It has extended the support for External Reference Code to other Liferay entities in version 7.4. With this new parameter, users will be able to access, create, update and delete various entities by simply specifying the scopeKey and the external reference code.

This External Reference Code is a custom identifier, which means that at the creation time it can be set, helping to migrate entities from one environment to another while keeping this External Reference Code the same across environments. You can check the available endpoints to be accessed by External Reference Code in the API explorer.

The batch engine API allows developers to export/import data, but it requires developers to provide a configuration with multiple parameters. With the new auto-generated endpoints, it is easier to perform export operations in the portal. The export endpoints are asynchronous, so it will provide a taskId in order to retrieve/download the records requested.

The endpoints follow this format:

With this feature it is possible to differentiate the login failures in the audit messages, which one is caused by incorrect password and which one is caused by incorrect login.

Before this change, audit messages were only returned for cases when the authentication failed with FAILURE status, which happens when the user provides an incorrect password. The event type is LOGIN_FAILURE in this case.

With the new changes, it is provided audit information for cases when the authentication fails with DNE status by adding a LOGIN_DNE event type. DNE stands for user "does not exist", it always means that the login (email / screenName / userID) is incorrect.

So with the newly added LOGIN_DNE event type we cover authentication DNE scenarios when the login fails due to incorrect login (email / screenName / userID) .

When the users are authenticated through SSO and IdP, it is possible to remove the ability of the end users to add or edit their passwords.

As an Instance Administrator, you are able to configure if the users have the option to give their password at registration and you can remove the whole password block from editing user data, if the password is not changeable by the password policy of the user.