Updating to version 3.22.0

Groovy security sandbox for scripted ICF connectors

From this version, Groovy scripts used by some ICF connectors run in a security sandbox. Earlier versions could let these scripts run unrestricted. That is no longer the case: a script that attempts a blocked operation fails.

Who is affected

Affected — connectors that run Groovy scripts, including:

• Scripted SQL (and connectors based on it, such as the PeopleSoft read connector)
• Scripted AS400
• Other similar scripted connectors

Not affected:

• Scripted API connectors
• Manual provisioning scripts

Blocked operations (summary)

Scripts must not, among other things:

• Read or write files on disk
• Start external programs
• Open network addresses from the script
• Load another Groovy script from disk at run time

What to do before or after upgrading

1. Inventory custom Groovy scripts used by Scripted SQL, Scripted AS400, and similar scripted connectors.
2. Check that they do not use the operations above—especially loading another .groovy file from disk.
3. Rewrite any affected script so it stays within the sandbox: inline shared code instead of loading another file.
4. Retest schema, search, create/update, and sync operations for those connectors in a non-production environment.

PeopleSoft reference schema scripts

The shipped PeopleSoft schema scripts no longer load a shared file at run time. The shared user and role object-class definitions are inlined in:

• ICF/reference-scripts/oracle-peoplesoft/SchemaOraclePeopleSoftCAMPUS.groovy
• ICF/reference-scripts/oracle-peoplesoft/SchemaOraclePeopleSoftHCM.groovy

The separate SchemaOraclePeopleSoftCommon.groovy file is removed from the distribution.

If you keep a customized copy of the old pattern that still loads the common script from disk, update it the same way (inline the shared definitions) before relying on it after the upgrade.

Offline review campaigns removed

The offline execution mode for access review campaigns is removed. Campaigns are always processed interactively: reviewers work in the product, and the creation screen no longer offers an online or offline choice. The Mode column is removed from campaign lists.

On upgrade:

• Existing offline campaigns are deleted, including campaigns that are in progress and campaigns that are finished, together with their review data, criteria, and parameters. Notification settings used only by those campaigns are removed as well.
• Interactive campaigns (previously online) are left unchanged.
• An incremental campaign that used an offline campaign as a reference keeps that reference. The reference name and date remain, even though the offline campaign itself is deleted.
• Campaign templates are kept. They no longer have an offline mode; campaigns created from them follow the interactive path.
• PDF and Excel files previously generated for offline campaigns remain on disk. They are no longer listed in the product, because those campaigns are deleted.