Migration notes 3.1

This page explains the changes required to migrate to the stated version of the Atoti Limits.

Migrate to 3.1.0

Upgrading from version 3.0.0, see the Atoti Limits 3.1.0 Release Notes.

Atoti Limits is using Atoti Server 6.0.9 and Atoti UI 5.1.x.

For new features and fixes included in these releases, please see the Atoti UI documentation and Atoti UI Migration Notes, and the release notes for Atoti Server.

Headline announcement

• Modified UI settings : “utilizationDashboards” has been removed. “exceptionAuditTrailNodeColors” has been removed, use “auditTrailNodeColors” instead.
• Custom User Workflow Actions: Any existing custom user workflow actions may need to be modified. Please see Adding Customizing Workflow Tasks for how to do so.
• Upgraded Java version: We have upgraded the Java version used to compile Atoti Limits to 17.
• Spring Security upgrade: We have upgraded Spring Security to version 5.8.7 to resolve vulnerabilities and prepare for the upgrade to Spring Security 6.0 (via Spring Boot 3).
• Common Parent POM: The Atoti Limits module now inherits third-party plugin versions from the Common Parent POM version 1.2.0, in line with other solutions.
• Interface/REST Service method signature changes: We have upgraded the IAlertTaskManager and LimitsEvaluationRestService methods to provide a cleaner API.

Java Upgrade

We have upgraded the Java version used to compile Atoti Limits from 11 to 17. You will need to upgrade to Java version 17 or higher, and supply the following jvm arguments when running Atoti Limits:

--add-opens=java.base/java.util=ALL-UNNAMED
--add-opens=java.base/java.util.concurrent=ALL-UNNAMED

This is related to the Atoti Server configuration.

Spring Security Upgrade

We have upgraded to Spring Security 5.8.7. To do so, we override the version of Spring Security in Spring Boot by importing the common-dependencies-bom version 1.2.0 into the parent pom file. The common-dependencies-bom overrides the Spring Security version using Spring’s migration guide.

You will eventually need to migrate your own custom security configuration(s) in preparation for Spring Security 6.0. We have upgraded our out-of-the-box security configurations to help in this migration.

The default security users and roles have not changed, only the way we implement the security. We have done so by making the following changes:

Stop Using WebSecurityConfigurerAdapter

We have replaced instances of WebSecurityConfigurerAdapter with SecurityFilterChain beans.

Use the new requestMatchers methods

In Authorize Http Requests, we have replaced invocations of http.authorizeHttpRequests((authz) -> authz.antMatchers(...)) with http.authorizeHttpRequests((authz) -> authz.requestMatchers(...)).

Use the new securityMatchers methods

We have replaced invocations of http.antMatchers(...) with http.securityMatchers(...).

As an example of the previous changes, the configuration for accessing the endpoint which exposes the JWT token changed from:

@Configuration
@Order(1)
public static abstract class AJwtSecurityConfigurer extends WebSecurityConfigurerAdapter {

   @Autowired
   protected ApplicationContext context;

   @Autowired
   @Qualifier(BASIC_AUTH_BEAN_NAME)
   protected AuthenticationEntryPoint authenticationEntryPoint;

   @Override
   protected void configure(HttpSecurity http) throws Exception {
      http
              .antMatcher(JwtRestServiceConfig.REST_API_URL_PREFIX + "/**")
              // As of Spring Security 4.0, CSRF protection is enabled by default.
              .csrf().disable()
              // Configure CORS
              .cors().and()
              .authorizeRequests()
              .antMatchers("/**").hasAnyAuthority(ROLE_USER)
              .and()
              .httpBasic().authenticationEntryPoint(authenticationEntryPoint);
   }
}

to

@Bean
@Order(1)
public SecurityFilterChain jwtSecurityFilterChain(HttpSecurity http,ApplicationContext applicationContext){
final AuthenticationEntryPoint basicAuthenticationEntryPoint = applicationContext.getBean(BASIC_AUTH_BEAN_NAME,AuthenticationEntryPoint.class);
        return http
            // As of Spring Security 4.0, CSRF protection is enabled by default.
            .csrf(AbstractHttpConfigurer::disable)
            // Configure CORS
            .cors().and()
            .securityMatcher(url(JwtRestServiceConfig.REST_API_URL_PREFIX,WILDCARD))
            .authorizeHttpRequests(
                auth->auth.requestMatchers(HttpMethod.OPTIONS,url(WILDCARD))
                .permitAll()
                .anyRequest()
                .hasAnyAuthority(ROLE_USER))
            .httpBasic(basic->basic.authenticationEntryPoint(basicAuthenticationEntryPoint))
            .build();
        }

Removed imports of ActivePivotRemotingServicesConfig

This class imports org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter, which may (if used) expose access to CVE-2016-1000027 in the Spring-web project.

Common Parent POM

The Common Parent POM version 1.2.0 is now a parent of the Atoti Limits module. This parent merely defines plugin management and is used by other solutions. The following dependency versions are now managed by this parent instead of by the Atoti Limits module:

Interface/REST Service Method Signature Changes

If you implement or override any of the following interfaces/services, you will have to update your method signatures.

IAlertTaskManager

LimitsEvaluationRestService

Input file formats

Modified

For Removal

Configuration files

Files Modified

limits.properties

New properties:

application.yml

New properties:

Datastores

Modified stores

Cube schema

Each hierarchy has been given a suitable dimension, as opposed to having single-level hierarchies where the dimension is of the same name. You can view these in Dimensions. The following modifications have also been made:

Added

Modified

Measures

Added

Modified

Removed

Context values

No changes.