Historical CalNet Releases

CalNet operates a complex suite of applications that support the Identity and Access Management functions of the University.  Below are CalNet releases from previous calendar years. Records of releases have been maintained on this website since March 2016. 

• 2022
• 2021
• 2020
• 2019
• 2018
• 2017
• 2016

You can sign up to receive timely notices when CalNet has a new release. To subscribe to the list, go to: https://groups.google.com/a/lists.berkeley.edu/d/forum/calnet-releases(link is external) and click JOIN.Or, see current year CalNet Releases.

November 13, 2022, 8:00 am

This release completed the upgrade of the EWH CalNet LDAP infrastructure to DS 7.2. This impacted LDAP services use by CAS, WiFi, and various other services across campus.  No impact to applications or customers is expected.  CMR: CHG0036096

Services Affected:

• LDAP
• CAS
• Wifi Services

This release included enhancements and bug fixes to Berkeley Person Registry and SPA provisioning. There may be a brief outage to Berkeley Person Registry and associated applications while the server restarts.  CMR: CHG0036067

Services Affected:

• Berkeley Person Registry
• Special Purpose Accounts (SPAs)
• Active Directory (AD)

October 3, 2022, 5:00 pm

June 7, 2022, 5:30 am

We patched CAS from the current version (6.5.2) to the latest version (6.5.4) to apply a bug-fix required to implement new functionality.  There was no planned outage associated with this release. CMR: CHG0035622

This emergency release fixed a bug that prevented CalNet accounts from expiring when they should. CMR: CHG0035425

This release included additional tracking of UCPath primary jobs and a bug fix. CMR: CHG0035401

March 22, 2022, 7:00 pm

In this release, we changed the firewall configuration for the CalNet LDAP cluster dedicated to authentication services.  CMR: CHG0035405

In this CalGroups change, we refactored 2-Step groups and also added a new feature for some admins in CalGroups to view alumni both in their groups and in their searches. 2-Step users should not notice the change. CMR: CHG0035296

February 17, 2022, 7:00 pm

This was a major upgrade of the identity management system that does data intake, identity matching, account provisioning, web services and data writing to LDAP and Active Directory. The significant changes can be summarized as: A refactoring onto the latest Spring Boot framework (numerous code changes as a result), an upgrade to using latest dependency libraries, an upgrade to using latest Java 17 LTS, an upgrade to the Tomcat 9 application server, and moving to new, upgraded virtual machines running RedHat. There was a short planned outage associated with this release. CMR: CHG0035238

January 30, 2022, 9:00 am

We patched Red Hat Enterprise Linux servers to address errata published by Red Hat. This included bug fixes, security, and enhancement updates to packages maintained in official Red Hat repositories. In addition we applied patches as needed from custom repositories for Zabbix and Duo. During this cycle we also upgraded our Nginx proxy servers. There was a short outage of bpr.calnet.berkeley.edu that affected CAT and CAM while that host rebooted. CMR: CHG0035220

Services Affected:

December 21, 2021, 7:00 pm

We patched the Red Hat Enterprise Linux servers to address errata published by Red Hat. This included bug fixes, security, and enhancement updates to packages maintained in official Red Hat repositories. In addition we applied patches as needed from custom repositories for Zabbix and Duo. There was a short outage of bpr.calnet.berkeley.edu thereby affecting CAT and CAM while that host rebooted. CMR: CHG0035116

December 2, 2021, 7:00 pm

In this release, CalNet is updating email templates used for account locking and for Stu-Delegate account creation. CMR: CHG0035062

November 30, 2021, 7:00 pm

The CalNet team is implementing an emergency change. The IP address of shib.berkeley.edu(link is external) will change. CMR: CHG0035046

IMPORTANT: If you currently enforce outbound firewall rules for web traffic, you must add an additional allow rule for the new Shibboleth virtual IP:

• Port: 443

• IP: 169.229.54.216

October 15, 2021, 6:00 am

October 10, 2021, 8:30 am

We patched Red Hat Enterprise Linux servers to address errata published by Red Hat. This included bug fixes, security, and enhancement updates to packages maintained in official Red Hat repositories. In addition we applied patches as needed from custom repositories for Zabbix and Duo. There was a short planned outage for CAT/CAM within the release window. CMR: CHG0034879

September 25, 2021, 6:00 am

The CalNet Postgres databases will be upgraded by the campus database team. This will result in an outage of some CalNet services of approximately 90 minutes. CalNet logins will not be impacted during this outage. CMR: CHG0034838

September 1, 2021, 7:00 pm

August 8, 2021, 6:00 am

July 29, 2021, 6:45 pm

June 17, 2021, 7:30 pm

This release included changes to identifierTypes, changes to the no recovery email address screen in CalNet Account Manager, and changes to roles in CalNet Admin Tool. There was a planned outage associated with this release. CMR: CHG0034593

Services Affected:

• CalNet Admin Tool
• CalNet Account Manager
• Berkeley Person Registry

May 24, 2021, 11:05 am

Starting at approximately 11:05 am some clients may have seen errors when trying to log into a CAS-protected application. The issue was resolved fully by 12:36 pm. The java process running the Tomcat web application server had more open file handles than allowed by the operating system. In trouble-shooting we found that the CAS process opens that script for every user log in to the service, but never closes the file handle. Over the course of approximately 30 days the number of opened files for that process grew above the hard limit set by the OS. There was an unplanned outage associated with this release which took place intermittently across the release window. CMR: CHG0034546

Services Affected:

• CAS

May 20, 2021, 7:00 am

The majority of the remaining deprecated attributes definitions (objectClasses and attributeTypes) were removed. These attributes are no longer maintained and have been marked for removal for several years. The list of attributes that were removed can be found at https://calnet.berkeley.edu/calnet-technologists/ldap-directory-service/ldap-simplification-and-standardization#B. There was no planned outage associated with this release. CMR: CHG0034495

Services Affected:

• LDAP

May 20, 2021, 5:00 am

We configured DNS failover for the ldap.berkeley.edu cluster.  This allows the service to automatically fail over to San Diego in case of a major network or system outage at EWH. There was no planned outage associated with this release. CMR: CHG0034507. 

Services Affected:

• LDAP

May 19, 2021, 7:00 pm

We issued a new certificate for the ldap cluster at ldap.berkeley.edu in preparation for enabling automated failover to our SDSC data center the following morning. We quiesced traffic to each node in turn to update the certificate. There was no planned outage associated with this release. CMR: CHG0034514. 

Services Affected:

• LDAP

May 5, 2021, 9:00 pm

This change allows campus postdocs to have a longer grace period. There was no planned outage associated with this release. CMR: CHG0034476

Services Affected:

• Berkeley Person Registry

May 2, 2021, 6:00 am

We changed the load balancing direct routing method used by ldap.berkeley.edu to stop using ARP tables and instead use iptables. The ldap.berkeley.edu cluster configuration for direct routing was not working as intended. Some applications were experiencing loss of connectivity to ldap when we performed maintenance that should otherwise be transparent. This change was intended to correct this issue and allow us to perform maintenance without impacting customers in the future. There was a planned LDAP outage of 10 minutes within the release window. CMR: CHG0034444

Services Affected:

• LDAP

April 25, 2021, 6:30 am

We patched Red Hat Enterprise Linux servers to address errata published by Red Hat.  This included bug fixes, security, and enhancement updates to packages maintained in official Red Hat repositories. In addition, we applied patches as needed from custom repositories for Zabbix and Duo. We patched to address OS bugs and vulnerabilities.  There was a 5 minute outage for Manage My CalNet while that system rebooted. CMR: CHG0034443

Services Affected:

• BPR systems
• CAS
• Grouper
• LDAP
• Shibboleth

April 21, 2021, 9:00 am

March 22, 2021, 7:00 pm

February 11, 2021, 7:00 am

We replaced the certificate on the test CAS instance (auth-test.berkeley.edu). The new certificate has a different issuer. We deprecated the Extended Validation certificates in favor of standard InCommon SHA-2 certificates. Certain applications, such as those using Java key stores or other non-operating system certificate stores, may require providing the root certificate in addition to the intermediate certificates. Obtain certificates from a trusted source like the certificate store on your local computer or directly from the Root CA. There were no planned outages associated with this release.  CMR: CHG0034267

Services Affected: 

• CAS

January 1, 2021, 9:00 am

We increased LDAP replication retention from 3 days to 5 days to ensure changes made while EWH DC is unavailable are retained in the event that the outage is longer than expected. These changes were pushed to LDAP-test on December 21, 2020. There were no planned outages associated with this release.  CMR: CHG0034176

Services Affected

• LDAP

Back to Top

December 21, 2020, 8:00 am

We removed the deprecated attribute values from CalNet LDAP directory (access to these attributes was revoked on Oct 29th). A list of those attributes can be found at https://calnet.berkeley.edu/calnet-technologists/ldap-directory-service/ldap-simplification-and-standardization#B. There were no planned outages associated with this release. CMR: CHG0034140

Services Affected

• LDAP

December 3, 2020, 6:30 pm

We changed the production DDODS connection string, no longer recognizing academic potential hire POI type, and changed how effective rows are calculated from DDODS POI table. There was a brief outage that occurred between 6:30pm - 7:00pm. CMR: CHG0034129

Services Affected

• Berkeley Person Registry

November 30, 2020, 7:00 pm

We had about 1200 old-style departmental accounts that were expired. We moved them from ou=people to ou=expired people in LDAP. We have made attempts to contact these account owners, but there may still be some users who are using these old-style accounts. If that is the case, then we can roll back the change for that particular account. There was no planned outage associated with this release. CMR: CHG0034115

Services Affected

• LDAP

November 30, 2020, 6:30 pm

We have set up new servers for the SPA Admin app. CNAME changes for the idc.berkeley.edu will point to these new servers. We added a new server name, spa.berkeley.edu, that idc.berkeley.edu will redirect to. This release included a planned outage, however the outage was momentary, and only impacted users logged in at that moment. If users were using the application at that time, they needed to refresh their browser. CMR: CHG0034119

Services Affected

• SPA Admin Application

November 30, 2020, 6:00 pm

To make it easier to determine if one has the current person when adding a member to a group in CalGroups, we added more attributes to the display value for member lookups. Previously, it was displayName. It was changed to uid - displayName - department name or "non-FSA". This release included a planned outage, however the outage was momentary, and only impacted users logged in at that moment. If they were using the application at that time, they needed to refresh their browser. For more information regarding this release, please click here(link is external). CMR: CHG0034116

Services Affected

• CalGroups

November 17, 2020, 8:00 pm

Informational Update - in this release, the Windows and bConnected teams switched the authentication page from ADFS to CAS for some campus services (eg Sharepoint). This release included a planned outage, however the outage was less than a minute and only impacted authentication attempts for applications using ADFS during that minute. CMR: CHG0034088

Services Affected

• CAS
• Sharepoint
• O365
• Azure
• ADFS

October 29, 2020, 7:00 pm

SPAs were showing up in departmental groups in CalGroups after the recent changes. Since these departmental groups are employee groups, we removed the SPAs from these groups. There was no planned outage associated with the release. CMR: CHG0034037

Services Affected

• SPA Admin Application
• CalGroups

We made modifications to SPA group names to allow both the group and the SPA to be added to groups. Multiple application owners would like to add SPAs to their groups since the accounts show up in their account list rather than the personal account.

Services Affected

• CalGroups
• LDAP
• SPA Admin Application
• CalNet AD

September 25, 2020, 2:00 pm

We updated the language found at mycalnet.berkeley.edu. This required a restart of CalNet Account Manager, so account claiming, passphrase resets, and other CAM functions were briefly unavailable. 

Services Affected

• CalNet Account Manager

September 19, 2020, 9:00 am

September 10, 2020, 7:00 pm

September 9, 2020, 7:00 am

September 2, 2020, 9:00 am

Services Affected

• BPR
• CalNetAD

July 23, 2020, 7:30 am

Updated the certificate for the CalNet ActiveMQ instance because it was due for renewal. CMR: CHG0033781

Services Affected

• CalNet Account Manager
• CalNet Admin Tool

July 22, 2020, 8:00 pm

Removed the "Entity not found" entries from CalGroups. Entity not found entries in CalGroups are of two types. They are from either ou=expired or ou=advcon. We will remove those from ou=expired from all groups. We cleaned-up the advcon entries from any official groups, but not app or org groups. CMR: CHG0033797

Services Affected

• CalGroups

July 8, 2020, 7:00 am

We are making updates to the LDAP schema in preparation for the new CalNet Directory Update tool.  This includes modifications that should only be visible to internal CalNet processes. 

CMR: CHG0033749

No Outages 

July 4, 2020, 7:00 am

Additional settings to ensure a secure operating system.  These settings have already been applied to the production CAS systems since April and have been in our test environment for a month.  There will be a 10-minute outage of BPR while the server restarts after patching.  Other services are load-balanced and no outage is expected. CMR: CHG0033719

Services Affected

• BPR / CalNet Account Manager
• Shibboleth
• CalGroups
• Manage My Keys
• LDAP 

July 1, 2020, 6:30 am

The PostgreSQL instance 'calnetbprprod' was migrated to a new RHEL7 VM dba-postgres-prod-55, as the RHEL6 VMs will soon be out of support. This database supports Calnet-BPR/IDM application.  CMR: CHG0033740

Services Affected

• BPR / CalNet Account Manager
• CalNet Admin Tool 

May 25, 2020, 7:30 am

We have upgraded CalGroups production servers to Grouper version 2.4. CMR: CHG0033624

Services Affected

• CalGroups 

May 23, 2020, 8:00 am

This change updates the CAS configuration to allow the release of the mail attribute for Sponsored Guests. CMR: CHG0033623

Services Affected

• LDAP
• CAS
• CalNet Sponsored Guests 

May 14, 2020, 6:00 pm

December 17, 2019, 8:00 pm

This release is a certificate update for bpr.calnet.berkeley.edu. There will be a brief outage of BPR as the service restarts. CMR: CHG0033161

Services Affected

• Berkeley Person Registry
• CalNet Admin Tool
• CalNet Account Manager

December 6, 2019, 5:30 pm

This release includes bug fixes and feature enhancements to Berkeley Person Registry, CalNet Admin Tool and CalNet Account Manager. CMR: CHG0033126

Services Affected

• CalNet Account Manager
• LDAP
• CalNet Admin Tool
• CalNet Namespace
• Berkeley Person Registry

Tickets Resolved

December 4, 2019, 9:00 pm

This release retires the legacy CalNet Guest application. CMR: CHG0033137

Services Affected

• CalNet Guest application

Tickets Resolved

November 21, 2019, 8:30 am

We will be launching the process that enables the policy of requiring an employee as part of a SPA user group starting Thursday morning, Nov. 21 at 8:30 am. There is no down time. 

Services Affected

• Special Purpose Accounts

November 21, 2019, 7:00 am

We are making two changes to our LDAP access logs.

1. Add milliseconds to the timestamp format. 
2. Switch to a combined log format to simplify log parsing and reduce log size.

Services Affected

• LDAP

November 15, 2019, 8:00 am - November 22, 2019

We will decommission net-auth-p1 and calnet-p2 servers.

Both servers will be powered off and then deleted after 7 days.

Services Affected

• Open IDM
• SPA Admin App

November 13, 2019, 9:00 pm

We need to restart openidm on idm-p1 to remove a dependence on the krbservice/net-auth. The service affected is the SPA Admin app which is available to employees only.  2 minute outage of SPA App expected. CMR: CHG0033079

Services Affected

• Open IDM
• SPA Admin App

November 12, 2019, 7:00 am

We will update CAS registrations to specifically ensure sponsored guests cannot access services that have not directly been enabled for sponsored guests by the application owner.  In some cases it is possible for a sponsored guest who has an existing and valid SSO session to access an application that has not specifically been enabled for guest access.  This is due to an issue in CAS that affected the migration of service registrations and was fixed in the last CAS upgrade. CMR: CHG0033075

Services Affected

• CAS

October 29, 2019, 8:00 pm

We will upgrade CAS (auth.berkeley.edu) to 5.3.12.1 and Tomcat server to 8.5.46.  Both contain numerous bug and security fixes.  Hazelcast is bundled with CAS and will receive a version bump as well. Auth-test and auth.berkeley.edu will be upgraded as follows:

Monday, 10/7 @0800 - Implement in auth-test.berkeley.edu
Tuesday, 10/29 @2000 - Implement in auth.berkeley.edu

We encourage developers to test their applications thoroughly against https://auth-test.berkeley.edu(link is external).  A separate announcement will be sent for the production upgrade toward the end of October. CMR: CHG0032985

Services Affected

• CAS

October 24, 2019, 9:00 pm

This release is a minor change to the idc.b.e/mmk app. We are removing the user defined option for bConnected keys. Given the idc.b.e system is HA, there is no expected downtime. CHG0033031

Services Affected

• Manage My Keys

October 22, 2019, 5:30 pm

In this release, we add known bad passwords to ucb-dictionary. CMR: CHG0033024

Services Affected

• ucb-dictionary
• bidms-downstream
• registry-service
• account-manager

October 7, 2019, 8:00 pm

This release includes configuration adjustments and cosmetic changes to CAS. It was released to auth-test.berkeley.edu on 9/30/19 to allow time for testing. There are no major changes to CAS code in this release. CMR: CHG0032969

Services Affected

• CAS

September 13, 2019, 6:00 pm - September 16, 2019, 8:00 pm

This release includes substantial changes to the CalNet stack. The MIT Kerberos authentication servers are being retired in favor of Active Directory. Reorganization of the AD structure follows security best practices and allows CalNet to be system of record for all user objects.

In addition, this release contains feature enhancements and bug fixes for CalNet Account Manager and CalNet Admin Tool; removal of legacy HCM and SIS processes; and an upgrade to Grails 3.3.10.

There may be brief periods of instability in the CalNet suite of services over the weekend while user account reprovisioning occurs. We expect all systems to return to their normal functions by 8pm on Monday, Sept. 16.

This release also retires the CalNet Sync Tool.

CMR: CHG0032879

Services Affected

• All CalNet and Berkeley Person Registry Applications

• CalNetAD

• CAS

• CalNet Sync Tool

Tickets Resolved

September 12, 2019, 8pm

In this release, we will add new authentication profile to the shibcas plugin. This is very minor change. Service won't be affected because the servers are in an HA configuration. CMR: CHG0032909

Services Affected

• Shibboleth

September 12, 2019, 8:15 pm

This is a minor change to CalGroups, CalGroups that changes the large group limit for AD and LDAP provisioning from CalGroups. There will be a short break (15 sec) in provisioning to AD and LDAP when the provisioning service is restarted.  CMR: CHG0032908

Services Affected

• CalGroups

August 1, 2019, 6:00 am

This release will update CAS logging and A10 health checks. CMR: CHG0032767

Services Affected

• CAS

July 4, 2019, 8:00 am

This is a test of DNS failover for auth.berkeley.edu and shib.berkeley.edu starting the morning of Thursday, July 4th at 08:00 AM PT. CMR: CHG0032674

The test period is expected to last for approximately 1 hour. During this period DNS requests for auth.berkeley.edu and shib.berkeley.edu will return the addresses for our DR site. 

If you currently enforce outbound firewall rules for web traffic, you should add additional allow rules for the SDSC virtual IPs:

CAS:
Port: 443
IP: 192.107.102.203

Shib:
Port: 443
IP: 192.107.102.199

This should be transparent to your applications. If you experience any issues please contact calnet-admin@berkeley.edu(link sends e-mail) with a thorough description of your problem.

Services Affected

• CAS
• Shibboleth

July 3, 2019, 7:00 pm

This release will prevent Student Volunteers from creating CalNet accounts, per instruction from UCPath. There will be a brief outage when the servers are restarted. CMR: CHG0032702

Services Affected

• CalNet Account Manager
• CalNet Admin Tool

July 2, 2019, 7:00 am

DNS change for the Shibboleth production hostnames to allow us engage in HA with our SDSC servers. There will be an outage of Shibboleth of up to 10 minutes during this time. CMR: CHG0032671

Services Affected

• Shibboleth

June 20, 2019, 8:00 am

We will upgrade CAS on the test auth-test.berkeley.edu cluster to 5.3.11.  The CAS release contains bug fixes for delegated authentication.  The CalNet-specific changes include enabling authentication and ticket issuance throttling.  No downtime expected, we will fail over to SDSC and back to EWH. CMR: CHG0032637

Services Affected

• auth-test.berkeley.edu

June 13, 2019, 9:00 pm

In this release, we will remove the passphrase synchronization feature from auth.berkeley.edu in preparation for the migration to AD Kerberos.  This is not a user-facing function of CAS and is not to be confused with the passphrase reset features of CalNet Account Manager. CMR: CHG0032603

Services Affected

• CAS

June 13, 2019, 7:00 am

In this release, we will configure DNS failover for the shib-test.berkeley.edu Shibboleth cluster.  This will allow Shibboleth to fail over to San Diego in case of a major network or systems outage at EWH.  There will be an outage to shib-test as DNS records will be deleted and re-created as new record types. CMR: CHG0032614

Services Affected

• shib-test

June 6, 2019, 7:00 am

This release is a patch of RHEL 6.x and the JVM for the idc.berkeley.edu application cluster. CMR: CHG0032587

Services Affected

• idc.berkeley.edu, including:
  • Legacy Guests
  • MMK

June 1, 2019, 10:00 am

This release will enable WebAuthn/FIDO2 and Touch ID for Duo users and devices. See https://guide.duo.com/security-keys(link is external) and https://guide.duo.com/touch-id(link is external) for details on these new options for Duo devices. Existing Duo U2F users will be prompted to re-register their devices. CMR: CHG0032567

Services Affected

• CalNet 2-Step

May 28, 2019, 9:00 pm

We will modify the CAS principal lookup filter to be more exclusive by only returning berkeleyEduPerson objects.  This is necessary to address an issue discovered while validating new Sponsored Guests with a specific application. CMR: CHG0032578

Services Affected

• CAS
• Shibboleth

May 23, 2019, 6:30 pm

This expedited change includes changes to UCPath and Sponsored Guests provisioning. CMR: CHG0032577

Services Affected

• SOR Gateway Service
• Registry Provisioning Scripts
• Berkeley Person Registry

Tickets Resolved

May 23, 2019, 6:30 pm

This expedited change includes changes to UCPath and Sponsored Guests provisioning. CMR: CHG0032577

Services Affected

• SOR Gateway Service
• Registry Provisioning Scripts
• Berkeley Person Registry

Tickets Resolved

May 12, 2019, 10:00 am

This release will modify the queries used for department and title code groups within CalGroups to only use UCPath data. Some users may gain or lose access to systems that use those groups. CMR: CHG0032522

Services Affected

• Any system utilizing department / title code groups, such as:
  • LDAP
  • Active Directory
  • Google
  • CalGroups API

Tickets Resolved

May 10, 2019, 6:30 pm

This release will upgrade all Berkeley Identity Management Suite apps to Grails 3.3.9.

It will also remove HCM as a system of record for job data and LDAP affiliations.

Employees and Affiliates that are in HCM but are not yet in UCPath may enter their grace period (https://calnet.berkeley.edu/calnet-me/how-claim-your-calnet-id/grace-periods) and are likely to get an account expiration notice. Employees and Affiliates who receive an unexpected expiration notice should review their UCPath HR status with their HR support staff.

LDAP affiliations for expired HCM and UCPath Affiliates will undergo a change to ensure backwards compatibility:

• HCM Affiliates who enter their grace period will get the FORMER-HCM-AFFILIATE  affiliation.

• UCPath Affiliates who enter their grace period will get the FORMER-AFFILIATE  affiliation.

• In 3-4 months, CalNet will transition to using FORMER-AFFILIATE, only.  

• Developers will receive additional communications when this change is made, and when the FORMER-HCM-AFFILIATE will be deprecated.

All affiliate records should only ever have either a FORMER affiliation or an active AFFILIATE-TYPE- affiliation, but not both at the same time.

See UCPath Affiliation Changes(link is external) for additional affiliation information.

CMR: CHG0032500

Services Affected

• Berkeley Person Registry
• Registry Service
• Registry Provisioning
• SOR Gateway Service
• Match Service
• CalNet Account Tool
• CalNet Account Manager
• LDAP

Tickets Resolved

In this release, CAS operating system patches will be applied. CMR: CHG0032465.

Services Affected

• CAS
• Shibboleth

April 24, 2019, 7:00 pm

This release includes work on the CalNet Sponsored Guest project, and some continuing UCPath cleanup. CMR: CHG0032481

Services Affected

• Berkeley Person Registry
• Registry Service
• Registry Provisioning
• LDAP
• SOR Gateway Service
• Match Service
• CalNet Sponsored Guests

Tickets Resolved

April 14, 2019, 8:00 am

This is an update to the Slate theme of the Duo login page. Related to: CHG0032441.

CMR: CHG0032458

Services Affected

• CAS
• Shibboleth

April 9, 2019, 8:00 pm

This is an update to a new version of the Duo websdk and includes changes to the CAS login view, to change how the Duo iframe is generated. Some users may now see the 2-Step page rendered as smaller-than-normal. See Known Issues for steps to fix this issue. CMR: CHG0032441

Services Affected

• CAS
• Shibboleth

April 1, 2019, 4:45 pm

This code is an update to the logic BPR uses regarding UCPath messages; specifically, to ignore ActionReason 'VOI' jobs in I-280 and DDODS. CMR: CHG0032422

Services Affected

• Berkeley Person Registry

April 1, 2019, 8:45 am

This code fixes timeout exceptions when provisioning large quantities from Berkeley Person Registry to Active Directory. CMR: CHG0032419

Services Affected

• Berkeley Person Registry
• Active Directory

March 28, 2019, 3:00 pm

This release fixes a bug in provisioning in which berkeleyEduExpDate got improperly reset for some legacy HCM former employees CMR: CHG0032416

Services Affected

• LDAP
• Berkeley Person Registry

March 27, 2019, 11:00 pm

With this release, we will replace the EV TLS cert for auth.berkeley.edu.  Additional alternative names will be included to support future DNS failover. CMR: CHG0032402

Services Affected

• CAS
• Shibboleth

March 27, 2019, 3:10 pm

This CalNet release updates logic used to populate employeeNumber attribute in LDAP as well as the way CalNet looks at POIs from UCPath. CMR: CHG0032413

Services Affected

• Berkeley Person Registry
• LDAP

Tickets Resolved

March 25, 2019, 10:40 am

This deployment is for new code to handle new information from UCPath DDODS tables. This deployment required a restart on registry-p1, which led to a brief outage. This deployment is already complete. CMR: CHG0032404

Services Affected

• Berkeley Person Registry

Tickets Resolved

March 25, 2019, 7:00 am

In this release, we will configure DNS failover for the auth-test.berkeley.edu CAS cluster.  This will allow CAS to fail over to San Diego in case of a major network or systems outage at EWH.  There should be no noticeable outage, this is just a transparent DNS change from the perspective of CAS clients. CMR: CHG0032379

Services Affected

• auth-test.berkeley.edu
• CAS-test

March 22, 2019, 7:00 am

This change is an upgrade to CAS on the test auth-test.berkeley.edu cluster to version 5.3.9. The CAS release contains minor bug fixes. This changes also includes cosmetic updates to support CalNet Sponsored Guest accounts. The TLS certificate for auth-test will also be updated to add additional SAN records for DNS failover and to use an EV certificate to mirror production.

The service will be down for less than 5 minutes for a restart. CMR: CHG0032374

Services Affected

• auth-test.berkeley.edu
• CAS-test

March 20, 2019, 6:00 am

CalNet will begin UCPath Go-Live and reprovisioning activities on or after 3/20/2019.

During the go-live process, there may be restarts needed that will affect CalNet Admin Tool and CalNet Account Manager for ~5 minutes. Reprovisioning could cause delays in real time messaging and updates to LDAP, Active Directory and API Integration Hub.

LDAP attributes will be updated with UCPath data (most notably: employeeNumber, berkeleyEduAffID, berkeleyEduAffiliations, title codes). Users using these attributes should refer to https://ucpath.berkeley.edu/ucpath-cal/tech-talk(link is external) or https://ucpath.berkeley.edu/faq/technical(link is external) for additional information.

There is no planned outage for SSO, CAS, Shibboleth, or LDAP.

This change date is tentative, and may be delayed by 1 or more days if UCPath conversion is behind schedule. CMR: CHG0032350

Services Affected

• LDAP - attributes only
• CalNet Admin Tool
• CalNet Account Manager

March 20, 2019, 12:00 pm

During this change, legacy apps using Rails are no longer needed and are vulnerable will be retired. CMR: CHG0032376

Services Affected

• Manage Your Identity Applications
• CalNet Deputy Application
• UAS Portal

Tickets Resolved

March 6, 2019, 6:00 pm

This release will add notices/warnings on the directory update pages hosted on calnet-p1. These warn about the potential for public exposure of addresses and phone numbers entered via the Directory Update app when published to the Campus CalNet Directory.

A brief outage of less than 1 minute will occur when the app is restarted. CMR: CHG0032344

Services Affected

• CalNet Directory Update Application

March 6, 2019, 6:45 am

This release includes code changes in support of the UCPath implementation and server patches. There will be two short outages, about one minute each, as the server is restarted. CMR: CHG0032340

Services Affected

• Berkeley Person Registry
• Registry Service
• Registry Provisioning
• CalNet Account Manager
• CalNet Admin Tool
• Active Directory
• LDAP

Tickets Resolved

February 27, 2019, 9:00 pm

On Wednesday evening (2/27) from 9-10 pm, we will be upgrading the ShibCAS plugin on the production Shibboleth servers. Since the servers are redundant, there will be no down time while the updates happen. This service is used by any campus member logging into an external service like bConnected. CMR: CHG0032328

Services Affected

• Shibboleth

February 27, 2019, 7:00 am

This is an update to the CAS / AD password sync filter. With the implementation of AD password sync in CAS on Sunday (CHG0032283) we are seeing a high number of errors for a specific account.  This change will alter the LDAP filter to exclude the account from the sync call. CMR: CHG0032323

Services Affected

• CAS
• Active Directory

February 24, 2019, 8:00 am

We will upgrade CAS on the production auth.berkeley.edu cluster to 5.3.7. CMR: CHG0032283

Notable Changes Include

• CalNet AD password synchronization
• Improved surrogate/impersonation support for SPAs
• Support for social guests
• Accessibility improvements

Services Affected

• CAS
• Shibboleth

February 21, 2019, 6:00 pm

We will reconfigure the httpd TLS settings on calnet.b.e and net-auth.b.e to follow OWASP recommendations for TLS security. A brief outage of less than 1 min will happen as the web servers are restarted. CMR: CHG0032301

Services Affected

• Directory Update App
• krbservice

February 17, 2019, 9:00 am

In this release, we will extend the berkeleyEduPerson object class to include a new attribute named berkeleyEduUCPathID.  After conversion to UCPath, the berkeleyEduHCMID will contain the deprecated employee id.  Both berkeleyEduUCPathID and employeeNumber will contain the UCPath employee id. CMR: CHG0032274

Services Affected

• LDAP

February 13, 2019, 7:00 am

We will replace the certificate on the test/QA CAS instance (auth-test.berkeley.edu) to update the subject alternative names in preparation for DNS failover testing.  There will be a brief outage while CAS is restarted, from 7am-7:10am. CMR: CHG0032291

Services Affected

• auth-test.berkeley.edu
• CAS-test

February 11, 2019, 9:00 am

This release is an upgrade of the CAS test/QA service definition files to the latest format to prepare for the CAS 5.3.7 upgrade in prod later this month. 

We will also implement a new default authorization policy on CAS applications that have not registered with the CalNet team. The default authorization will enforce that any non-registered applications are restricted to student, staff, faculty and valid HCM affiliates. See https://calnet.berkeley.edu/calnet-technologists/single-sign/cas/cas-default-authorization for more information. CMR: CHG0032273

January 31, 2019, 8:00 am

This release is the retirement of the nds.berkeley.edu LDAP service. CMR: CHG0032216.  All customers should use ldap.berkeley.edu as the primary LDAP service and ldap-test.berkeley.edu for test/qa purposes.

On October 31, 2018 ldap.berkeley.edu was upgraded to the latest directory server software, which is a major upgrade from nds.berkeley.edu.  With that service stable we are now retiring the legacy LDAP service.

If your service depends on LDAP, you can test the performance and functionality of the latest software using either ldap.berkeley.edu or ldap-test.berkeley.edu.  It is highly recommended that you test your applications as soon as possible and report any issues to calnet-admin@berkeley.edu(link sends e-mail).

If your application or TLS/SSL libraries do not accept the ldap.berkeley.edu certificates as trusted see this resource for developers.

January 3, 2019, 6:00 pm

This is an emergency release primarily to address a regression bug affecting some accounts with conflicting affiliations. CMR: CHG0032199

Notable changes Include

• Fix for employees showing up with FORMER-EMPLOYEE and EMPLOYEE-TYPE-* LDAP affiliations at the same time
• Add LDAP mail attribute for social guests
• Registry-match-service newSORObjectQueue queue listener stops listening after one exception on a message.

Services Affected

• Registry Service
• Registry Provisioning
• Cirrus Guest App
• CalNet Account Manager
• CalNet Guest Accounts

Tickets Resolved

 Back to Top

December 19, 2016, 5:00 pm

This release includes functionality to support upcoming term changes, backend registry handling of grace periods, service indicators that prevent students from being unregistered, improvements to how HCM employees and alumni are provisioned, and clearing of stale berkeleyEduExpDates. CMR: CHG0030233

Services Affected

• Berkeley Person Registry
• Registry Service
• LDAP

Tickets Resolved

December 16, 2016, 5:00 am

This release improves the Change CalNet ID function in CalNet Account Manager, and fixes a bug related to alumni accounts. It also includes an update to the instructions regarding claiming accounts and changing accounts. CMR: CHG0030232

Services Affected

• CalNet Account Manager
• Registry Service

Tickets Resolved

December 1, 2016, 9:30 pm

To support updating of certain AdvCon (mostly Alumni) CAS customers, a check for CalNetIDs starting with "cads" is now done. The popup dialog triggered then redirects the browser to the Change CalNetID page. Released to QA (auth-test.b.e) November 30, 2016.  CMR: CHG0030193.

Services Affected

• CAS

Tickets Resolved

November 18, 2016, 5:00 am

This release added the ability for alumni to set a bConnected key.

This release fixes a provisioning bug that is picking up inactive records. CMR: CHG0030054

May 27, 2016

May 25, 2016

May 22, 2016

RHEL 6.x OS patching for production MIT Kerberos KDC cluster completed.

See CMR 4558.

Services Affected

• Campus MIT Kerberos

Tickets Resolved

May 21, 2016

Edits made to delegate email to make claiming a delegate account more user friendly. 

Services Affected

• CalNet Account Manager

Tickets Resolved

May 18, 2016

People in CS with only student affiliation and not admit or SIRCompleted affiliations are now getting "berkeleyEduAffiliations: STUDENT-TYPE-NOT REGISTERED" set in LDAP.

Services Affected

• Berkeley Person Registry
• LDAP Provisioning

Tickets Resolved

May 16, 2016

The obsolete DNS CNAME records for auth2.berkeley.edu and ncas.berkeley.edu were removed from DNS today.

See CMR 4579.

Services Affected

• CAS

May 13, 2016

Edited logic to deal with duplicates in Berkeley Person Registry. Implemented redirect for idc.berkeley.edu to calnetweb.berkeley.edu. 

Services Affected

• Berekely Person Registry
• LDAP Provisioning
• idc.berkeley.edu

Tickets Resolved

May 10, 2016

Bug fixes and URL update for Calnet Admin Tool. Redirect for mycalnet.berkeley.edu implemented.

Services Affected

• Account Manager

May 3, 2016

May 1, 2016

April 27, 2016 

April 24, 2016 

April 21, 2016

April 20, 2016

April 17, 2016 - deferred

April 11, 2016

Summary

• Added new features to the CalNet Account Manager application to allow users to reset their passphrase and change their recovery email address. 
• Added error reporting to calnet-systems@berkeley.edu(link sends e-mail).
• Added filter to disallow undergraduate admits who have not SIR'ed from creating a CalNet ID. 
• Revised code to allow users with CalNet ID's that are all-numeric or begins with "CADS" to be able to create a new CalNet ID. 
• Revised code to check the namespace before granting a CalNet ID.
• Revised code to check that a delegate does not have CalNet ID before allowing them to create one.
• Minor webpage and email content edits.

Services Affected

• CalNet Account Manager
• Berkeley Person Registry
• LDAP Provisioning

Known Bugs with this Release

This issues are being addressed and will be resolved as soon as possible.

• Requesting an update to an empty external email address currently isn't working.
• When a requestor submits their recovery email address to reset their passphrase, CalNet Account Manager is erroneously showing the requestor's non-employee and non-student accounts, if they exist, to be reset. This functionality doesn't work and will be addressed in a later version.

Tickets Resolved