Axians
Key visual release notes

Axanto 4.3 released

Author:

Markus Koestner

Tags:

Axanto Portal 4.3 is here. Portal sign-in can be secured with an authenticator app, request offerings can be restructured in the Designer and maintained by their owners, and API call activities sign in with stored credentials.

What’s new

Sign-in

  • Multi-factor authentication: Portal sign-in can be secured with an authenticator app as a second factor.
  • Form sign-in: The portal checks the password once at sign-in instead of with every request. How long a sign-in stays valid is set in the portal settings.
  • Portal settings can be edited directly in the Administration UI.

Request offerings and the Designer

  • Restructure: Activities can be moved, reordered and grouped into sequential or parallel activities in the Designer.
  • Owners maintain their own: Owners of a request offering and their deputies can edit its activities.
  • Handling: The Designer has an action bar per activity, works with the keyboard and keeps its state after save, delete and reload.
  • Extension data: Create Entity and Modify Entity activities support extension data for Service Manager target classes.

API call activities

  • Stored credentials: API calls authenticate with shared credentials – Basic/PAT, Bearer or OAuth2 client credentials.
  • Troubleshooting: A failed call shows the reason right on the activity.

More improvements

  • The service component detail view shows the incidents, service requests, changes and problems that affect the service.
  • The review catalog has its own administration area; its filter supports NOT/OR conditions, related objects and extension data.
  • Opening a record by its number now works for all auto-numbered types, without maintaining key fields.
  • Teams presence is requested once per user and page instead of once per occurrence.
  • The customization admin can delete tabs permanently and shows which tabs use an action.

What else we fixed

4.3 contains 27 fixes. Requests no longer stall at an activity whose template was deleted from the request offering, and users without administrator rights are no longer signed out when a page calls an administrator function. A notification whose linked record is missing no longer ends the notification round for everyone else, and after signing out and in again in the same tab, new notifications arrive again. The calendar view shows its entries again, and a user created from Active Directory no longer replaces a user of the same name from another domain. On top of that come security updates of third-party components (as of October 2026).

Updating

From 4.2 the update is a regular setup run; the database is updated automatically. Because sign-in has changed, a few points for operations:

  • The setup switches /api in IIS to anonymous and Windows authentication and turns Basic off. Integrations that sign in with Basic keep working; the IIS role service “Basic Authentication” is no longer needed.
  • /legacyapi only accepts calls from the server itself.
  • Form sign-in should run over HTTPS.
  • Multi-factor authentication is off after the update. Before switching it on: HTTPS, a correct server clock and exemptions for integration accounts.

The upgrade runbook in the product help has the details. For the update from 3.72 the advice stands: please plan it together with your Axanto contact and read the upgrade runbook in the product help first.

Changelog

The complete list of changes, as it appears in the CHANGES.TXT shipped with the release:

Feature

  • AX03120 [PO] Multi-factor authentication for portal sign-in with an authenticator app
  • AX03124 [PO] Password sign-in is checked by the portal once per sign-in instead of with every request
  • AX03156 [PO] CreateEntity/ModifyEntity activities: support extension data for SCSM target classes
  • AX03161 [PO] Portal settings can be edited in the Administration UI
  • AX03165 [PO] Opening a record by its number now works for all auto-numbered types without maintaining Key Fields
  • AX03167 [PO] Teams presence is requested once per user and page instead of once per occurrence
  • AX03184 [PO] Review catalog: maintained in its own administration area; filter supports NOT/OR conditions, related objects and extension data
  • AX03186 [SD] Service component detail shows the incidents, service requests, changes and problems that affect the service
  • AX03191 [PO] Customization admin: permanently delete tabs and show which tabs use an action
  • AX03193 [PO] Offering owners and deputies can edit the activities of their own request offerings
  • AX03198 [PO] Request offering activities can be moved, reordered and grouped into Sequential or Parallel activities in the Designer
  • AX03199 [PO] API call activities: authentication via shared credentials (Basic/PAT, Bearer, OAuth2 client credentials)
  • AX03201 [PO] Designer: activity action bar, editor width and tree labels
  • AX03202 [PO] Designer: state after save, delete and reload (stale responses, lost selection, stale tree)
  • AX03203 [PO] Designer: keyboard access, layout height and cleanup
  • AX03204 [PO] API call activities: failed calls show the reason on the activity and log credential mode, response headers and a body excerpt

Bug

  • AX03102 [PO] A notify message whose linked record cannot be found shows no title or link, and in the scheduler it ends that round of notifications for everyone after it
  • AX03157 [PO] Fix PropertyConfig.Type reverting to "notselected" after save
  • AX03158 [PO] After signing out and in again in the same browser tab, the portal stopped picking up new notifications until the page was reloaded
  • AX03159 [PO] Sync to SCSM: support relation fields where the synced object is the relation target
  • AX03160 [PO] SCSM sync outbox: drop a row after 3 failed apply attempts instead of retrying it forever
  • AX03162 [SD] Review scheduler now assigns the ServiceComponent's Support Service Group to created SRQs
  • AX03163 [PO] Customization Admin: saving a tab with chart colour settings failed with "Body required."
  • AX03164 [PO] Service tree editor: a newly added node was not shown and was lost on save
  • AX03166 [PO] Teams presence is no longer requested when Azure is not configured
  • AX03168 [PO] Notify messages are resolved for the active user when an old account with the same name exists
  • AX03169 [PO] Creating a user from Active Directory no longer replaces a user with the same name from another domain
  • AX03177 [PO] Comment panel breaks when the relation type has no IsPrivate property
  • AX03178 [PO] Creating a request from an offering fails when it contains a parallel or sequential activity with sub-activities
  • AX03179 [PO] Calendar view loads entries but shows none
  • AX03180 [PO] Chart configuration: edit display names and tooltips of query choices
  • AX03183 [PO] Table field: row input lost on save when the row was not confirmed
  • AX03185 [PO] Table field: fix CSV import/export and row editing, restructure the component
  • AX03187 [PO] Request offerings list: select-all limited to the current page, toolbar reworked
  • AX03188 [PO] Saving a request offering failed when activities added in the same session were saved again
  • AX03189 [PO] Customization admin: saving a tab no longer drops localized labels and default/not-allowed marks of enum-based inline lists
  • AX03190 [PO] Saving a new request offering activity with an assigned user, group or support service failed
  • AX03192 [PO] Hard-deleted actions no longer reappear after a scheduler restart
  • AX03194 [PO] Non-admin users are no longer signed out when a page calls an administrator-only function
  • AX03195 [PO] Designer: long activity names hide the "+" button in the structure tree
  • AX03196 [PO] Designer: unsaved offering edits can be lost (leave without warning, double save, stale drawer, incomplete dirty tracking)
  • AX03197 [PO] Requests no longer stall at an activity whose template was deleted from the request offering
  • AX03200 [PO] Security updates of third-party components (October 2026)