MPP Handbook

1. What’s New

Please refer to the upgrade instructions if you want to upgrade your MPP installation to the latest version. The upgrade instructions can be found here.

MPP 8.5

OpenID Connect Authenticator: Add support for Proof Key for Code Exchange (PKCE) Refer to Section 2.2.5.1, “OpenID Connect Authenticator” for more information.

The what’s new archive can be found here.

2. Configuration

2.1. Administration

2.1.1. Manage Config

Navigation: Administration | Manage Config

The MPP’s configuration management is based on GIT. Therefore every configuration revision has an unique id assigned. To save the current configuration enter a short description and click the button Save & Activate. After the configuration has been applied you see the new revision in the table underneath. To load a previously applied configuration, you have two options. First, you have the ability to just load the configuration by clicking Load. In this case, you can modify or view the desired configuration and may activate it afterward by pressing Save & Activate. The second option is to press Load & Activate. The latter will keep the configuration activated until the next reboot.

Figure 1. Manage configuration

2.2. Network Access

2.2.1. Templates

Navigation: Network Access | Template Bundles

The MPP uses Mustache to compile the templates.

Variables

Table 1. Template Variables
Name	Description
`ip_address`	Dotted decimal formatted IP address of the client, eg. `203.0.113.139`
`mac_address`	Hyphen delimited MAC address of the client, eg. `00-11-22-33-44-55`
`mobile`	Mobile phone number. Only available during the SMS authentication process.
`site_name`	Name of the site, where the client is online
`customer_name`	The name of the customer to whom the session belongs
`profile_name`	The name of the profile to which the session belongs
`mpp_hostname`	Fully-qualified domain name of the serving MPP
`session_id`	ID of the session
`intercepted_url`	Intercepted URL of the client
`server_name`	Fully-qualified domain name of the landing page URL
`session_end_time`	The session’s end time. May be `null`.
`error_code`	Numerical representation of an error. May be `null`. See for more information.
`error_message`	A textual representation of an error. Not localized and may be `null`.
`remaining_upload`	Remaining upload amount in a human readable format. Only available if a Metered Device Authenticator with metering mode Traffic exists.
`remaining_download`	Remaining download amount in a human readable format. Only available if a Metered Device Authenticator with metering mode Traffic exists.
`tag`	The name of the tag. May be `null`.
`user_data_token`	Signed JSON Web Token (JWT). The customer’s shared secret is used to sign the message.
`user_id`	Hashed Username. Only available if the customer has a shared secret configured.
`device_id`	Hashed MAC address. Only available if the customer has a shared secret configured.
`csrf_token`	Token to prevent cross-site request forgery (CSRF) attacks.
`registration_username`	MPP authenticator may provide a registration username.
`registration_password`	MPP authenticator may provide a registration password.
`code_challenge`	OpenID Connect Authenticator must provide a code challenge, if authentication method is PKCE. See OpenID Connect.

Authentication Error Codes

Table 2. Authentication Error Codes
Code	Default Message	Description
0	OK	-
1	Internal Server Error	Will be returned if the MPP could not fulfill the request or could not reach the authentication server.
2	Invalid credentials	Returned if no configured authentication server is responsible for this type of authentication or if the specified credentials were invalid.
3	Terms not accepted	The responsible authenticator requires the user to accept the terms and conditions.
4	Invalid mobile number	The provided phone number is not valid.
5	Concurrent session limit reached	The configured session limit has been reached and the Concurrent Login Limit Policy has been set to Reject.
6	Account locked	The account for the provided credentials is locked. An account can be blocked by the MPP itself if it detects a bad behavior.
7	Account disabled	The user account found by the authenticator is disabled. An account can only be disabled by a human being.
8	Account expired	The user account is currently not valid.
9	SMS provider unavailable	The SMS could not be sent.
10	Session not found	Will be returned if no session was found.
11	Invalid security token	Returned if the specified security token was not valid.
12	Authentication timeout	The timeout for authentication has been reached.
13	Max authentication retries reached	Will be returned if a Failed Retries Authenticator is in place and the client has reached the configured maximum retry attempts.

To check for an error, you can use the variable error_code_<error code>, eg. error_code_2. An error handling block may look as follows:

{{^error_code_0}} (1)
    <strong>Error!</strong>&nbsp;

    {{#error_code_1}} (2)
        Internal Server Error
    {{/error_code_1}} (3)

    {{#error_code_2}} (4)
        Invalid Credentials
    {{/error_code_2}} (5)

{{/error_code_0}} (6)

1	Checks that an error has occurred and therefore "error" code 0 is not set
2	Checks if error code 1 is set
3	End marker for error code 1 check
4	Checks if error code 2 is set
5	End marker for error code 2 check
6	End marker for error code 0 check

Web Forms

Table 3. HTTP POST Fields
Field Name	Description
`username`	Contains the username. Used by login templates.
`password`	Provides the password. Used by login templates.
`terms`	If present, the MPP assumes that the client has accepted the terms and conditions.
`intercepted_url`	Intercepted URL. If present and no redirect URL is configured on the current site, the client will be redirected to this URL on successful authentication.
`mobile`	Contains the phone number. Used by SMS registration templates.
`security_token`	Contains the security token. Currently used by the SMS validation templates.
`tag`	Provides the tag. If present and the given tag is configured as Tagged Redirect URL, the client will be redirected to the configured URL on successful authentication. This mechanism is more secure than using the `intercepted_url` because the client can not change the URL in this approach.
`csrf_token`	Contains the CSRF token. Usually rendered as hidden field, eg. `<input type="hidden" name="csrf_token" value="{{csrf_token}}"/>`
`voucher`	Contains the voucher code. Currently only supported by the SMS registration templates.
`code_challenge`	Contains the code challenge for OpenID Connect Authenticator PKCE.
`code_challenge_method`	Contains the code challenge method for OpenID Connect Authenticator PKCE, always set to S256.

Links

Table 4. HTTP GET Parameters
Parameter Name	Description
`key`	Key to identify a resource. Mainly used by Route Authenticator to decide if it is responsible for authentication or not.
`l`	Requests the page with the given language, eg. `de` or `en`
`s`	Provides the session ID for consecutive requests. May speed up the session ID lookup process.
`i`	Intercepted URL. If present and no redirect URL is configured on the current site, the client will be redirected to this URL on successful authentication.
`tag`	Provides the tag. If present and the given tag is configured as Tagged Redirect URL, the client will be redirected to the configured URL on successful authentication. This mechanism is more secure than using the `i` parameter because the client can not change the URL in this approach.
`csrf_token`	Contains the CSRF token. Required by the Route Authenticator when CSRF prevention is enabled.
`terms`	If present, the MPP assumes that the client has accepted the terms and conditions.
`code`	Contains the code of a successful authentication response. Required by the OpenID Connect Authenticator login request.
`state`	Contains the state of a successful authentication response. Required by the OpenID Connect Authenticator login request.
`error`	Contains the error of a failed authentication response. Used by the OpenID Connect Authenticator login request.
`error_description`	Contains the optional error description of a failed authentication response. Used by the OpenID Connect Authenticator login request.
`code_challenge`	Contains the code challenge for OpenID Connect Authenticator PKCE.
`code_challenge_method`	Contains the code challenge method for OpenID Connect Authenticator PKCE, always set to S256.

Endpoints

Table 5. HTTP Endpoints
Path	Method	Description
`/c/s`	GET	Used internally to serve templates.
`/login`	POST GET, if code and state params are provided for OpenID Connect Authenticator	Use this URL to authenticate the user with the specified Web form fields.
`/logout`	GET POST, if CSRF prevention is enabled	Ends the current client session. If CSRF prevention is enabled, you must specify the template bundle Template Bundle (Logout) in the customer configuration.
`/set_language`	GET	Sets the language of the current session. Requires at least the GET parameter `l`.
`/go`	GET	Navigate to the template bundle with the given key provided by the GET parameter `key`.
`/route`	GET	Authenticates the client session with the key specified by the GET parameter `key`.
`/session/route`	POST	Authenticates a client session via Route Authenticator. See MPP Client API
`/debug`	GET POST, if CSRF prevention is enabled	Shows debug information of the current client session. If CSRF prevention is enabled, you must specify the template bundle Template Bundle (Debug) in the customer configuration.
`/device/purge`	GET POST, if CSRF prevention is enabled	De-registers the current client device from the user account. If CSRF prevention is enabled, you must specify the template bundle Template Bundle (Device de-association) in the customer configuration.
`/device/information`	GET	Shows device information such as user group and mark information. See MPP Client API
`/session`	POST + DELETE	Remote session manager API to start and stop MPP client sessions. See MPP Client API

2.2.2. Sites

Navigation: Network Access | Sites

Presence Mode

The presence mode decides how user sessions are started and stopped. It can be configured per site.

Presence Mode DHCP

This is the standard presence mode. In DHCP mode, a user session is started when a valid DHCP lease is detected and stopped when the lease expires.

Presence Mode Traffic

In this mode sessions are managed manually via the MPP Client API.

Figure 2. Presence Mode Traffic configuration

Idle Timeout: Number of seconds after which a session is automatically terminated if no traffic is detected. A default value can be configured per customer (System | Customers).

2.2.3. Docking Networks

Navigation: Network Access | Docking Networks

Docking networks are configured to introduce a client network to a certain customer. If a target site is assigned at docking network level, the site assignment algorithm will always choose this site for the client user session.

The DHCP option 82 match configuration is ignored, when a target site is configured.

The docking network must not have any DHCP scopes or hosts in case the target site has presence mode Traffic.

2.2.4. DHCP Option 82 Matches

Navigation: Network Access | DHCP Option 82 Matches

As a second site assignment method, DHCP relay agent information may be used. This method is only enabled, if the target site is not assigned on docking network level.

Java regexp patterns for circuit and remote ID are configured for each DHCP option 82 match. The configured target site of the first match is assigned to the client user session. See Java Pattern for further documentation.

Consider a wildcard match as last resort to ensure all clients have an assigned site and running user session.

Figure 3. DHCP option 82 wildcard match

2.2.5. Authenticators

Navigation: Network Access | Authentication Schemes

OpenID Connect Authenticator

OpenID Connect Authenticator supports OpenID Connect based on the specification documented at OpenID Connect Core 1.0 with the following implementation:

Endpoints (URI) must be configured, Discovery Endpoint is not supported
Authentication Flow: the authenticator supports the Authorization Code Flow and PKCE
Client Authentication method can be either client_secret_basic for the Token Endpoint (using HTTP Basic authentication), or none (using PKCE)
Scope: openid, optional phone email offline_access
Nonce claim as CSRF protection
UserInfo sub must be provided and depending on the configuration phone_number, phone_number_verified, email and email_verified must also be provided.
Configured additional claims can be requested using the claims authorization request parameter. Claim Parameters
JWKS supports only asymmetric encryption with RSA
Access- and refresh token location is HTTP header: Authorization: Basic …
UserInfo token location is HTTP header: Authorization: Bearer …
Currently, the following algorithms are supported for signing a JWT: none, RS256, RS384, RS512, ES256K, ES256, ES384 and ES512

Configuration

Among other common authenticator properties, the following OpenID Connect-specific must be configured:
client_id, configured within the OIDC backend
client_secret, configured within the OIDC backend in case of Basic authentication
PKCE code_challenge to support Authorization Code with PKCE Flow. Code challenge method (code_challenge_method) is S256
redirect_uri, configured within the OIDC backend (MPP landing page URL)
Issuer iss, used for JWT validation
Token Endpoint, used to exchange authentication code to an access-token/refresh-token
JWKS Endpoint, used to fetch the JSON web key set for JWT validation
UserInfo Endpoint, used to fetch user info such as sub, phone_number, phone_number_verified, email and email_verified
Custom claim mpp_target_profile in the UserInfo Response allows the authorization server to define the target profile for the authenticated user. If the claim is not present in the response, the configured target profile of the OpenID Connect or MAC Authenticator configuration must be used. Profile ID or name may be used for mpp_target_profile
Custom claim mpp_session_duration in the UserInfo Response that allows the authorization server to define the session duration for the authenticated user. If the claim is not present in the response, the configured session duration of the OpenID Connect or MAC Authenticator configuration must be used. Numerical session duration value in seconds or as ISO 8601 duration encoded string may be used as mpp_session_duration
Additional Claims, essential custom claims which have to be provided with userinfo response. All non-null values are valid
Enable Request Refresh Token to refresh the access_token within the MAC authenticator (offline_access), may need scope offline_access and prompt consent in authorization request

If Request Refresh Token is enabled, a MAC Authenticator must be present for the configured MAC User Group to refresh the token each time the user joins the network. Make sure that either Reject Authentication, Lock User Account, or Delete User Account (incl. Registered Devices) is selected for the Inactive Remote User Action setting in the MAC Authenticator. Otherwise, the user is not validated by its refresh token!

Authorization Request Sample with PKCE (GET request template)

<a href="https://test.example.org/oauth2/authorize?client_id=my-client-id&scope=openid%20phone%20offline_access&prompt=consent&redirect_uri=https%3A%2F%2Fwifi.example.org%2Flogin&state={{csrf_token}}&nonce={{csrf_token}}&response_type=code&code_challenge={{code_challenge}}&code_challenge_method=S256&ui_locales=en">
    OpenID Connect Login
</a>

Authorization Request Sample with PKCE (Login form template)

<form method="get" action="https://test.example.org/oauth2/authorize">
    <input type="hidden" name="client_id" value="my-client-id"/>
    <input type="hidden" name="scope" value="openid phone offline_access"/>
    <input type="hidden" name="prompt" value="consent"/>
    <input type="hidden" name="redirect_uri" value="https://wifi.example.org/login"/>
    <input type="hidden" name="state" value="{{csrf_token}}"/>
    <input type="hidden" name="nonce" value="{{csrf_token}}"/>
    <input type="hidden" name="response_type" value="code"/>
    <input type="hidden" name="code_challenge" value="{{code_challenge}}"/>
    <input type="hidden" name="code_challenge_method" value="S256"/>
    <input type="hidden" name="ui_locales" value="en"/>
    <button id="submit-btn" type="submit">
        OpenID Connect Login
    </button>
</form>

Request Additional Claims: Pretty printed sample requesting voluntary scope-phone and another_claim:

{
  "userinfo": {
    "phone_number": null,
    "phone_number_verified": null,
    "another_claim": null
  }
}

{"userinfo":{"phone_number":null,"phone_number_verified":null,"another_claim":null}}

claims parameter must be URL encoded before adding it to the authentication request URL, to make sure all special characters are properly escaped.

<form method="get" action="https://test.example.org/oauth2/authorize">
    ...
    <input type="hidden" name="claims" value="%7B%22userinfo%22%3A%7B%22phone_number%22%3Anull%2C%22phone_number_verified%22%3Anull%2C%22another_claim%22%3Anull%7D%7D"/>
    ...
</form>

<a href="https://test.example.org/oauth2/authorize?claims=%7B%22userinfo%22%3A%7B%22phone_number%22%3Anull%2C%22phone_number_verified%22%3Anull%2C%22another_claim%22%3Anull%7D%7D">
    OpenID Connect Login
</a>

2.2.6. QoS

Navigation: Network Access | QoS

Quality of Service (QoS), network traffic control or traffic shaping can control the downstream (incomming) traffic with destination matching and the upstream (outgoing) traffic with source matching on the corresponding interface.

Figure 4. Interface QoS

QoS is only possible on outgoing interface (egress) so that client download and upload rate limits must be configured on different interfaces.

Optional rate limits can be assigned per interface, site, profile or device. Site and profile must be assigned where the QoS should be applied.

Figure 5. Site QoS

Figure 6. Profile QoS

The mode defines if the configured sites or profiles share the same TC class and rate limit One TC class for all or not One TC class for each. One TC class for each mode is a short to share the same rate limits and child configuration.

2.2.7. API Access

Navigation: Network Access | API Access

Figure 7. API Access configuration

Name: Name of the API access configuration.
/device/information: Allowed to access the device information.
/session/route: Allowed to route sessions.
/session: Allowed sites of presence mode type traffic, to start and stop sessions.
IP addresses: List of IP addresses that are allowed to access the API.

2.3. Advanced

2.3.1. After Network Config Script

Custom Bash hook script may be provided under /etc/mpp/after-network-config, which is executed between network and daemon configuration. The configuration apply process will fail in case of a non-zero exit code. Log entries may be found in /var/log/mpp/system-agent.log. The Bash script is executed with the following command:

/bin/bash /etc/mpp/after-network-config

3. Administration

3.1. Upgrade

After you’ve upgraded your MPP installation you need to check that the MPP still runs by issuing the command systemctl status mpp. The line starting with Active must be active (running). If this is not the case, try to start start the MPP with systemctl start mpp. We recommend that you restart the operating system after each upgrade. If you do so, you’re sure that everything works fine.

To upgrade a redundant installation you should first update your backup system. After the backup system is back online and its state switched to backup, you should enable the Maintenance Mode on the master system. You can enable the Maintenance Mode at Administration | System Admin. Once you’re done with the upgrade process on the master, you must manually disable the maintenance mode.

It is recommended to backup the database before upgrading. You can do so, by either taking a snapshot of the VM or by MPP backup functionality. If you want to continue without creating a backup, please be aware that you are doing it at your own risk.

3.1.1. MPP < 8.0 and > 7.x

From MPP 8.0 upwards the onway director (Sponsoring Portal) 4.0 or higher is required. Otherwise, the communication between these two will not work!

Depending on your hardware configuration and the size of your database, the upgrade may take up to 1 hour. Normally, the upgrade process does not take any longer than 20 minutes.

Upgrade all packages on Ubuntu 18.04

export APT_LISTCHANGES_FRONTEND=none (1)
apt update (2)
apt upgrade (3)
apt purge mpp-linda mpp-snoopy mpp-netmaid (4)
apt autoremove --purge (5)

1	Optional: Disable reading of changelog
2	Update the local package information database
3	Install all available upgrades of all packages currently installed on the MPP
4	Remove legacy packages
5	Remove packages that are no longer needed by the system

Update sources.list file to new resources

sed -i 's/bionic/focal/g' /etc/apt/sources.list.d/packages-onway.list

Perform Ubuntu release upgrade from 18.04 to 20.04

systemctl stop mpp.service (1)
do-release-upgrade (2)
  Configuration file '/etc/ntp.conf' → N
  Configuration file '/etc/snmp/snmp.conf' → N
  Configuration file '/etc/default/snmpd' → N
  Configuration file '/etc/snmp/snmpd.conf' → N
  Configuration file '/etc/default/dhcp-snoopy' → N
  Configuration file '/etc/default/netmaid' → N
  Configuration file '/etc/bind/named.conf.options' → N
apt purge postgresql-12 postgresql-client-12 (3)
apt autoremove --purge (4)
shutdown -r now (5)

1	Shutdown MPP before upgrade
2	Perform the release upgrade from Ubuntu 18.04 to 20.04
3	Remove previously used packages
4	Remove packages that were automatically installed to satisfy dependencies for other packages and are now no longer needed
5	Restart system

3.1.2. MPP ⇐ 7.4.0

From MPP 7.5 upwards the onway director (Sponsoring Portal) 3.3 or higher is required. Otherwise, the communication between these two will not work!

3.1.3. MPP >= 7.0.0

With the release 7.2.0 we update the PostgreSQL database from version 10 to 12. For this purpose a complete export of the current database has to be done and the whole database has to be imported into PostgreSQL 12. Depending on your hardware configuration and the size of your database, the upgrade may take up to 2 hours. Usually the upgrade process does not take longer than 30 minutes.

export APT_LISTCHANGES_FRONTEND=none (1)
apt update (2)
apt upgrade (3)
apt purge postgresql-10 postgresql-client-10 (4)
apt autoremove --purge (5)

1	Optional: Disable reading of changelog
2	Update the local package information database
3	Install all available upgrades of all packages currently installed on the MPP
4	Remove PostgreSQL 10 packages and configuration
5	Remove packages that are no longer needed by the system

3.1.4. MPP < 7.0.0

Depending on your hardware configuration and the size of your database, the upgrade may take up to 2 hours. Normally, the upgrade process does not take any longer than 30 minutes.

Upgrade all packages on Ubuntu 16.04

export APT_LISTCHANGES_FRONTEND=none (1)
apt update (2)
apt upgrade (3)
apt purge postgresql-contrib (4)
apt autoremove --purge (5)

1	Optional: Disable reading of changelog
2	Update the local package information database
3	Install all available upgrades of all packages currently installed on the MPP
4	Remove postgresql-contrib package
5	Remove packages that are no longer needed by the system

Update sources.list file to new resources

cat <<EOF >>/etc/apt/auth.conf
machine packages.onway.ch/system login system password <password>
machine packages.onway.ch/3rd-party/stable login 3rd-party password <password>
machine packages.onway.ch/onway/stable login onway password <password>
EOF
chmod 600 /etc/apt/auth.conf

cat <<EOF >/etc/apt/sources.list
deb https://packages.onway.ch/system/ bionic main
deb https://packages.onway.ch/3rd-party/stable/ bionic main
deb https://packages.onway.ch/onway/stable/ bionic main
EOF

Perform Ubuntu release upgrade from 16.04 to 18.04

systemctl stop mpp.service (1)
do-release-upgrade (2)
  Continue running under SSH? → Y
  While scanning your repository information no entry about xenial could be found.
  An upgrade might not succeed.
  Do you want to continue anyway? → Y
  Do you want to rewrite your 'sources.list' file anyway? → Y
  Do you want to start the upgrade? → Y
  Configuration file '/etc/default/snmpd' → N
  Configuration file '/etc/dhcp/dhcpd.conf' → N
  Configuration file '/etc/bind/named.conf.options' → N
  Configuration file '/etc/ntp.conf' → N
  Configuring grub-pc: What do you want to do about modified configuration file grub? → install the package maintainers's version
  Modified configuration file: What do you want to do about modified configuration file 50-default.conf? → install the package maintainer's version
  Configuring openssh-server: What do you want to do about modified configuration file sshd_config? → install the package maintainer's version
  Remove obsolete packages? → Y
  System restart required → Y

1	Shutdown MPP before upgrade
2	Perform the release upgrade from Ubuntu 16.04 to 18.04

Cleanup new system and finish release upgrade
```
apt purge postgresql postgresql-9.5 postgresql-contrib-9.5 postgresql-client-9.5 resolvconf mpp-linda mpp-snoopy mpp-netmaid (1)
apt autoremove --purge (2)
```
1 Remove previously used packages

2 Remove packages that were automatically installed to satisfy dependencies for other packages and are now no longer needed

3.2. Network Recovery

If the MPP is unable to start and the whole network configuration is gone, you can configure the network by invoking systemctl start network-setup on the machine’s command line interface.

3.3. Certificate Signing Request (CSR)

To obtain a certificate either for the management console or the landing page you must first create a CSR. The simplest way to create such a request is on the MPP command line itself.

Connect to the MPP by SSH
```
ssh -l mpp-admin HOST
```

Create and change directory

mkdir mpp.example.org
cd mpp.example.org

Create configuration file

With the following configuration file we request a certificate with two domain names: mpp.example.org and mpp.example.com.

cat <<EOF >mpp.example.org.cnf
[ req ]
default_bits                = 2048
prompt                      = no
default_md                  = sha256
distinguished_name          = req_dn
req_extensions              = req_ext

[ req_dn ]
countryName                 = CH
stateOrProvinceName         = Zurich
localityName                = Zurich
organizationName            = onway ag
commonName                  = mpp.example.org

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
DNS.1    = mpp.example.org
DNS.2    = mpp.example.com
EOF

Create CSR with a newly generated key

openssl req -new -newkey rsa -nodes -keyout mpp.example.org.key -out mpp.example.org.csr \
-config mpp.example.org.cnf

Verify the request

Check at minimum the Subject and the requested Subject Alternative Names.
```
openssl req -text -noout -in mpp.example.org.csr
```
Let your CA sign your request mpp.example.org.csr

Request the certificates in a PEM-encoded format like.

3.4. VMware Tools

If you are running the MPP in a VMware virtual environment, you should install the tools to run the MPP smoothly and optimally integrated.

Install Open VM Tools

apt update
apt install open-vm-tools

3.5. Logging

Any log files generated by the MPP are in /var/log/mpp. To change the configured log level, you need to adjust the configuration in /etc/mpp/logback.xml or /etc/mpp-system-agent/logback.xml respectively. More information about the logging framework Logback can be found here.

accounting.log: The MPP logs all session start and end messages in this file. It is rotated daily and keeps the archive of the last 30 days. The log level is INFO by default.
console-audit.log: Log file with every authentication attempt for the MPP console. It is rotated monthly and keeps the archive of the last 4 months. The log level is INFO by default.
mpp.log: This ist the main log file and therefore makes a lot of noise. It is rotated after 250 MB and keeps the last 7 archived files. The log level is INFO by default.
session.log: Log file that contains session-related information, such as bad authentication attempts. It is rotated after 250 MB and keeps the last 3 archived files. The log level is WARN by default.
sync.log: If you have synchronization issues, this file is your friend. It is rotated after 250 MB and keeps the last 3 archived files. The log level is INFO by default.
system-agent.log: If the MPP was unable to activate your configuration, you should look at the entries here. It is rotated after 250 MB and keeps the last 7 archived files. The log level is INFO by default.

3.6. Daemons

3.6.1. Lawful Interception Daemon

LINDA (Service name: linda) is the new Lawful Interception Daemon. It writes a binary logfile for each day stored in /var/log/mpp/li-*.log. To read such a binary file we provide a small utility called linda-parse that reads from stdin and writes to stdout. With the command cat /var/log/mpp/li-*.log | linda-parse you can read any Lawful Interception file and print it in a human readable form.

3.6.2. Snoopy

Snoopy (Service name: dhcp-snoopy) replaces Sioux’s DHCP snooping capabilities 1:1. It captures any DHCP traffic that flows through the MPP and sends the captured information to the MPP.

3.6.3. Netmaid

The Netmaid Daemon (Service name: netmaid) is responsible for the whole Kernel communication and provides an interface to configure various parts of the Linux networking stack such as IPtables, setting IP addresses and alter its network routes.

3.7. Notifications

MPP has a built-in notification system. It runs various system checks periodically and informs the administrator with a notification if things change from one check to another.

Performing system checks is called monitoring the MPP, while sending notifications is called alarming.

3.7.1. Monitoring

MPP monitors the following things since version 6.9.

MPP version check, to determine if a new MPP version is available on the package server
DHCP scope check, to determine if a docking network runs out of available IP addresses. Two float threshold values [0.0-1.0] can be set in application.properties, mpp.dhcp-pool-usage.warning and mpp.dhcp-pool-usage.critical
VRRP state transitions
Sync state transitions

More checks might be added in the future.

3.7.2. Alarming

A notification is produced if the result of a check is different than its previous result. New notifications are indicated in the toolbar.

Figure 8. Notification icon

Clicking on the notification icon opens a view and shows all notifications in chronological order with the newest on top. A notification provides the following details:

Source, to display the origin
Timestamp, to show the creation time
Severity, which is Information, Warning or Alarming
Subject, similar as in an email
Message, to provide more details, if available

Notifications are sent via email to all Backend Users which are Enabled and have Receive System Notifications activated. Please note that the MPP MTA service must be configured and enabled.

Notifications are removed automatically from the MPP if they have reached a certain age. This retention time is configured in the System Constants page.

3.8. Remote Server

If the MPP Remote Server service is enabled and configured, remote peers such as the onway director can communicate over an encrypted connection, which is secured with X.509 certificates.

The communication uses TCP/IP on port 9011.

The service can be disabled, if remote peer communication is not required, i.e. if the onway director is not installed.

3.8.1. Processes

The following picture illustrates how the processes are connected to each other:

3.8.2. Let onway director connect to MPP

Add a new peer to the MPP by opening Services → Remote Server → Remote Peers. Add the IP address and the Peer ID of the onway director. The onway director Peer ID is defined in the onway director in Administration → Remote Client → Service. Choose which MPP customers are allowed to be accessed. MPP creates the corresponding firewall rule for this peer.

The Peer ID corresponds to the Subject Alternative Name (SAN) of the certificate and is equal to the hostname of the system during installation.

A remote peer is qualified by a State. It provides three values:

DISCONNECTED: peer is not reachable, or peer did not trust
UNTRUSTED: peer certificate is not trusted by us
CONNECTED: goal state, both parties trust each other

The connection will be shown as DISCONNECTED, if the onway director did not add the MPP connection before.

In MPP a connection is called a Remote Peer while in the onway director it is called MPP connection

The onway director tries to establish a connection to the MPP for an infinite period of time. The connection is not established as long as the certificates are not trusted. This state is shown as UNTRUSTED. The Peer ID and the SHA-256 fingerprint of the certificate are shown to identify the other party.

To establish a secure communication channel, both parties (onway director and MPP) must trust each other. Trusting is a manual interaction, done by the administrator. A click on the lock button and approval changes the state to DISCONNECTED, if done on one party.

It changes to CONNECTED, if both parties trust each other, and after a successful handshake has been done between onway director and MPP. This is the required final state for secure communication between the peers.

3.8.3. Disconnect onway director from MPP

If one party wants to revoke an established connection for any reason, a click on the unlock icon with approval is enough. The state changes to UNTRUSTED on the MPP and to DISCONNECTED on the onway director. Communication between MPP and onway director is refused. Please note that the onway director keeps trying to establish the connection to the MPP.

A remote peer can be deleted if it is not required anymore by clicking on the delete button.

3.8.4. Renew a certificate

It is possible to renew the built-in certificate in Services → Remote Server → Service. But be careful. All configured MPP connections in onway director must trust the new certificate to be able to communicate with the MPP.

3.8.5. Unknown Peers

The MPP can discover a remote peer connection attempt, if the firewall allows connections from the onway director. Such peers are displayed below the remote peer table as Unknown Peers. Please verify its certificate details before adding it.

3.8.6. MPP data stream services

Use the following settings to stream data from the MPP to the onway director. Please note that the onway director must enable the corresponding data stream services on its MPP connections.

SMS Accounting: enable this service to stream the SMS accounting log
Session Accounting: enable this service to stream the user session history log

3.8.7. Troubleshooting

Disconnected Peers

If the remote peer state is always DISCONNECTED, please verify that port 9011 is open on your firewall. The remote server must be reachable on this port.

4. Installation

4.1. System requirements

Table 6. System requirements
Component	Minimum	Recommended
Processor	Quad core with 2 GHz or faster	Hexa core with 2 GHz or faster
RAM	6 GB	8 GB, no more than 12 GB
Storage	120 GB	>= 260 GB
NIC	2x1 Gb/s	3x1 Gb/s for Uplink, Client networks and Management

The MPP runs on VMware vSphere 6 or later (Virtual Hardware Version 11+) and on any modern hardware (Bare metal) that is supported by Ubuntu Linux 20.04 LTS with Linux Kernel 5.4.

4.2. Product Dependency

The MPP requires at least the following onway director (Sponsoring Portal) versions.

Table 7. Product dependency
MPP Version	onway director (Sponsoring Portal) Version
8.5.0	>= 4.5.0

4.3. Example Setup

In this section, you will learn how to install a redundant MPP with the following requirements:

Employees authenticate themselves against the company’s LDAP directory during their first use and get an auto session without any authentication afterward.
Any other user uses the SMS self-registration process. If the authentication was successful, the registration is valid for 180 days and the user shall visit the welcome back page only once a day.

4.3.1. Network Topology

Figure 9. Network Topology

Table 8. IP configuration
What	IP address
Landing-Page URL	https://wifi.example.org/
Site: Zurich	203.0.113.1 (VRRP) 203.0.113.17 - 203.0.113.126 (DHCP Range)
Site: Bern	203.0.113.129 (VRRP) 203.0.113.145 - 203.0.113.254 (DHCP Range)
Service IP address (DNS, DHCP Server)	185.12.129.33
External DNS	8.8.4.4 (primary) 8.8.8.8 (secondary)

4.3.2. Boot from image

To install the MPP, we need either a bare metal server or a virtual machine that meets the requirements as specified here.

Download the latest onway ISO from https://packages.onway.ch/iso/.

After you have started from the disk image the following GRUB screen will show up:

Figure 10. GRUB boot screen

Select Install MPP 8.5.0 and press return. As next, the setup wizard pops up. Follow the instructions and configure the management access. Next, to the wizard, the MPP gets installed on the local disk. This may take five to ten minutes. To finish the installation the server reboots once, and a yellow Linux prompt appears.

During the first start of the MPP, the system gets initialized. This can take up to another five minutes, so be patient. Once the MPP was started successfully the management console should be accessible via https://mpp01.example.org:1443/. The username and password of the admin user are mpp-admin. If you cannot log in to the Linux console, the initialization process may not have finished yet. Just wait a moment and try again.

After a successful installation, there will be a message in the top right-hand corner, saying that a system restart would be required. Just ignore this advice for now.

After accepting the End-user license agreement (EULA), you will be asked if you either want to run the MPP as MPP Cluster Coordinator (MPP CC) or as standalone MPP. If you have no clue what an MPP CC does, it would be wise not to select the checkbox.

4.3.3. Customer setup and login

Every MPP installation needs at minimum one customer as shown below:

Figure 11. Customer setup dialog

Finally, after you have configured your customer, the MPP web console login screen shows up. Login with the default credentials mpp-admin/mpp-admin.

4.3.4. Navigation

Figure 12. Navigation

The MPP console is divided into four different sections:

Main Navigation (1): The main navigation is always visible and sticks to the top of the page. In the top right corner, the currently logged-in username is displayed. If you click on its name, you can either change the password or log out and leave the administration console.
Meta Bar (2): Relevant information, such as the hostname, the current configuration state, the sync state, the VRRP state, etc. is placed inside the meta bar and thus always available.
Side Navigation (3): If necessary, a second navigation will be shown on the left-hand side. With this navigation, you can navigate within the currently active section of the main navigation.
Content (4): This is the main part of the page and here you will see the content.

Usually, the configuration is done from left to right (main navigation) and from top to bottom (side navigation).

4.3.5. Connectivity

One of the essential parts of a networking device like the MPP is connectivity. Therefore, we need to configure our local IP addresses and routes. The MPP supports physical, VLAN (IEEE 802.1Q) and GRE interfaces.

Interfaces

Navigation: System | Network | Interfaces

Configure the physical interfaces according to the network topology as shown above. Once you have done this, continue with the VLAN interfaces.

The loopback address 185.12.129.33 is a reserved address that belongs to our AS and is not routed. You can use it without a doubt.

Figure 13. VLAN configuration

If you plan to run your system in cluster mode, it may be helpful to enable the VRRP service first rather than to enable it afterward and reconfigure the virtual IP addresses once the initial configuration is done.

Routing

Navigation: System | Network | Routing

The MPP maintains at least two different routing tables. The routes entered under System are mainly used by the system itself. It’s not necessary to configure layer two attached networks.

Change the default route gateway to use the uplink router.

Figure 14. System routes

4.3.6. System Firewall

Navigation: System | Network | System Firewall

As long as no firewall input rule is configured, the MPP management (TCP/22 SSH and TCP/1443 Web Console) is accessible from anywhere. So we highly recommend that you configure your management source IP addresses.

Figure 15. System firewall input rules

With this configuration the MPP is only accessible from IPs within the network 192.0.2.0/24 received on the management interface ens38.

In our setup we need to NAT/PAT any client traffic. The easiest way to achieve this is to configure a Post-Routing Firewall Rule as shown below.

Figure 16. System firewall post-routing rules

After we’ve configured the basic connectivity parameters, it’s a good idea to save the changes we’ve made so far.

4.3.7. Services

Navigation: Services

Any stuff related to Linux Daemons managed by the MPP is configured in this section. First of all, we need a DHCP service that assigns IP addresses to our clients. This can be done by using the existing DHCP server of the company with or without DHCP relay enabled. The easiest way is to run the DHCP server right on the MPP as we will do during this setup.

DHCP

Navigation: Services | Configuration | DHCP

Figure 17. DHCP service configuration

Generally it’s a good idea to use a relatively small lease time such as 600 seconds. Keep in mind that any client that connects to your open wifi infrastructure requests an IP address. If you choose a common lease time of at least 24 hours you might run out of IP addresses pretty fast.

DNS

Navigation: Services | Configuration | DNS

The DNS configuration is split into two views Services and Zones. First we need to configure the server service settings.

Figure 18. DNS service configuration

As with the DHCP service it’s possible to use your external DNS server if you want.

To create a new DNS zone we need to configure some meta data followed by the actual zone definition.

Figure 19. DNS zones

If you want that the name of your DNS record refers to the zone itself, use the @ sign as in this example.

If you’re not a DNS expert it would be wise to use the default values recommended by the system. Therefore, read the provided help text carefully. If you want to use the default value just leave the field empty.

NTP

Navigation: Services | Configuration | NTP

It’s always a good idea to run the MPP with time synchronization enabled. Otherwise reading log files can become really cumbersome.

Figure 20. NTP configuration

Choose the Bind Address carefully. This address needs to be able to query the configured NTP servers.

Save & Activate the configuration we did so far.

4.3.8. Network Services

So far we’ve configured our network connectivity parameters and the Linux Daemons we use. In this section we go a step further an configure the business logic of our installation.

Page Assets

Navigation: Network Access | Page Assets

With MPP 5.0 we’ve introduced a new concept to handling template assets like CSS, images, etc. and the templates themselves. You can download the current assets by clicking the Download button and upload the new assets by select the ZIP archive and press Upload.

During the upload process, any existing data will be removed or overridden. Therefore the ZIP archive must include any assets needed by your setup.

For our example we use the sample assets. Download and upload the sample assets.

More information about the template engine can be found here.

Template Bundles

Navigation: Network Access | Template Bundles

Working directly with templates is cumbersome and error-prone. Therefore, we offer template bundles to bundle different templates into a single logical unit. Any template bundle you want to navigate to needs a Key as identifier. In our example, the template bundles sms-registration, login and welcome need such a key. Otherwise, it would not be possible to navigate from the welcome page to the login or SMS registration page and vice versa.

Figure 21. Template bundles configuration

Routing Tables

Navigation: Network Access | Routing Tables

The MPP requires at least one client routing table per customer. Any traffic received from a docking network first queries this table. If no configured route matches, the system’s routing table is used. Incoming traffic does not use this routing table. Therefore, it is not necessary to configure directly attached or routed docking networks in this table.

For safety reasons you should configure at least the default route 0.0.0.0/0. Otherwise, it would still be possible to query the system’s routing table.

Figure 22. Client routing table

SMS Gateways

Navigation: Network Access | SMS Gateways

To send SMS the MPP offers three different gateway types:

onway SMS
Mail to SMS
HTTP-GET

In this tutorial we go with the CloudGaurd SMS gateway as this is our preferred one. If you need an Application Token do not hesitate and contact your account manager.

Figure 23. SMS Gateway

We recommend that you use a valid phone number as originator, as many international operators do not allow alphanumeric phone numbers.

Since MPP 5.0, we support multiple SMS gateway configurations per customer. Therefore, it is possible that you use different application tokens for different authentication scenarios and thus receive different invoices.

Open Garden Schemes

Navigation: Network Access | Open Garden Schemes

If you want to allow to access one or multiple dedicated IPs, networks or FQDNs without authentication, you are in the right place. The open garden scheme Certificates is built-in and managed by the MPP itself. When you upload a new certificate and select the Certificate Open Garden checkbox, the MPP inserts each defined CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) resource here.

Figure 24. Open Garden Schemes

To use FQDN based open gardens, the local DNS service must be configured and running. The MPP queries the local DNS every minute and updates the firewall rules as needed. If the DNS response provides multiple IP addresses, the MPP tracks each one of them.

Profiles

Navigation: Network Access | Profiles

At any time, each client session has a profile assigned. A profile defines what authentication mechanisms, which open garden schemes and which client routing table is used for such a profile. In addition, any profile can provide its firewall pre-routing, forward and post-routing rules. A profile can run in three different modes: Allow Any Traffic, Show Landing Page and Use Manual Configuration.

Allow Any Traffic: If a profile run in this mode, all traffic is allowed an nothing is filtered.
Show Landing Page: If you select this mode, the MPP redirects each HTTP and HTTPS request to the configured landing page URL.
Use Manual Configuration: Use this mode with caution, as you need to configure the redirect behavior by yourself.

In most cases, you will need at least two profiles: one for the anonymous devices and one for the authenticated devices.

Figure 25. Profile welcome-back

For our tutorial we need an additional profile to display a welcome back page. Create a new profile named welcome-back. Also, enable the Logout, Debug and Enforce Configured DNS feature for each profile.

Logout: When enabled, the user can end their session by calling the URL https://mpp.example.org/logout.
Debug: If this option is enabled, the user can view their session information by requesting the URL https://mpp.example.org/debug.
Enforce Configured DNS: With this function in place, every DNS request is forwarded to the locally running DNS server.

Sites

Navigation: Network Access | Sites

Configure the two sites Bern and Zurich and their DHCP scopes. You can leave the optional fields blank.

Figure 26. Sites

Figure 27. Site Zurich

User Groups

Navigation: User Accounts | User Groups

Before we can start configuring our authentication schemes, we need to create the user groups. Create a user group called Self-registered Users with the key SRU and one with the name Employees and the key EMPL.

Figure 28. User Groups

Authentication Schemes

Navigation: Network Access | Authentication Schemes

First, create an authentication scheme named login and one named welcome-back.

We start with the simple one. Configure the authentication scheme welcome-back as follows:

Figure 29. Authentication Scheme welcome-back

In this authentication scheme, we use only a Route Authenticator.

The scheme login is a little more complicated as shown in the following overview:

Figure 30. Authentication Scheme login

Configure a MAC Authenticator to start an auto-session for our employees

Figure 31. MAC Authenticator empl / auto-session

Make sure, that you set the option Inactive Remote User Action to Delete User Account (incl. Registered Devices) to ensure, that the user account is removed, when the user is removed on the LDAP server.

In order to remember the authentication token of our self-registered users, you will have to configure two authenticators.

Configure a Mark Authenticator, to mark self-registered users that need to be remembered

Figure 32. Mark Authenticator sru / mark

Configure a Remember Me Authenticator to check if a self-registered user should be remembered, based on the marks that were set

Figure 33. Remember Me Authenticator sru / remember-me

With this configuration, each remembered authentication token is removed at midnight.

Configure a MAC Authenticator to start a welcome-back session for our self-registered users

Figure 34. MAC Authenticator sru / auto-session

If the MAC address is known by the MPP, a welcome-back session is started and assigned to device.

In contrast to the empl / auto-session configuration, it is not necessary to set the option Delete User Account (incl. Registered Devices) as the MPP can not know whether the account is still valid or not. Therefore, this option would have no effect.

Configure a HTML Template to display the welcome page

Figure 35. HTML Template welcome

On this page the user can choose between LDAP login or SMS registration.
Configure a MAC Authenticator to allow employees to login

Figure 36. LDAP Authenticator empl / auth01srv-a
Configure an SMS Authenticator to allow users to register

Figure 37. SMS Authenticator sru / registration

Update Profile

Navigation: Network Access | Profiles

Go back to the profiles page and edit the profile anonymous. Assign the authentication scheme login and the open garden scheme generic.

Figure 38. Profiles

4.3.9. Finish setup

If you are running the MPP in a VMware virtual environment, we recommend that you install the open VM tools.

Before we can start testing our configuration, we need to Save & Activate the current configuration. Save the configuration and then restart the MPP by navigating to Administration | System Admin and clicking Reboot.

Do not reload the browser window manually because the MPP Console automatically checks if the MPP is available.

4.3.10. Setup backup system

In this step, we are going to transform our installation into a redundant setup. First we install the backup system and configure its network connection:

Install Backup System from ISO Image
Accept the end-user license agreement
Do not run the MPP in the cluster coordinator mode
Configure an initial customer

It does not matter what you enter here as we will load the configuration from mpp01 later.
Configure IP addresses

Configure the IP addresses as shown in the network topology diagram above. However, do not configure the VRRP addresses.

Figure 39. Physical Network Interfaces on mpp02.example.org

Figure 40. VLAN Network Interfaces on mpp02.example.org
Configure Peer

Navigate to Services | Configuration | Sync | Peer & Federation and configure mpp01 as your peer. We will synchronize via the management network. The field Peer System ID refers to the system ID of mpp01. Copy the ID of mpp01 at System | General | Settings.

Figure 41. Peer & Federation Configuration on mpp02.example.org
Save and activate the new configuration

Now it’s time to go back to mpp01.example.org.

Configure Peer

Configure mpp02 as the mpp01 peer as we did before with mpp02.
Configure VRRP

Navigate to Services | Configuration | VRRP | Service and configure the VRRP daemon.

Figure 42. VRRP Configuration
Re-Configure IP addresses

Head over to System | Network | Interfaces | VLAN and reconfigure the interfaces as follows:

Figure 43. VLAN Configuration on mpp01 with VRRP enabled
Save and activate the new configuration
Restart mpp01

Go back to mpp02.example.org and finish its configuration.

Load synchronized configuration

Navigate to Administration | Manage Config and click Load on the latest synchronized configuration. Verify that the configuration of the VLAN interfaces has been successfully updated.
Enable and configure each service

Navigate through each service and carefully update the fields annotated with the broken chain symbol. In general, you only need to enable the service itself and configure its listening IP address. The remaining settings should be ok. There is an exception. At the VRRP daemon you have to add the tracking interfaces manually.
Save and activate the new configuration
Restart mpp02
Trigger seed

Go to Services | Overview | Sync Neighbors an click Trigger seed next to the hostname mpp01.example.org.

5. What’s New Archive

MPP 8.4

OpenID Connect Authenticator: Claim mpp_target_profile and mpp_session_duration in the UserInfo Response allows the authorization server to define the target profile and session duration for the authenticated user. Refer to Section 2.2.5.1, “OpenID Connect Authenticator” for more information.

MPP 8.3

Miscellaneous: In this version, several bugs were fixed and an upgrade to PostgreSQL 14 and Java 17 was performed.

MPP 8.2

OpenID Connect Authenticator: Added the ability to define custom claims required for login.

MPP 8.1

HTTP/2: MPP 8.1 now supports HTTP/2 for receiving landing pages.
Disable legacy TLS protocols: With this version, TLS 1.0 and 1.1 have been disabled.

MPP 8.0

Upgrade to the latest Ubuntu LTS version: If you upgrade to this release, the MPP will run on Ubuntu 20.04 (Focal Fossa)

5.1. MPP 7.4 - MPP 7.6

Extensions for statistics in onway director: Under the hood a lot of improvements were made for more statistics in the onway director.

5.2. MPP 7.3

QoS per Site: QoS configuration has be enhanced to support QoS per site. Refer to Section 2.2.6, “QoS” for more information.
BGP Service: MPP was extended with the BGP service. The service is configured and controlled by the MPP.
User session statistics: User session history accounting was added as a Remote Server service. The service streams session accounting history data to the onway director.

5.3. MPP 7.2

OpenID Connect Authenticator: We added a OpenID Connect authenticator that allows you to authenticate against an OpenID Connect backend using the Authorization Code Flow. Refer to Section 2.2.5.1, “OpenID Connect Authenticator” for more information.
DHCP Option 82, Relay Agent Information Option Support: Site and docking networks are now independent of each other. Target site to be assigned for a certain docking network, may be configured within the docking network itself. As a second site assignment method, the DHCP relay agent information is configurable for each customer. Pattern for circuit and remote ID may be configured to assign different sites according to the DHCP option 82 identifier match. Refer to Section 2.2.4, “DHCP Option 82 Matches” for more information.
Remote Server: MPP is able to stream data to the onway director, such as SMS accounting. See Section 3.8, “Remote Server” how and when this service is activated.

5.4. MPP 7.1

Session re-validation: The MPP is now able to re-validate ongoing sessions. Thus it is now possible to terminate a running session, e.g. if the user has been locked in the LDAP directory.
HiMed Authenticator: We added a HiMed authenticator that allows you to authenticate against Siemens HiMed. This authenticator must be enabled in application.properties.

5.5. MPP 7.0

Upgrade to the latest Ubuntu LTS version: If you upgrade to this release, the MPP will run on Ubuntu 18.04 (Bionic)

5.6. MPP 6.9

Execute script after applying network configuration: Customer may provide a Bash script under /etc/mpp/after-network-config, which is executed between network and daemon configuration.
Local consumer status: It is now possible to manage local consumers in the manner already known from synchronization consumers.
DHCP pool usage statistics: DHCP pool usage statistics view shows the current number of available and used IP addresses for each docking network.
Notifications: MPP now has a built-in notification system. A new toolbar icon opens the notifications view and informs the administrator of important system events. Notifications can be sent as emails via the MTA.
LDAP/ADS authenticators: Configuration of multiple group distinguished names is possible now. This leads to simpler configurations.

5.7. MPP 6.8

Improve StartTLS security: Peer verification algorithms have been improved to make StartTLS connections more robust.

There may be situations where some authenticators that were previously able to successfully connect to an LDAP or AD server may no longer be able to do so. In most cases, this is the reason because an IP has been specified instead of the fully qualified domain name.

SMS Flood Prevention: A defined time window preset to 1 minute, in which the MPP prevents an SMS from being sent multiple times to the same number and IP address.

5.8. MPP 6.7

API Access: API access is now configurable for each customer in "Network Access" section. Refer to Section 2.2.7, “API Access” for more information.
Device Information: We added a new MPP Client API to gather device information.
Mark Authenticator: We added a Mark authenticator that allows you to set and reset marks for a RememberMe authenticator. A RememberMe authenticator will no longer work, without having a Mark authenticator configured.

5.9. MPP 6.6

Client API: We added a new MPP Client API to manually start and stop user sessions.
Presence Mode: Each site has now a presence mode (DHCP or Traffic) that differentiates whether sessions are managed automatically via DHCP lease or manually via MPP Client API. Refer to Section 2.2.2.1, “Presence Mode” for more information.

5.10. MPP 6.5

RADIUS class attribute: If present the RADIUS authenticator will read and evaluate the RADIUS attribute class (Type 25). Besides, the assigned profile name is signaled via the class attribute during RADIUS accounting.

5.11. MPP 6.4

Network configuration: The systems' network configuration will be written every time you modify the MPP’s network configuration. Thus the server should be reachable even if the MPP is unable to start.
Restrict supported SSL ciphers: With this release, we have dropped some legacy SSL ciphers to protect the MPP against newer SSL attacks.
Synchronization: We did a lot of work to make the MPP synchronization even more reliable.
User session history: We have re-written large parts of the user session history to handle huge repositories with over 30 million entries.

5.12. MPP 6.3

Dashboard: Under Reporting | Dashboard you get a quick overview of the current state of your MPP setup.
Maintenance Mode: It’s now possible to put the MPP into maintenance mode Administration | System Admin. If the system runs in this mode, it won’t handle any DHCP or HTTP client requests. If the MPP runs in a cluster setup, this mode prevents the system from becoming VRRP master. To exit the maintenance mode, you must explicitly deactivate it.
Show current session count via CLI: Call mpp-sessions.py on the MPP CLI, and it will show you the currently active user count.
Copy profile or authentication scheme: Till now it was cumbersome to create a similar authentication scheme. With this release, we introduce a copy functionality for profiles and authentication schemes.
Enforce configured DNS server: If you create or edit a profile, you get a new option called Enforce Configured DNS. If you enable this option the MPP will automatically redirect any TCP and UDP traffic on port 53 to the first DNS configured in your DHCP settings. This feature is only available if the local DHCP server is configured and enabled.

5.13. MPP 6.2

With this version, we introduce a new backup format. Therefore it’s mandatory to create a new backup after a successful upgrade. In addition, you can schedule backup jobs, so you only have to download them but do not need to wait until the backup is ready.

For systems with higher security requirements we support CSRF prevention for any landing page action like login, route, logout, debug and device de-association.

5.14. MPP 6.1

Remember-me authenticator: With this release, we introduce the remember-me authenticator. This authenticator can remember an authentication done by another authenticator. So it’s possible to configure authentication chains where a user needs to authenticate only once a day for example.

5.15. MPP 6.0

SMS Gateway: We’ve switched to our new redundant SMS gateway. To use the new gateway, you have to order credentials for the new one and re-configure any existing SMS configuration.

Open garden scheme: Define open gardens in a scheme and reference that scheme from any profile you want.

Initial seed: Get the initial data like user session history, user account et cetera from you neighbor MPP.

MPP Cluster Coordinator: If you ever wanted to span the same MPP user database over several MPP Clusters our new MPP Cluster Coordinator will be your friend.
Certificates: Support for certificates without a common name

5.16. MPP 5.6

SMS Statistics: We’ve added a new view that shows how many SMS have been sent by which gateway to which country.
Failed Retries Authenticator: The Failed Retries Authenticator now counts sent SMS and block if the limit gets reached.
Expand/Collapse Firewall Rules: Add ability to expand/collapse all firewall rules with one click.
Authentication Endpoints per FQDN: It is now possible to configure authentication endpoints like LDAP servers by its FQDN instead of its IP address.
DHCP hosts: It’s now possible to configure static IP assignments per site.
SMS statistics: We introduced detailed SMS statistics per SMS gateway. You’ll find the report at Reporting | SMS Statistics.

5.17. MPP 5.5

Since version 5.5.0 the MPP runs on the Ubuntu LTS 16.04 release with Linux Kernel 4.4.

QoS: With this release, it’s possible to rate a client by Customer, Profile or MAC address.
Kernel Subsystem: With this release we retired the Sioux Daemon and replaced its functionality with three new Daemons: Lawful Interception, Snoopy and Netmaid
Metered Device Authenticator: In addition to the existing metering mode Time we’ve added the new mode Traffic. This mode allows you to terminate a session if the client hits either the download limit or the upload limit.
KeepaliveD: Upgrade to version 1.3.4

6. Changelog

6.1. MPP 8.5.0

Release: February 22, 2022

Story

[MPP-2039] - Validate nonce claim in ID token
[MPP-2040] - Support PKCE
[MPP-2045] - Remove linked data when OpenID refresh token is invalid

Bug

[MPP-2038] - Linked information not updated
[MPP-2043] - Many user_session with duration = 0
[MPP-2044] - Seed of sms_gateway_statistic fails
[MPP-2046] - MPP may not be restarted after Kafka upgrade
[MPP-2050] - Postgres commands must not use more connections than configured

Task

[MPP-2042] - Use new favicon

6.2. MPP 8.4.0

Release: December 6, 2021

Story

[MPP-2030] - OpenID Connect Claim to define target profile
[MPP-2031] - OpenID Connect Claim to define session duration

Task

[MPP-2035] - Allow rejection of an inactive remote user

Bug

[MPP-2032] - Shutdown keepalived on status failures
[MPP-2033] - Dynamic selection of the verification algorithm
[MPP-2034] - Netmaid configuration is not updated

6.3. MPP 8.3.0

Release: November 16, 2021

Story

[MPP-2025] - Document API to save and activate a new configuration

Bug

[MPP-2021] - Broken backup status (de-)serialization of AsyncTaskServiceStatus
[MPP-2022] - Unable to create or update a customer
[MPP-2023] - Footer overlaps select option
[MPP-2026] - Restart snmpd service on failure
[MPP-2027] - Allow trailing slash in MPP URL class

Task

[MPP-2024] - mpp-remote-server should depend on kafka
[MPP-2028] - Upgrade to PostgreSQL 14
[MPP-2029] - Upgrade to Java 17

6.4. MPP 8.2.0

Release: August 30, 2021

Story

[MPP-2016] - Allow definition of user-defined required claims

Bug

[MPP-2018] - Prevent DHCP messages from being processed multiple times
[MPP-2019] - Broken MPP backup restore

6.5. MPP 8.1.0

Release: May 18, 2021

Task

[MPP-2007] - Disable TLS 1.0 and TLS 1.1 in Nginx configuration
[MPP-2008] - Enable HTTP/2 in Nginx configuration

Bug

[MPP-2006] - Keepalived requires at least one virtual IP
[MPP-2009] - Expired sessions are not cleaned up
[MPP-2011] - Running session is not stopped when device is created via sync handler
[MPP-2013] - Unable to install certificate without common name

6.6. MPP 8.0.1

Release: April 20, 2021

Bug

[MPP-2012] - Broken user account linked data serialization

6.7. MPP 8.0.0

Release: March 7, 2021

Story

[MPP-1999] - Extend DHCP lease with optional gateway attribute
[MPP-2000] - Log OpenID Connect requests
[MPP-2001] - Stop running session when the device is created
[MPP-2003] - Ubuntu 20.04 upgrade

Bug

[MPP-2004] - Session log is flooded when inserting sessions

Task

[MPP-1981] - Upgrade to keepalived 2.1.5
[MPP-1982] - Remove deprecated HelloSyncMessageHandler

6.8. MPP 7.6.6

Release: October 28, 2020

Task

[MPP-1995] - Add request logging OpenID Connect service

Bug

[MPP-1994] - Username is empty

6.9. MPP 7.6.5

Release: August 28, 2020

Bug

[MPP-1990] - Insufficient backup file validation
[MPP-1992] - Offset calculation is wrong

Story

[MPP-1991] - Kafka consumers should retry if they fail

6.10. MPP 7.6.4

Release: August 10, 2020

Bug

[MPP-1988] - HTTP Post variable handling leaks memory

6.11. MPP 7.6.3

Release: July 28, 2020

Bug

Fix MPP remote library version mismatch

6.12. MPP 7.6.2

Release: July 27, 2020

Bug

[MPP-1987] - Whitespaces in form input are not correctly decoded

6.13. MPP 7.6.1

Release: July 9, 2020

Bug

[MPP-1984] - Iterating large DB tables may cause OME

6.14. MPP 7.6.0

Release: July 7, 2020

Bug

[MPP-1975] - Message processing is stopped at network partitioning

6.15. MPP 7.5.2

Release: June 11, 2020

Bug

[MPP-1972] - User Device last seen not updated
[MPP-1973] - User device of long running session can be deleted
[MPP-1974] - Remaining sync messages may be skipped

6.16. MPP 7.5.1

Release: June 7, 2020

Bug

[MPP-1971] - Intermediate session updates are not published

6.17. MPP 7.5.0

Release: June 3, 2020

Bug

[MPP-1967] - Unable to delete VLAN interface when VRRP instance is not configured

Story

[MPP-1968] - Intermediate session accounting updates
[MPP-1969] - Extend published user session
[MPP-1970] - Extend published MPP site

6.18. MPP 7.4.0

Release: March 16, 2020

Task

[MPP-1953] - Requests from clients without a session should always be logged
[MPP-1960] - Remove invalid Open ID connect refresh token from user account
[MPP-1962] - Add service id mapping to DsiRedirectService

Bug

[MPP-1945] - NPE in VlanNetworkInterfaceConfigController
[MPP-1950] - Empty exaBGB status info in service view
[MPP-1951] - Broken age validation in HiMedAuthenticator
[MPP-1952] - Empty username causes log warn entry in session.log
[MPP-1957] - Broken request validation in SiteBulkController
[MPP-1958] - Link to mozilla 'What is OCSP stapling?' doesn’t explain the question
[MPP-1959] - Service Warning not displayed in Dashboard Federation Summary
[MPP-1961] - Avoid IllegalArgumentException in OpenID Connect error handler

Story

[MPP-1947] - DSI service to publish configured customers
[MPP-1948] - DSI service to publish configured sites
[MPP-1949] - DSI service to publish configured profiles
[MPP-1955] - DSI service to publish configured SMS gateways
[MPP-1956] - Extend sms accounter with gateway id and site id

6.19. MPP 7.3.0

Release: January 11, 2020

Task

[MPP-1937] - Log if MPP ignores SeekRequest
[MPP-1941] - Change config: remote server sms accounting service
[MPP-1942] - Change default SMS text messages

Bug

[MPP-1938] - KafkaOffsetChecker fails if federation name is configured without cluster coordinators

Story

[MPP-1862] - Add a new user session accounter for the Sponsoring Portal
[MPP-1894] - Enhance the QoS capabilities of MPP
[MPP-1934] - BGP support

6.20. MPP 7.2.0

Release: December 06, 2019

Task

[MPP-1906] - Make MPP Remote Server configurable
[MPP-1910] - Log API calls to a dedicated log file
[MPP-1919] - Upgrade to Spring Boot 2.2.0
[MPP-1920] - Upgrade MPP to PostgreSQL 12
[MPP-1926] - Add session id to Syslog- and LogfileAccounter
[MPP-1927] - Shuffle authentication endpoints before authentication
[MPP-1928] - Delay the offset warning state by counter and time
[MPP-1929] - Implement netmaid target CT
[MPP-1930] - Support pptp and sip connection tracking
[MPP-1932] - Log DHCP option 82 info via Syslog and into local file
[MPP-1933] - Cleanup LI logfiles after data retention time

Bug

[MPP-1715] - Handle deconfigured or removed physical network interface
[MPP-1885] - Failed retries authenticator blocks only once in SMS authenticator
[MPP-1890] - MPP CC starts snoopy client when disabling maintenance mode
[MPP-1891] - Local Kafka topics are federated on MPP CC
[MPP-1901] - Disabled user can login trough remote validation
[MPP-1902] - Skip synced RunningUserSession if Device is missing in federation mode
[MPP-1905] - Kafka Unknown producer id
[MPP-1909] - NPE in authentication processor MDA logout handler
[MPP-1913] - Remove accounting data when a device is being deleted
[MPP-1915] - Missing number of MACs in LOCAL_DB authentication scheme overview
[MPP-1923] - BackoffRetryStrategy looses configured delay after reset
[MPP-1925] - Syslog- and LogfileAccounter have incorrect traffic values

Story

[MPP-1863] - Implement SMS accounter for the Sponsoring Portal
[MPP-1879] - Bootstrap an MPP remote client application
[MPP-1880] - Service layer to handle SMS accounting data
[MPP-1881] - Bootstrap an MPP remote server application
[MPP-1887] - Calculate SMS statistics to visualize the sent SMS
[MPP-1888] - SMS statistics cleanup
[MPP-1892] - Migros OpenID Connect authenticator
[MPP-1895] - Make the site and docking network configuration independent of each other
[MPP-1897] - DHCP option 82 configuration
[MPP-1898] - Site assignment based on DHCP option 82
[MPP-1900] - Remove SWITCH PWLAN functionality
[MPP-1911] - Extend our public API to handle route session requests
[MPP-1912] - QoS must comply with the rate limits defined on the parent interface
[MPP-1914] - Stop running session when the device is removed

6.21. MPP 7.1.2

Release: August 30, 2019

Bug

[MPP-1876] - Unformatted build date in console footer
[MPP-1882] - Unable to add open garden entry when comment is too long
[MPP-1883] - Running session may have an unsupported language after config apply
[MPP-1886] - Mail delivery fails with connection type plain text
[MPP-1896] - Wrong linked user Id in RegisteredUserDeviceSyncResource converter
[MPP-1908] - Client IP not set in NAT pool rule

6.22. MPP 7.1.1

Release: February 27, 2019

Bug

[MPP-1872] - Session end time of remembered sessions should not be unlimited
[MPP-1873] - Using StartTLS for LDAP/AD authenticator leads to a memory leak
[MPP-1874] - If multiple DHCP scopes are defined, the static DHCP hosts will not receive a gateway IP

6.23. MPP 7.1.0

Release: February 04, 2019

Bug

[MPP-1866] - User account detail pane formatting error
[MPP-1869] - Sms should only be synced between cluster neighbors
[MPP-1870] - KafkaOffsetChecker requests local topics from cluster neighbor

Story

[MPP-1767] - Authenticator to authenticate against Siemens HiMed
[MPP-1768] - Detect access via HiMed terminal and show special page
[MPP-1864] - Add management for remote peers

6.24. MPP 7.0.0

Release: December 07, 2018

Task

[MPP-1843] - Upgrade to Ubuntu 18.04
[MPP-1844] - Upgrade to PostgreSQL 10
[MPP-1845] - Upgrade to Java 11
[MPP-1860] - Upgrade to Kafka 2.1.0
[MPP-1861] - Upgrade to Elasticsearch 6.5.1

Bug

[MPP-1865] - Cluster coordinator sync state warning

6.25. MPP 6.9.1

Release: November 29, 2018

Task

[MPP-1851] - Order DHCP Pool Usage Statistic by Highest Usage column

Bug

[MPP-1835] - Increase MPP restore file limit
[MPP-1846] - Invalid message on Administration / Sync Config view
[MPP-1847] - Fix calendar component
[MPP-1848] - Fix setting the actual user language
[MPP-1849] - Create backup may fail with execution timeout exception
[MPP-1852] - DHCP Usage statistics memory overflow

6.26. MPP 6.9.0

Release: November 13, 2018

Task

[MPP-1790] - Reduce MPP memory requirements
[MPP-1802] - Use the latest RESTclient capabilities from elasticsearch

Bug

[MPP-1779] - FQDN/IP Address validator issue
[MPP-1781] - DHCP circuit and remote ID may have non-printable characters
[MPP-1789] - Retain the maintenance mode after the seed has ended
[MPP-1793] - Missing URL host validation
[MPP-1801] - RADIUS authenticator does not support hostname
[MPP-1812] - Elasticsearch connect exception after MPP system restart
[MPP-1815] - Fix ADS/LDAP group membership check
[MPP-1817] - Stop the Keepalived before the configuration is activated
[MPP-1822] - Update max offset of every local topic
[MPP-1825] - EMail notification improvements
[MPP-1826] - Rendering issues of the user-account list view on IE11
[MPP-1832] - Broken /reporting/performance views on ie 11
[MPP-1833] - Bootstap MPP shutdown
[MPP-1834] - Fix system forward rule
[MPP-1837] - Handling new SNMP status when Keepalived is not running

Story

[MPP-1769] - Group user accounts by validity
[MPP-1780] - Flag to globally force the customer’s default redirection URL
[MPP-1782] - Show 3rd party licenses on the support page
[MPP-1783] - Show current user and registered device count per customer
[MPP-1786] - Show valid to information on the user account index page
[MPP-1787] - Prevent users from getting higher access rights
[MPP-1791] - Execute script after applying network configuration
[MPP-1792] - Allow multiple hosts for LDAP, AD and RADIUS authenticators
[MPP-1794] - "Hidden" Kafka topics are stuck
[MPP-1796] - Set HSTS header if configured
[MPP-1797] - Show DHCP pool usage
[MPP-1803] - Introduce system notification center
[MPP-1804] - Send notifications by email
[MPP-1805] - Add notification if a newer MPP version is available
[MPP-1806] - Add a notification when a threshold is hit by a DHCP scope
[MPP-1814] - Add a notification on VRRP transitions
[MPP-1816] - Add support for multiple LDAP/ADS group checks
[MPP-1823] - Add notification on global sync state transitions
[MPP-1829] - Add option to mark all notifications as read

6.27. MPP 6.8.2

Release: September 26, 2018

Bug

[MPP-1800] - Make IPset table size configurable

6.28. MPP 6.8.1

Release: September 1, 2018

Bug

[MPP-1778] - Do not track listening VRRP interface

6.29. MPP 6.8.0

Release: August 31, 2018

Task

[MPP-1757] - Show not running service names in dashboard tooltip
[MPP-1766] - Upgrade to Keepalived 2.0.7
[MPP-1770] - Upgrade to Kafka 2.0.0

Bug

[MPP-1733] - No error for invalid nginx config
[MPP-1734] - Delete old certificates
[MPP-1736] - Kafka topic with wrong broker ID if CC is rebooted before broker ID is configured
[MPP-1753] - Chat topic should never block
[MPP-1756] - Service API /device/information might fail
[MPP-1758] - Prohibit empty GIT commits
[MPP-1762] - Save & Activate might fail with 'Reset network failed'
[MPP-1763] - Binding result is mapped to a wrong variable
[MPP-1764] - Broken MPP 5 to 6 upgrade
[MPP-1771] - LDAP/AD authenticator does not validate the peer correctly

Story

[MPP-1772] - Prevent SMS flooding
[MPP-1777] - Index NAT IP addresses

6.30. MPP 6.7.1

Release: June 1, 2018

Bug

[MPP-1750] - GUI error in the extended API access view
[MPP-1755] - Ldap Authentication fails with [LDAP: error code 3 - Timelimit Exceeded]

6.31. MPP 6.7.0

Released: May 18, 2018

Task

[MPP-1738] - Upgrade to Kafka 1.1.0
[MPP-1739] - Upgrade to Spring Boot 2.0.2
[MPP-1741] - Upgrade to Keepalived 1.4.3
[MPP-1742] - Indicate unsaved config changes in MPP console
[MPP-1746] - Upgrade to ZooKeeper 3.4.12

Bug

[MPP-1740] - Resolved IPv6 addresses are logged as a warning
[MPP-1747] - The usage of DHCP hosts produces Syslog warnings, saying that there are overlapping networks
[MPP-1748] - Asset path module doesn’t get rendered, if there are no assets

Story

[MPP-1743] - Provide an API to request device information
[MPP-1744] - Ability to show a landing-page to unknown devices
[MPP-1745] - Authenticator to reset a specific remember-me mark

6.32. MPP 6.6.0

Released: April 6, 2018

Task

[MPP-1612] - Update documentation

Bug

[MPP-1725] - Delete user accounts after data retention time if they were created automatically
[MPP-1730] - Registered user device cleanup task
[MPP-1731] - User device cleanup task
[MPP-1732] - DHCP scope definition may contain network or broadcast address
[MPP-1737] - Allow ICMP and VRRP between sync peers

Story

[MPP-1690] - REST interface to start and stop sessions
[MPP-1727] - Drop network services
[MPP-1728] - Add comment field for DHCP host entries

6.33. MPP 6.5.2

Released: March 15, 2018

Task

[MPP-1722] - Upgrade to Kafka 1.0.1

Bug

[MPP-1696] - Close DB connection if the running thread gets interrupted
[MPP-1706] - Prevent same landing page and redirect URL
[MPP-1707] - Landing page URL must be unique
[MPP-1712] - Load and activate of manually created config version fails
[MPP-1713] - Cluster coordinator startup failed
[MPP-1716] - M2M log dispatcher fails
[MPP-1717] - Last seen of user account set to null on edit
[MPP-1718] - Last seen of running is incorrectly updated
[MPP-1719] - User account that is valid forever must remain
[MPP-1720] - If an interface is deleted, the configured QoS rule stays
[MPP-1723] - Broken MPP views on IE11

Story

[MPP-1721] - Bundle MPP documentation with MPP Debian package

6.34. MPP 6.5.1

Released: March 6, 2018

Bug

[MPP-1714] - Broken SbbM2mImportAppCfg

6.35. MPP 6.5.0

Released: March 2, 2018

Task

[MPP-1698] - Set offset reset policy for chat topics
[MPP-1701] - Upgrade to keepalived 1.4.2
[MPP-1711] - Respect provided languages in actual language evaluation

Bug

[MPP-1695] - Revived RunningUserSessions should not be synced
[MPP-1697] - Broken SBB user import feature
[MPP-1700] - Inconsistent RADIUS attribute value encoding
[MPP-1704] - Revision not set in insert statements
[MPP-1705] - Wrong revision in synced entity
[MPP-1708] - Site bulk controller is not customer aware
[MPP-1709] - Remember me table is missing in seed
[MPP-1710] - Race condition in VLAN interface configuration

Story

[MPP-1680] - Make LDAP logging cleaner
[MPP-1683] - DHCP Relay Built-In Network Service
[MPP-1688] - Extend RADIUS authenticator to support group membership
[MPP-1689] - Provide information about assigned profile in RADIUS accounting

6.36. MPP 6.4.1

Released: February 22, 2018

Bug

[MPP-1229] - Visualization issues of failed "save" config attempts
[MPP-1672] - Save & Activate invalid config
[MPP-1684] - Prevent FQDN open gardens if local DNS server is not running
[MPP-1685] - Redirect to landing page url should not be possible if no template bundle is defined
[MPP-1687] - Stop database cleanup during seed
[MPP-1693] - No available DB connections during VACUUM of user_session table
[MPP-1694] - Double accounting on backup and sync back to master

Story

[MPP-1691] - Skip synced RunningUserSession if Device is missing in cluster mode

6.37. MPP 6.4.0

Released: February 14, 2018

Task

[MPP-1647] - Upgrade to Apache Velocity Engine 2.0

Bug

[MPP-1631] - Loading of a synchronized configuration with a newer version must not be possible
[MPP-1636] - During a config save/load, all buttons should be inactive
[MPP-1643] - Dashboard summary session count coloring is not federation aware
[MPP-1650] - Registered user device and user account repository doesn’t support customer key change
[MPP-1655] - TaskService may time out during shutdown
[MPP-1658] - Recover from publish failure
[MPP-1663] - VRRP isn’t started if peer is offline
[MPP-1665] - Sync state doesn’t switch to error when system is outdated
[MPP-1666] - Broken user session history pagination
[MPP-1668] - FW rule conversion throws several NPE
[MPP-1669] - Open garden update process is not configuration life-cycle aware
[MPP-1671] - FW pre-routing rule DNAT target destination port range only for tcp and udp
[MPP-1673] - Missing config validation in system agent controller
[MPP-1674] - ifup may fail on persisted vlan network interface
[MPP-1675] - Remember-Me is broken
[MPP-1678] - Make traffic counter collector task life-cycle aware

Sub-task

[MPP-1651] - Re-index after seed
[MPP-1652] - Re-index after restore
[MPP-1653] - Add ability to re-index via web console

Story

[MPP-1630] - Persist network interface configuration
[MPP-1633] - Show maintenance mode in dashboard
[MPP-1634] - Improve user session search
[MPP-1638] - Defer VRRP start till MPP sync state is OK
[MPP-1639] - Sort dashboard entries by master’s hostname
[MPP-1641] - Keep existing registered user devices during merge
[MPP-1642] - Try to recover a synchronized orphaned registered user device
[MPP-1644] - Generate mpp package via Maven
[MPP-1645] - Write accounting log file on backup system too
[MPP-1649] - Show meta bar on the dashboard
[MPP-1654] - Check VRRP source address of unicast packets
[MPP-1659] - Make postgres server configurable
[MPP-1660] - Report sync health state via health script
[MPP-1661] - Report Elasticsearch’s health state via health script
[MPP-1662] - Drop fk_user_session_psid and refactor forEach
[MPP-1664] - Vacuum user database tables after cleanup
[MPP-1667] - Reorder firewall fields
[MPP-1676] - Restrict supported SSL ciphers

6.38. MPP 6.3.2

Released: December 5, 2017

Bug

[MPP-1637] - Skip registered user device of locally unknown user account

6.39. MPP 6.3.1

Released: November 30, 2017

Bug

[MPP-1635] - Broken config upgrade due to duplicate config version 9

6.40. MPP 6.3.0

Released: November 30, 2017

Task

[MPP-1613] - Upgrade to Kafka 1.0

Bug

[MPP-1618] - Package python3-requests is missing
[MPP-1626] - Profile view broken
[MPP-1629] - It is not possible to register the same MAC address at two different customers

Story

[MPP-1099] - Dashboard
[MPP-1608] - Maintenance Mode
[MPP-1609] - Defer VRRP state transition to Master
[MPP-1611] - Optimize MPP site bulk import
[MPP-1619] - Run session-count.py without authentication
[MPP-1620] - Copy authentication scheme
[MPP-1621] - Prevent profile deletion if profile is used as target profile
[MPP-1624] - Copy profile
[MPP-1625] - Enforce configured DNS server
[MPP-1627] - Show action URLs in profile view
[MPP-1628] - Improve description of cron fields

6.41. MPP 6.2.0

Released: November 2, 2017

Task

[MPP-1601] - Ensure that the MPP package depends on Ubuntu 16.04
[MPP-1602] - Upgrade to keepalived 1.3.9

Bug

[MPP-1540] - Metric batch insert may fail
[MPP-1548] - Handle DHCP RELEASE message without IP address
[MPP-1560] - IPset does not support prefixes lower than 1 for network definitions
[MPP-1563] - Wrong offset in TopicMirror
[MPP-1565] - Inconsistent running user session repo
[MPP-1570] - MDA should only block if the target/current profile is one of his metered profiles
[MPP-1581] - compareTo in model objects
[MPP-1582] - Load old config version creates new commit
[MPP-1584] - Performance Graphs use edit config instead of running config
[MPP-1585] - Overlay error in DateTimeControl
[MPP-1586] - Anonymous profile in customer edit view is not selected if a different customer is selected in the customer switch
[MPP-1587] - Do not write db dump file into the persistent (config) directory during a backup task
[MPP-1591] - Fix React key-prop warnings when using Format.CollectionAsDelimitedElement()
[MPP-1596] - Not all MPP service daemons disabled on system start
[MPP-1600] - Warning state for Kafka and Zookeeper on single MPP installations
[MPP-1603] - Do not sync termination request of orphaned sessions
[MPP-1604] - Metric PK constraint error after daylight saving

Sub-task

[MPP-1592] - MDA invalidateAt from cron expression

Story

[MPP-1019] - Store search query and pagination params in URL
[MPP-1020] - Store pagination params into URL
[MPP-1152] - Refactor Backup/Restore
[MPP-1530] - Use Kafka for accounting messages
[MPP-1535] - Do not terminate running user sessions on shutdown if peer is in backup state
[MPP-1536] - Delete orphaned seed topics during startup
[MPP-1561] - MAC authenticator must register as filter
[MPP-1562] - Local database authenticator must register as filter
[MPP-1572] - Use seek for session history view
[MPP-1573] - Session revive must validate session params
[MPP-1575] - Use Kafka for metric messages
[MPP-1577] - Log wrong password in authenticators
[MPP-1578] - Store persistent configuration human readable
[MPP-1579] - /var/lib/mpp is readable for everyone
[MPP-1588] - Make system mail alias configurable
[MPP-1589] - Allow cron expression in MDA’s and Remember-Me fixed reset strategy
[MPP-1590] - Schedule backup task
[MPP-1597] - Allow option that authentication endpoint updates user group
[MPP-1598] - Delete device registration by calling MPP web endpoint
[MPP-1599] - Protect authentication requests with CSRF tokens
[MPP-1610] - Provide template variable to identify user or device

6.42. MPP 6.1.0

Released: September 29, 2017

Task

[MPP-1545] - Upgrade Kafka to 0.11.0.1
[MPP-1552] - Remove "terms accepted" field in running sessions view
[MPP-1555] - SBB Statistics

Bug

[MPP-1538] - Seeder and leecher dies if seeder seeds already
[MPP-1542] - Firefox shows always first template asset path as selected
[MPP-1543] - Daemon linda runs on MPP CC even if trafficTracking is false
[MPP-1544] - MPP shutdown may hang
[MPP-1546] - Seeding of SMS statistics fails
[MPP-1547] - User session and sms statistics is not seeded to cluster peer if in federation
[MPP-1549] - Time-out of built-in accounting endpoints is too low
[MPP-1550] - User ID in user data token must be anonymized
[MPP-1551] - Potential missing foreign key after seed
[MPP-1554] - MAC authenticator’s session duration must depend on valid for and device registration at field
[MPP-1564] - Updated username in DHCP and logout token is not synced

Story

[MPP-1233] - Ignore RunningSession updates older than hello packet
[MPP-1528] - Show user accounts by group
[MPP-1529] - Authentication filters must be persistent
[MPP-1532] - Group sync neighbors by cluster
[MPP-1533] - Defer sync warning state when waiting
[MPP-1537] - Prompt user before triggering seed
[MPP-1539] - Stop keepalived while leeching
[MPP-1553] - Remember-me authenticator

6.43. MPP 6.0.4

Released: September 19, 2017

Bug

[MPP-1550] - User ID in user data token must be anonymized

6.44. MPP 6.0.3

Released: September 18, 2017

Bug

[MPP-1546] - Seeding of SMS statistics fails
[MPP-1547] - User session and sms statistics is not seeded to cluster peer if in federation

6.45. MPP 6.0.2

Released: September 10, 2017

Bug

[MPP-1534] - During the nightly cleanup any registered user device gets deleted

6.46. MPP 6.0.1

Released: September 8, 2017

Bug

[MPP-1523] - Virtual IP addresses should only be available, when VRRP instance is configured
[MPP-1524] - Open garden scheme drop-down is empty if you create a new profile
[MPP-1525] - When creating a new profile the authentication/accounting scheme (none) must be selected
[MPP-1526] - Fix broken links to peer-federation view
[MPP-1527] - Translated address must be permanent

Story

[MPP-1509] - Change MAC authenticator validity time unit
[MPP-1511] - Upgrade to keepalived 1.3.6
[MPP-1512] - Improve running session sync
[MPP-1520] - Use generated broker id of Kafka
[MPP-1521] - Configure broker id only once
[MPP-1522] - Move state and offset handling to consumer/producer

6.47. MPP 6.0.0

Released: September 4, 2017

Task

[MPP-1499] - Disable IPv6 via sysctl
[MPP-1503] - Remove the word "Kafka" from sync status view

Bug

[MPP-1214] - Configure Kafka only if necessary
[MPP-1465] - Site header format is wrong
[MPP-1466] - Profile header format is wrong
[MPP-1467] - NPE in Metered Device Authenticator configuration view
[MPP-1468] - It’s possible to delete a profile that is referenced in a profile QoS rule
[MPP-1469] - Configuring a VLAN during setup does not work
[MPP-1474] - Unusual exponential certificate serial representation
[MPP-1476] - Wrong resolver seperator produced by setup UI
[MPP-1477] - Broken resolver validation in setup UI
[MPP-1478] - Prevent concurrent edit config modifications in Controllers
[MPP-1479] - NGINX delivers page assets from wrong (editable) directory
[MPP-1482] - Inconsistent RunningSessionRepository
[MPP-1490] - SMS authenticator may take wrong configuration to rememeber MAC
[MPP-1491] - Old user input error after business hours and failed retries auth
[MPP-1492] - Route authenticator sets user input error
[MPP-1496] - Strange behavior on network services synchronization
[MPP-1501] - Broken redirect in authenticated profile
[MPP-1507] - Keep user data on MDA session migration
[MPP-1508] - Update session traffic counters on the backup system
[MPP-1510] - Static config initializer configures eth0 as primary interface

Sub-task

[MPP-1458] - Check reference from network service to open garden

Epic

[MPP-1345] - MPP Federation
[MPP-1504] - MPP Cluster Coordinator

Story

[MPP-1028] - Kafka management client
[MPP-1156] - Introduce Kafka to system agent
[MPP-1230] - Send hello packages to Federation peers
[MPP-1262] - FQDN based open garden
[MPP-1263] - Flag to automatically open garden CRL and OCSP URLs
[MPP-1396] - Use revision to identify newer messages
[MPP-1397] - Configure Federation data consumption from MPP CC
[MPP-1419] - Open Gardens
[MPP-1449] - Introduce MPP communication as network service
[MPP-1450] - Introduce a language variable for redirect URLs
[MPP-1451] - Apply saved configuration without commit
[MPP-1452] - Use sms.cloudguard.ch as new SMS gateway
[MPP-1459] - Optimize database cleanup
[MPP-1460] - Make authenticator graphs customer aware and group them by scheme
[MPP-1461] - Make accounter graphs customer aware and group them by scheme
[MPP-1462] - Make the profile performance graphs customer aware
[MPP-1463] - Make session history customer aware
[MPP-1464] - Make running session view customer aware
[MPP-1470] - Refactor SMS templates view
[MPP-1471] - Configure JOOQ code generator
[MPP-1472] - Drop dummy repositories
[MPP-1473] - Use generated table and field declarations by jooq
[MPP-1475] - Allow all protocols for open gardens
[MPP-1480] - Configurable Password Policy
[MPP-1484] - Expand-/Collapse all SMS voucher
[MPP-1486] - Use Kafka for cluster synchronization
[MPP-1487] - Seed
[MPP-1488] - Publish Federation data to MPP CC
[MPP-1489] - Make sync peer source address configurable
[MPP-1493] - Upgrade to keepalived 1.3.5
[MPP-1495] - Remove vouchers after data retention time
[MPP-1497] - Define shared secret per customer
[MPP-1498] - Template variable to exchange sensitive user data
[MPP-1502] - Ensure max offset is at least equal to current offset
[MPP-1505] - Differ between MPP and MPP CC
[MPP-1506] - Configure Kafka and Zookeeper
[MPP-1513] - Configure kafka’s compression mode
[MPP-1514] - Configure Kafka’s topic retention times

6.48. MPP 5.6.4

Released: July 19, 2017

Bug

[MPP-1422] - Prevent concurrent edit config modifications
[MPP-1443] - Fix MPP 4.x importer

Story

[MPP-1428] - Redesign template bundle view
[MPP-1430] - Refactor Site view
[MPP-1444] - Refactor profile view
[MPP-1445] - Speed-up site validation
[MPP-1446] - Increase SMS resolution to one day
[MPP-1447] - Externalize application.properties
[MPP-1448] - Define core constants in application.properties
[MPP-1453] - Make remaining data volume variable human readable

6.49. MPP 5.6.3

Released: July 9, 2017

Bug

[MPP-1429] - User account view is really slow
[MPP-1436] - Use upsert for user device creation
[MPP-1439] - Deserialization of CoreAuthState is wrong when traffic MDA is active
[MPP-1440] - MeteredDeviceTrafficAccounting sync messages are not being processed

Story

[MPP-1441] - Introduce template variables to show remaining traffic count on the landing page

6.50. MPP 5.6.2

Released: July 7, 2017

Bug

[MPP-1434] - SMS synchronization must only sync increments
[MPP-1435] - Fix PA bug
[MPP-1438] - Direct field access error on DTO validation error

Story

[MPP-1357] - DHCP hosts
[MPP-1427] - Define provided languages per customer
[MPP-1437] - Use "GIN" for user account search

6.51. MPP 5.6.0

Released: May 31, 2017

Task

[MPP-1421] - Increase datapoint padding speed

Bug

[MPP-1432] - Snoopy DHCP leaseDuration is optional
[MPP-1433] - UserDeviceService may not find a UserDevice

Sub-task

[MPP-1413] - SMS gateway repository and service
[MPP-1414] - Use service from our 3 gateways
[MPP-1415] - Controller and DTO’s
[MPP-1416] - Create View/GUI
[MPP-1417] - Database cleanup
[MPP-1418] - Sync
[MPP-1420] - Journal

Epic

[MPP-1346] - User migrator

Story

[MPP-996] - Show SMS statistics
[MPP-1317] - Define Monday as first day in week in day picker
[MPP-1337] - Increase max allowed authentication timeout
[MPP-1358] - Set default country code
[MPP-1361] - Allow remote authentication hosts to be entered as IP or hostname
[MPP-1392] - Make firewall comment in list view searchable
[MPP-1395] - Standalone Utility to import MPP 4.1-SBB users into MPP 5.x
[MPP-1404] - Limit SMS count per session

6.52. MPP 5.5.0

Released: May 22, 2017

Bug

[MPP-1370] - Upgrade keepalived config to v1.3.4
[MPP-1372] - Interfaces are not selectable anymore after changing to new interface naming
[MPP-1373] - No redirect for clients due to too many concurrent logins
[MPP-1398] - Netmaid client stop errors
[MPP-1400] - Chart tooltips are not visible anymore

Sub-task

[MPP-1410] - Customer rate limit GUI Backend
[MPP-1411] - Profile rate limit GUI Backend

Epic

[MPP-1340] - Upgrade operating system to Ubuntu 16.04 LTS with Kernel 4.4
[MPP-1341] - Introduce snoopy and linda
[MPP-1342] - Use netmaid to communicate with Netfilter
[MPP-1343] - Extend MPP with QoS functionalities

Story

[MPP-1074] - Migrate MPP 5.4 to MPP 5.5 on Ubuntu 16.04 LTS
[MPP-1079] - Move sysctl settings from sioux to mpp package
[MPP-1154] - Upgrade JOOQ’s PostgeSQL dialect
[MPP-1161] - System rate limit
[MPP-1261] - Build custom isc-dhcp packges for Ubuntu 16.04
[MPP-1318] - Limit CGS SMS gateway originator to 11 ASCII characters
[MPP-1326] - Upgrade to NodeJS v6.x LTS
[MPP-1344] - Convert SystemV init scripts to Systemd
[MPP-1347] - Integrate snoopy
[MPP-1348] - Integrate linda
[MPP-1349] - Integrate netmaid
[MPP-1350] - Upgrade installation CD to FAI 5.x and Ubuntu 16.04 LTS
[MPP-1351] - Build Sioux Package for Ubuntu 16.04 LTS
[MPP-1352] - Customer rate limit
[MPP-1353] - Profile rate limit
[MPP-1354] - Site rate limit
[MPP-1355] - Device rate limit
[MPP-1356] - Metered device/user authenticator
[MPP-1362] - Prepare clean VM container based on Ubuntu 16.04
[MPP-1363] - Build custom keepalived package for Ubuntu 16.04
[MPP-1376] - Netmaid Client
[MPP-1377] - Set hostname by System-Agent
[MPP-1378] - Collect CPU data via Netmaid
[MPP-1379] - Collect memory data via Netmaid
[MPP-1380] - Collect load data via Netmaid
[MPP-1381] - Netmaid link handler
[MPP-1382] - Netmaid address handler
[MPP-1383] - Netmaid rule handler
[MPP-1384] - Netmaid route handler
[MPP-1385] - Netmaid conntrack handler
[MPP-1386] - Netmaid ipset handler
[MPP-1387] - Netmaid netfilter handler
[MPP-1388] - Replace Sioux’s session handling code
[MPP-1389] - Replace Sioux’s traffic accounting code
[MPP-1390] - Remove Sioux code
[MPP-1393] - Netmaid netsched handler
[MPP-1394] - Standalone Utility to import MPP 3.7 users into MPP 5.x
[MPP-1409] - Configure DHCP transport network if necessary
[MPP-1412] - Delete conntrack entries by CONNMARK

6.53. MPP 5.4.2

Released: March 3, 2017

Bug

[MPP-1364] - DatabaseCleanupTask very slow
[MPP-1365] - foreach methods in repositories load the entire table into memory
[MPP-1366] - Zip method tries to load the entire file into memory
[MPP-1367] - File upload size limit and timeout
[MPP-1368] - 'Add new Site' does not work in IE11

6.54. MPP 5.4.0

Released: January 12, 2017

Bug

[MPP-1315] - Invalid config after v5.x to v5.3 upgrade
[MPP-1319] - Only one certificate for each common name configurable
[MPP-1320] - Infinite connection timeout on cloudguard SMS gateway
[MPP-1323] - Missing certificate private key lengh attribute in detail pane
[MPP-1325] - Wrong broken chain symbol in client route edit view
[MPP-1329] - Missing mobile number support in landing page templates
[MPP-1332] - Allow search by linked-username/linked-userid
[MPP-1338] - Error if the customer name contains umlauts

6.55. MPP 5.3.0

Released: September 5, 2017

Task

[MPP-1297] - Auth. Endpoint Cfg. Model
[MPP-1298] - Configuration Frontend
[MPP-1299] - Authenticator Backend

Bug

[MPP-1238] - CustomerSwitchModule does not re-render after customer-delete action
[MPP-1312] - Collapsible Table Rows are broken
[MPP-1313] - MTA config de-serialization error
[MPP-1314] - Unable to modify site template

Story

[MPP-958] - Prevent brute-force authentication attacks
[MPP-1153] - Refactor DB injection
[MPP-1160] - Block user after X retries for X minutes
[MPP-1282] - Max Authentication Retries Authenticator
[MPP-1284] - Ring buffer monitor
[MPP-1289] - Show NTP daemon status
[MPP-1307] - Allow system daemon templates to be overwritten
[MPP-1308] - Move "DNS Zones" to "Service" section
[MPP-1309] - Move "VRRP Tracking IPs" to "Service" section
[MPP-1310] - Show nice error message on duplicate username in user account and backend user view
[MPP-1311] - Show nice error message on duplicate group name in user group and voucher group view

6.56. MPP 5.2.0

Released: August 28, 2016

Task

[MPP-1275] - Database, Model
[MPP-1276] - Auth. Endpoint Cfg.
[MPP-1277] - Config Frontend
[MPP-1278] - Authenticator backend
[MPP-1279] - Integration, Testing

Bug

[MPP-1272] - LocalDb authenticator mac user group is misleading
[MPP-1281] - Template Bundles config validation leads to unwanted situation
[MPP-1286] - Allow more than 10 characters as SMS token characters
[MPP-1288] - Do not start Daemon during Daemon#configure() call
[MPP-1290] - DHCP port not open-gardened
[MPP-1291] - Sample assessment login.fr.html
[MPP-1292] - Title tag not localized
[MPP-1293] - Check special DHCP relay treatment in DhcpRelayDaemon
[MPP-1295] - Erroneous MTA daemon configuration
[MPP-1296] - NPE in MAC Auth Endpoint Configuration
[MPP-1300] - NPE if intercepted_url is an empty string
[MPP-1301] - Errornous CoreAuthState de-serialization
[MPP-1302] - Broken Url validation
[MPP-1303] - ProfileModule resets value if customerKey!=currentCustomerKey
[MPP-1304] - Switch PWLAN config fails
[MPP-1305] - Disk charts appear and disappear sporadically
[MPP-1306] - SwitchPwlan SideNav entry disappears when opening the edit view of ProfileFwRules

Story

[MPP-1188] - Metered Device Authenticator
[MPP-1246] - Fidelio Authenticator
[MPP-1283] - Debug Page
[MPP-1285] - Show system name as HTML title
[MPP-1287] - Add comment field to RegisteredUserDevice

6.57. MPP 5.1.0

Released: August 8, 2016

Task

[MPP-1248] - New SWITCH PWLAN view
[MPP-1249] - Toggle SWITCH PWLAN view from constants view
[MPP-1250] - New SWITCH PWLAN service
[MPP-1251] - New firewall forward rules
[MPP-1252] - Activate switch_pwlan ipset with scheduler and with save&activate
[MPP-1255] - Call authentication chains recursive
[MPP-1256] - Show ipset addresses in mpp-console

Bug

[MPP-1224] - Cleanup orphaned sync peer GIT repo
[MPP-1232] - Validate interface of virtual IP addresses
[MPP-1234] - HaawiHandler pipeline concurrent modification issue
[MPP-1236] - Unable to redefine physical IP as virtual
[MPP-1237] - Regenerate SSH host keys after installation
[MPP-1239] - Missing validation of overlapping DockingNetworks over all customers
[MPP-1241] - Sync delete of unknown entities should not end with out of sync
[MPP-1253] - Sioux produces corrupt match-set rules
[MPP-1254] - Wrong MPP sysctl and modules deconfiguration dependency in packages
[MPP-1257] - Missing last seen update of remote authenticated user accounts
[MPP-1258] - Missing AuthEndpointConfig in RunningSession without PreviousSession
[MPP-1259] - Wrong manage config status update when trying to push sync config
[MPP-1260] - Initial padding hits max records
[MPP-1264] - Sync config push may hang for a while
[MPP-1266] - RegisteredUserDevice time not updated
[MPP-1267] - LDAP and ADS authenticator allow users to log in with wrong password
[MPP-1269] - Method run(…) of ExecutionUtil does not cancel the task after reaching the timeout
[MPP-1274] - DatabaseClenaupTask removes UserAccount’s with unlimited duration
[MPP-1280] - By-pass DNAT for landing-page if network protocol ALL is selected

Story

[MPP-999] - SWITCH PWLAN integration
[MPP-1088] - Check remote user validity before auto-session
[MPP-1120] - NAT address pool
[MPP-1139] - Drop unused dynamic graphs during "save & activate"
[MPP-1157] - Update sync federation and policy on modifications
[MPP-1187] - Business hours authenticator
[MPP-1189] - Session graphs per profile
[MPP-1190] - Add template variable with session end-time
[MPP-1242] - Remove OSX special ZIP folder while extracting
[MPP-1244] - Build own ISC DHCP package
[MPP-1245] - Terms authenticator
[MPP-1247] - Merge anonymous and authenticated session with into Running Session View
[MPP-1265] - Usage graph for NAT address pool
[MPP-1268] - Replace site id with site key
[MPP-1270] - Refactor Authentication
[MPP-1273] - Load user account, similar to TermsAuthenticator

6.58. MPP 5.0.0

Released: July 10, 2016

Task

[MPP-1117] - Make cluster sync peer deletable in GUI
[MPP-1140] - Sync UserAccount
[MPP-1141] - Sync UserDevice
[MPP-1142] - Sync RegisteredUserDevice
[MPP-1143] - Sync UserSession
[MPP-1144] - Sync UserGroup
[MPP-1145] - Sync BackendUser

Bug

[MPP-979] - Performance chart y-axis title is not updated
[MPP-1012] - Move user account task file into dedicated folder
[MPP-1013] - Locked User Account isn’t processed during authentication
[MPP-1018] - Integer input fields can overflow
[MPP-1022] - DHCP messages on VLAN interfaces are reported twice
[MPP-1075] - Switch to fault state if the administrator stops any DHCP service
[MPP-1082] - VRRP state gets not updated if SNMPd is not running
[MPP-1084] - Mark VRRP state "unknown" as danger like "fault" state
[MPP-1092] - Open connections remain estabished after automatic session termination
[MPP-1093] - Fix wrong SMS gateway view style
[MPP-1094] - User account factory explicit delete
[MPP-1097] - Postfix "stop" fails on start-up
[MPP-1102] - resolv.conf does not update if the MPP was installed by CD
[MPP-1103] - Ensure that MetricCollector#collectMetrics() calls do not hang
[MPP-1104] - Fix type duplication while JSON serialization
[MPP-1105] - Fix wrong DNS zones view style
[MPP-1109] - Revive sessions after save & activate
[MPP-1134] - Allow '-' in template bundle key
[MPP-1135] - Make template bundle optional in authenticator endpoint configuration
[MPP-1151] - Fix browser warnings regarding controlled and uncontrolled input components
[MPP-1163] - Session duration missing in LDAP auth ep config GUI
[MPP-1164] - Session duration missing in ADS auth ep config GUI
[MPP-1165] - Session duration missing in Local DB auth ep config
[MPP-1166] - Session duration missing in MAC auth ep config
[MPP-1167] - Re-schedule sync processing after a PROCESSING_FAILED
[MPP-1168] - Wrong error message in MPP Setup wizard
[MPP-1169] - Fix browser error on ConstantEditWidget (invalid id reference)
[MPP-1170] - Add field validations for phone number and email field in Constants
[MPP-1171] - Expired User Accounts can log in
[MPP-1172] - Fix insertion and update of SMS Gateways
[MPP-1173] - User account "Terms accepted at" is missing in DB and GUI
[MPP-1174] - User session shows empty Intercepted URL in GUI
[MPP-1175] - Duplicate accounting message for previous stopped user sessions
[MPP-1176] - Browser shows "Unable to connect" error message for intercepted HTTPS requests
[MPP-1177] - Fix insertion and update of several model objects
[MPP-1178] - Mustache template exception handling
[MPP-1179] - DHCP lease renew missing
[MPP-1180] - Sync state is not shown in MPP Console
[MPP-1181] - Reference sync peers by ID and not by name
[MPP-1183] - Handle RestTemplate exceptions during startup
[MPP-1191] - Show empty graph instead of "No metric data"
[MPP-1192] - MPP landingpage doesn’t have css stylesheets anymore
[MPP-1194] - Inherited anonymous session profile is undefined on site view
[MPP-1195] - Check that DHCP scope gateway is within docking network and host address
[MPP-1196] - Re-configure MPP console from HTTP to HTTPS produces an error 400
[MPP-1197] - Sync voucher when usage count gets decremented
[MPP-1198] - Add location matcher for assets without leading slash
[MPP-1199] - Check that any referenced assets exist
[MPP-1200] - Resolve TODOs in UserSessionDTO
[MPP-1201] - Missing time period update in base URL of performance charts
[MPP-1202] - UserDevice is not synced when getOrCreateIfAbsent() was called
[MPP-1211] - LinkInformationCollector can sporadically store negative rx- and tx-values
[MPP-1212] - Sync user_session doesn’t treat previousSessionId correctly
[MPP-1213] - Cluster MPP setup may be out of sync after master/backup switch
[MPP-1215] - Backup System creates accounting message when stopping running user session
[MPP-1219] - Show (None) instead of "Please choose…"
[MPP-1220] - Chart label may be too long
[MPP-1222] - Incomplete Shutdown
[MPP-1225] - GRE Issue
[MPP-1226] - DhcpConfigRangeBuilder produces wrong ranges
[MPP-1227] - Config version parser fails in case of pretty printed config.json
[MPP-1228] - Shutdown/reboot on backup terminates sessions on master
[MPP-1231] - UserDevice traffic counter overflow
[MPP-1235] - RunningSessions are not correctly snychronized after save and activate
[MPP-1240] - Does the MAC authenticator need concurrent login limitations and valid for days?
[MPP-1243] - Validate interfaceName of VirtualIp

Story

[MPP-782] - Cluster sync: DB entities and configuration
[MPP-893] - Migrate versioned configuration
[MPP-964] - Show EULA on first login
[MPP-997] - Show CRL and OCSP information of certificates
[MPP-1005] - Extract any Netfilter functionality from mpp-sioux
[MPP-1030] - Prefix any MPP Daemon controller
[MPP-1031] - Session count graph
[MPP-1032] - Registered user count graph
[MPP-1033] - Registered device count graph
[MPP-1034] - Migrate network performance graphs
[MPP-1035] - MPP action performance graphs
[MPP-1036] - Authenticator performance graphs
[MPP-1037] - Accounter performance graphs
[MPP-1038] - Migrate system performance graphs
[MPP-1052] - Migrate site template bundles
[MPP-1053] - Migrate site templates
[MPP-1063] - Create Mail2SMS gateway configuration view
[MPP-1064] - Create HTTP-GET SMS gateway configuration view
[MPP-1068] - MAC authentication
[MPP-1073] - Add support information view
[MPP-1076] - RFC 7710
[MPP-1077] - Task to delete unused User Accounts/Devices
[MPP-1081] - Show/edit user account devices
[MPP-1083] - Hide disabled services in service overview
[MPP-1085] - Delete session history entries after X days
[MPP-1086] - Delete user accounts/devices after X days of inactivity
[MPP-1087] - SMS Voucher
[MPP-1095] - Sync peer view
[MPP-1096] - Refactor SystemAware views
[MPP-1098] - Cluster sync: Running user session
[MPP-1100] - Refactor routes
[MPP-1101] - Refactor interfaces
[MPP-1119] - Define MPP constants via GUI
[MPP-1121] - Cleanup Session Log
[MPP-1122] - Installation tutorial
[MPP-1123] - Refactor Aptly structure
[MPP-1124] - Refactor DB services
[MPP-1126] - Add de-configure button to any service and sync-peers
[MPP-1127] - Return 503 if the system is unavailable
[MPP-1128] - MPP favicon
[MPP-1131] - Auto-refresh services view
[MPP-1132] - Replace placeholders with help text annotations
[MPP-1133] - Refactor HTTP view
[MPP-1136] - Voucher groups
[MPP-1137] - Manage vouchers
[MPP-1138] - Route authenticator
[MPP-1146] - Sync Config
[MPP-1147] - Sync all entities and current config on request
[MPP-1148] - Hide NAT address pool in GUI
[MPP-1149] - Refactor Customer controller/service
[MPP-1155] - Upgrade JOOQ’s PostgeSQL dialect to SQLDialect.POSTGRES_9_3
[MPP-1182] - Merge strategy for sync’d entities
[MPP-1185] - Upgrade to keepalived 1.2.21
[MPP-1186] - Publish MPP 5.0.0 release
[MPP-1193] - Provide SSL certificate
[MPP-1203] - Cache control
[MPP-1204] - Handle config exceptions in Sioux and System Agent
[MPP-1218] - Send sync hello on startup to trigger initial session sync from master to backup
[MPP-1221] - Show Config Status in Metabar