Composable Agentic Platform (CAP) - RHEL Enterprise Edition

This is a feature release of the Composable Agentic Platform (CAP) Console on Red Hat Enterprise Linux 10.1 (Coughlan), delivering enterprise single sign-on across three protocols - hardened SAML 2.0, a new OpenID Connect login option, and a modernised LDAP directory login - together with write-only masking for multi-line credential vault fields, upstream cookie suppression for forwarding agents, and Console fixes. The embedded Jetty 12.1.10 server runtime is unchanged from the previous AMI. Local logon remains the default, so sign-in behaviour is unchanged until an access manager is configured. All existing rulesets, extensions, and TCL scripts continue to work unchanged. This AMI also carries the intervening build 30080 maintenance round (UTF-8 form handling, performance data retrieval, agent window titles, run-time settings layout, headless start) for deployments coming from the previous AMI.

Enterprise single sign-on:

• One access manager at a time - The Console authenticates against a single configured access manager: SAML 2.0, OpenID Connect, or LDAP. The configuration file now ships with ready-to-populate SAML and OpenID Connect sections under Authentication.
• OpenID Connect login (new) - Authorization code flow with PKCE against any OpenID Connect identity provider (Entra ID, Okta, Keycloak, Ping). Configure with OIDCDiscoveryURL or OIDCIssuer, OIDCClientID and OIDCClientSecret; the client secret can be sourced from a Console credential vault entry. User accounts are auto-provisioned from ID token claims, including the standard roles claim (for example Entra ID app roles), with the same user type and role mapping as SAML. Logging out of the Console also ends the identity provider session when the provider advertises an end session endpoint.
• SAML improvements - A new optional SAMLEntityID property sets a stable SP entity ID, announced as the SAML issuer and enforced as the assertion audience; without it the Console continues to use its /console/SAML URL as the entity ID. Single log-out: logging out of the Console now also ends the identity provider session when the identity provider metadata advertises a SAML single logout endpoint.
• LDAP login modernised - Reliable group mapping for users that are members of many directory groups, new CAPUserType_ and CAPUserRole_ group names (existing configurations keep working), custom search filters via LDAPSearchFilter with the CAPUSERNAME token, LDAPS trust store scoped to the directory connection with credential vault support for the trust store password, connection timeouts so an unreachable directory fails logons quickly, and hardened logon validation. The user directory password is no longer stored by the Console.
• Fail-closed option - A new optional RequireAccessManager=true property refuses all logons when the configured access manager plugin fails to load, instead of falling back to local logon.
• Proxy and hardening - The Console honours the X-Forwarded-Proto header when building and validating sign-on URLs, enabling SAML and OpenID Connect behind TLS-terminating load balancers; the header is restricted to http or https, and the OpenID Connect sign-on redirect is origin-checked against the identity provider discovery document.
• Provisioning audit - Users auto-provisioned by SAML or OpenID Connect sign-on are recorded in the Console audit log, both on creation and when identity provider attributes change an existing account. The identity provider is authoritative on every login, so out-of-band privilege changes to federated accounts are reverted and audited at the next sign-in.

Credential vault:

• Masked multi-line fields - Multi-line text fields can now be masked with the padlock. A masked field never displays its stored value again - the Console shows a placeholder and the value is changed by pasting a replacement - so PEM certificates and private keys are no longer readable from the vault screen.

Forwarding agents:

• Strip upstream cookies - The new Strip upstream cookies setting on the Forwarding tab discards all cookies set by upstream hosts instead of relaying them to the browser, so third party services fronted by the proxy cannot plant cookies on the end user's browser. When enabled it supersedes the Clean cookie path setting. Requires the updated Built-in Proxy extension on the agent; older agents ignore the setting and log a warning.

Console fixes:

• Rules Editor - Comment rules render correctly again: the comment box honours its configured width with proper word wrap and left-aligned text, and the comment description is edited in a multi-line field. Comments had been drawn as standard rule boxes with the width setting ignored since V11.
• Policy Dial API - Setting a dial and reverting it shortly after now applies correctly, and reads immediately after a write return the written value. Previously a quick revert within the status poll interval could be silently skipped.
• Credential vault - The buttons of a newly added vault field no longer raise a script error on mouse events.

Platform updates:

• Console at build 30090, RulesBase at build 30090 - The Console application and the shared rules libraries both move to build 30090 for this release. The CAP Agent engine remains at build 30080: engine code is unchanged, and rule execution behaviour is identical.
• One new dependency - The Nimbus JOSE+JWT library (nimbus-jose-jwt 9.37.4) is added for OpenID Connect token validation; it is recorded in the SBOM and legal notices. All other bundled dependency versions are unchanged from the previous baseline (HttpClient5 5.6.4, HttpCore5 5.4.3, Log4j API 2.25.5, and the rest).
• RHEL 10.1 + JDK 21 LTS baseline retained - The AMI keeps the Red Hat Enterprise Linux 10.1 (Coughlan) + JDK 21 LTS foundation, the embedded Jetty 12.1.10 server, systemd cap-console service, first-boot cap-init credential initialisation, and pre-installed AWS Systems Manager agent.
• Reproducible AMI build - The AMI is produced by the same auditable EC2 Image Builder pipeline (triggered from GitHub Actions OIDC) used for prior releases, baked from the identical CI-built Console distribution published to all other channels.

Upgrade notes:

• Existing installations can take the same Console content as an in-place update via the TomorrowX update server; the in-place update does not perform a server-level Jetty change and requires no PDA restart. The single sign-on features are dormant until an access manager is configured, so existing local logons are unaffected by the update itself.
• When enabling an access manager, note that local form logons are refused while it is active. Create and verify any credential vault entries the configuration references (for example the OpenID Connect client secret) BEFORE enabling the access manager, and keep the configuration file accessible for recovery. The Authentication pages under Installation and Configuration in the product documentation walk through the setup for each identity provider, including Entra ID, and the role provisioning pattern.
• The Strip upstream cookies setting requires the updated Built-in Proxy extension and the build 30090 RulesBaseFactory extension from the update server, applied through the normal extension deployment process. Older Built-in Proxy versions ignore the setting and log a warning naming it, while the rest of the forwarding configuration still deploys.

For full documentation see: https://docs.tomorrowx.com/cap/vZHo2144m1e79o3WX0RU