20 March 2025

Production release: 20 March 2025
Staging release: 18 March 2025

20 March 2025

Enhancements

• Support both GET: /users/me/groups and GET: /users/{userId}/groups endpoints.

• Update Live-Sync to Handle Create When Account Exists:
  Updated the live-sync process to check the account in IAM before updating it. This ensures that a subsequent modified event from CDH will update the IAM record correctly and prevent the DLQ event from being invalidated.

• Fix “Connect” External Reference Casing:
  Updated the case sensitivity of “Connect” to always be uppercased to “CONNECT” while respecting the case for CDH source systems “Clarity” and “Trimble-PX”.

• Test - Resolve Account Sync DLQ Items:
  Resolved a subset of items in the account sync DLQ by addressing cases where creating an account fails due to a pre-existing account in IAM (due to profiles sync).

• Rerun Snapshot Migration for Long Account Names:
  Reran the snapshot migration for accounts with names that are in the 51-100 character range.

• Added a new attribute “is_identity_group” to the Group entity.

• Added ID fields in the GET user’s endpoint response.

• Restrict User Token Support for Specific APIs:
  User tokens should not be supported in the following APIs:

  • /roles/trusted_groups/<group_id>
  • /permissions/trusted_groups/<group_id>

• Group-Role Assignment on Application Scope:
  Support group-role assign/un-assign on application scope.

• Fix TRN Format Display:
  TRN format is incorrectly displayed for the /users/{userId}/roles endpoint.

• Internal Employee Account Provisioning:
  Implement internal employee account provisioning based on the PX dataset via the DOMO dataset, performing scheduled operations such as account creation based on Trimble Division, user creation via invitations in TID using their email, account associations of created/existing users based on their division cost center, and internal employee migration with new account associations/disassociations.

• Support Non-IAM Applications as Target Application:
  Added support for Non-IAM applications as target applications.

  • Endpoints:
    • POST: /applications/{applicationId}/roles/{roleId}?on=
    • GET: /applications/{applicationId}/roles?on=
    • DELETE: /applications/{applicationId}/roles/{roleId}?on=

• Update Live Sync of CDH User/Role Association:
  Updated live sync of the CDH user/role association to accounts to unwrap EventBridge and SQS events rather than a straight DynamoDB event.

• Set maximum limits for roles and permissions:

  • Max Roles Limit: 50
  • Max Permissions Limit: 200

• CDH Migration Account Creation:
  Accounts were created in IAM for the first time via CDH migration and therefore do not have user-role-account relationships. This is a new functionality to CDH migration which can reference Profiles methodologies.

Bug Fixes

• Fix Incorrect Links in the Cursor for List Groups of User/Applications:
  The links shown in the cursor for list groups of user/applications redirect to “/groups” instead of “/users/me/groups”.

• Fix Internal Employee Account Association:
  The internal employee account association used the CDH account ID instead of IAM’s UUID5. Additionally, the payload in DynamoDB should be a dictionary, not a list.

• Update Authorization for User get Endpoints:
  Update authorization to consider account ID from query parameters for GET: /users/{userId} and GET: /users/me endpoints.

• Fix Invalid Picture URL in GET Users Endpoint:
  Invalid picture URL present in GET: /users/{userId} call even if the user doesn’t have a picture.

• Fixed 403 Forbidden error during role assignment:
  Ensured the user is assigned the owner role via group-based assignment.