4.8.1

Introduced the initial version of the Oracle NetSuite connector (agtnetsuite), provided as part of the standard Connector Pack.

Group membership add/remove operations

Implemented group membership management in the NetSuite Python connector so GRUA scenarios no longer failed with an "objreladd not implemented" error, by adding the groupuseradd and groupuserdelete operations to add and remove users from roles.

Connector verification classification updated

The Oracle NetSuite custom connector was reclassified from Bravura Security‑Verified to Customer‑Verified because Bravura did not maintain a NetSuite environment and did not run regression tests for this connector.

Option to exclude users with disabled access from listings

The agtnetsuite connector now supports excluding users with Give Access set to false from the user listing, configurable in Address Settings.

Support for the script address attribute type

The agtnetsuite connector now supports the script attribute type for address configuration options.

Updated the Bravura Safe (2025+) and Bravura Safe User Management (2025+) connectors to use the Bravura Safe CLI (bsafe.exe) instead of the legacy Bitwarden CLI (bw.exe). The CLI is available via the Bravura Safe GitHub repository: https://github.com/Bravura-Security/bravura-safe_clients/releases.

Listing behaviour

Improved error handling when listing users and other objects so that partial listings are no longer treated as successful. This prevents only a subset of Okta users being loaded during auto‑discovery.

Salesforce SOAP API version 65.0 support

Support has been added for version 65.0 of the Salesforce SOAP API.

Support for the OAuth 2.0 client credentials flow

The Salesforce connectors, agtsalesforce and agtsalesforce-ctc, now support the OAuth 2.0 client credentials flow. Salesforce orgs that use External Client Apps require this flow. Select it per target with the new oauthflow address option. The default remains the username-password flow, so existing targets are unchanged. In client credentials mode, the connector authenticates as the Run As integration user of the External Client App. Enter the Consumer Key and Consumer Secret as the target system credentials, and set the Server address to the org's My Domain host. The connector does not support the Verify operation in this mode.

Azure AD onPremisesSyncEnabled account attribute added

Added the onPremisesSyncEnabled account attribute for the Azure Active Directory (agtazure) connector.

Support for Entra Temporary Access Pass

The Azure Active Directory connector (agtazure) now issues, lists, and revokes Entra Temporary Access Passes. You can set default values for pass lifetime, one-time use, and start time on the target. Using this capability requires the UserAuthenticationMethod.ReadWrite.All application permission on your Azure app registration.

HTTPS support for on-premises connections

The Exchange connector previously hardcoded http:// in the New-PSSession -ConnectionUri for on-premises Exchange PowerShell connections, meaning port 80 was required. A new useSSL boolean parameter was added to the target address configuration that toggles the connection URI between http:// and https://. The default remains http:// for backward compatibility. The Exchange Online (ConnectCloud) code path is unaffected. Upgrade note: when enabling useSSL, the Exchange server must have a valid SSL certificate bound to the PowerShell virtual directory.

Exchange connector longid output for create operations

Updated the Exchange 2007+ Server connector (agtexg2k7) to add the longid for the agent output for the create operation and for when users already exist.

Exchange connector OAuth 2.0 authentication support

Exchange connector now supports OAuth 2.0 authentication for Exchange Online (list operations only; on-premises Exchange continues to use Basic Authentication).

Logging level

Updated the PowerShell connector so that variable conversion messages are logged at Debug level instead of Info, reducing noise in normal logs.

Fault-tolerant listing and configurable rate limiting

Enhanced the Dayforce connector (agtdayforce) with externalized delay and thread-count parameters and improved rate limit handling. Listings of 20,000 or more users now complete reliably instead of failing partway through.

Support for the script address attribute type

The agtdayforce connector now supports the script attribute type for address configuration options.

Host key verification options now enforced for Unix and Linux SSH targets

The Unix/Linux SSH connector now honors the Host keys file and Action for host keys options for the agtlinux, agtsolaris, and agtaix targets. Previously, these targets relied on Paramiko's default host key handling, which did not let you enforce custom verification policies.

High memory usage when listing account attributes

Fixed an issue where the SAP Server (Netweaver 7.5+) connector (agtsapnw) did not always call the RfcDestroyFunction. The missing call leaked resources and exhausted server memory on targets with large account counts.

New option to leave empty attributes out of account creation requests

The SCIM connector (agtscim) has a new target address option, omitempty, labeled Do not send attributes without values when creating accounts. When you select it, the connector leaves attributes that have no value out of the account creation request. The option is off by default, so existing SCIM targets keep the legacy create payload. Select it on Oracle ERP Cloud targets, which reject the whole create request with HTTP 400 when it contains any property that the User model does not accept, even an empty one.

SSH protocol version 1 support deprecated

The Force SSH v1 option, referenced internally as enable_ssh_1 and enable_ssh_v1, is deprecated. This legacy option has no effect because SSH protocol version 1 is obsolete and insecure.

Windows Server connector default global attributes with overrides

Fixed an issue to include default global attributes when an attribute override is used.

Siteminder connector list override setting

Fixed an issue in the Siteminder connector (agtsm) so that it now correctly saves the list override setting.

PeopleSoft 8.49 session handling crash during list groups

Fixed session handling in PeopleSoft 8.49 agent to prevent a crash during list groups operation.

Notice log spam from empty timestamps

Eliminated repeated "not a valid format []" notices when Okta timestamp fields are missing.

Active Directory connector – expired password/account handling

Restored the documented behaviour for how expired passwords and accounts affect login checks via registry options.

New user creation falsely reported as failed

Fixed a bug where Azure user creation succeeded but was reported as failed because subsequent attribute updates immediately after creation returned HTTP 404 "resource does not exist". The connector now recognises this as a temporary propagation delay, retries PATCH operations for newly created users, and uses the user's object ID when checking for resource existence, so template attributes and post‑creation changes are applied reliably without manual intervention.

Azure AD query URL construction with empty attributes

Updated the Azure Active Directory connector (agtazure) to correctly construct the query URL when attributes are empty and a filter is used, which was previously causing listing to fail.

Corrected the spelling of the OAuth2 authentication port address parameter

Fixed a misspelling in the label for the OAuth2 authentication port address parameter, which read "Autentication" when you defined address parameters.

NetSuite entityId not set on create account

Fixed an issue where the NetSuite connector was not correctly setting the entityId field when creating new user accounts, resulting in an auto-generated identifier instead of the specified value. Create account operations no longer failed to set entityId as configured (previously requiring manual correction in the NetSuite UI); this was noted as applicable for environments running Pass/Identity 12.6.3 with Connector Pack 4.8.x.

Paged SuiteQL results now retrieved in full

Fixed an issue where the Oracle NetSuite connector (agtnetsuite) did not follow SuiteQL result paging. Listing failed with Error: Could not list the user data: Incomplete dataset on targets holding more than 1,000 accounts. The connector now follows the next link until it retrieves every record.

Correct handling of includeInGlobalAddressList

Fixed an issue where create operations could default includeInGlobalAddressList to true (and log "Warning: Error occurred when setting attributes: [Resource Not Found: userKey]"); the connector now treated the attribute as a boolean (not a string) and corrected the read/write paths, including a copy-paste error where the read path returned a different attribute's value.

Python dependency version mismatch

The dayforce-py connector's pip requirements file specified jsonpath_ng==1.6.0, but the connector code required jsonpath_ng==1.8.0 (specifically the ExtendedJsonPathParser import). Running the connector with the pinned 1.6.0 version resulted in an ImportError. The dependency was bumped to 1.8.0.

Correct status code now logged when listing users fails

Fixed an issue in the Dayforce connector where a failed user listing logged the status code from the wrong response object. The log now reports the status code returned by the initial list call.

Account creation failure on strict SCIM 2.0 targets

The agtscim connector now posts account creations to the /Users collection endpoint, as RFC 7644 requires. Previously it posted to an item URL such as /Users/<id>, which strict SCIM 2.0 targets, including Oracle ERP Cloud, rejected with HTTP 405.

Real HTTP status now reported for error responses that are not UTF-8

The SCIM connector (agtscim) now reports the real HTTP status when an error response is not valid UTF-8 or not JSON. An HTML gateway error page is one example. Previously, the connector reported a generic utf8 to wchar conversion error and could crash on such a response. Successful operations are unchanged.

Error details from compressed target responses are now reported

The SCIM connector (agtscim) now decompresses gzip-encoded response bodies, so the connector log shows the actual error that the target returned. Previously, compressed error responses, such as those from Oracle ERP Cloud, produced a generic message.

Invalid multi-valued attribute values now fail cleanly

The SCIM connector (agtscim) now reports an error when the value of a multi-valued attribute is not valid JSON. Previously, the connector could crash.

Empty user name now falls back to the account ID

The SCIM connector (agtscim) now uses the account ID as the user name when the userName creation attribute is empty. Previously, the connector sent an empty userName value in the create request, so the account ID fallback did not apply.

Duplicate accounts are detected before creation

The SCIM connector (agtscim) now detects an existing account before it sends a create request. Previously, the connector added extra quotation marks around the userName value in the lookup filter, Oracle ERP Cloud rejected the lookup with HTTP 400, and the connector treated the failed lookup as no match.

Plain values for multi-valued attributes are now accepted

The SCIM connector (agtscim) now accepts a plain mapped value for a multi-valued attribute such as emails. It sends that value as the default value sub-attribute. Previously, the connector required a JSON fragment and dropped a plain value, either silently after account creation or by failing the creation outright. Values mapped as explicit JSON fragments keep their previous behavior.

User accounts now display a name instead of a GUID

The Bravura Safe (2025+) connectors, agtbsafe25 and agtbsafe25-user, now set the fullName attribute when displaying a user's accounts. Previously, the user interface showed the raw GUID, because it used the long ID as the display name.

Resumed installation after an interruption now completes

Fixed an issue where the connector pack installer failed permanently with Error 25000 after an interrupted installation. The installer reported Please run setup.exe to install this product on every later attempt. Resumed installations now complete.

Backup progress is now shown, and Cancel works during a backup

The connector pack backup now shows its progress, including the file it is backing up. Selecting Cancel during the backup stops the installation cleanly. Previously, the installer appeared to hang during a long backup, and Cancel had no effect.

For environments using the Bravura Safe (2025+) connectors, replace bw.exe with bsafe.exe on the Bravura Safe connector host. Download bsafe.exe from: https://github.com/Bravura-Security/bravura-safe_clients/releases .

Salesforce OAuth token

An OAuth token must be configured on the Salesforce side and set on the Bravura Security Fabric side.

The system ID corresponds to the client_id and the system password corresponds to the client_secret.

Oracle NetSuite / agtnetsuite-py – Connector moved to Customer-Verified distribution

Transitioned the Oracle NetSuite (Python) connector from Bravura Security-Verified to Customer-Verified, removing it from the Connector Pack installer and bundling it in the customer-verified connector pack zip; deployments that use this connector should install it as a Customer-Verified connector.

Dayforce Python dependencies (4.8.1 / 4.9.0)

The dayforce-py connector now requires jsonpath_ng>=1.8.0. If you manage Python dependencies outside the standard installer (e.g., air-gapped environments), update jsonpath_ng before deploying the new connector version.

Exchange useSSL parameter (4.7.1 / 4.8.1 / 4.9.0)

Existing on-premises Exchange target systems are unaffected — the default remains HTTP. To enable HTTPS, add useSSL=true to the target address configuration. Ensure the Exchange server has a valid SSL certificate bound to the PowerShell virtual directory before enabling.

Oracle ERP Cloud account creation (4.6.3 / 4.7.1 / 4.8.1 / 4.9.1 / 4.10.0)

To create accounts on an Oracle ERP Cloud target after upgrading, select Do not send attributes without values when creating accounts on each target. The option is off by default, and other SCIM targets keep their existing behavior.