Vhost mappings on the management and statistics endpoints (XP 8.2.0) - #601
Draft
rymsha wants to merge 8 commits into
Draft
Vhost mappings on the management and statistics endpoints (XP 8.2.0)#601rymsha wants to merge 8 commits into
rymsha wants to merge 8 commits into
Conversation
…2.0) Vhost mappings can name an endpoint (management, statistics), restrict id provider flows (default&enabled=flow,flow) and carry a principal allow list. Basic authentication on the management endpoint is provided by the Standard ID Provider application. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YFqoY5nKdmhXqM7MAU9cqU
Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YFqoY5nKdmhXqM7MAU9cqU
Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YFqoY5nKdmhXqM7MAU9cqU
Left only for backwards compatibility; JWT authentication is the way. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YFqoY5nKdmhXqM7MAU9cqU
…ic' flow Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YFqoY5nKdmhXqM7MAU9cqU
Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YFqoY5nKdmhXqM7MAU9cqU
anatol-sialitski
approved these changes
Sep 1, 2026
rymsha
commented
Sep 6, 2026
|
|
||
| XP 8.2 requires no upgrade steps. Two behavioral changes are worth knowing about: | ||
|
|
||
| * Basic authentication on the management endpoint is deprecated and left only for backwards compatibility - it is now provided by the Standard ID Provider application (bundled with XP) instead of the platform itself. It remains enabled by default and can be disabled with `idprovider.system.autologin.basic.enabled = false`, or per vhost with a <<../config/vhosts#flows, flow list>> that leaves out `basic`. An installation running without the Standard ID Provider application has no basic authentication on the management endpoint. Use <<../security/service-accounts#jwt-authentication, service account JWT authentication>>. |
Contributor
Author
There was a problem hiding this comment.
Suggested change
| * Basic authentication on the management endpoint is deprecated and left only for backwards compatibility - it is now provided by the Standard ID Provider application (bundled with XP) instead of the platform itself. It remains enabled by default and can be disabled with `idprovider.system.autologin.basic.enabled = false`, or per vhost with a <<../config/vhosts#flows, flow list>> that leaves out `basic`. An installation running without the Standard ID Provider application has no basic authentication on the management endpoint. Use <<../security/service-accounts#jwt-authentication, service account JWT authentication>>. | |
| * Basic authentication on the management endpoint is deprecated and left only for backwards compatibility - it is now provided by the Standard ID Provider application (bundled with XP) instead of the platform itself. It remains enabled by default and can be disabled with `idprovider.system.autologin.basic.enabled = false`, or per vhost with a <<../config/vhosts#flows, flow list>> that leaves out `basic`. Use <<../security/service-accounts#jwt-authentication, service account JWT authentication>>. |
|
|
||
| XP 8.2 requires no upgrade steps. Two behavioral changes are worth knowing about: | ||
|
|
||
| * Basic authentication on the management endpoint is deprecated and left only for backwards compatibility - it is now provided by the Standard ID Provider application (bundled with XP) instead of the platform itself. It remains enabled by default and can be disabled with `idprovider.system.autologin.basic.enabled = false`, or per vhost with a <<../config/vhosts#flows, flow list>> that leaves out `basic`. An installation running without the Standard ID Provider application has no basic authentication on the management endpoint. Use <<../security/service-accounts#jwt-authentication, service account JWT authentication>>. |
Contributor
Author
There was a problem hiding this comment.
Suggested change
| * Basic authentication on the management endpoint is deprecated and left only for backwards compatibility - it is now provided by the Standard ID Provider application (bundled with XP) instead of the platform itself. It remains enabled by default and can be disabled with `idprovider.system.autologin.basic.enabled = false`, or per vhost with a <<../config/vhosts#flows, flow list>> that leaves out `basic`. An installation running without the Standard ID Provider application has no basic authentication on the management endpoint. Use <<../security/service-accounts#jwt-authentication, service account JWT authentication>>. | |
| * Basic authentication on the management endpoint is deprecated and left only for backwards compatibility - it is now provided by the Standard ID Provider application (bundled with XP) instead of the platform itself. It remains enabled by default and can be disabled with `idprovider.system.autologin.basic.enabled = false`, or per vhost with a <<../config/vhosts#flows, flow list>> that leaves out `basic`. Use <<../security/service-accounts#jwt-authentication, service account JWT authentication>>. |
|
|
||
| === Vhosts on the management and statistics endpoints | ||
|
|
||
| A mapping may name the endpoint it applies to - `endpoint = management` or `endpoint = statistics` - and brings ID provider authentication with it. Together with the allow list below, that makes it practical to expose these endpoints behind a proper host name instead of keeping them reachable only from inside. Requests no mapping matches keep behaving exactly as before, so nothing changes until a mapping says so. See <<config/vhosts#endpoint, virtual host configuration>>. |
Contributor
Author
There was a problem hiding this comment.
requests with no match do not rich xp. The only difference for management nd statistics - for backwards compatibility they keep working the old way when there is no vhost specified
…rted Master moved the upgrade notes to the top-level upgrade page and renamed the version badges; the v8.2 section moves with them as v8.2 notes. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YFqoY5nKdmhXqM7MAU9cqU
…r-API verbs Once a mapping names the management or statistics endpoint, requests there that match none of its mappings are rejected - the unrestricted default only serves endpoints no mapping names. Document the per-API verbs context setting management APIs read from the vhost. Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YFqoY5nKdmhXqM7MAU9cqU
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents enonic/xp#12302 (enonic/xp#10838), landing in XP 8.2.0. The xp change is merged to master, followed by enonic/xp#12318 (management methods to universal API); this branch is merged with the doc master's restructure (upgrade notes at the top level, three-digit badge names) and follows both xp changes.
Changes
config/vhosts.adocendpointandallowentries in the field list, andidProvidermentions the flow list onenabled.login/autologin/logout, additional flows of the ID provider app — the Standard ID Provider'sbasicand adevice-style flow as examples; no list = no restriction, an explicit list serves only what it names), Management and statistics endpoints (endpoint = management | statistics, non-interactive flows only; an unmapped endpoint keeps pre-vhost behavior, a mapped one rejects unmatched hosts with 404), Per-API restrictions (theverbscontext setting the management APIs read), and Allow list (401/403 semantics, ID provider endpoints exempt).endpoints/management.adoc: authorization section mentions vhost mappings on the endpoint; basic authentication is stated as deprecated and left only for backwards compatibility — provided by the Standard ID Provider application (system ID provider, management endpoint only), enabled by default, disable-able viaidprovider.system.autologin.basic.enabled = falseor per vhost with a flow list that leaves outbasic.endpoints/statistics.adoc: the exposure note now says the endpoint is by default unauthenticated, and that a vhost mapping can protect it.release.adoc: new XP 8.2 section — vhosts on the management/statistics endpoints (including per-API verbs and unmatched-host rejection), flows per vhost, the allow list, and deprecated basic authentication moving to the Standard ID Provider.upgrade.adoc: new v8.2 notes section — no breaking changes; behavioral notes on basic authentication (deprecated, now from the Standard ID Provider app, config or per-vhost disable) and autoLogin running for every enabled ID provider. The rolling-vs-full-restart statement is left for the release owner to settle.images/xp-820.svgversion badge.Draft until XP 8.2.0 ships.
🤖 Generated with Claude Code
https://claude.ai/code/session_01YFqoY5nKdmhXqM7MAU9cqU