Skip to main content
Version: Aeon 7.0

Aeon 7.0.1835

Released September 8, 2026. Atlas Support Access, staff roster import and bulk SSO onboarding, Atlas BI sign-in, and fixes across single sign-on, reading rooms, and billing

Highlights​

  • Atlas support engineers sign in through the Atlas support broker, only with your permission. A new Support Access page under Customization Manager → Permissions controls whether Atlas support can sign in, under which role and site scope, and until when; it is off unless you turn it on. Each engineer signs in as a named, audited account with no shared credentials. Whatever role you grant, a server-enforced deny overlay means support can never change your grant, reset credentials, manage API keys, or edit site groups or API key templates; installing server add-ons and every other sensitive action sits behind a switch that is off by default. Patron last names, email addresses, contact details and identifiers are hidden from support sessions unless you decide otherwise, multi-site systems give support the same site assignments as staff, idle sessions end after 20 minutes by default, and a support sign-in can land directly on a page that downloads the log export and signs out again.
  • See everything Atlas Support has ever done on your site. The Log Viewer gains an Audit view over the permanent auth audit trail, and the Support Access page gains an Activity tab with every support session, an optional email alert on each sign-in, the list of accounts Atlas created, and a CSV export of the full history. Support accounts can no longer be given a password or Client Access from any client; the database itself refuses both, and the page names any support account that already has one so Atlas sign-ins to it are refused until it is deleted.
  • Bring staff on board in bulk. The Staff screen exports the full roster, including access flags and site assignments, as Excel or CSV, and imports an edited roster back: new usernames become accounts, existing accounts are updated, and every change is previewed before anything is saved. Select staff and send single sign-on invitations to all of them at once, with a preview of who receives one and why the rest are skipped, or create an account with no password by choosing "Email them a setup link" so the new staff member picks their own through a one-time link nobody else sees. Password-reset and invitation emails are now stored encrypted until sent and survive restarts, with queue status available to administrators through the API.
  • Create activities from a spreadsheet. New → Activities from File creates one activity per row, and a Usernames column links users to each one so Requests from File can follow. Both Requests from File and Activities from File now offer Download Example, a sample spreadsheet with every accepted column including your site's custom fields.
  • Open Atlas BI from Aeon. Grant roles Atlas BI access as Viewer or Contributor, and staff will sign in from the ⋯ menu with no separate Atlas BI password (set the address in the AtlasBIURL key). Aeon's side of this connection is complete; the Atlas BI servers are still being updated to accept it, so the sign-in becomes available as that rollout reaches your Atlas BI instance.
  • Routing rules can now match on every item field. Item Citation, Subtitle, Edition, Place, Publisher, Number, ISBN/ISSN, EAD Number, Reference Number, Format, Service Level, Shipping Option and For Publication are available in the routing rule field picker and in match strings.
  • Choose the currency Aeon displays. A new BillingCurrencyCode customization key (System → Billing, default USD) sets the symbol on every amount: billing tabs, Billing Defaults, request history, printed invoices, and invoice emails.
  • Dashboard queues follow role permissions. Staff whose role has no Requests access no longer see the Queues tab on the dashboard, so a registration-only role gets a dashboard without hand-stripped layouts.
  • Log Viewer exports now include every matching entry. The export used to stop silently at 10,000 rows, about one day at a busy site. It now exports everything the current filters match, as a zipped CSV so even an all-time export is a small download.

Fixes​

  • Single sign-on works with more identity providers and configurations. SAML logins succeed when the IdP releases only a NameID, and a genuinely missing attribute now reports which one. Pasting the full discovery URL as the Authority no longer breaks sign-in, and the help text says to enter the issuer alone. The SAML-only Protocol options card is hidden under OpenID Connect, and switching protocols no longer resets stored SAML policy or identity-provider details. On Windows installs the installer records the staff web client's address so SSO redirects and invitation emails land on the right page, and the Staff Web URL setting now controls the address in every emailed staff link instead of being overridden by a server-level setting. The sign-in page retries its login-methods lookup after an API restart instead of hiding the SSO button, and a test sign-in that reaches an account still using a password reports success with the one remaining step.
  • Fewer unexpected sign-outs. Every tab of a browser now shares one session that any of them can renew, so working in several tabs no longer signs you out. Reloading the page on a multi-site install keeps your site or site group selection. Access flags stored as "yes" instead of "Yes" now grant the same permissions at sign-in that the staff editor shows.
  • Calendar views: All day no longer books straight through a midday closure when a reading room's hours are split; it fills the first block and leaves the times editable. The week and month views now mark a day closed by a reading-room exception, distinct from a scheduled closed day, and the week view shows appointments booked on closed days alongside the Closed marker.
  • Reading room saves are safer. Deleting an exception visibly removes the targeted one instead of appearing to remove the last in the list. A room with an unreadable legacy exception can be saved again; the exception is labeled and left alone. If another staff member removed a policy or closure while your form was open, saving now shows a validation error instead of silently dropping your copy. The API requires every policy field and rejects an incomplete policy instead of defaulting Reminder Days to -1. The Reading Rooms and Appointment Scheduling implementation modules no longer clear a room's site associations and locations, which neither module collects. Reading-room time zones can no longer be saved in a form that locks the desktop client out: the implementation wizard offers a time-zone picker, and every path that writes a room stores the zone the way the Windows client expects.
  • Billing: removing a billing account from a user warns about requests still using it and lists them first, and a request's Billing tab no longer says the user has no accounts while showing one. Add Billing Account search narrows on the server across every account, not only the first 50, and says when more matches exist. Choosing (None) for a Billing Category clears it instead of saving __none__; rows written that way are repaired on upgrade, and a request with no category no longer estimates from another category's rates. Invoices and charges generated in the evening are dated the library's own day instead of the next UTC day.
  • Staff screen: creating a staff user now requires a role, chosen from the roles you may assign, so an account can no longer be saved with no permissions. Staff cards no longer truncate long usernames to a single letter. The Logon to Web action and its API endpoint have been removed.
  • Routing rules written in the desktop client can be switched back on from the web. Activating a stored rule no longer fails when its match string uses a column the web field picker does not list. Match strings no longer accept bracket- or quote-wrapped field names; reference fields as alias.FieldName, while brackets inside quoted values such as LIKE patterns still work.
  • Activities: searches no longer time out on large databases, because matching a word against an activity's associated requests no longer slows down with the number of matching requests. Editing an activity's begin or end time no longer shifts it by the server's time-zone offset.
  • Role-assigned dashboard templates now reach the staff they are meant for. Role and default Activity Designer templates show up for staff who never customized their own layout, and staff who did customize theirs see a notice naming the template assigned to their role with an offer to switch, so pushing out a new layout no longer looks like nothing happened.
  • Server Addons: saving an addon no longer stops the Windows System Manager and Customization Manager from loading server addons, and the permissions an addon requests now appear on its page.
  • Printing: request print templates offer the request's notes as fields (latest note, latest researcher note, all notes) and as a Notes table, and Word templates using «Notes» map to real notes when imported; already-imported templates are unchanged until re-imported. An element on a grid print template can be marked "print once per page" so column headers and free text no longer repeat for every request.
  • Email: Compose Email keeps Send unavailable until the message has a body, and shows the server's validation message on error. The web client uses the same smtp.config, environment-variable, and OAuth configuration as System Manager, retries transient failures, and offers a connection test through the API. Custom Transaction templates fill the <#Appointment.*> merge fields from the linked appointment. Importing a template package no longer fails when two email templates differ only by a leading space.
  • Interface polish: the highlighted row in the command palette and command menus is easier to see in both themes, long submenus such as Add Flag scroll instead of cutting off, edited reference lists (custom dropdowns, flags, queues, email templates) refresh in open screens as soon as they are saved, the Basic Search and Search & Commands guided tours match the current search experience, and two settings descriptions now use American spelling.
  • Security updates were applied to the staff web client's underlying framework.