• SAML: The following is available to ease configuration:
    • You can create a self-signed SP certificate with the Alfabet Administrator:
      1. Click the Alfabet Aliases node in the explorer.
      2. In the toolbar of the view that opens, click Tools > Create self-signed certificate.
      3. In the editor, provide the following details:
        • File Path: Click Select and define a name and location for the file.
        • Password: Enter a password for the certificate.
        • Issued To: Enter the issuer of the certificate. Server certificates are typically issued to host names, which could be a machine name or domain name.
        • Save certificate into Certificate Store: Set the checkmark to store the certificate in the certificate store of your current host.
    • The Examples folder of the Alfabet Web Application directory contains a folder Log_SAML containing an appsettings.json file and an alfasettings.json file with the required configuration to use NLog with SAML.
  • Only HTTPS is used for connection between client side and the Alfabet Web Application. HTTP is no longer used.

    Usage of HTTP can be enforced but this is not recommended.

  • Session handling has been enhanced:
    • User sessions and allocation of resources only start after user login.
    • Only one session is allowed per browser window.
    • If the user has opened multiple tabs for the same session and logs out in one tab, the session is closed for all tabs.
    • A session is limited to one browser window. Copying a link from one active session to another browser or browser windows will require a re-login in the new browser window.
    • The browser cache is cleared at the end of the session.
  • The following has been added to the web.config file of the Alfabet Web Application to avoid information disclosure in the HTTP header:
    • <system.webServer>
      • <httpProtocol>
        • <customHeaders>
          • <remove name='X-Powered-By' />
        • </customHeaders>
      • </httpProtocol>
    • </system.webServer>
  • To change the default content security policies for the Alfabet Web Application, the following must be included in the alfasettings.config file:
    • 'AlfabetWebConfig': {
    • [....]
    • 'ContentSecurityPolicyValue':'content security policy directives'
    • },