# Upcoming changes to identity management integrations

**URL:** <https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994>\
**Category:** Announcements\
**Created:** [August 26, 2021, 5:50pm UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994 "2021-08-26T17:50:05Z")\
**Posts on this page:** 20\
**Page:** 5

<div class="post-metadata">

**Author:** ![\_ff](https://avatars.discourse-cdn.com/v4/letter/_/b9e5f3/32.png) [@\_ff](https://forums.rocket.chat/u/_ff)\
**Post date:** [September 16, 2021, 1:26pm UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/82 "2021-09-16T13:26:30Z")

</div>

We have 11000 users in our LDAP. Filtering special groups for channels and login. . .

Bad promotion to trim/move very important features to an enterprise version! Now you can shake hands to mattermost.

Peace im out.

BR

rm -rf /opt/rocketChat

---

<div class="post-metadata">

**Author:** ![sing.li](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/sing.li/32/6_2.png) [@sing.li](https://forums.rocket.chat/u/sing.li)\
**Post date:** [September 16, 2021, 1:49pm UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/84 "2021-09-16T13:49:15Z")

</div>

Thanks for your post @7tsstlix and apologies for the delayed reply.

We’ve been busy working on [clarification update](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/) and digesting community feedback since the [Community Open Call](https://www.youtube.com/watch?v=RdbqOdUb3Wk).

The Pro Edition will continue to have all features marked as CE in [this updated clarified document](https://docs.rocket.chat/guides/administration/administration/identity-management-ee-vs-ce). Can you please check to see if they satisfy your needs.

In any case, Pro Edition users will not observe any changes before their renewal.

---

<div class="post-metadata">

**Author:** ![sing.li](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/sing.li/32/6_2.png) [@sing.li](https://forums.rocket.chat/u/sing.li)\
**Post date:** [September 16, 2021, 1:49pm UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/85 "2021-09-16T13:49:55Z")

</div>

Thanks for the post @_ff

_ **LDAP filtering will remain implemented in CE.** _

There is no need to disengage.

We’ve been busy working on [clarification update](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/) and digesting community feedback since the [Community Open Call](https://www.youtube.com/watch?v=RdbqOdUb3Wk).

Thank you for your continued support of RC.

---

<div class="post-metadata">

**Author:** ![paul](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/paul/32/259_2.png) [@paul](https://forums.rocket.chat/u/paul)\
**Post date:** [September 17, 2021, 11:41pm UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/86 "2021-09-17T23:41:42Z")

</div>

Gatekeeping the user sign-in functionality (even advanced features) seems very short-sighted in that it slows the adoption decision of the platform as a whole to new deployments and potential customers. I am sure that your company valuation is directly linked to the number of deployments and number of users reached, even if they are non-paying users.

Also charging for every user able to login into the system is very hard to justify in many deployment cases that would want to pay for Rocket.Chat, since not all users that can access the chat are valued equally when assessing a ROI calculation.

Why don’t you guys consider charging for the omnichannel agent support thing? It seems very Corporate EE oriented and probably more interesting to charge for feature unlock and also per agent seat as it has a more clear ROI for companies using Rocket Chat.

---

<div class="post-metadata">

**Author:** ![sing.li](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/sing.li/32/6_2.png) [@sing.li](https://forums.rocket.chat/u/sing.li)\
**Post date:** [September 22, 2021, 1:28pm UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/87 "2021-09-22T13:28:32Z")

</div>

Thank you very much @paul for these very well thought-out, constructive and practical suggestions.

I sincerely hope you can join us for the upcoming [roadmap reveal](https://app.livestorm.co/rocket-chat/rocketchat-roadmap-reveal?utm_source=COMMUNITY) and our [next Community Open Call](https://app.livestorm.co/rocket-chat/community-open-call-october?type=detailed).

---

<div class="post-metadata">

**Author:** ![rcadmin](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@rcadmin](https://forums.rocket.chat/u/rcadmin)\
**Post date:** [September 27, 2021, 8:34am UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/88 "2021-09-27T08:34:50Z")

</div>

It seems that also SAML mappings and Clockdrift feature is removed from CE. It means that RC becomes useless for us. How long is version 3.x supported?  
Fortunately, Zulip has a migration feature: [Import from Rocket.Chat (Zulip Help Center)](https://zulip.com/help/import-from-rocketchat) 👍

---

<div class="post-metadata">

**Author:** ![mkrumbholz](https://avatars.discourse-cdn.com/v4/letter/m/f9ae1b/32.png) [@mkrumbholz](https://forums.rocket.chat/u/mkrumbholz)\
**Post date:** [October 4, 2021, 9:21am UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/89 "2021-10-04T09:21:55Z")

</div>

For me was the only reason, why i selected Rocket Chat in the first place, that the security/login features are not an extra or upsale.  
This is a big deterioration and i’ll start looking for a diffrent solution.  
The push notification change was understandable and reasonable but this is not.  
Also the Link for identity-management-ee-vs-ce is not working, this should be the correct one [Link](https://docs.rocket.chat/quick-start/identity-management-ee-vs-ce)

---

<div class="post-metadata">

**Author:** ![oitde](https://avatars.discourse-cdn.com/v4/letter/o/6a8cbe/32.png) [@oitde](https://forums.rocket.chat/u/oitde)\
**Post date:** [October 4, 2021, 12:25pm UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/90 "2021-10-04T12:25:13Z")

</div>

Ok, than switching to MS Teams. I have argued to our CEO that open source is the right decision and that RC is a nice and open Tool. But we’ve got alle Exchange accounts and Teams is is part of it.  
So no questions we have to switch.

Whats a shame about it is, what others here are mentioning, you can’t know whats the next feature is which is scraped from the CE version.

---

<div class="post-metadata">

**Author:** ![schulz](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@schulz](https://forums.rocket.chat/u/schulz)\
**Post date:** [October 5, 2021, 8:58am UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/91 "2021-10-05T08:58:21Z")

</div>

After reading about all of the upcoming plans and cut down of LDAP sanchronization features is really sad to hear.

We are currently using Rocket.Chat with over 100 users synced to our LDAP server, the question for us would be, how long will you support the CE with security updates for versions lower than 4.0.x like 3.18.1?

---

<div class="post-metadata">

**Author:** ![rasos](https://avatars.discourse-cdn.com/v4/letter/r/779978/32.png) [@rasos](https://forums.rocket.chat/u/rasos)\
**Post date:** [October 5, 2021, 8:15pm UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/92 "2021-10-05T20:15:09Z")

</div>

We also convinced and support a few organizations that rely on the feature syncing LDAP groups to RocketChat channels. But they have not calculated a budget for the enterprise version.

If RocketChat would not be willing to backport security fixes to RC 3.18.1 maybe we could organize that as a community effort.

---

<div class="post-metadata">

**Author:** ![mstafurik](https://avatars.discourse-cdn.com/v4/letter/m/f04885/32.png) [@mstafurik](https://forums.rocket.chat/u/mstafurik)\
**Post date:** [October 7, 2021, 5:55am UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/93 "2021-10-07T05:55:47Z")

</div>

We are not going to update either unless background sync is included. We are corruently exploring Zulip if it will be valid replacement. There is migration feature, they got push notifications free as well so no need to build custom apps.

---

<div class="post-metadata">

**Author:** ![d3h](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@d3h](https://forums.rocket.chat/u/d3h)\
**Post date:** [October 8, 2021, 1:23pm UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/94 "2021-10-08T13:23:48Z")

</div>

Will there be LTS for 3.18?

---

<div class="post-metadata">

**Author:** ![sing.li](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/sing.li/32/6_2.png) [@sing.li](https://forums.rocket.chat/u/sing.li)\
**Post date:** [October 12, 2021, 5:06am UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/95 "2021-10-12T05:06:04Z")

</div>

@dsh Please see [Getting Support](https://docs.rocket.chat/getting-support#rocket.chat-versions) for LTS policy. Please join our upcoming [Community Open Call](https://app.livestorm.co/rocket-chat/community-open-call-october?type=detailed) to get your questions answered.

---

<div class="post-metadata">

**Author:** ![sing.li](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/sing.li/32/6_2.png) [@sing.li](https://forums.rocket.chat/u/sing.li)\
**Post date:** [October 12, 2021, 5:10am UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/96 "2021-10-12T05:10:41Z")

</div>

Hi @rasos , great to “meet” you again. Please join our upcoming [Community Open Call](https://app.livestorm.co/rocket-chat/community-open-call-october?type=detailed) if you can.

---

<div class="post-metadata">

**Author:** ![sing.li](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/sing.li/32/6_2.png) [@sing.li](https://forums.rocket.chat/u/sing.li)\
**Post date:** [October 12, 2021, 5:13am UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/97 "2021-10-12T05:13:38Z")

</div>

Thanks for posting @schulz. Please see [Getting Support](https://docs.rocket.chat/getting-support#rocket.chat-versions) for the LTS policy.

---

<div class="post-metadata">

**Author:** ![sing.li](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/sing.li/32/6_2.png) [@sing.li](https://forums.rocket.chat/u/sing.li)\
**Post date:** [October 12, 2021, 5:18am UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/98 "2021-10-12T05:18:00Z")

</div>

Thanks for posting, @rcadmin. The Clockdrift feature should be in CE.

Please see [Getting Support](https://docs.rocket.chat/getting-support#rocket.chat-versions) for LTS policy, and please join our upcoming [Community Open Call](https://app.livestorm.co/rocket-chat/community-open-call-october?type=detailed) if you can.

---

<div class="post-metadata">

**Author:** ![tomaszd](https://avatars.discourse-cdn.com/v4/letter/t/3be4f8/32.png) [@tomaszd](https://forums.rocket.chat/u/tomaszd)\
**Post date:** [October 27, 2021, 8:39am UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/99 "2021-10-27T08:39:45Z")

</div>

I am under no obligation to explain to you how I use this software, it’s one of the benefits of using open source software, I could be maintaining rocketchat for a bunch of orphanages in Africa or an evil dictator’s personal server, it’s still not OK what you did and the messaging is confusing, I still am not sure what the actual changes are. We already have O365, so moving to Teams is a no brainer, but I will wait until you bring back the stolen Sync button [LDAP Missing Background Sync Options · Issue #23423 · RocketChat/Rocket.Chat · GitHub](https://github.com/RocketChat/Rocket.Chat/issues/23423) and then re-evaluate the situation.

---

<div class="post-metadata">

**Author:** ![debdut.chakraborty](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/debdut.chakraborty/32/2900_2.png) [@debdut.chakraborty](https://forums.rocket.chat/u/debdut.chakraborty)\
**Post date:** [October 27, 2021, 10:18am UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/100 "2021-10-27T10:18:53Z")

</div>

> [@tomaszd](#):
>
> but I will wait until you bring back the stolen Sync button [LDAP Missing Background Sync Options · Issue #23423 · RocketChat/Rocket.Chat · GitHub](https://github.com/RocketChat/Rocket.Chat/issues/23423) and then re-evaluate the situation.

Hi @tomaszd

I’ve just commented on the issue. Manual sync and background sync are part of Enterprise Edition. Basic user data sync is still part of CE.

---

<div class="post-metadata">

**Author:** ![rcadmin](https://avatars.discourse-cdn.com/v4/letter/r/e56c9b/32.png) [@rcadmin](https://forums.rocket.chat/u/rcadmin)\
**Post date:** [November 2, 2021, 6:34am UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/101 "2021-11-02T06:34:11Z")

</div>

This is very confusing. During the last month I have sent couple of emails to your sales without any responses. How could we even think about buying licenses if your sales doesn’t reply to offer requests? Here is something really weird going on…

---

<div class="post-metadata">

**Author:** ![spd](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@spd](https://forums.rocket.chat/u/spd)\
**Post date:** [November 5, 2021, 6:06pm UTC](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994/102 "2021-11-05T18:06:02Z")

</div>

SAML SSO authentication with ADFS is not working anymore since you can’t configure custom authentication context. And the default if login/password and you need windows authentication for SSO to work.

Add to this great security issue in mobile clients which is not addressed for several months:

> <https://github.com/RocketChat/Rocket.Chat.ReactNative/issues/3236>
>
> \<!-- 
> 
> Please see our guide for opening issues: https://rocket.chat/docs/contr…ibuting/reporting-issues
> 
> If you have questions or are looking for help/support please see: https://rocket.chat/docs/getting-support
> 
> If you are experiencing a bug please search our issues to be sure it is not already present: https://github.com/RocketChat/Rocket.Chat.ReactNative/issues
> 
> \--\>
> 
> \### Description:
> 
> 
> 
> On iOS RocketChat app users can acquire full url link to uploaded file in channel. 
> This url contains userid and access token. 
> user can send this link to someone else which will revel his userid and access token
> Access token as I understood do not have expiration time
> 
> So by sending such url user in fact 1) will send permanent link to the file
> and 2) the ability to get access to rocketchat server impersonating that user. 
> 3) potentially have access to any file on RocketChat server
> 
> 
> 
> 
> \### Environment Information:
> 
> \- Rocket.Chat Server Version: 3.15.0
> \- Rocket.Chat App Version: 4.17.0.24389
> \- Device Name: iPhone 8
> \- OS Version: 14.6
> 
> \### Steps to reproduce:
> 
> 1. Click on file in the channel conversation
> 2. File will be open
> 3. Click the Share button at the bottom (one with up arrow) and select Copy
> 4. Paste somewhere and you have full url to the file with user id and token
> 
> 
> \### Expected behavior:
> 
> 
> 
> users should not be ably to have access to links containing non expiring access tokens
> It's either should be temporary access token to required file only
> or at least send it in POST request so user won't have access to it.
> 
> 
> \### Actual behavior:
> 
> 
> 
> User can have access to urls like this:
> 
> https://\<rocketchat\_address\>/file-upload/\<file\_id\>/\<actual\_filename\>?rc\_uid=\<user\_id\>&rc\_token=\<access\_token\>
> 
> The same thing also possible for Android mobile app with slightly different manipulations 
> 
> \### Additional context:
> 
> 
> 
> By having userid and token it is possible to get access to any file on the RocketChat server. 
> Access to the files is not checked against who can access it. 
> If you have fileid (with is always 17 symbols long containing A-Z,a-z,0-9) you can open any file with any userid/token combination.
> 
> I've verified such scenario:
> 
> user1 sends file to user2 in direct message
> user3 (not in that direct message conversation) using his userid and access token able to have access to that file if he knows fileid
> by accessing url like this
> 
> https://\<rocketchat\_address\>/file-upload/\<file\_id\>/?rc\_uid=\<user\_id\>&rc\_token=\<access\_token\>

> <https://github.com/RocketChat/Rocket.Chat.ReactNative/pull/3210>
>
> \## Proposed changes
> 
> Open unsupported files inside an authenticated WebView an…d don't pass the id and token as query params.
> 
> \## Issue(s)	
> 
> User token in query param to access authenticated files
> 
> \## How to test or reproduce
> 
> 1.add image in group with ios apps
> 2.other group member open uploaded image in browser
> 3.when open image in browser token added on it
> 
> \## Screenshots
> 
> \<table\>
> \<thead\>
> \<tr\>
> \<th\>Before\</th\>
> \<th\>After\</th\>
> \</thead\>
> \</tr\>
> \<tbody\>
> \<tr\>
> \<td\>
> \<img src="https://user-images.githubusercontent.com/47038980/121956746-de376600-cd37-11eb-90ff-5daa5ea00d8d.png" height="450" /\>
> \<img src="https://user-images.githubusercontent.com/47038980/121956754-e1325680-cd37-11eb-95ad-9c6e8374657b.png" height="450" /\>
> \</td\>
> \<td\>
> \<img src="https://user-images.githubusercontent.com/47038980/121956896-07f08d00-cd38-11eb-807c-5eea53919d19.png" height="450"/\>
> \</td\>
> \</tr\>
> \</tbody\>
> \</table\>
> 
> \## Types of changes
> 
> 
> 
> \- \[x\] Bugfix (non-breaking change which fixes an issue)
> \- \[\] Improvement (non-breaking change which improves a current function)
> \- \[\] New feature (non-breaking change which adds functionality)
> \- \[\] Documentation update (if none of the other choices apply)
> 
> \## Checklist
> 
> 
> \- \[x\] I have read the \[CONTRIBUTING\](https://github.com/RocketChat/Rocket.Chat/blob/develop/.github/CONTRIBUTING.md#contributing-to-rocketchat) doc
> \- \[x\] I have signed the \[CLA\](https://cla-assistant.io/RocketChat/Rocket.Chat.ReactNative)
> \- \[x\] Lint and unit tests pass locally with my changes
> \- \[\] I have added tests that prove my fix is effective or that my feature works (if applicable)
> \- \[\] I have added necessary documentation (if applicable)
> \- \[\] Any dependent changes have been merged and published in downstream modules
> 
> \## Further comments

So bye rocketchat hello zulip

[Previous page](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994.md?page=4)

[Next page](https://forums.rocket.chat/t/upcoming-changes-to-identity-management-integrations/11994.md?page=6)