The presentation is hosted by Alexandre Delaunay, in charge of the GLPI development team and the product owner for GLPI.
In this video he talks about roadmap and some features development team wants in GLPI for the next major version. Here is the transcription:
“To keep the presentation short, we will discuss only about:
- Major topics
- Or very graphical ones
And I would like to insist on the fact that there is no promises of time regarding the delivery.
We will try our best to add the features, but in function of how the year will go, some will be OK, others not.
Now, we have in our marketplace 2 plugins to address generic adds:
- Genericobject
- Fields
We want to add the possibility to let you customize each type of objects displayed in the Assets menu (at first).
The first part of that is to let you define your types.
We will provide a list of predefined types matching the current assets list and let you add new ones if you want. Like servers in addition to desktop or laptop computers. Or to do something completely different from IT management, e.g: cars, desks, etc.
Some of the current types will still be not removable like Software, Rack, Cable, Cartridge and Consumable. The reason is their behavior, or their presentation differs from other assets.
You will still be able to disable these if you want but deletion will be impossible.
So, GENERICITY covers the creation of new asset types.
In addition, on the same setup page, you will be able to define which capacity an asset type use.
E.g. contracts, management, etc., COMPOSITION of an asset type, with some checkboxes to select capacities.
This permits you to remove or add tabs to the object.
Or if an object can be inventoried by an agent.
Let us talk a little about features related to the GLPI inventory agent.
Remote inventory reminder.
Before talking about roadmap, let us do a quick reminder about remote inventory feature
This is a task you can set up for an agent to let it query other computers on your network to construct an inventory file for each.
The single agent will aggregate all inventory files and send them in one pass to the inventory API of GLPI.
So, the main purpose is to have only one deployed agent.
We use SSH and WinRM protocols to achieve that.
GLPI Agent - Roadmap (1/2).
The first point we want to improve is to ease the inventory process of your network.
We currently have two tasks:
- discover which "ping" addresses in an IP range
- network inventory, which takes the result of the discovery to do a full SNMP inventory for network equipment and printers.
We will change the process, by:
- adding remote inventory of COMPUTERS
- and let discovery task directly doing a FULL inventory if it knows the type of the remote device. A SNMP query for network equipment, SSH or WinRm queries for computers.
With one unified task and one setup, we aim to let you discover all your network devices.
The two last bullet points describe things required by unified discovery. The new toolbox UI will receive forms:
- to plan tasks for the agent.
- to save credentials, like SNMP community, login password couple for Windows domain or public key for a SSH connection. In summary, any information to let the agent connect to a remote device.
GLPI Agent - Roadmap (2/2)
We thought about rewriting a large part of the agents, and we shortlisted Golang for that.
The fact the agent is written with the language PERL.
Recently, finding developers comfortable with this language has been hard.
We will try a prototype within the year to measure our capacity to switch to this new language.
We plan also to enforce exchange between agents and backend by adding authentication and registration flows. This will be recommended but you will be able to do simple exchanges if you prefer.
And we still need to redo all forms to drive remotely the agent in GLPI UI.
This is still planned.
Let us talk a bit about features related to the GLPI web application.
High-level API (1/2)
Firstly, we will add a new API, again.
We observe that, despite the old one permits more usage, due to its low-level connection with the framework, it is hard to maintain its stability and avoid regression.
We maintain an interface to address depreciation for this previous API, but it is getting harder and harder to do.
So, a new API connected to a higher level with stabilized endpoints and parameters.
And we took advantage to add some comfort features:
- we have a dedicated UI based on Swagger UI to ease discovering and testing endpoints and their parameters
- we also use RSQL, a common Query language for filtering API.
High-level API (2/2)
For the second slide, you can see in action a GET request to list users in GLPI database.
We want to extend the datacenter features in the next version. Mainly about adding graphical views.
DCIM - Network equipment's panels
The first and the simpler one is graphical panel for network ports list in equipment forms.
We will take the front and rear pictures defined in the model of the equipment and display them above the ports list.
The user will get information about each port directly on the picture panel by hovering them.
A single click on a port will scroll the page to the good line to get more information.
In the model setup, you will have a new tab to draw each port's position.
DCIM - Graphical enclosures (1/2)
In the same way, slots of an enclosure can be drawn and indexed to indicate to GLPI where sub items can be placed.
DCIM - Graphical enclosures (2/2)
On a rack view where an enclosure is inserted, instead of a single blank rectangle, slots will be displayed and usual controls available, like hovering or clicking to get more information.
DCIM - Graphical connections
Finally, for DCIM part, we will try to add some representation for network or power connections.
The goal is to get links between equipment.
This is early to talk about this, we have short specifications for this, and it requires more research to find a library, for example.
Keep in mind the current screenshot does not represent any existing development.
Workflows - Processes
We have a functional prototype for this.
A new view to let GLPI administrator's set up their business processes.
With steps, transitions, conditions and actions, a full toolkit to describe a full workflow.
This aims to replace legacy rules.
And for a start, it will be available for assistance objects like tickets or change.
Nutanix inventory import
Another development currently in alpha is the connector to Nutanix API to get:
- Clusters
- Hosts
- Virtual machines
- Disks
The module parses the distant API and sends them to the native inventory API of GLPI.
The merger with existing devices is done with the rule engine as usual.
SCIM
Another connector, GLPI will serve a SCIM endpoint for your Microsoft Azure instance.
This protocol pushes changes of users from the directory to connected application.
So instead of synchronizing the whole user's database and matching everyone, any change in the directory will be immediately pushed to GLPI.
Now, a security feature, two factors authentication!
Administrators can enforce users' logins in the security setup to ask them to register an external application like Google Authenticator or Authy.
Security - 2 factors (2/2)
After a successful login, a new field will appear asking users to paste a pin code from the authentication application.
Security - Oauth Server
We will add an Oauth server to GLPI for 2 purposes:
- connect applications to GLPI to delegate the login feature and identity management
- secure our several API like inventory one or the general purpose one.
Security - misc
- Vulnerabilities management
- Scanners integration (vuls, tsunamin)
- CVE matching
Some various points:
In the management menu, a new entry to list vulnerabilities.
The goal is, with the help of external scanners, like vuls or tsnunamin, as well as some API to get CVE and match them to known software's to see if a host has some security vulnerabilities.
Some dashboard cards and alerts will also be added to enhance reporting about this subject.
Technical changes
- Web root for the application will be `/public`
- continue work on twig (removing legacy echo)
- removal of legacy auto escaping
- modularization of critical features
- e-charts lib for dashboards
Last slide to tell you we continue to improve the core of GLPI.
The most impactful for you will be the move of the web root of the application.
Now, it will be a sub-folder named /public.
Thereby, all other sub-folders (like files for example) will not be available on the web when the webserver is not well set up.
The next point is legacy codebase we need to clean.
And to finish, we moved to a new charting library called e-charts.
It is simpler to use on our side and you appreciate the new colors and its interactivity.
Timeline?
- Currently, finish stabilize 10.0 version
- End of 2023, beta of next major version
We are still working on bugfixing the 10 version. This last brought substantial changes, especially on the assistance part.
But we aim to work on the incoming yearly results fully on the latest version.
Very soon the new major version of GLPI will be released with many new features, including a major overhaul of the interface.
Here is the quick look at automatic inventory features.
Fork of the Perl FusionInventory agent, this new agent is enhanced with several new features:
The GLPI agent can advantageously replace the FusionInventory agent because it remains fully compatible with the automatic inventory of the FusionInventory.
This new agent is already available, you can download and test it:
https://github.com/glpi-project/glpi-agent/releases
Nightly built packages are also available to get the latest developments: https://nightly.glpi-project.org/glpi-agent/
We provide the community with a documentation detailing the installation, use and configuration of this new agent. Note that there may still be a few aspects to be completed (the missing points will be filled in the coming weeks).
We also provide a perl script (see dedicated documentation) allowing you to install agent on Linux with a suitable package (rpm, deb, snap.)
Some screenshots to illustrate the ToolBox interface of new agent:
Some time ago the android agent has returned to the google play store. It supports versions 4 to 10.
For GLPI Network subscription customers, we have also added the possibility of configuring the server URL via mechanism called "Deeplink". Using QRCode agent automatically retrieves the configuration to connect to the server.
We are happy to announce we add support for automatic inventory directly to GLPI core.
New API REST (front/inventory.php) will be available to receive inventory files in historical format (OCS, fusioninventory) or via new format json.
We therefore keep compatibility with the previous agents (just it will be necessary to reconfigure the server URLs of the historical agents, or to set up a web proxy to perform a redirection to the new URL).
You can now manage with this new format most of GLPI's inventory objects, like telephones, applications, racks, etc.
This is enabled by a new rewrite of the underlying code. The interface is inspired by the community projects mentioned above, the code is new.
This code now allows you to receive partial inventories.
This consists of sending only part of the particular information related to the object, and indicating to the server - via a flag - to update only the data concerned.
Transfer, processing, insertion and update of data is done in a significantly faster way.
As seen above, GLPI now integrates the basic building block concerning automatic inventory.
However we have not yet taken over the advanced tasks allowed by previous projects.
Here are a few points about these tasks:
For these last two features several scenarios are possible:
In our roadmap it is planned to work on rewriting of these parts, but as long as version 10 being almost done (and this substantial work), we are postponing their availability for a few months.
On June 22nd at 11.00 AM (Paris time) we are launching a webinar to talk about:
Speaker: Alexandre Delaunay, head of GLPI of Development team
Registration link: https://us02web.zoom.us/webinar/register/WN_LcEA0DzaT0m3vWasVbq8fQ
GLPI v.10 includes since its latest release the native inventory feature (including GLPI agents also released during the year).
Inspired by previous project: FusionInventory and OCS (and using their XML format), - it aims to be a unified entry point for the inventory (by adding greater compatibility of all GLPI objects).
A complete rewrite directive had been one of the stated objectives (without code recovery) at the beginning of the development of the project.
Recently (after the release of the stable 10.0 version), it appeared that this functionality within GLPI included pieces of code from FusionInventory. As a development team we have been patently negligent about the copyrights of the previous project.
Moreover, there is an incompatibility between the license of GLPI (GPL-2.0-or-later) and FusionInventory (AGPL-3.0-or-later).
We apologize to the FusionInventory community for this situation. Teclib’ and its developers are also contributors to the project and are therefore included in this notion of copyright (mainly to the agent but also in part of the plugin).
A few changes will be made to address the situation:
The copyright of the Fusion Inventory project will be added to the source files concerned,
GLPI license (and source file headers) will be changed to GPL-3.0-or-later.
On this last point, it is possible because previous license contained “or later”. It allows us to switch from the current version 2 to later versions.
Compatibility between GPL-3.0 and AGPL-3.0 (Affero) is explicitly provided in the text of both licenses.
In addition to this change, we took the opportunity to check current uses in terms of libraries.
We have replaced some to resolve any incompatibilities following the switch to GPL-3.0-or-later.
DHTMLX/gantt was impossible to replace and the entire Gantt functionality was taken out of GLPI to be integrated into a dedicated plugin. There is normally no functional loss, you will simply need to install the plugin (via the Marketplace or manually) to recover previous displays.
These changes will come in effect in the next version of GLPI, which will be in a few weeks.
A quick summary of the impact of these changes:
GLPI is, and will remain, completely free and open source, its code is always accessible and adaptable by everyone.
All projects wishing to share or re-use GLPI code must now do so with the GPL-3.0 or compatible license.
The mention “or later” of the news makes it possible to foresee the case where a version 4 of the GPL would become available.
If you are a GLPI user, the impact is probably zero.
We promise to be more vigilant in the future towards the compatibility of our code and the libraries that we use.
Original post: https://www.jamf.com/blog/jamf-plugin-glpi-open-source/
Discover the background and future trajectory of the Jamf Plugin for GLPI, one of the many valuable tools available through the Jamf Marketplace. Independent developer Curtis Conard provides a first-hand account of its creation and the importance of open-source software.
The Jamf Marketplace is home to a wealth of helpful tools that extend the Jamf platform and connect it with third-party solutions and ecosystems. The independent developers who contribute these integrations and other tools play a vital role in cultivating Jamf’s global reach and interoperability. One such developer, Curtis Conard, has provided the account below of their creation of the Jamf Plugin for GLPI. Read on to learn what value the plugin adds and what developments can be expected in the future.
Gestionnaire Libre de Parc Informatique (GLPI) is a free automatic inventory asset and IT service management package. GLPI was originally created in 2003 by the INDEPNET Association and was transferred to Teclib’ (both based in France) in 2015.
Although GLPI is maintained by a French company, the default language in the software is English, and the activity on the GitHub page is in English as well; I think that this choice has helped the adoption of GLPI globally. There are currently community-contributed translations for 80 different languages.
Even though its focus is on asset management and help desk functionality, GLPI provides a wide variety of other tools such as:
Teclib’ offers paid professional support, both on premises and in the cloud, for the businesses that want the support or to offload the responsibility of hosting their GLPI instance. GLPI has remained free and open source under a GPL license from the start, and there is no difference to the core software if you decide to host it yourself or through the cloud.
GLPI has a large catalog of plugins that extend its functionality even more. While some of the plugins are available as part of the professional services agreement, most of them have been created by the community for free. At the moment, there are over 50 plugins that support the current version of GLPI.
The GLPI project just released version 10.0, marking a huge UI/UX upgrade for the project which helped streamline a lot of workflows, improve its usability of tablets and phones and more. It also adds a native automatic inventory system, supporting agent inventory and remote inventory, for many different types of devices.
There are multiple big features on the roadmap for future versions to improve its current offering and add new features like event management, power management for “green IT,” and more.
The open-source nature of GLPI allows users of the software to give something back to the project, whether that be bug fixes, new features, translations or documentation changes. Users are not required to pay for the core software or for the majority of the plugins, but those who do help keep paid developers on staff to keep the project alive and growing.
This is where I come into the picture. I started using GLPI while I was working in the IT department at a local school district in 2014. In the summer of 2018, I started making code contributions to the software. This was in part because my work helped our department function more efficiently by adding much-needed features and changes, but it also allowed me to improve my skills in web development, which had been my original career choice.
From mid-2018 until the end of 2020, I worked voluntarily without any monetary compensation. At the end of 2020, I was brought on under contract with Teclib’ to be paid for my contributions. I finally made the decision in early 2022 to leave my IT job and focus on GLPI development full-time.
I can’t envision a scenario in which these transitions could have happened if GLPI wasn’t open source and funded by optional professional service agreements and cloud hosting. As I was developing the Jamf Plugin for GLPI, multiple improvements were contributed back to GLPI to accommodate it, including adding software and components to phones in the inventory which were previously mainly for older analog or VoIP phones.
As of now, I personally maintain six different plugins for GLPI. All of these are free to use and open source.
In the summer of 2019, I started work on the Jamf Plugin for GLPI, focusing only on mobile device inventory as that was what we were using at the time. Previously, our department was copying inventory information for our 1,000+ iOS devices from Jamf to GLPI manually and through CSV exports/imports. That same summer, I presided over the first release of the plugin. I think I actually ended up spending less time that year creating the plugin than I spent manually importing the latest inventory data from Jamf to GLPI.
Later in 2019, the scope of the plugin expanded to include syncing extension attributes and issuing mobile device commands directly from GLPI. For the latter, users in GLPI could be linked to their Jamf Pro account so that they had access to the same commands in both systems. The purpose of this was to streamline certain workflows. For instance, if we got a ticket that a device was stolen, we could immediately view the asset in GLPI, issue an Enable Lost Mode command, mark it as Lost in our inventory system and then later view any location information all from that same page.
The next major version(s) came in 2020 alongside the release of GLPI 9.5. This added support for syncing additional information about iPhone and support for syncing computers.
For the future of the Jamf Plugin for GLPI, in the short term I have plans to add support for Jamf School sometime after the GLPI version 10.0 release, due to multiple requests from community members. Afterwards, new features will appear as the community requests them and as time permits. Even though I am paid for my GLPI contributions, this plugin is still a personal project, so it isn’t funded.
I am looking for contributions to the localization of the plugin. It currently features translations for English, French and Japanese. Completing the partial Spanish translation is a priority. I am also looking for users to test and give feedback on the plugin. This will help me to find issues that I could not, or to identify needed features.
The main news of this version is a complete redesign of the interface and the user experience. The latest overhaul, dating back to version 0.90 was released in October 2015.
Based on tabler, Bootstrap 5 and Twig, this novelty brings many visual changes.
The integration of these standard libraries will make it easier to develop new interfaces and above all provides a “responsive” display mode that is easier to maintain.
Here are some screenshots to give you a preview:
We also have made a certain number of improvements of the user experience within GLPI. Without getting into the details, here is the list of key points.
We hope you enjoy these changes.
As you may have noticed with the previous captures, GLPI has now a default layout with a vertical menu on its left. If you still prefer a layout similar to previous versions (named Horizontal) you can find it in the the user preferences.
Now t is possible to collapse the menu in order to have a compact display.
Present since version 9.2 of GLPI, the “Go to” button allows a quick search of a menu. Now you can find it on top of the menu, its keyboard shortcut recalled.
The saved searches panel now is integrated to the GLPI design.
It can either be floating, as before, or pinned to pages, to be kept permanently (even during navigation).
Pinning is done on a page-by-page basis, a pinned panel for tickets will not be pinned for computers.
Note that it is now organized to present in the first tab, the saved searches corresponding to the type of object concerned: the list of tickets will display in priority order the saved searches concerning the tickets.
The second tab lists all the other searches concerning the other types of objects.
As the panel is now contextual to the type of object presented, access is via an icon named “Lists” present next to the breadcrumb.
It is now possible to disable the display of the search engine.
Very practical because you can navigate in GLPI only thanks to your saved searches!
The display of the search engine is now launched in “AJAX” mode. A loading icon is displayed when starting a search, changing pages or sorting. Once the new results are available, only the content is replaced and not the entire page.
With a “ctrl” you can add several sorts on the columns of your search results.
Example: sort by “Name” and by “Date modified”.
The main element form now displays a panel on the right recalling the images associated with the corresponding model.
These images were previously used only in the display part of data center racks, they are now available everywhere.
With the arrival of new libraries tabler and Bootstrap 5, it is now much easier to create and modify the palettes defining the colors of GLPI.
Here is sample palette file corresponding to the screenshot below:
2 new dark palettes are also available:
The display and use of ITIL objects (Tickets, Issues and Changes) were redesigned.
Many changes were made:
The user who asked the question will be added as an observer of the object and a notification will be sent to him personally.
A new notification (and a corresponding event) named “New user mentioned” is added to your GLPI instance.
You can now define the timeline for a follow-up.
In addition, an automatic reminder after a certain period and with recurrence can be defined in order to warn participants that a response from them is expected. It is also possible to plan an automatic resolution after a certain number of reminders.
This display mode previously only available in projects, is now accessible from the Helpdesk via dedicated icon next to the breadcrumb.
You can add columns corresponding to the statuses.
Attention, even if the “Closed” status is available, we will not display the relative data in order to prevent the execution time from taking too long. The column remains available to accommodate the object move.
On this new page and also on the page of projects it is now possible to add criteria to filter the cards.
Follow-ups, tasks and solutions templates now support the addition of variables. These are replaced by their values at the time of their use. For example, it is possible to use {{ticket.id}} in a template and when choosing the template in a follow-up, the variable is replaced by the ID of the current ticket.
Integrated documentation is available to know all the variables available.
We now support automatic inventory directly in GLPI.
A new REST API will be available (directly in the GLPI index) to receive inventory files in historical xml format or via the new json format.
We therefore maintain compatibility with previous agents (it will just be necessary to reconfigure the server URLs of historical agents, or to set up a web proxy to redirect to the new URL).
We now manage with this new format most of the GLPI inventory objects, such as telephones, applications, racks, etc.
This code now allows you to receive partial inventories.
This consists of sending only part of the information related to the object concerned, and indicating to the server, with a key, to update only the data concerned.
Transporting, processing, inserting and updating data is done significantly faster.
This new agent (bifurcating since version 2.6 of the fusioninventory project) has been enhanced with several new features:
You can get the archives for your systems at the following address: https://github.com/glpi-project/glpi-agent/releases
Nightly build packages are also available to get the latest developments: https://nightly.glpi-project.org/glpi-agent/
We also provide a perl script (see documentation dedicated) allowing to install the agent on your linux with a suitable package (rpm, deb, snap.)
The documentation is available and details of the installation, use and configuration of this new agent.
Some screenshots to illustrate the ToolBox interface of this new agent:
The android agent is back on the google play store. It supports versions 4 to 10 of the OS.
For customers under subscriptions we have also added the possibility of configuring the server URL via a “Deeplink”. Via QRCode, the agent automatically retrieves the configuration to connect to the server.
As seen above, GLPI now includes the basic brick for automatic inventory.
However we have not yet resumed the advanced tasks allowed by the previous projects.
Here are the points about these tasks:
For these last two features, two temporary scenarios are possible:
This package is transitional and the integration of these modules is planned in our roadmap, the complete package is expected in a few months.
We have started the work on developing the remote deployment module. In addition to its integration into the core of GLPI, a temporary community plugin will be made available to use the functionality before the next major version of GLPI.
We will continue SNMP and ESX functionality in the same way during the year: support available in the next major release, and community plugin for beta testing of the functionality.
Contribution of Fian services and Smartwood, the old Gantt view has been refreshed by integrating the library DHTMX Gantt.
This change also brings an interactivity of the view (possibility to create/modify/move tasks).
Material (items) reservations now use the same library (fullcalendar) as GLPI planning.
From the preferences, it is now possible to choose for the rich text fields (html), the layout of the integrated toolbar:
In the settings it is now possible to choose for the rich text fields (html), the layout of the integrated toolbar:
The “embedded” layout displays a contextual embedded toolbar to the right of your cursor.
Selecting text will bring up other options such as bold or italic.
Other less common options (source code, full screen, etc) will be available via right click.
The plugin databases previously carried by Infotel is now directly integrated (Management menu) thanks to their help.
A migration script to recover data from the old plugin is available from the command line console.
These two objects now can be linked, tabs have been added to them.
A new cable object is now added to the Assets menu.
It is used to represent the physical link between the ports of two inventory objects.
New prerequisites:
If you are ready to try it, download the final version here:
At Teclib´ we are happy to announce that we are expecting the release of GLPI 10 in the following weeks. We have received many questions related to migration from older versions of GLPI/compatibility of plugins and decided to publish a dedicated video. Watch it on Youtube or read the transcription below.
You can migrate to version 10 from any GLPI version (we support migrations from at least 0.80 version), all data, like users, tickets or assets, will be transferred.
The server must have at least PHP 7.4 and MySQL 5.6 dependencies. If your server doesn’t have these, you must upgrade these requirements.
No data loss is expected, but as usual, make backups (files and database) and/or snapshots.
You will need to execute some optional migrations after GLPI main update with the help of the console.
If you have custom developments or core changes, please note they will be erased when copying the files. Consider porting them before the migration.
All plugins listed in GLPI Network Subscriptions (both Community and Exclusive ones) will be compatible with GLPI 10.
Check https://plugins.glpi-project.org/#/version/~~10.0.0/plugins for a community based list.
In addition to the small gain of not using a plugin, the feature will use less history data and database storage (for example, software updates take 1 line instead 2).
We worked also on user experience, you have now assets separated by types for a more comfortable setup.
It unlocks some features like partial inventories, which reduces performances footprint.
More asset types are available for inventory (you can send files for racks, appliances, certificates, etc).
In combination with GLPI agent, you also obtain some great features:
Our professional support for on-premise (GLPI Network Subscriptions) covers support L.3 for migration from GLPI 9.5 to GLPI 10.
All GLPI Network Cloud paid customers will be upgraded for free.
Major features:
See changelog for detail.
Many things has changed since the release of GLPI 10.0.0-rc2, including:
See rc2 to rc3 changelog for detail.
Report bugs: https://github.com/glpi-project/glpi/issues
Some weeks ago, we released a beta version for GLPI 10.0.0. Many of you have tested it and reported issues in this version, and we thank you for these reports.
Today, we release a new release candidate archive with a lot of additional fixes for this future version.
Consult the full changelog for a more complete list.
| GLPI native inventory news: GLPI Agent v.1.1 is available (bugfixes version). Click on detailed changelog to see what has been done & download the update. |
Here is a list of major issues fixed in this new release:
Download the RC archive, test the migration and the new features (you may also test the existing ones) and report us the issues you encounter on the bug tracker (tag it as [beta-10.0.0]).
Translators, please, add missing sentences of your language on transifex.
Need professional support? Check our offer on https://services.glpi-network.com/
A newly revealed critical vulnerability impacting Apache Log4j was disclosed and registered as CVE-2021-44228 with the highest severity rating. Log4j is an open-source, Java-based logging utility widely used by enterprise applications and cloud services. By exploiting this vulnerability, a remote attacker could take control of the affected system.
We would like to assure all users that GLPI core and its plugins, being written in PHP and not using Log4j, are not affected by the Log4Shell vulnerability.
Exploiting this vulnerability requires a Java Virtual Machine and the org.apache.logging.log4j.core.lookup.JndiLookup Java class in a vulnerable version. None of them are included or used in GLPI distributions.
We can also confirm that:
Warning: this does not prevent layers/tools potentially upstream of GLPI (reverse-proxy, firewall, etc.), or connected to GLPI, which we are not aware of in your context, from being potentially impacted.
For example, if you have a Metabase server connected to GLPI you should note that Metabase (<0.41.4) is affected by Log4j vulnerability, and you should update it ASAP!
Documentation:
