ADSelfService Plus Fixes and Enhancements [2025]
- The Tomcat version used in the product has been updated to 9.0.109.
- ADSelfService Plus now supports PKCE (Proof Key for Code Exchange) in OAuth authorization flows, enhancing security for both server-based and client-only applications.
- Security hardening has been implemented to safeguard your instance with appropriate security recommendations.
- An issue where Force Enrollment was skipped when UMCP (User Must Change Password) was enforced has been fixed.
- Login page loading performance when rendering domains has been improved.
- An issue where SSHA (Salted Secure Hash Algorithm) password encryption failed with OpenLDAP and 389 Directory Server has been fixed.
- Issues with Google Password Sync caused by configuring more than one Google Workspace for a single user have been resolved.
- An issue caused by idle SP-initiated SAML login sessions to the portal has been resolved.
- An issue where CPU utilization reached 100% when multiple users logged in simultaneously via SSO has been resolved.
- FIDO2 Passkeys support for machine logins: FIDO2 Passkeys can now be used as an MFA method for logins to Windows, macOS (including offline MFA), and Linux machines. This enhances security by ensuring robust, phishing-resistant authentication right from the initial point of access.
Enhancements
The commons-fileupload-1.5.jar and esapi-2.6.0.0.jar files used in the product have been upgraded to commons-fileupload-1.6.0.jar and esapi-2.7.0.0.jar, respectively.
Login agent registry settings are now synchronized with agent-installed machines in real time during MFA verification, ensuring that configuration changes take effect immediately without having to wait for the GINA/macOS/Linux Customization Scheduler to run.
Issue fixes
- An issue that caused empty emails to be sent out instead of the scheduled Agent Installed Machines Report has now been fixed.
- Fixed an issue where I18N property file customizations did not replicate to the secondary server in High Availability environments.
Enhancements
1Kosmos is now supported as an Identity Provider for both SSO and SAML MFA configurations. Learn more
The Tomcat version has been upgraded from 9.0.102 to 9.0.104.
The Java Runtime Environment (JRE) has been upgraded from Azul Zulu version 8.84.0.15 to 8.86.0.25.
The Bootstrap library has been updated to a customized version with unused components removed, and the Bootstrap-select plugin has been customized with enhanced HTML sanitization to mitigate reported vulnerabilities.
The Highcharts library has been updated to a customized version with manually applied security patches.
The jQuery and jQuery UI libraries have been upgraded to versions 3.7.1 and 1.14.0.
The Moment.js library has been upgraded to version 2.29.4.
The DOMPurify library has been upgraded to version 2.5.8.
The Spring JARs used in the Service Proxy Membrane component have been updated to a secure, patched version.
Issue fixes
A performance issue where the OU tree took longer to load when multiple OUs were expanded has now been fixed.
An issue that prevented audit report schedulers from executing when handling large volumes of audit data has been fixed.
An issue that prevented password synchronization with Entra ID for tenants in the China region has been fixed. Support is now available for China, US, and Global regions.
Enhancements
ADSelfService Plus now supports MFA for logins to Red Hat (versions 8.x to 9.x) and Rocky Linux (versions 8.x to 9.x) machines.
In addition to email notifications, admins can now get instant SMS alerts to monitor ADSelfService Plus service startups and downtime. Learn more .
Issue fixes
An SQL injection vulnerability ( CVE-2025-3833 ) that allowed any ADSelfService Plus technician to execute SQL queries through the Reports module has been fixed.
An issue that prevented mobile numbers containing the character X from being updated during directory self-update has been fixed.
An issue that prevented users from configuring passwords containing the $ special character during password resets or changes has now been resolved.
An issue that prevented the ADSelfService Plus MFA connector from being installed on RD Web Access servers with a default language that was not English has been resolved.
An issue caused while installing the ADSelfService Plus login agent via GPO, where the Button Text parameter stored non-readable characters in the registry instead of the correct Unicode characters (such as Polish letters), has now been resolved.
An issue where error messages during login agent installation failures were displayed as junk values in the Agent Installation Failures Report when the ADSelfService Plus server's system locale was set to Japan, has been resolved.
An issue where password synchronization with AD failed if the AD domain was added into ADSelfService Plus with the NetBIOS name instead of the DNS name has been fixed.
An issue that caused password synchronization with SAP NetWeaver to fail for SAP service, reference, system and communication users has been resolved.
An issue that removed Turkish characters from exported PDF reports when ADSelfService Plus was configured to use English as the display language has now been fixed.
An issue preventing the customization of columns in reports generated by the free Password Expiration Notification tool in ADSelfService Plus has now been fixed.
An issue that caused users who had never logged into ADSelfService Plus to be excluded from the Soon-To-Expire User Passwords Report sent to admins has now been fixed. This issue occurred when push notifications were enabled for the password expiry notification.
An issue that prevented non-English characters from being used in the State and City fields while generating a self-signed SSL certificate through the built-in SSL Certificate Tool has been fixed.
An issue that prevented audit logs from being forwarded to the syslog server has been fixed.
An issue where whitespace characters in the SAML response signature caused some applications to fail signature validation has been fixed.
Enhancements
Support for Smart Card Authentication using USB devices like YubiKeys and PIV cards has now been extended beyond the ADSelfService Plus portal to include logins to VPNs, Outlook Web Access, and Windows machines.
MFA for VPNs can be configured with any authenticator offered by ADSelfService Plus, including FIDO Passkeys, Smart Card Authentication, and other MFA methods not natively supported by the VPN client, by clicking a secure browser-based link. Learn more
The Account Blocking feature has been enhanced to secure Active Directory accounts by extending its coverage to both portal logins and enterprise applications, providing comprehensive protection against unauthorized access.
The Account Blocking feature has been enhanced to allow admins to control or automate the unblocking of accounts blocked due to failed authentication attempts.
Separate authenticators can now be configured for self-service password resets and account unlocks.
Granular MFA enforcement on protected Windows resources can now be applied to specific sets of users via policies. Learn more
ADSelfService Plus now supports auto-launching SSO applications upon user logins, streamlining access to apps and eliminating the need for extra clicks.
SAML attribute assertions can now be passed for multi-valued attributes, enabling applications to support complex user attributes more efficiently.
Bookmark applications for SSO: ADSelfService Plus' now offers a Bookmark feature, which provides a convenient way to integrate external applications which do not support protocols like SAML, OAuth, or OIDC, into the user portal.Learn more
Admins can now choose to perform report generation, license management, and login agent installation exclusively on parent OUs, without affecting the child OUs.
An option to skip MFA during OWA logins if the user has not enrolled for the required authenticators has been added.
Admins can now limit the number of secondary email addresses and phone numbers a user can add to their profile.
A username format will now need to be configured to use the TOTP-based authenticators offered for MFA.
Using the Password Policy Enforcer, you can now force your users to set strong passwords that match custom regex patterns. Learn more
The Notification Delivery Report and Password/Account Expiry Notifications Delivery Report now include additional columns with information about the recipient's (admin or manager) email address.
Issue Fixes
To improve security and prevent unauthorized access to resources protected with TOTP-based authenticators, TOTPs which have been used to verify the user's identity once cannot be reused even if the TOTP lifetime is still valid.
An issue that prevented user enrollment data for FIDO Passkeys from appearing in the MFA Enrollment Audit Report has been resolved. This issue occurred following modifications to the Access URL.
Enhancement
Minor updates have been made to enhance the integration of ADSelfService Plus with ManageEngine AD360 build 4407.
An account takeover vulnerability (CVE-2025-1723) caused by session conflicts has been fixed. Learn more.
The push notification certificate on the ADSelfService Plus iOS app has been renewed.
macOS 15 Sequoia is now supported by the macOS login agent for MFA and self-service password resets and account unlocks from the machine login screen.
Note: This support is limited to devices with Apple silicon.The Apache Tomcat version used in the product has been updated to 9.0.98.
Issue Fixes
Security enhancements have been made to the communication between the ADSelfService Plus server and the OWA MFA connector.
Note: After updating ADSelfService Plus to build 6510, it is recommended to reinstall the OWA MFA connector for OWA MFA to work properly.An issue that prevented user restriction or license removal in bulk has been fixed. This issue occurred when ADSelfService Plus was integrated with AD360 or configured to use the MS SQL database.
An issue causing delays in Endpoint MFA logins during high volumes of concurrent MFA requests has now been resolved.
An issue where reports visible on the primary server were not displayed on the secondary server during failover has been fixed.
An issue that prevented the configuration of High Availability when SSL was enabled for MS SQL database connections using the JDBC driver has been fixed.