=============================
ThinLinc 4.21.0 release notes
=============================

Introduction
============

Cendio are proud to present ThinLinc 4.21.0, with more than 100
enhancements and fixes. The most prominent changes are:

* ThinLinc Web Access now supports the OpenID Connect authentication
  protocol. This enables organizations to delegate authentication to
  solutions like Keycloak or Microsoft Entra ID, allowing convenient
  single sign-on, and more flexibility in authentication methods and
  policy.

* ThinLinc session logs are now in the system journal instead of in
  xinit.log in the ThinLinc session directories. This avoids multiple
  log locations for modern Linux systems, and gives more flexibility
  when analyzing logs.

* It is now possible to configure the ThinLinc client with mandatory
  settings on managed endpoint devices. These settings will be forced
  and cannot be overridden by the user.

* The Linux ThinLinc client now supports 64-bit ARM (ARM64),
  replacing the previous 32-bit ARM client. This improves
  compatibility with modern ARM hardware and operating systems.

* The platform requirements for the ThinLinc client on macOS have
  been raised. It now requires macOS Ventura (version 13) or newer.
  Users on older versions of macOS will need to upgrade their
  operating system to use this version of the ThinLinc client.

ThinLinc works on most modern Linux distributions and is supported on
any platform that fulfills our documented requirements.

Changes in this release
=======================

In the list below, the bug number is given in parentheses. For more
information, visit https://bugzilla.cendio.com.

General
-------

* The ThinLinc server now has protection against starting a ThinLinc
  session when the user already has a local session running on the
  server. The user will have the option to "force stop" the already
  logged in session, provided that the user runs the latest ThinLinc
  client. (8401, 8775)

Server
------

* Patched a security vulnerability which could allow a user to bypass a
  ForceCommand set to thinlinc-login and still gain remote shell access.
  (8825)

* The ThinLinc server will no longer accept licenses issued on different
  subscription agreements. The ThinLinc server will pick the most
  appropriate agreement if such a conflict arises. (8742, 8871)

* The ThinLinc server will now more clearly warn both administrators and
  users about the expiration of ThinLinc licenses. (8866, 8869)

* ThinLinc session logs are now in the system journal instead of in
  xinit.log in the ThinLinc session directories. (5486)

* The internal communication between ThinLinc nodes are now version
  checked. This clarifies the requirement that all nodes in a cluster
  need to run the same version of ThinLinc. (5679, 8780)

* Agent servers in a cluster will now reject communication from a local
  duplicate master service running on the same machine. This change
  makes sure that the real master node for the cluster can maintain a
  consistent state. (8878)

* Fixed an issue where the server setup would hang when installing the
  thinlocal and nearest printer queues on Ubuntu 26.04. (8891)

* Added a password confirmation step when setting a password for Web
  Administration during the server setup. (5944)

* Fixed an issue where the server setup failed on Debian/Ubuntu systems
  using `ufw` as firewall. (8759)

* Fixed an issue where it was not possible to start new sessions on
  Fedora 42 and subsequent releases because of a bug in the Fedora
  SELinux policy. (8727)

* Fixed an issue where the configured login background would not always
  be shown. (8212)

* Fixed an issue where both the ThinLinc client and server incorrectly
  logged warnings about incorrect SSH host keys. (8536, 8857)

* The desktop shortcuts for ThinLinc setup, ThinLinc Web Access and
  ThinLinc web administration have been removed. (8392)

* The ThinLinc setup now uses colors to emphasize the most important
  parts of the output when it runs in fallback text mode. (8858)

* The ThinLinc setup now allows you to configure the parameter
  `/vsmagent/master_hostname` when setting up an agent-only node. (4709)

Native client
-------------

* A Linux client for 64-bit ARM platforms has been added. This improves
  compatibility with modern hardware and operating systems. The 64-bit
  ARM client replaces the older 32-bit ARM client, which has been
  removed. (6978, 8833)

* The ThinLinc client now supports adding multiple key files for public
  key authentication. As a result, the interface for configuring keys
  has been changed. (8663)

* It is now possible to configure the ThinLinc client with mandatory
  settings on managed endpoint devices. These settings will be forced
  and cannot be overridden by the user. (5567)

* The ThinLinc client for macOS now requires macOS Ventura (version 13)
  or newer. The ThinLinc server remains backwards compatible with older
  clients, for those users who cannot upgrade in the near future.

* Windows 11 no longer shows a warning about an unknown publisher when
  installing the ThinLinc client. (8483)

* All binaries in the ThinLinc client for Windows and the client
  customizer are now signed, not just the installers. This provides more
  protection against malicious tampering and provides compatibility
  with Windows Smart App Control. (4433, 6991, 8777)

* Debug level is now configurable using the new tlclient.conf parameter
  DEBUG_LEVEL or through the new "Troubleshooting" tab in the options
  dialog. (8329)

* The "Troubleshooting" options tab now provides a quick-access button
  to the log file folder using the native file manager of the local
  system. (8843)

* Fixed an issue in the ThinLinc client for Linux where the ThinLinc
  session would resize incorrectly when reconnecting, causing
  application windows to move. This issue was a regression introduced in
  ThinLinc 4.19.0. (8686)

* The ThinLinc client for macOS has an updated icon to match Apple's
  "liquid glass" design language. (8767)

* The ThinLinc client now supports exporting audio input and output
  independently. (8193)

* Patched a low severity security vulnerability which under certain
  circumstances might allow an attacker, that is able to modify the
  ThinLinc client username through the commandline, to execute code on
  the client machine. [CVE-2025-61984, CVE-2026-35386] (8838)

ThinLinc Web Access
-------------------

* It is now possible to configure ThinLinc Web Access to allow users to
  log in using an OpenID Connect provider. (8247)

* The Web Access login API has now been documented, making automated
  logins from web portals easier. (5231)

* Fixed a security vulnerability where a user could bypass the
  authentication policy when reconnecting. Note that the vulnerability
  only allowed a user to reconnect to their own sessions. (8782)

Smart card support
------------------

* Improved compatibility with some smart card applications, primarily
  FreeRDP-based applications such as Remmina. (8817)

Administration
--------------

* A refresh button was added to ThinLinc web administration's
  Status/Sessions page to allow immediate refresh of session
  information. (8864)

* The duration a session has been disconnected is now directly shown in
  the sessions list in both ThinLinc web administration and tlctl.
  (8820)

* Added a new subcommand "tlctl license usage" that can display peak
  license usage for a given period. (8786, 8791)

* License usage statistics retention has been extended from 600 days to
  10 years. This change applies only to new installations. Existing
  statistics databases are not automatically migrated to the new
  settings. (8790)

Documentation
-------------

* Each page in the ThinLinc web administration interface now has a "?"
  button that links to the relevant section in the ThinLinc
  Administrator's Guide. (3964)


Configuration changes
=====================

New
---

* New configuration folder: `/webaccess/oidc/`. Holds settings
  relating to OpenID Connect authentication in ThinLinc Web Access.

* New parameter: `/webaccess/login/password`. Controls whether password
  authentication is permitted or not in ThinLinc Web Access.

A complete configuration reference can be found in the ThinLinc
Administrator's Guide.

Corrected issues
================

ThinLinc has also been enhanced in many other ways. The complete list
of corrected issues is::

    3304, 3813, 3964, 4433, 4709, 4761, 4899, 5105, 5231, 5238, 5356,
    5357, 5486, 5567, 5588, 5679, 5878, 5944, 6978, 6991, 7184, 8105,
    8130, 8151, 8172, 8187, 8193, 8212, 8247, 8300, 8329, 8392, 8397,
    8401, 8412, 8441, 8483, 8532, 8536, 8554, 8606, 8618, 8637, 8652,
    8663, 8686, 8687, 8704, 8727, 8730, 8742, 8756, 8757, 8759, 8765,
    8767, 8768, 8770, 8771, 8772, 8774, 8775, 8777, 8779, 8780, 8782,
    8785, 8786, 8790, 8791, 8803, 8807, 8811, 8814, 8815, 8816, 8817,
    8820, 8825, 8830, 8833, 8837, 8838, 8839, 8840, 8842, 8843, 8848,
    8849, 8850, 8851, 8854, 8857, 8858, 8860, 8862, 8864, 8866, 8867,
    8868, 8869, 8871, 8876, 8878, 8889, 8891

| ARM is a registered trademark of ARM Limited.
| Debian is a registered trademark of Software in the Public Interest, Inc.
| Fedora is a registered trademark of Red Hat, Inc.
| Keycloak is a registered trademark of Red Hat, Inc.
| Linux is a registered trademark of Linus Torvalds.
| Microsoft Entra is a registered trademark of Microsoft, Inc.
| OpenID is a registered trademark of the OpenID Foundation.
| macOS and OS X are registered trademarks of Apple Computer, Inc.
| Red Hat is a registered trademark of Red Hat, Inc.
| ThinLinc is a registered trademark of Cendio AB.
| Ubuntu is a registered trademark of Canonical Ltd.
| Windows is a registered trademark of Microsoft, Inc.
