JIM v0.12.0

[JayVDZ]

JIM v0.12.0

This release sharpens how data enters the metaverse and how you administer and operate JIM. The headline is per-mapping inbound value processing: fine-grained control over cleaning and normalising imported text right at the point it flows in. Alongside it are quality-of-life wins for command-line administration (persistent SSO sign-in, CLI/API bootstrap of the first administrator), a reorganised Synchronisation Rule and Schema editing experience, a safer factory reset, and a batch of correctness fixes to rule editing and Connected System deletion. Under the surface, this cycle also brought a meaningful step up in supply-chain and documentation guardrails.

What's new

• Per-mapping inbound value processing. Source data is rarely clean. Inbound text attribute mappings can now treat whitespace-only or empty values as no value (on by default, so a stray space no longer masquerades as a real value), trim surrounding whitespace, collapse runs of internal whitespace, and normalise case (Upper, Lower, or Title). It is configured per mapping, because the need to trim or fold case varies attribute-by-attribute within a single source rather than by system type, and it runs as normalisation before attribute priority resolves which rule's value wins. Available in the mapping editor, the REST API, and the PowerShell module. Where you deliberately keep whitespace, the portal now flags such values with a "(whitespace)" indicator rather than rendering a misleading blank cell.

• Persistent PowerShell SSO sign-in. After Connect-JIM, opening a new terminal now reconnects silently without a browser round-trip. Only the refresh token is stored, in the operating system's credential store (Credential Manager on Windows, login Keychain on macOS, libsecret on Linux). Use -NoPersist to opt out for a session, -Force to re-authenticate, and Disconnect-JIM to clear stored tokens. Headless Linux without a keyring falls back to in-memory tokens.

• Bootstrap the first administrator from the command line. On a fresh deployment, the configured initial administrator's first authenticated call (CLI or API, not just the portal) just-in-time creates their identity and grants the Administrator role. An edge or air-gapped instance can now be stood up and administered entirely from the command line, with profile attributes backfilled on a later portal sign-in.

• Factory reset in the portal. A new Administration danger area (/admin/factory-reset) lets you clear down JIM's business data with a backup warning and type-to-confirm. It preserves administrator users by default so you cannot lock yourself out, and always records a Reset activity attributed to whoever ran it; removing administrators too is an explicit opt-in.

• A calmer, more scalable editing experience. The Synchronisation Rule editor is now organised into deep-linkable tabs (Details, Matching, Scope, Attribute Flow, Danger Zone) with a single save bar, so you can fill in any tab in any order and still save the whole rule in one action. The Connected System Schema tab is split into sub-tabs with a searchable, filterable object-type grid, which stays usable when a system exposes hundreds of object types such as a full LDAP schema. Connected System settings that only apply in certain configurations are now hidden until relevant and required once shown (for example, LDAP Certificate Validation appears only with LDAPS enabled).

Fixes

• Synchronisation Rule editing now saves reliably. Editing an existing rule (for example, disabling it) previously appeared to succeed but could be silently discarded; creating a rule from scratch could fail outright with a database error. Both paths are fixed and covered by new database-backed regression tests, and creating a rule now transitions the page cleanly into edit mode.
• Connected System deletion is reliable and atomic. Deleting a Connected System (including one that has been synchronised) no longer fails with a database error and now either completes fully or rolls back, removing dependent objects in the correct order.
• Failed expressions are no longer silently swallowed. A synchronisation expression that throws now errors the affected object with a distinct "expression evaluation error" and leaves the target attribute untouched, instead of quietly leaving stale data behind. The expression tester also resolves attribute names case-insensitively, matching live synchronisation.
• Clearer settings validation. Either/or Connected System settings (such as the File Connector's "exactly one of Object Type Column or Object Type") are validated at save time with live feedback, in the form and for API callers.

Under the hood

Beyond the headline features, this release included substantial engineering work that does not change day-to-day usage but strengthens security, reliability, and maintainability:

• Documentation can no longer drift silently. A new CI gate couples documentation to user-facing change: a pull request that adds a new-feature or changed-behaviour changelog entry must also update the public docs, or explicitly and visibly opt out. The aim is that the docs you rely on keep pace with the product release by release.
• Tightened supply-chain posture. Base images were patched for CVE-2026-45447, container scanning now runs from a pinned Trivy image rather than a floating action, and the changelog quality lint now runs on every pull request. Routine dependency updates landed across Entity Framework, the .NET runtime image set, the API reference renderer, the LDAP protocol library, and PostgreSQL.
• Hardened command-line reliability and tests. The persistent-reconnect path is now covered by tests for cached reconnect and refresh-token write-back, and connecting before authenticating gives a clear, actionable message rather than a raw internal error. The REST API also now rejects request bodies with duplicate JSON property names, closing an ambiguous-parsing and request-smuggling vector, and a factory reset invalidates all existing portal sessions.
• Smoother contributor experience. The development container uses a stable PowerShell global tool, commit-signing verification in Codespaces is more frictionless, and the repository root was decluttered.

Upgrade notes

• SSO deployments: JIM now requests the offline_access scope at interactive sign-in so the identity provider issues a refresh token (this powers in-session token renewal and the new PowerShell persistence). Ensure offline_access is permitted on the interactive/public client; see the updated SSO setup guide.

Links

• Full changelog: https://github.com/TetronIO/JIM/blob/main/CHANGELOG.md
• GitHub Release: https://github.com/TetronIO/JIM/releases/tag/v0.12.0