failed to start after logging in.

• OKTA-329128 - When validating database-based datastores, valid Table names were evaluated as invalid unless Advanced query mode was enabled.

Enhancements

• New documentation has been added on Bootstrapping Access Gateway for development use.
• DNS documentation has been extended and enhanced.  See About Access Gateway DNS use.
• Troubleshooting documentation has been extended and enhanced. For more information see:
  • Application troubleshooting process
  • Troubleshoot applications
  and
  • Troubleshooting tips and techniques
• Documentation enhanced to include support for adding IDP specific Access Gateway Admin UI console applications.
  See Add an Access Gateway Admin UI console application for more information.

Fixes

• OKTA-324582 - When adding or modifying applications, valid IP addresses entered in the Public Domain field failed validation with Invalid domain format errors.

Enhancements

• Documentation enhanced to include support for adding IDP specific Access Gateway Admin UI console applications.
  See Add an Access Gateway Admin UI console application for more information.
• All application documentation pages have been updated to include supported version information.
• Getting started has been updated to include development and test focused Bootstrap Access Gateway documentation.
• Additional documentation has been included on how to:
  • Set Access Gateway instance hostname.
  • Set Access Gateway instance IP address.
  • Set Access Gateway DNS Servers.
  • Set Access Gateway proxy server.

Fixes

• OKTA-300184 - When using the Access Gateway Admin UI console to update an application, the updates overwrote the Okta org Cross-Origin Resource Sharing (CORS) settings.
• OKTA-313764 - When configuring the No Session/Session Expired setting on the Access Gateway Admin UI console to force reauthentication, the Resource not found error occurred.
• OKTA-324392 - When the number of entries for a given host name decreased before a valid Domain Name System (DNS) host name resolution request was initiated, the error attempt to index a nil value appeared in the Lua log and the process timed out.
• OKTA-325103 - After an upgrade where the Access Gateway node was using a proxy, the Access Gateway Admin UI console would become unreachable with error Admin UI service is not Available.
• OKTA-325545 - When using the Access Gateway Admin UI console to add or modify an application, valid URLs failed to resolve and the error Domain must resolve in DNS and connect with TCP/IP appeared.

Fixes

• OKTA-321124 - When validating an advanced policy directive, valid directives failed with a Config generation error.

• Administrators can now define and use Trusted domains.
  For more information see About trusted domains and Manage Trusted domains in Command Line Management Console reference.
• Administrators can now perform Admin renomination.
  See About admin renomination and Perform admin renomination.
• Administrators can now better manage certificates in the Access Gateway Admin UI console.
  See About Access Gateway certificates and Managing certificate tasks.
• Access Gateway now supports deploying into Oracle Cloud Infrastructure.
  See Oracle Cloud Infrastructure (OCI) deploy tasks for more information.

Enhancements

• Documentation has been enhanced to include new log events in support of Trusted domains, Admin renomination and Certificate management.
  See Monitor log Access Gateway monitor log for more information.
• Documentation restructured and extended for Monitor, Access and Audit logs.

Fixes

• OKTA-277067 - When adding worker nodes to an Access Gateway cluster, the immutable flag for resolve.conf was not reset, leading to potential DNS issues.
• OKTA-304742 - Applications updated using the Access Gateway Admin UI console overwrote some Okta Org application settings.
• OKTA-278891 - Corrects an issue with unauthenticated open redirects.

• Administrators can now delete and rename backups in the Access Gateway Admin UI console.
  For more information see Manage backups.

Enhancements

• Access Gateway documentation as a whole was restructured to improve structure and usability.
• Documentation added for Oracle Application Express applications.
• Documentation added for Oracle Forms applications.
• Documentation added for including JavaScript into pages to support AJAX session timeout handing. See Advanced Access Gateway policy examples.
• When downloading backups, administrators can now choose to hide or show passwords.

Fixes

• OKTA-254374 - When localhost was configured as the DNS nameserver, the Access Gateway Management console displayed the loopback address instead of the hostname.
  
• OKTA-286718 - Adding a high availability worker node to an Access Gateway cluster failed with an initialization error.
• OKTA-288224 - When an Access Gateway disk was at or near full capacity, the SNMP agent stopped working.
• OKTA-295495 - Duplicate log entries were created when some SNMP error messages were incorrectly marked as INFO instead of ERROR.
• OKTA-295590 - In some situations, during initial session creation when submitting forms, Access Gateway would redirect GET requests as POST requests.
• OKTA-298878 - When trying to remove an LDAP data store on the Access Gateway Admin UI console, some data stores incorrectly reported their status as in use.
• OKTA-298939 - On high availability clusters, worker node events were missing when capturing log events using system loggers.