Skip to main content
Version: Aeon 7.0

Aeon 7.0.1826

Released August 3, 2026. Staff single sign-on (SAML 2.0 + OpenID Connect), mandatory two-factor, and Field Customizations

Highlights​

  • Single sign-on (SAML2). Staff can sign in through their institution's identity provider — including InCommon federation members — with per-account Local/SSO modes, full Single Logout, and an always-available admin break-glass sign-in. A Single Sign-On page under Customization Manager → System sets it up: import the IdP from metadata (URL or XML) or InCommon, prefill the whole form from an existing legacy SP configuration (Atlas SAML SAML.config or Shibboleth shibboleth2.xml) when migrating off a desktop install, generate or upload the service-provider signing certificate, choose the login mode and identity matching, and edit the raw provider document directly. Staff accounts are onboarded with admin-sent invitations: one emailed link, the staff member signs in at the institution, and the account's SSO identifier is filled in from the identity the IdP actually asserts — no hand-typed identifiers; the staff editor also gains the authentication-method, SSO-identifier, and email fields directly.
  • Single sign-on now supports OpenID Connect. Alongside SAML 2.0, staff can sign in through an OpenID Connect provider (Entra ID, Okta, Keycloak…). On the Single Sign-On page under Customization Manager → System, pick the OpenID Connect protocol, paste the provider's authority (or discovery URL), client ID, and client secret, and choose the scopes and identity claim — the authorization, token, signing-key, and logout endpoints are discovered automatically. Everything else works the same: per-account Local/SSO modes, mandatory authenticator codes, admin-sent invitations, the break-glass emergency sign-in, the test sign-in, and RP-initiated logout.
  • Two-factor authentication is now required for all password sign-ins. Staff without an authenticator are walked through enrollment at their next sign-in and receive single-use recovery codes; SSO sign-ins require the TOTP step by default, with an instance setting to disable it when the identity provider enforces its own MFA.
  • Zero-downtime SP certificate rotation. The single sign-on Service Provider now holds a list of signing certificates instead of one. To rotate: add a new certificate, re-import the SP metadata at the identity provider (it then trusts both), and delete the old certificate at your convenience — Aeon keeps signing with the oldest valid certificate and switches to the replacement automatically when it expires. The last currently-valid certificate cannot be deleted while SSO is enabled, and the login-time expiry warning is suppressed once a replacement is staged.
  • Administrators can now reset a staff member's authenticator. In Roles & Permissions, Staff, a new Reset MFA button clears the enrollment when someone has lost their device: they are signed out, and set up a new authenticator — with fresh recovery codes — at their next sign-in. Their password is unchanged, and single sign-on accounts can be reset too. Resetting an administrator's authenticator requires Roles & Permissions configuration access.
  • Mark staff as inactive instead of deleting them. Departed staff can now be inactivated from Roles & Permissions, Staff — from the account editor, the staff card menu, or in bulk with the new Select mode. An inactive account can't sign in (any sign-in method) and its active sessions end immediately, but its role and site assignments are preserved, so reactivating restores it exactly as it was — and the username stays on record for tracking history. The staff list's new Status filter shows Active accounts by default.
  • Field Customizations: rename any field once and the new name appears everywhere it displays — grid columns, form designers, field pickers, and filters. Find it under Customization Manager → Data & Fields → Field Customizations. Form placements where staff typed their own label keep it, with a per-placement notice. Names are display-only: email/print template tags, addons, and the Windows client are unaffected.
  • Requests grid: every request field is now available as a column — including Special Request, ISBN/ISSN, Page Count, Shipping Option, For Publication, Web Request Form, billing fields (Max Cost, Internal Account Number, Invoice Number), cancellation info, researcher username, and photoduplication status. Open the Columns dialog on the grid to add them.
  • Route menus now organize queues by Menu Group. Everywhere you route requests — the request form's Route menu, the bulk-selection bar's Route picker, and the command palette — queues with a Menu Group now sit inside a submenu per group (groups and queues both alphabetized), with ungrouped queues listed after the groups, so long queue lists stay tidy. Typing still searches every queue across all groups, so you can find a queue by name without knowing its group.
  • Show a requester's user custom fields on request forms. User-record custom fields can now be placed on request form layouts from the form designer's new User Custom Fields palette category. They display the requester's stored values read-only — the values themselves are still edited on the user record. The built-in Preferred Name field (from the user form's Identity category) is likewise available first-class on request forms, under the User category.
  • Shift-click now range-selects in both request views. Clicking one selection checkbox and Shift-clicking another selects the whole range between them — in the grid view and the card list alike. Row-body Shift-click in the grid keeps its open-in-new-tab meaning.
  • Form Prompts buttons can stamp who answered and when. A button's write values now support substitution tokens resolved at click time — {{staff.name}}, {{now}}, {{field:Name}} and friends — so a prompt can record, e.g., Reviewed by Jane Doe on 7/31/2026 in a visible custom field. Web addons can also read the signed-in staff member via the new aeon.currentStaff. Requires Form Prompts addon 1.4.0.
  • Issue reports now include recent system logs, and reporting is permission-gated. The Report an Issue button appears only for staff whose role includes the System Logs permission, and each submitted report now carries the last 30 minutes of the system log to speed up triage.

Fixes​

  • Changes to a staff user's site access now take effect right away. Previously a signed-in user could keep working with a site that had been removed from their site group until they signed out, and removing a site from a group — or deleting a group or a site — left everyone it affected on their old access.
  • Locking a staff account now signs it out immediately. Setting Account is Locked ends the account's active sessions right away instead of waiting for the session to expire, and locking or unlocking an administrator now requires Roles & Permissions configuration access — the same protection that guards role changes.
  • Administering a staff account now stays within the access you have yourself. Giving someone access to a site you do not have, or resetting the credentials of someone who works at one, needs Roles & Permissions access — as does copying an account that carries Customization Manager access. Administering accounts at your own sites, and copying an ordinary staff member, work as before.
  • Staff account management no longer lets you reach access you don't have yourself. Copying an account, or resetting its password or authenticator, is now refused when that account holds Customization Manager access you lack — the refusal names which access it is. Deleting an administrator, or removing their site access, now requires Roles & Permissions, matching the rule that already applied to locking one. Password resets are also recorded in the account audit trail.
  • Changing your own sign-in credentials now asks you to confirm your password. Clearing your own authenticator from the staff editor asks for your current password first, and resetting your own password there sends you to Change Password, which already asks. Resetting someone else's account is unchanged.
  • Signing out now clears your username from the browser unless you asked it to be remembered. Previously the name stayed behind on the machine after logout even when "Remember me" was unchecked, so the next person at a shared workstation could recover it.
  • Text submitted at sign-in can no longer forge entries in the application log. Log messages are now stripped of line breaks and control characters as they are written, so the audit trail stays trustworthy. One visible side effect: multi-line messages in AeonApi.log — most often a failed database command quoting its SQL — now render on a single line, with a � where each break was. The in-app Log Viewer is unaffected and keeps its line breaks.
  • A submitted report can no longer break the triage tools. Report text is now kept as plain text in the Slack notification, so submitted content can't add links or channel-wide alerts to the staff channel, and a report containing unexpected values now displays that value instead of blanking the triage page.
  • Require password change on next login is now checked by default for patron passwords too. When you set a patron's password — from Users, either Manage then Change Password, or the New user form — the Require password change on next login checkbox now starts checked, so a temporary password you hand out can't quietly become the patron's permanent one. Staff-account dialogs already defaulted this on; patron forms now match. You can still uncheck it before saving when you want the password to stand.
  • New requests created in the staff client now run your routing rules. A request created from the New Request form is evaluated against the routing rules for its starting status, so it lands in the routed queue right away — the same as a request created by cloning an existing one.
  • Printing callslips from the Activity window now routes the printed requests to In Item Retrieval. Previously the requests stayed in Awaiting Activity Processing after printing. The Activity window's print now matches queue-grid printing: after a successful print, the requests that were awaiting processing move to In Item Retrieval — for an "All Requests" print, only that awaiting subset is routed, and the print button spells out the partial count.
  • Manually sending an Appointment Reminder no longer leads to a duplicate automated reminder. Sending the Appointment Reminder email from the appointment panel now marks the appointment's reminder as sent, so System Manager's automated reminder job skips it instead of emailing the patron a second time. Rescheduling an appointment still clears the flag, so a moved appointment gets a fresh reminder as before.
  • Deleting a custom queue now checks the queue's real usage. The safety check behind queue deletion compared the wrong identifier, so it could refuse to delete an unused queue ("has been used in transactions") while allowing deletion of a queue that still had requests in it or was referenced by routing rules, email routing, or batch processing. The check now looks at actual queue references — including photoduplication requests — and cascade deletion cleans up the right dependent rules.
  • Cloning an activity now starts the copy at Created. A cloned activity used to inherit the original's status, so a copy of a finished activity opened as Completed and was hidden from the Request For activity picker. Clones now begin at the initial Created status, just like an activity you make from scratch.
  • Batch processing no longer asks you to confirm activity requests that are already in a valid status. When a custom queue is shared by researcher and activity requests, running a process like Reshelve Item on the activity requests used to pop the "Confirm Processing" dialog claiming their status wasn't a valid starting point. Those requests now pass the pre-flight check like their researcher counterparts.
  • Signing a user out of a reading room now warns when they still have items checked out. The confirmation appears wherever you can sign a user out — the user record, the request screen, the appointment panel, and the dashboard's Signed In Users list — and tells you how many items are still out. Cancel is the default, and you can still continue the sign-out. Items are counted whether they sit in a standard Item Checked Out queue or in a custom queue of your own that shares that status, and the dashboard's checked-out indicator — which could stay dark even when a patron had items out — is now accurate too.
  • The dashboard now shows which signed-in researchers still have items checked out. The book icon in the Signed In Users panel and the checked-out count on the user record never appeared — even when a researcher had items out — so staff could sign them out without any warning. Both indicators (and the sign-out confirmation they drive) now fire reliably, and the count matches the desktop client: items in any queue with the Item Checked Out status count toward the researcher, while items checked out to an activity do not.
  • Restricting the Username field no longer breaks the user record's Attachments and History tabs. When a role's field restrictions included Users.Username, the API masked the username in the user-detail response, so the Attachments tab fetched its data for a user named "undefined" and showed "Failed to load attachments" / "Failed to load history". Identity fields that address the record — Users.Username and Transactions.TransactionNumber — are now always exempt from field-restriction masking (they identify the record; they don't reveal restricted data), existing field groups containing them are ignored at enforcement time, and the field-group editor no longer offers or accepts them as members.
  • Role-assigned queue layouts now show up without a hard reload. Assigning a queue-layout template to a role (or editing the assigned or default template) used to have no visible effect on the dashboard until the page was hard-reloaded — the app kept serving the stale resolved layout from its cache, and the Queues card never re-read it. Layout assignment and template changes now refresh the resolved form, card, queue, and activity layout caches, and the dashboard picks up the new queue layout automatically for users without a personal override. Users who have customized their own queue layout keep it, as designed — the Reset button in the card's customize mode switches them to the assigned template.
  • The site switcher no longer lists site groups that contain no sites. Login already hid site groups with zero assigned sites, but the in-app site switcher still showed them — selecting one gave you an empty site scope. The switcher (and the context returned after switching sites) now applies the same rule as login: a site group with no sites doesn't display anywhere.
  • The addon catalog now agrees with itself about an addon's latest version. The version shown on a catalog card, the version offered on the detail page, the one you get when you install without picking a version, and the one the update check compares against are all resolved the same way, so an addon whose newest release was withdrawn no longer advertises a version it will not install.
  • Paging through the staff, site groups, and activities lists is now stable when no sort is selected. These lists previously had no default sort order, so moving between pages could occasionally repeat or skip rows; each now applies a consistent default ordering.
  • Staff list stays fast and complete on very large rosters. The staff list in Roles & Permissions now loads in pages as you scroll and filters on the server; previously accounts past the first 500 were silently left off the list.
  • The Multi-Site overview now loads staff site access in a single request. Previously it fetched each staff member's site groups one request at a time, which made the Overview tab slow to appear on installations with large staff rosters.
  • You can now add the first billing default on a fresh install. Billing Defaults previously kept its New button inside the selected category's toolbar, so an installation with an empty billing table had no categories, nothing to select, and no way to add anything. New now sits in the Billing Categories list header, where it is always available.
  • The Web Form Values section has been removed from the Customization Manager. It only ever drove the submit-button text on Aeon 4.1-and-earlier patron web pages; on Aeon 5.0 and later that text is edited directly in the page HTML, so the section had no effect. Its stored data is left untouched in the database. The Photoduplication implementation module still asks for a submit button label, but now records it as a note rather than trying to write it.
  • The Card Designer's Reset to system default button now really resets the layout. On every card designer (Request, Request Wide, User and Activity) the circular-arrow button in the designer toolbar used to throw away your unsaved edits instead of restoring the built-in layout, and appeared to do nothing when there was nothing unsaved. It now performs the same true reset as the template menu's Reset to System Default, and shows a spinner while it runs. To drop unsaved edits, use the Discard changes button beside Save.
  • Form designer previews now show sample data consistently across all three designers. In Customization Manager, the Activity Form designer's preview canvas left most fields blank, so the few values that did appear read like real entered data rather than preview content: its sample activity was built on an older set of field names that no longer matched the activity form's fields, so Name, Status, Begin Date, Reference Name, Reference Number, Billing Category, Activity Info 1-5, Active, Linked Users and Notes all resolved to nothing. That sample now fills every field the default activity layout renders. The Request and User previews were filled in to match, so moving between the three designers no longer changes how populated the canvas looks: Item Info 1-5 on the request, and shipping address line 2, User Info 2-5 and Research Sharing on the user, had all previewed empty, with Research Sharing showing an unchecked box even though the sample held a value. The only fields still left blank are the ones a real record genuinely would not have yet, such as the cancellation, billing, photoduplication and appointment details of a request that is still awaiting processing.
  • Duplicating a print template now asks for a name. Duplicate opens a dialog prefilled with the suggested copy name, so you can name the new template before it is created instead of having to rename it afterward — matching the other designers.
  • Typing in designer panels no longer closes them, and editable Location fields open on the first click. Pressing Space while renaming a field in the form designers' field-specs panel closed the panel mid-word and truncated the label; the New Request form's Location, Sub-location and Reshelving Location dropdowns needed a second click to stay open. Both fixed via the designers package 0.6.2.
  • Every field in the email template editor now shows the unsaved-changes highlight. Previously only the Body picked up the amber highlight when edited — changes to the other fields (Name, Type, Description, Subject, the address fields, and the routing queues) gave no visual cue until you saved. All of them now highlight in amber as soon as they differ from the saved template.
  • Save now highlights on user and activity records the same way it does on requests. Once you edit a user or an activity, the Save button turns the filled blue that already marks unsaved changes on a request, so it's easy to spot in the toolbar.
  • With more than 5 reading rooms, the calendar's room filter collapses into a compact multi-select dropdown. Sites with many rooms no longer get an overwhelming row of tab buttons on the Appointments calendar — pick any combination of rooms from the dropdown instead. With 5 or fewer rooms the tab bar works exactly as before.
  • Arrow keys and Enter now work in the Customization Manager search palette. In Customization Manager, opening the command palette (Ctrl+K / ⌘K) and typing a search left the ↑/↓ and Enter keys dead until you first pressed Tab — the footer hint promised keyboard navigation that didn't work. You can now move the highlight through results with the arrow keys and open the highlighted one with Enter while typing, without pressing Tab or reaching for the mouse, matching the main workspace palette.
  • The user search list no longer spills outside the picker dialog. Typing a username in Requests from File — or when picking a user to merge from a user's record — now keeps the matching results inside the dialog's bordered list, instead of extending past its edge with a transparent, unreadable background. Long names, emails, and organizations shorten with an ellipsis, and the status badge stays visible.
  • Activity and appointment search lists no longer spill outside their picker dialogs. When linking a request to an activity or an appointment — or bulk-assigning requests to an appointment — long activity names, appointment names, and reading-room names now shorten with an ellipsis and stay inside the dialog's bordered list, instead of extending past its edge with a transparent, unreadable background. The status badge stays visible. The underlying dialog layout has also been hardened so overly wide content can no longer push past the edge of any dialog. (Same fix as the user picker dialogs in #277.)
  • The Filter and Sort controls no longer overlap the Active toggle in a narrow list panel. On the search screen — for example after using "View All in Search" from a user's Requests tab — the sort field (such as Transaction Date) used to run underneath the Active switch and its label, forcing you to zoom the browser out to separate them. The controls now wrap onto a second line, and a long sort field name shortens with an ellipsis, when the panel is too narrow to fit them side by side.
  • The Custom Fields list in the Customization Manager scrolls all the way to the last field. On Data & Fields → Custom Fields, the field list was drawn taller than the space available to it, so the final entry stayed hidden below the bottom edge and could not be scrolled into view or selected. The list is now bounded to its panel and reaches its last item.
  • The last entry of several scrollable lists could not be scrolled into view. The same layout bug fixed for Custom Fields also affected Cancellation Reasons, Custom Dropdowns, Scheduled Closures, Billing Accounts, Bundles, Appointments to Confirm, and the appointment Notes and History panels — each list's bottom entry is now reachable, and long names in the Billing Accounts, Bundles, and Appointments to Confirm lists and the bundle assignment dialogs now shorten with … instead of being cut off at the edge of the pane.