Restrict user roles to certain application instances

When running multiple instances of Identity Manager and Self-Service, it is sometimes required to allow different functionalities on different nodes (for example to provide only limited functionality for users that log in from the internet instance).

Instances can be named via the system properties idmInstanceId (or the old one detailedUserInformationCreator.explorerInstanceId). The corresponding names can now be configured as a whitelist in the Roles configuration of Identity Manager Admin, so that only roles with a matching instance ID will be granted during login. (An empty list in the roles configuration still means that all instances are allowed, so that the default behavior remains the same.

For more information, see Limit role to access certain instances of Identity Manager client.

Fixed the issue that a wrong internal ordering in BatchSync could lead to missing records when doing a data export (the export claimed in the logfile to have duplicate records).

Fixed an error return code during card production when a smart card is getting full. Now a proper, dedicated error code is returned so that this case can be handled properly in the BPMN workflow.

With 20.11, the download buttons in Identity Manager and Self-Service were extended, so that filenames and suffixes for a file to be downloaded can be configured. This configuration only worked for normal binary fields but not for encrypted fields. This has been fixed, so that the configuration of filenames now also works for the encrypted fields.

FIed an issue to open Card Designer in Identity Manager Admin.

The extended EST & SCEP registration capabilities that were introduced in 20.11.1, did not work if a single OU attribute was used (only a multi-OU scenario was working). This has now been fixed.