Known Issues – Relution Customer Hub

Apps and Books: very high license counts for purchased apps

2026-10-30T00:00:00+01:00

Apple has changed the licensing model for Apps and Books (VPP in the portal): apps are no longer purchased in a fixed quantity but are assigned to a location without a count. For such apps, Apple reports the technical maximum value 2147483647 as the license count. Relution takes over Apple’s values unchanged, so values such as 2147483647 appear under Purchased Apps in the Licenses and Available columns.

The value means that the licenses for the app are not limited. Assignment to devices and users works as usual; the Used column still shows the number of licenses actually assigned.

Database update fails when updating from 26.0.x to 26.1 or later (MariaDB)

2026-10-29T00:00:00+01:00

When updating from Relution 26.0.x to 26.1 or later, the automatic database update can fail with the error message Cannot change column 'action_uuid': used in a foreign key constraint. MariaDB versions 10.11.5–10.11.7 are affected (known MariaDB issue).

Cause and solution: Known error messages for database updates →

Linux: installation directory writable for the Relution service

2026-10-28T00:00:00+01:00

As of Relution 26.5.8, the Relution server checks on startup whether the installation directory is writable for the user the service runs as. This affects Linux installations without Docker where /opt/relution is entirely owned by the service user relution, for example after chown -R relution:relution /opt/relution. For each affected directory, the Relution server log shows an ERROR message that starts as follows:

Installation path /opt/relution/portal is writable for the user running Relution.

The server still starts and continues to work normally. The message indicates file permissions that are too broad. On Windows, the check is not performed.

Solution: The installation directory is owned by root. Only the log/ and branding/ directories remain writable for the service user relution, and application.yml remains readable for it. For an installation under /opt/relution, the permissions are set as follows:

sudo systemctl stop relution
sudo chown -R root:root /opt/relution
sudo chmod -R u=rwX,go=rX /opt/relution
sudo mkdir -p /opt/relution/log /opt/relution/branding
sudo chown -R relution:relution /opt/relution/log /opt/relution/branding
sudo chown root:relution /opt/relution/application.yml && sudo chmod 640 /opt/relution/application.yml
sudo systemctl start relution

After the restart, the message no longer appears.

Apple TV Remote: new bundle ID as of iOS 27

2026-10-23T00:00:00+02:00

With iOS 27, Apple provides the Apple TV Remote app as a standalone app in the App Store. It uses the new bundle ID com.apple.TVRemoteApp. Relution’s list of iOS system apps (as of 27.0.1) still contains the app under its previous bundle ID com.apple.TVRemote. If Apple TV Remote is added from the system app selection in the App compliance policy configuration, the entry therefore does not apply to the new app.

Effects on devices running iOS 27 or later:

If Apple TV Remote is listed under Allowed apps, the new app is hidden nonetheless.
If Apple TV Remote is listed under Blocked apps, the new app remains usable nonetheless.

Workaround: The bundle ID com.apple.TVRemoteApp is added to the respective list as well, either via the Apple TV Remote app imported from the App Store (Manage App Store apps →) or by entering the bundle ID manually. The previous entry can remain in place. Since Relution does not treat the new app as a system app, it can be distributed via Required apps like any other App Store app.

More information: App compliance →

PHP2Shell (CVE-2026-109618, CVE-2026-109619): Relution not affected

2026-10-22T00:00:00+02:00

The critical vulnerabilities in the PHP core published in October 2026 (PHP2Shell, CVE-2026-109618 and CVE-2026-109619) do not affect Relution. Relution server, Relution portal and Secure Mail Gateway contain no PHP and do not use a PHP interpreter; the services are based on Java.

No action is therefore required for Relution. Other applications using PHP that run on the same server or in the upstream reverse proxy must be checked independently of Relution and updated according to the PHP project’s guidance.

SMG: access token expires 30 days after updating to 26.5.5

2026-10-22T00:00:00+02:00

As of Relution 26.5.5, API access tokens always have an expiration date. Existing tokens without an expiration date expire 30 days after the update; they cannot be extended. This also applies to the access token the Secure Mail Gateway (SMG) uses to authenticate against the Relution server if it was created without an expiration date. Once it has expired, the Relution server rejects the token and the Relution server log shows the following message:

AccessTokenService: AccessToken verification failed, the token is expired

As of Relution 26.5.8, the Relution server answers requests with an expired token with HTTP status 401 and the error code ACCESS_TOKEN_EXPIRED; previously it answered with 500. The log message remains unchanged.

PostgreSQL with Relution 26.5.5 or 26.5.6: With a PostgreSQL database, existing tokens without an expiration date did not expire 30 days after the update to 26.5.5 or 26.5.6 but immediately. As of Relution 26.5.7, these tokens correctly receive a remaining lifetime of 30 days during the update. Tokens that have already expired remain expired and are replaced as described below.

Solution: Within 30 days of the update (immediately if the token has already expired), a new access token with the usage API and the API scope Secure Mail Gateway (smg) is created for the SMG’s technical user in the global organization. The expiration date is only set on creation and cannot be changed afterwards. On creation, the Expiration Date is preset to today plus 30 days and can be set to a later date, as of Relution 27.0.1 up to the latest possible expiration date shown in the dialog (by default 1 year after creation); the Limited time of use switch is no longer available for API tokens. A new token is created before each expiry (Create a technical user and access token →). The new token replaces the previous value of api-key in smg/application.yaml. The SMG container is then restarted so that the changed configuration is loaded:

docker compose restart smg

If the new token lacks the API scope Secure Mail Gateway (smg), the Relution server rejects the SMG’s requests with HTTP status 403.

More information: REST API →

Exchange policy: No user certificate of subtype Exchange

2026-09-30T00:00:00+02:00

When a policy with an Exchange configuration is applied, the Change policy action fails in the device actions. The following message is displayed:

At least one sub action failed: ErrorCode: -, Message: No user certificate of subtype Exchange found for user <username>.

The cause is the Use user certificate setting in the Certificate section of the Exchange configuration. With this option, Relution looks for a user certificate of subtype Exchange for the device user. If no such certificate exists for the user, the account cannot be deployed.

Solution: In the applied Exchange configuration, the Select certificate option is set in the Certificate section. No certificate needs to be selected; the configuration can be saved directly.

The same applies to the S/MIME certificates further down in the Exchange configuration. If S/MIME signing or encryption is enabled, the S/MIME signing certificate and S/MIME encryption certificate sections appear there with the same choice. If one of these sections is set to Use user certificate, Relution additionally looks for a user certificate of subtype S/MIME signing or S/MIME encryption, and the action fails with the corresponding message if none exists. In this case, the Select certificate option is set in these sections as well.

More information: Exchange →

Shortcuts as a required app

2026-09-01T00:00:00+02:00

Apple changed the bundle ID of the Shortcuts app. The older Apps and Books listing (VPP in the portal) with the bundle ID is.workflow.my.app can no longer be installed on devices running iOS 26 or later, because iOS actively rejects the installation with the error AppBlacklisted. If this older listing is included in the Required apps list, the deployment keeps restarting without the installation ever completing successfully.

Typical symptoms:

Affected iOS devices are displayed as Noncompliant in the device inventory.
Shortcuts is correctly listed under Installed apps.
The app deployment keeps restarting but never completes successfully.
The device log shows the message This app can no longer be installed on this version of the OS. together with the error code AppBlacklisted.

Workaround: The outdated Apps and Books app with the bundle ID is.workflow.my.app is removed from the Required apps list, and the corresponding Apps and Books assignment is deleted.

The current Shortcuts app with the bundle ID com.apple.shortcuts should not currently be added to the Required apps list as a replacement, since Relution still treats Shortcuts as a system app that cannot be installed. If Shortcuts is genuinely missing on individual devices, it can instead be installed separately by distributing an Apple App Store app (Manage App Store apps →).

Log levels cannot be changed via the system portal

2026-08-28T00:00:00+02:00

As of Relution 26.4, only the health endpoint is exposed by default for security reasons. The system portal therefore shows the Details section only; the Logger, Environment, Metrics and Threads sections appear once the corresponding endpoints have been enabled in the application.yml. Independently of this, log levels can still be changed via the Web API.

Cause and solution: Enabling the actuator endpoints →

Update hangs at GeneratedSelfSignedSignerKeyStore (Docker)

2026-08-27T00:00:00+02:00

In Docker installations with an outdated host kernel, the update can hang while generating the self-signed signing certificate (GeneratedSelfSignedSignerKeyStore).

Cause and solution: Known error messages of the Docker installation →

Prometheus metrics are not exposed

2026-08-27T00:00:00+02:00

As of Relution 26.4, only the health endpoint is exposed by default for security reasons; the Prometheus endpoint (/actuator/prometheus) is disabled. Prometheus monitoring therefore does not receive any metrics until the endpoint has been enabled once in the application.yml.

In addition, as of Relution 26.5.5 the server no longer evaluates basic authentication by default. Prometheus queries of /api/management/actuator/prometheus with user name and password therefore do not receive any metrics either; Prometheus is switched to an API access token.

Cause and solution: Enabling Prometheus metrics in Relution →

Server startup fails with a self-signed S3 certificate

2026-08-26T00:00:00+02:00

After updating from a version earlier than 26.2 directly to Relution 26.4 or newer, the server no longer starts if the connected S3 object storage is reached over TLS using a self-signed or company-internal certificate. The following error appears in the log:

AccessDeniedException: software.amazon.awssdk.core.exception.SdkClientException: Unable to execute HTTP request: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target (SDK Attempt Count: 3)

Cause and solution — including the required re-login of all users: S3: Startup fails with PKIX error →

Error when updating to Relution 26.1

2026-04-23T00:00:00+02:00

After updating to Relution 26.1, the Docker container no longer starts. The following error appears repeatedly in the container log:

Exception in thread "main" java.lang.reflect.InvocationTargetException
Caused by: java.io.IOException: Permission denied
at java.base/java.io.File.createTempFile(File.java:2184)
at io.relution.boot.Main.checkTempDirectory(Main.java:291)
at io.relution.boot.Main.main(Main.java:216)

Cause and solution: Permission denied after update to 26.1 →

OIDC + Entra ID

2026-03-26T00:00:00+01:00

OIDC authentication with Microsoft Entra ID was reconfigured according to the documentation.
The configuration itself is correct, but login does not work immediately after setup.
After logging in with their Microsoft credentials, users receive a generic error page with a ticket number.

Solution / Workaround

Only after restarting the Relution server does OIDC login work as expected.

Backups with iOS 26.4

2026-02-24T00:00:00+01:00

When restoring backups from iOS 26.3 or earlier to a device with iOS 26.4 installed, the Device Management state is lost.

Shared iPad

2025-12-17T00:00:00+01:00

On a shared iPad, as of iOS 26, local files cannot be created or saved in Guest Mode. A case has been opened with Apple. Additional cases (Create an Apple Case →) speed up processing; informing the support team is helpful.
- Workaround: Files are created and edited through a connected file share. paed.ML x Relution →

New Apps

2025-12-17T00:00:00+01:00

New Apps and the bundle IDs to block
- Preview → com.apple.Preview
- Games → com.apple.games
- Tips → com.apple.tips

Apple Files App

2025-12-17T00:00:00+01:00

An error occurs in the Files app on shared iPads (tested with iOS 18.2 and 18.3).

The share and the use of the Apple Files app works on non-shared devices.

The bug is also noticeable in that downloaded files are missing from the Downloads folder. When data is opened, it is visible in the Downloads folder until the Apple Files app is closed and reopened.

The problem can be worked around. To do this, the Extension Type of the respective share in the Relution File Shares policy configuration is changed from Modern (default) to Classic.

QR code scanner

2025-12-17T00:00:00+01:00

Another known problem concerns the QR code scanner in iOS 18 with devices from generation 9. The bundle identifier has been shortened here. The current identifier is:

com.apple.BarcodeScanner

To fix this, the bundle identifier must be added manually to the positive list in the app compliance. The name is irrelevant here; it is only important to enter the bundle identifier mentioned above.

Devices older than generation 9 must use the separate app Code Scanner. It can be opened by swiping down from the top of the home screen to open the Spotlight search and searching for Code.

Slow login on shared devices

2025-12-17T00:00:00+01:00

With iOS 17.x, setting the restriction configuration Allow iCloud keychain synchronisation to No causes the login on shared devices to be slowed down.

To bypass this behavior, the item Allow iCloud keychain synchronisation must be set to Yes in the applied restriction configuration.

Lack of storage space on iOS devices

2025-12-17T00:00:00+01:00

On iOS devices, despite sufficient memory for app installations, a message may appear that there is not enough memory available. This is also displayed accordingly in the system settings.

The problem is caused by using the policy configuration Shared iPad settings. Repeated logins and logouts of guest users on the shared device can cause this error to occur spontaneously.

To avoid the occurrence of this problem, it is recommended not to use the policy. Alternatively, at least the two fields Quota size per user (in megabytes) and Number of users should be left empty.

For affected devices, it is necessary to reset them to factory settings.

Known Issues – Relution Customer Hub

Apps and Books: very high license counts for purchased apps

Database update fails when updating from 26.0.x to 26.1 or later (MariaDB)

Linux: installation directory writable for the Relution service

Apple TV Remote: new bundle ID as of iOS 27

PHP2Shell (CVE-2026-109618, CVE-2026-109619): Relution not affected

SMG: access token expires 30 days after updating to 26.5.5

Exchange policy: No user certificate of subtype Exchange

Shortcuts as a required app

Log levels cannot be changed via the system portal

Update hangs at GeneratedSelfSignedSignerKeyStore (Docker)

Prometheus metrics are not exposed

Server startup fails with a self-signed S3 certificate

Error when updating to Relution 26.1

OIDC + Entra ID

Solution / Workaround #

Backups with iOS 26.4

Shared iPad

New Apps

Apple Files App

QR code scanner

Slow login on shared devices

Lack of storage space on iOS devices

Solution / Workaround