Release Notes

Java 17 no longer supports the 3DES and RC4 crypto algorithms (see also https://bugs.openjdk.org/browse/JDK-8139348). SSO login in FirstSpirit is then no longer possible. Instead, a stronger crypto algorithm should be used, e.g. AES.

If FirstSpirit is operated with Kerberos module or Windows SSO, the keytab file should therefore be adapted.
Under Java 11 (use with FirstSpirit no longer recommended) this change can also be made, since Java 11 also already supports AES256-SHA1 (see Java 11 documentation).

The adaptation of the keytab file can be done, for example, as follows with ktutil:

1)Create backup

$ cp test.keytab test.keytab.bak

2) Customize the keytab file

$ ktutil
ktutil:  read_kt test.keytab
ktutil:  list -e 
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
 1    7 HTTP/fs5host.mydomain.net@MYDOMAIN.NET (des-cbc-crc) 
 2    7 HTTP/fs5host.mydomain.net@MYDOMAIN.NET (des-cbc-md5) 
 3    7 HTTP/fs5host.mydomain.net@MYDOMAIN.NET (arcfour-hmac) 
 4    7 HTTP/fs5host.mydomain.net@MYDOMAIN.NET (aes256-cts-hmac-sha1-96) 
ktutil:  delete_entry 1
ktutil:  delete_entry 1
ktutil:  delete_entry 1
ktutil:  list -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
 1    7 HTTP/fs5host.mydomain.net@MYDOMAIN.NET (aes256-cts-hmac-sha1-96) 
ktutil:  write_kt test-updated.keytab
ktutil:  quit

3) Check that the new file does not contain weak/deprecated algorithms

$ ktutil
ktutil:  read_kt test-updated.keytab 
ktutil:  list -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
 1    7 HTTP/HTTP/fs5host.mydomain.net@MYDOMAIN.NET (aes256-cts-hmac-sha1-96) 
ktutil:  quit

4) Copy permissions of the original file

$ chmod --reference=test.keytab test-updated.keytab

5) Replace the original file

$ mv --force test-updated.keytab test.keytab

6) Restart FirstSpirit, Tomcat and other services if necessary

In addition, the Active Directory Controller should be adapted (admin rights required!) to enable AES Encryption there. See: https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/decrypting-the-selection-of-supported-kerberos-encryption-types/ba-p/1628797.
Important: Enable AES for service accounts for which an SPN is specified. Please note that a null value for msDS-SupportedEncryptionTypes will cause the DC to issue service tickets and session keys with RC4.

See also “FirstSpirit Dokumentation für Administratoren”: https://docs.e-spirit.com/odfs/edocs/admi/firstspirit-ser/configuration-f/login-process-f/kerberos-ticket/index.html.

When a project is deactivated, local project web applications are now automatically uninstalled from the configured web server. If the web server is not accessible, the local project web applications remain installed on it (as always).

When the project is reactivated, a message indicates that the web applications must be rolled out again (“Project reactivated. However, its web apps (if there are any) have not been deployed. They can be deployed manually via the ‘Edit Project’ dialog.”). You can do this either manually via the ServerManager or they will be installed automatically during the next server restart.

The deinstallation of local project web applications that are no longer needed releases the corresponding resources on the web server and prevents possible subsequent problems when the FirstSpirit Server is updated with the deactivated (or deleted) project.

See https://docs.e-spirit.com/odfs/edocs/admi/firstspirit-ser/menu-bar-items/project/index.html for more information.

Using the new parameter webserver.jetty.hide you can disable the integrated webserver “Jetty Web Server”.
For this purpose the parameter must be set to true:

webserver.jetty.hide=true

For more information, see also FirstSpirit Manual for Administrators:

• about usage of web servers: https://docs.e-spirit.com/odfs/edocs/admi/firstspirit-ser/server-properti/web-server/index.html
• about the configuration file fs-server.conf: https://docs.e-spirit.com/odfs/edocs/admi/firstspirit-ser/configuration-f/firstspirit-ser/index.html (area “Web Applications”).

Java 17 compatibility was introduced with the current backend version. The fs-wrapper-vendor.conf file has been extended with corresponding --add-opens calls for this purpose.

On the customer side, the same --add-opens parameters should be specified for the Apache Tomcat web server that are also used for FirstSpirit. For customer-specific modules, it may also be necessary to add --add-opens calls, in this case in the fs-wrapper.isolated.conf file.

The “Project history” report in ContentCreator has been revised to include elements of media and data source management.

The “Project” and “Detail” tabs list the last changes made to the project or to a specific element.
Additionally, on elements in the main area, in the navigation bar and on entries of the report itself, the function “Show history” can be used to open the history of the respective element in the report.

For more information, see https://docs.e-spirit.com/contentcreator/report-area/project-history/index.html.

This functionality can be hidden via “Tailored UI”, using the “Show History” feature.
For more information on the “Tailored UI” see https://docs.e-spirit.com/odfs/template-develo/contentcreator/customization/standard-functi/index.html.

FirstSpirit 2022.10 supports the following module versions for “FirstSpirit Content Experience Tools”.

* These modules require FirstSpirit 2020-03 or higher from this version.