Blog | IDaaS Documentation

Release 5.31

August 2023 · 13 min read

New in this release

Device Verification using Certificates

A new Device Certificates risk factor has been added to Resource Rules. When configured, this risk factor requires that the client be able to perform client-authenticated SSL with a certificate issued from a trusted CA to pass.

When configuring Certificate Authorities, the customer can now configure Issuing CAs which is the existing capability of configuring CAs to issue smart credentials and Trusted CAs which is a new capability for configuring CAs that have issued the certificates on the user's devices.

Device certificates are supported for SAML and OIDC applications as well as the IDaaS portals.

Certificate Details for mPKI CA Smart Credentials

A new Certificate action is available for Smart Credentials using a mPKI CA. The Certificate action lists the certificates issued to the selected Smart Credential and allows an administrator to manage those certificates. Previously this action was only available for Smart Credentials using a PKIaaS CA.

Resource Rule Risk-factor Enhancements

The Risk-factors in resource rules have been enhanced to include a Deny Access option. When the Deny Access option is enabled for a risk factor, access to the application is denied if that risk factor fails regardless of the results of the other risk factors.

OIDC Claim Enhancements

Custom OIDC Claims can be defined and associated to any OIDC application. Claims can be defined to always be returned with User Info or with the ID Token. The way attributes are mapped to OIDC claims has been improved.

Microsoft AD Strong Authentication

Microsoft Windows is changing to require that certificates used for smart-card login include the user's security identifier as an extension. IDaaS has been enhanced to include a new user attribute to store the user's security identifier and to encode this value into smart credentials. Additionally, AD and Azure directory sync have been enhanced to retrieve this value from the customer's directory and store it for IDaaS users.

If you have a CA that was created before this release you will need to update the CA configuration to support Security Identifiers.

For an Entrust PKIaaS CA, there is a new Refresh action available from the IDaaS Issuing Certificate Authority list. This will update the necessary CA configuration.
For Entrust mPKI or Microsoft CA the certificate profiles managed from the CA will need to be updated.

Identity Provider Enhancements

The following enhancements have been made to identity providers:

A new identity provider IDVaaS has been added supporting integration with Entrust's Identity Verification as a Service.
When configuring an identity provider, additional checks can be configured that ensure IDP claim values match existing IDaaS user attributes to successfully complete IDP authentication.

Administration API Long-Lived Token

An administration API can be configured to support long-lived tokens. When creating an administration API or refreshing its shared secret, a long-lived token is available if enabled for the application. When invoking an administration endpoint, instead of passing the authentication token returned from the administration API authentication endpoint, the long-lived token can be passed instead. The long-lived token does not expire, meaning that client applications do not need to refresh the authentication token periodically.

User Provisioning using System for Cross-Domain Identity Management (SCIM)

IDaaS users can now be managed by 3rd-party clients using SCIM.

SAML Enhancements

The following enhancements have been made to SAML applications:

A SAML application can now define multiple Assertion Consumer Service (ACS) URLs.
Each SAML application now has a public endpoint that returns the SAML metadata for the application. This endpoint can be used by SAML service providers that automatically fetch the SAML metadata.
SAML applications can now be configured to specify the audience returned in SAML assertions. The audience can either be specified in IDaaS or requested from the SAML SP as a parameter.

Manage Inactive Users

IDaaS now allows a customer to have users be blocked from authenticating if the user has not authenticated in a period of time.

User Search/Report Enhancements

The following enhancements have been made to user search/export capabilities:

The user search criteria have been enhanced to allow an administrator to search for users who have not authenticated in a period of time. Previously, only searching for users who had authenticated in a period of time was supported.
The user export operation has been enhanced to allow an administrator to export customer defined attributes.

Phone/Email Verification APIs

New administration APIs have been added that allow a customer application to verify that a user owns a given phone number or email address.

User Portal Improvements

The following enhancements have been made to the user portal:

Users synchronized from AD were unable to modify any contact values. Now they are only blocked from modifying contact values synchronized from AD. Other contact values can be modified.

New Passkey/FIDO2 Registration Policies

The following new policies have been added to the Passkey/FIDO2 Authenticator policies to control registration.

User Verification - controls if the user must be verified or not.
Resident Key (User ID stored) - controls if the user ID is stored on the token during registration. This is required if the token is to be used for passwordless Passkey authentication where the user does not need to enter their user ID.
Authenticator Attachment (platform or cross-platform) - controls whether a platform type, cross-platform type or either type of token can be registered.

Additionally, the option to select whether the User ID is stored during registration has been removed from the token registration dialog. The behavior is now controlled by policy.

Rate Limiting

Rate limiting is now enforced for trial accounts. The current limits are:

Authentication requests: 5 requests per second (50 requests in a 10-second time window)
Request to retrieve audits: 1 requests per second (10 requests in a 10-second time window)
Administration requests: 3 requests per second (30 requests in a 10-second time window)

New Integrations

The following integrations have been added.

A new OIDC application template for ConnectWise
A new SAML application template for ConnectWise ScreenConnect
A new SAML application template for Epic Hyperdrive. This template is designed to be used with the Entrust Epic Hyperdrive plugin.
A new SAML application template for Fivetran
A new SAML application template for Pingdom
A new RADIUS application template for Sophos XG Firewall

Additionally, the existing RADIUS integration Fortinet has been renamed to Fortinet-FortiGate.

Fixed or changed in this release

Some dates in IDaaS API responses included milliseconds and some did not. Now all date values are consistent and do not include milliseconds. (31481)
Refreshing the page after changing the user locale in the User portal prompts the user to change the locale back to the original value. (31955)
Changing the locale on the login page is not always correctly applied. (31962, 32025, 32107)
The TLS configuration of the IdentityGuard Agent on the Enterprise Service Gateway (ESG) has been updated. It now supports TLSv1.2 and TLSv1.3 and the ciphers TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384. (16301, 31970)
When importing Mobile SDK push notification credentials into IDaaS, the credentials were rejected if they contained extra fields not used by IDaaS. Now those fields are ignored and the credentials are imported. (32040)
When configuring the Knowledge-Based Authenticators Minimum Challenge Size and Default Challenge Size a value of 1 should be allowed. (32523)
The error message displayed when trying to delete a group assigned to an unassigned grid card was incorrect. (31475)
The messages displayed in the Service Provider portal for the delete tenant dialog and the reset resource rule dialogs were incorrect. (31950)
The smart credential activation dialog was not formatted correctly for some locales. (31590)
When creating a CA the UI now prevents the administrator from entering a duplicate name. (32507)
When creating a custom role the UI crashes when trying to add a group. (32061)
When a locale is selected during authentication it is not used if the user needs to register. (32015)
When a service provider unlocks administrators of a tenant it should not make service provider administrators in that tenant active. (32382)
The audit generated when removing a RADIUS application should not list all the attributes of the application. (31133)
Improve the formatting of the Registration Settings page. (31974)
When a user has a FIDO/Passkey token registration for another application, the user portal registration should require that the user register a FIDO/Passkey token for the user portal. (31606)
The audit displayed when a user used a temporary access code as a replacement for a token erroneously stated Grid authentication instead of Token authentication. (32018)
The UI now trims leading and trailing whitespace for the Password Expiry Notification Days setting. (31983)
Improved handling if the user currently logged into the user portal does not match the userid specified in the password expiry link. (31927)
Improved how the number of days until your password expires shown in the password expiry notification email is calculated. (31976)
The smart credential unblock dialog has been refreshed. (31363)
If a duplicate expected location is added to the RBA settings an error is now returned. Previously duplicates were removed without error. (29346)
Improvements made to the OIDC application audits to remove some UUID values that were audited. (24876)
When change the password in the portal for user's in a group with group specific policy for the password expiry the password expiry date from the global policy was used. (32341)
Client Credentials Grant for OAuth2 resources are now sorted. (31520)
Change Password dialog displayed wrong password rules for Include Lowercase set to Not Allowed. (32383)
The User Portal session expiry warning dialog can display negative values until expiry. (32019)
Users with alternative email addresses for OTP may not see the Alternative Authentication option during login. (32647)
The default Group Name Attribute for AD directory synchronization has been changed from sAMAccountName to cn. This change only applies when creating new directories and not to existing directories. (31090)
Access to the user location history page in the Administration portal required the settings View permission which should not be required. (31545)
The Export Audits dialog in the Administration portal does not display the Filters value if it is set to 1 Hour. (31944)
AD Connector page may crash in the UI the if administrator does not have the necessary permission to view it. (32633, 32656)
Dates included in Emails are in English and do not use the user's locale. (15278, 31769)
ActiveSync Device authentication issues have been addressed. Only OAuth authentication is supported now. (32199, 32730)
Prepare Identity as a Service for Salesforce link in Technical Integration Guide is broken. (32060)
Email template preview triggers browser console error. (31899)
Unable to set the attribute mapping for an Azure directory configuration. (32512)
For APIs that do not return a result, the API guides in the developer portal now show the response as "Successful" instead of "No Response". (31024)

Changes to Identity as a Service APIs

Authentication API

The following models have been updated in this release:

authToken has been added to UserAuthenticateQueryParameters. If passed to the authentication query, the query will determine if authentication is allowed with the given auth token.
authenticationCompleted has been added to UserAuthenticateQueryResponse. It indicates if further authentication is required when the auth token was passed as a parameter.
deviceCertAuthDesired has been added to UserAuthenticateQueryResponse. This attribute is currently not used by the public authentication API.
deviceCertAuthDesired has been added to AuthenticatedResponse. This attribute is currently not used by the public authentication API.
registrationAuthenticatorAttachment, registrationRequireResidentKey and registrationUserVerification have been added to FIDORegisterChallenge. These attributes are arguments that describe how the FIDO token should be registered.

Administration API

The following APIs have been added in this release:

POST /api/web/v1/contact/verification/challenge (contactVerificationChallengeUsingPOST)

Given a phone or email contact value this method sends an OTP challenge to the contact using email or SMS.
POST /api/web/v1/contact/verification/authenticate (contactVerificationAuthenticateUsingPOST)

Validate the challenge generated by a previous call to contactVerificationChallengeUsingPOST.

The following models have been added in this release:

OTPVerificationChallengeValue contains the parameters passed to contactVerificationChallengeUsingPOST.
OTPVerificationChallengeResponse contains the response returned from contactVerificationChallengeUsingPOST.
OTPVerificationAuthenticateValue contains the parameters passed to contactVerificationAuthenticateUsingPOST.
OTPVerificationAuthenticateResponse contains the response returned from contactVerificationAuthenticateUsingPOST.
DeviceCertificateContext defines the device certificate context for a resource rule.

The following models have been updated in this release:

inactivityGracePeriod has been added to GeneralSettings. This attribute specifies the amount of time an administrator can grant to a user who has been deactivated due to inactivity to authenticate.
manageInactiveUsers has been added to GeneralSettings. This attribute specifies if inactive users are blocked from authenticating.
userInactivityThreshold has been added to GeneralSettings. This attribute specifies the amount of time a user has to be inactive before they are blocked from authenticating.
frozen has been added to User. This attribute specifies if a user has been frozen (blocked from authenticating) due to inactivity.
frozenGracePeriod has been added to User. If a user blocked from authenticating due to inactivity has been granted a grace period for the administrator this attribute specifies when that grace period expires.
securityId has been added to User and UserParms. This attribute specifies the users security identifier and is used to encode the value into the certificates of their smart credentials which will become a requirement to support Microsoft Windows smart-card login.
userCreationTime and lastModifiedhave been added to User. These attributes specify the date the user was created and last modified.
applyGracePeriod has been added to UserParms. This attribute is used to specify a grace period to users who have been blocked from authenticating due to inactivity.
allowLongLivedToken has been added to AdminApiApplication and AdminApiApplicationParms. This attribute specifies if a long-lived token can be used to authenticate to this admin API application.
denyAccess has been added to DateTimeContext, DeviceCertificateContext, IpContext, KbaContext, LocationContext, LocationHistoryContext, MachineContext, TransactionContext and TravelVelocityContext. This attribute specifies if access to the application associated with the resource rule is denied if this context does not pass evaluation.
deviceCertificateContext has been added to ResourceRule. This attribute returns the device certificate context of a resource rule.
deviceCertificateContext and removeDeviceCertificateContext have been added to ResourceRuleParms. These attributes allow the device certificate context of a resource rule to be set or deleted.

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.31 and the three previous releases 5.28, 5.29 and 5.30). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

Microsoft Windows 2012 Deprecation

Microsoft will stop supporting Windows Server 2012 and Windows Server 2012 R2 in October 2023. At that time, Identity as a Service will no longer support clients running on these platforms where they do not support up-to-date TLS ciphers.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service ceased support for Internet Explorer 11 after May 2023.

Release 5.30

May 2023 · 8 min read

New in this release

SAML Signing Certificate Enhancements

SAML Signing Certificates have been enhanced to support a signing key and certificate issued by a CA (for example, using a P12 file). Additionally, the option to generate a PKCS#10 certificate-signing request (CSR) has been enhanced to offer stronger key size options, signing algorithm options, and an optional challenge password.

SAML Metadata Enhancements

Exported SAML Metadata now also contains the set of configured SAML Attributes.

Authentication Locale Enhancements

When a user chooses a different locale when authenticating to the IDaaS User Portal, the user is given the option to store the new locale as their default. The locale is used to localize any messages (such as an OTP Email or SMS) sent during authentication.

Password Expiry Notification

IDaaS now includes the ability to deliver password expiry notifications to users when their password approaches or reaches expiry. The expiry notification can be sent using EMail or SMS. EMail notifications can include a link to take the user to the password change dialog in the IDaaS user portal.

FIDO2/Passkey Authentication API Support

The IDaaS authentication API now includes FIDO2 and Passkey authentication options. APIs for a user to register FIDO2 tokens are also available.

IDaaS Portal Improvements

The password entry field on the login and password change pages now include an option to view the password.

The change user password dialog has been refactored. Additionally the URL https://<hostname>/#/?redirect=password&userid=<userid> (for example, https://myaccount.us.trustedauth.com/#/?redirect=password&userid=myuserid) takes the user directly to the password change dialog in the User Portal after authentication.

Enterprise Service Gateway Updates

The version of MS CA Proxy used with IDaaS has been updated. Customers that are using IDaaS with Microsoft CAs should update the version of MS CA Proxy they have installed when they upgrade their ESG.

The ESG install documentation now includes a procedure that describes how to configure the ESG UI to use a public CA issued SSL certificate.

New OIDC Integrations

A new OIDC/OAuth application template has been added for OAuth2 Native Apps (RFC 6749 section 4.3)

New RADIUS Integrations

A new RADIUS application template has been added for Fortinet.

Fixed or changed in this release

In past releases some customers encountered issues with their ESG when the underlying VM was modified. This required the ESG be re-initialized to recover. This issue has been addressed. (30855)
User Provisioning has been optimized to not perform provisioning for some user changes that do not require reprovisioning. (31311, 31323)
Address issues in User Provisioning where users were not provisioned or deprovisioned for some group changes. (31317, 31434)
User Provisioning related audits have been improved. (31312, 31294)
User Provisioning should not be enabled for Service Providers that are not Premium accounts. (31396)
Improvements to User Provisioning where attributes, including locale and some custom attributes, were not provisioned as expected. (31278, 31314, 31341)
Improvements to User Provisioning configuration to prevent invalid values from being configured and other UI improvements. (31326, 31461, 31492, 31496)
The notification sent to users when an authenticator is locked specified the wrong action. (31376)
Improved the label for the Smart Credential > Activation Lifetime setting in the UI. (31411)
Differentiate audits for FIDO2 authentication to differentiate when the userId is entered and where it comes from the FIDO2 token. (30284)
Improvements to Identity Provider configuration for Microsoft Identity Providers. (29118)
Improve audit details when the attribute filters for a SAML application are updated. (29222)
Fix a problem with Entrust soft token activation when the maximum time steps policy was set to 1. (31397)
Improved error message returned when invalid values were provided for Google Max. Time Steps and Max. Reset Time Steps settings. (29721)
Some links to documentation in IDaaS admin portal were broken. (30976)
RADIUS applications with External first-factor can now be configured to skip second-factor authentication. (31052)
Password blocklist did not allow the last value to be deleted. (31402)
Admin API authentication now ignores leading or trailing whitespace in the applicationId. (29297)
Improve errors logged when attempting to delete external users using the bulk delete user operation. (29530)
Fixed issues with date filters for authentication counts in the Admin Portal dashboard. (31519, 31522)
The UI in the Admin Portal for adding custom OIDC attributes has been updated. (31674)
Improve the audit for modifying OIDC applications to not include attributes that have not been changed. (31399)
The audit for delete grid card showed the action in lowercase. (31423)
The Admin Portal did not allow email addresses with leading or trailing whitespace. The whitespace is now automatically trimmed. (28895)
When creating a new site role, the option to delete groups was missing. (31189)
Log file for IdentityGuard bulk import operation now includes more information about errors. (30645)
The Azure AD reauthenticate audit used a non-standard date format for the authorizationDate value. (31443)
Generic Device OIDC applications should not be clickable in the User Portal. (30456)
When configuring a Microsoft CA in the Admin Portal, fix some formatting issues when the configuration is displayed. (31254)
When configuring Authorization, OIDC applications created to support Service Provider administration should not be allowed for Client Credentials Grants. (31419)
The list of OIDC applications listed for Add Client Credentials Grant for Authorization should be sorted. (31418)
OIDC applications without an Initial Login URI configured should not be clickable in the User Portal. (30458)
The IDaaS portal has been improved to support authentication in browsers that do not support local storage which is common for browsers running in protected mode or on mobile devices. (31641, 29604, 27564, 30924, 30224)

Changes to Identity as a Service APIs

Authentication API

The following APIs have been added in this release:

POST /api/web/v1/authentication/passkey (requestPasskeyChallengeUsingPOST)

Create a Passkey authentication challenge to begin Passkey authentication.
GET /api/web/v1/self/fidotokens (startFIDORegisterUsingGET)

Get a FIDO token registration challenge for the authenticated user.
POST /api/web/v1/self/fidotokens (completeFIDORegisterUsingPOST)

Complete registration of a FIDO token for the authenticated user.

The following models have been updated in this release:

FIDORegisterChallenge. This model contains the attributes returned from startFIDORegisterUsingGet.
FIDORegisterResponse. This model contains the attributes passed to completeFIDORegisterUsingPOST.
PasskeyChallengeParameters. This model contains the attributes passed to requestPasskeyChallengeUsingPOST.
PasskeyChallengeResponse. This model contains the attributes returned from requestPasskeyChallengeUsingPOST.

The following models have been updated in this release:

locale has been added to UserChallengeParameters and UserAuthenticateParameters. If specified, this value specifies the locale to be used when generating messages sent for the authentication challenge or the authentication complete operation. If not specified, the user's default locale is used.
origin has been added to UserChallengeParameters and UserAuthenticateParameters. If specified, this value specifies the origin of FIDO tokens. Only FIDO tokens registered with this origin are used for authentication.
In previous releases, the response and newPassword attributes of UserAuthenticateParameters were erroneously labelled as required attributes. These attributes are optional.

Administration API

The following APIs have been added in this release:

PUT /api/web/v1/users/{userid}/password/notify (sendPasswordExpiryNotificationUsingPUT)

This API sends a password expiry notification to the specified user.

The following models have been updated in this release:

expiryNotificationDate has been added to UserPassword. This attribute specifies the next time that a password expiry notification will be delivered.
passkeyEnabled has been added to AuthApiApplication. This attribute indicates if the application supports Passkey authentication.
origin has been added to FIDOToken. This attribute indicates the origin from which this token was registered.
showNotification has been added to User. This attribute is currently not used.

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.30 and the three previous releases 5.27, 5.28 and 5.29). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

Microsoft Windows 2012 Deprecation

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service will cease support for Internet Explorer 11 after May 2023.

Release 5.29

March 2023 · 8 min read

New in this release

User Provisioning

IDaaS now supports provisioning of users to 3rd-party services using the System for Cross-domain Identity Management (SCIM) protocol. The first release of this feature has been tested against Salesforce.

Identity Provider Enhancements

The following enhancements have been made to Identity Providers:

A new user verification policy has been added to require a user to approve a user verification message. When configured, users must approve the message in order to complete verification. Administrators configure the user verification messages on the IDaaS Theme page.
An Administrator can configure IDaaS to find users using the User Principal Name attribute or an IDaaS custom attribute during Identity Provider authentication. This is in addition to finding users using the Userid/Alias attribute.

Token Reset Bulk Operation

A new bulk operation to perform token reset for a list of tokens has been added.

New Option on SAML/OIDC Applications to Disable Go Back Button

A new option has been added to SAML and OIDC applications that allows an administrator to disable the Go Back button that is present during authentication.

Options to configure the User Portal

The following options have been added to allow an administrator to configure the IDaaS User Portal

Options to select a default tab and additional tabs that appear on the User Portal. The default tab is the landing page tab when a user logs in.
A setting to specify the URL of the User Guide User Portal help. If set, the User Guide Help option displays this document instead of the default IDaaS documentation. This allows a customer to provide custom documentation.

Create Grid Action in User Portal

Users can now create their own grids in the User Portal. Previously, only administrators could create grids for users.

Fixed in this release

When deleting, enabling, or disabling a smart credential from the User portal, the audit specified the Admin portal. (28966, 29007)
When changing the variable values of a smart credential, the audit does not indicate which values were changed. (29009)
Sync add user audit specified edit permission instead of add permission. (29673)
User registration dialog and registration emails for Mobile smart credential contained outdated links for both Android and iOS apps. (30906, 30908)
User portal smart credential activation dialog is missing option to download Android and iOS apps. (30877)
Updated the encryption of PDF eGrids to use AES-256. (30949)
Unable to delete KBA word maps. (30960)
Errors updating KBA word maps. (30793)
KBA word maps defined in a per group policy were not correctly applied. (30947)
Improve the logs generated for the IdentityGuard (Identity Enterprise) import. (30941)
When importing tokens using the IdentityGuard (Identity Enterprise) import, the token set name from IDE is imported into the IDaaS token label. (31038)
When importing tokens using the IdentityGuard (Identity Enterprise) import, if the token has push authentication enabled, the push authentication is now enabled in IDaaS during import rather than after the first time the user uses the Entrust Identity application after migration. (30899)
Creating a smart credential in the User portal sends multiple activate requests. (30248)
When adding a contact in the User portal, the generated audit specifies user add. It should be user edit. (29556)
When a resource rule is cloned, the UI displays Edit Resource Rule. It should be Add Resource Rule. (31130)
When checking user aliases for uniqueness, white space was ignored. White space is significant. (31059)
When a resource rule Date/Time context was set without a time zone, it displayed as an unknown value the next time the resource rule was viewed. (30898)
When a resource rule Date/Time context was set, the start time may not be set correctly resulting in situations where it was rejected. (30669, 30900)
When a second-factor authenticator is checked in the resource rule it should automatically sort above all unselected authenticators. (31015)
Display a proper error message if a cloned resource rule is created with an existing name. (31012)
When viewing a resource rule as an administrator that does not have write access the External Risk Engine settings should be read-only in the UI. Note that IDaaS correctly rejects the edit request if submitted. (30792)
The performance of LDAP queries performed by the directory sync agent on the Enterprise Service Gateway have been improved. (27563)
The RADIUS agent option to perform first-factor AD password authentication directly to AD was broken. (30041)
The SIEM agent on the Enterprise Service Gateway could stop sending logs to syslog for some network connectivity issues. (30701)
The layout of PDF eGrids has been improved. (30657)
The authentication types and actions included in the authenticator change notification email are not localized. (30436)
Unable to remove the email value from a schedule report. (30655)
In the Admin UI, fix the tab order between fields for the EMail Server OAuth Settings page. (30472)
When configuring an EMail server to use OAuth, the defined scope may be removed if the OAuth server returns a null scope. (30471)
When configuring an EMail server to use OAuth, require the OAuth server to be reauthorized if the OAuth data changes. (30795)
When testing EMail server configuration for a server configured to use OAuth, only try the test a single time if the OAuth refresh token is expired. (30785)
Improve the audit for Email server configuration changes to show which attributes changed. (30814)
When accessing the Email server settings, the OAuth Authorize action should be disabled if the administrator does not have edit permission. (30557)
Improve the error messages displayed in the User portal when using FIDO/Passkey authentication. (30384)
Reports can get stuck in the schedule state preventing new reports from being started. These reports are now automatically cancelled. (29761, 31164)
Accounts with the standard bundle should have access to use IP lists. (30568)
The audit generating when modifying User RBA Settings is missing the admin permission. (29717)
Fix how the User Portal Change Password dialog is loaded on a slow network so that is does not display until fully rendered. (22039)
When modifying Active Sync settings, the Save button should not be enabled until the Test operation completes. (27969)
OAuth scopes during authentication are not sorted in the display. (30850)
Add gateway audit included information about DB proxy that is not applicable and is now removed. (29472)
Audit for unassigning a grid from a user should include the userId of the user. (29339)
When all user entitlements have been consumed, synchronizing an inactive user fails. Inactive users do not consume an entitlement. (29135)
Warning message displayed when editing a resource rule that has Identity Providers associated with it should only be displayed for resource rules associated with OIDC and SAML applications. (30823)
The default Date Range for audit and authentication searches performed on the Admin portal dashboard has been changed from 24 hours to 1 hour.
All new Facebook Identity Providers must use openid scope. (31350)

Changes to Identity as a Service APIs

IDaaS API documentation has been refactored and moved to the Developer Portal
Dropped support for .NET Core 3.1 for CSharp clients and added support for .NET Framework 4.8.

Changes in this release

The following changes have been made to address issues or enhance existing functionality.

All existing Facebook Identity Providers that do not use openid will require an update to use openid.

Authentication API

The following APIs have been updated in this release:

POST /api/web/v2/authentication/users (userAuthenticatorQueryUsingPOST)
POST /api/web/v1/authentication/users (userAuthenticatorQueryUsingPOST)
POST /api/web/api/v1/authentication/users (userAuthenticatorQueryUsingPOST) - returnDefaultChallenge has been added to UserAuthenticateQueryParameters. This attribute is used to indicate whether a challenge should be returned for the default authenticator. - The following attributes are also added to UserAuthenticateQueryParameters to support returning the default challenge--see UserChallengeParameters for details: summary, priority, requestDetail, pushMessageIdentifier, tokenPushMutualChallengeEnabled, offlineTVS - UserAuthenticateQueryResponse has been updated to include the following attributes with the default challenge information--see AuthenticatedResponse for details: otpDeliveryType, kbaChallenge, gridChallenge, tokenDetails, fidoChallenge, tokenChallenge, tempAccessCodeChallenge, tokenPushMutualChallenge - authenticatorLockoutStatus has been added to UserAuthenticateQueryResponse. This attribute contains detailed user authenticator lockout information. This behavior is controlled by the General policy enableEnhancedAuthenticationDetails.
POST /api/web/v1/authentication/users/authenticate/{authenticator}/complete (userAuthenticateUsingPOST)
POST /api/web/api/v1/authentication/users/authenticate/{authenticator}/complete (userAuthenticateUsingPOST) - Providing a JWT in the Authorization header is now optional. This change allows to authenticate a user with a single API call for authenticators that do not require a challenge.

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.29 and the three previous releases 5.26, 5.27 and 5.28). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

Microsoft Windows 2012 Deprecation

Microsoft will stop supporting Windows Server 2012 and Windows Server 2012 R2 in October 2023. At that time, Identity as a Service may no longer support clients running on these platforms where they do not support up-to-date TLS ciphers.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service will cease support for Internet Explorer 11 after May 2023.

Release 5.28

February 2023 · 6 min read

New in this release

External Risk Engine Support

IDaaS has extended risk-based authentication to include risk factors from external providers. These external providers can track additional information about a user session to determine whether this is likely the user. Only authentications using the Authentication API support External Risk Engines.

PDF eGrid Automatic Delivery

Grid delivery can be configured so that a PDF eGrid is automatically delivered to the user when a new grid is created. Additionally, a new option has been added to registration so that a grid is automatically created when a user is created.

Resource Rule Improvements

The following enhancements have been made to resource rules:

For customers that are not using resource rule contexts to choose between different risk levels, a new simplified resource rule is shown that hides all of the unused configurations.
When creating an additional resource rule for an application, the existing resource rule can be cloned.
The information included in an authentication audit has been enhanced to show how the authentication decision was reached.

Fixed in this release

The following issues have been fixed in this release.

A bash script has been added to the Enterprise Gateway to allow administrators to easily configure the static IP address of the Enterprise Gateway. The script can be found at /home/entrust/tools/setup_static_ip.sh and requires sudo privileges to run. The script prompts for the interface name, IP address, netmask, network gateway, and DNS server. After the script runs, users must then use the cockpit to register the Enterprise Gateway with Identity as a Service. (30106)
IDaaS features that use OAuth to authenticate to 3rd-party services have been refactored to use common OAuth functionality. These services include External Email, secure device provisioning, and Azure AD directories. Improvements include better handling of expired auth tokens. (30467)
A customer can now create multiple bulk operations of the same type. The bulk operations will be queued and run one at a time. Previously a second bulk operation could not be created until the first operation had completed. (29735)
FIDO2/Passkey token registration error handling in the User portal has been improved to better handle the error caused when the user has registered the maximum allowed number of FIDO2/Passkey tokens. (30403)
The password state icon shown in the User portal authenticator list could be truncated. (30451)
The subject of Emails sent to deliver eGrids to users were not translated for non-English locales. (30431)
Improved the bulk operation create dialog display when a long description is entered. (30506)
Audits generated when a user was updated as part of a directory sync operation indicated the audit was for the Gateway Agent instead of the user. Also, all user attributes were listed instead of just the attributes that changed. (28154)
Enhanced the user list password expiry filter to differentiate between a password that has expired and a password that never expires. (28311)
The AD Connector Delete Group operation has been renamed from "Delete Group" to "Delete AD Connector Group" so that it does not get confused with deleting IDaaS groups. (29769)
Importing a grid export file generated by Identity Enterprise was broken. (30493)
Password could not be reused even after password history was cleared. (30083)
An OIDC Generic Server Application should not show the "Authentication Flow" option because this type of OIDC application does not support the standard authentication flows. (30376)
Disable input fields when displaying a resource rule for administrators that do not have write access. The Save button was correctly disabled. (30569)

Changes to Identity as a Service APIs

The swagger files provided for the IDaaS APIs have been updated from Swagger (OpenAPI 2.0) to OpenAPI 3.0.

Authentication API

The concept of self-management APIs has been introduced and are included in the IDaaS authentication APIs. To use a self-management API, the customer application must do the following:

Use the authentication API to authenticate the end user which generates an authToken.
Call a self-management API providing the authToken as an authentication token. The self-management API will act on the user associated with the authToken.

The following self-management APIs have been added in this release:

POST /api/web/v1/self/values (selfSetUserClientValuesUsingPOST) - store the specified list of name/value pairs for the user.
GET /api/web/v1/self/values (selfGetUserClientValuesUsingGET) - return the stored name/value pairs from the user.
PUT /opt/web/v1/self/values (selfDeleteUserClientValuesUsingPUT) - delete the named name/value pairs from the user.

The following models have been added in this release:

UserClientValue defines a name/value pair that is passed to selfSetUserClientValuesUsingPOST and returned from selfGetUserClientValuesUsingGET.

User client values can be used by any application using an IDaaS authentication API application to manage user client values used by client applications.

Administration API

The following attributes have been added to existing models:

userValuesEnabled has been added to AuthApiApplication and AuthApiApplicationParms. This boolean value indicates whether user client values can be managed for this application.
defaultGrid has been added to GeneralSettings. This boolean value indicates if a grid should be automatically created for a new user.
riskEngineContext has been added to ResourceRule and ResourceRuleParms. This attribute is a list of TransactonContext and specifies external risk engines to apply to the risk authentication.

In previous versions of the Administration API swagger file, the method unblockSmartCredentialUsingPUT was incorrectly defined to return the type SmartCredentialUnblockParms. It should have been SmartCredentialUnblockResponse.

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.28 and the three previous releases 5.25, 5.26 and 5.27). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

Microsoft Windows 2012 Deprecation

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service will cease support for Internet Explorer 11 after May 2023.

Release 5.27

December 2022 · 7 min read

New in this release

Service Provider Tenant Management Enhancements

When configuring a tenant, authentication to Tenants using Identity Provider authentication can be enabled for Service Provider users.

Passkey/FIDO2 Enhancements

IDaaS has been enhanced to more fully support Passkey/FIDO2 authentication. Enhancements include optionally storing a user's user ID when registering a Passkey/FIDO2 token and an authentication flow that uses Passkey/FIDO2 to allow a user to authenticate without providing their user ID.

User Authenticator Notification

IDaaS now supports sending user notification emails when a user's authenticators have been changed. The actions include but are not limited to creating, assigning, deleting, and state changes.

PDF eGrids

User grids can now be exported as a PDF file or delivered to the user by email. eGrids can optionally be encrypted.

Developer Portal

The Developer portal has been redesigned to be more user-friendly and to provide a better experience for developers. The new Developer portal includes installation instructions and hands-on tutorials to help developers get started with the IDaaS API client library. The Python API client library is also available on the Developer portal.

Resource Rules Improvements

A new clone action has been added to resource rules allowing administrators to clone an existing a resource rule in the same category.
IP lists can now be associated with source IP addresses in resource rule risk factors. Administrators must configure IP Lists first before using this feature.
Various resource rules risk factors have been redesigned and refreshed to be more user-friendly.

Group Management Enhancements

The group list page now supports paging when an account has a large number of groups and the option to export a list of groups.

Fixed in this release

The following issues have been fixed in this release.

When updating the SAML Web application logo with no additional changes, the audit logs show only the modified logo. (29395)
Fixed generating grid cards for selected groups. (25018)
When bulk importing users and the CSV file column does not specify user attributes or extra attributes, the original custom user attributes and additional custom user attributes are not deleted or modified. (29323, 29332)
The 'overage allowed' attribute no longer appears in the user entitlement information. (29237)
Fixed when updating password reset settings, duplicate authenticators throws an error. (29315)
Fixed when an optional user attribute column is not included in the bulk operation import file, users can no longer remove those attributes from their user profile. (29304, 29331)
Fixed an issue with the Desktop Credential Provider (DCP) offline token support where offline OTPs could not be downloaded after DCP was upgraded. (25145)
Changed the Entrust Service Gateway log configuration to automatically rotate the audit log. Previously the Gateway would shut down when this log filled. (29109)
When a RADIUS application is configured to perform first-factor token only authentication, the IP address was not being logged in IDaaS audits. (30335)
Token synchronization with an empty response did not work for Entrust Soft Tokens. (29877)
Importing Entrust Soft Tokens from Identity Enterprise (IdentityGuard) did not work if the tokens were being used for offline token authentication with Desktop Credential Provider. (30058)
User list operation filtering by smart credential push authenticator included users with smart credentials that do not support push authentication. (29635)
The Admin portal now displays an error if an administrator tries to remove the value for a required attribute. (29324)
The pre-5.4 option for registering a Gateway has been removed from the IDaaS Gateway Registration page. (29789)
The Submit button on the Service Provider Unlock Administrators dialog has been renamed from OK to UNLOCK. (29798)
Fixed IP Address entry fields in the Admin portal to accept IP addresses that end with .0 or .255. (29671)
Fixed errors in the API documentation for the Administration API StartSmartCredentialSignParms model. (30243)
Fixed errors in the API documentation for the token list operations. The label search criteria was not documented. (29727)
When using an offline soft token authentication transaction, a follow-up soft token push authentication transaction would fail (no push notification would be triggered and the transaction would not be initiated). (30298)
Fixed a problem on the User portal Activity page where it did not display correctly while loading with a slow network connection. (29638)
The Smart Credential Activation page in the User portal is not properly translated for some locales. (29732)
In the Admin portal, the Directory Sync page did not correctly sort by Sync Status. (29313)
In the Admin portal, when changing the Supported Scopes of an OIDC application, the OIDC signature algorithm could be reset to NONE. (28929)
On the OIDC consent page, disable the Cancel and Accept buttons after Accept is clicked. (28862)

Changes to Identity as a Service APIs

Authentication API

The following attributes have been added to models in the authentication API.

userHandle has been added to FIDOResponse. This value includes the user information stored on the FIDO2 token when it was registered.

The following enhancements have been made to the Authentication API to return more detailed information when authentication fails. This behavior is controlled by the new General policy enableEnhancedAuthenticationDetails.

When an authentication fails due to an invalid response, the exception returned from IDaaS can include additional information, including the number of authentication attempts remaining.
When a user is locked out, return the error access_denied_locked instead of access_denied.
When a user is denied authentication because they have no authenticators, return the error access_denied_no_authenticators instead of access_denied.

Administration API

The following APIs have been added to the administration API.

getSpIdentityProviderUsingGET returns Service Provider information.
setSpIdentityProviderUsingPUT updates Service Provider information.
groupsPagedUsingPOST supports paging through a list of groups.
deliverAssignedGridByEmailUsingPOST delivers a PDF eGrid by Email.
getSingleGridExportUsingGET returns a PDF eGrid allowing the client to export it.

The following attributes have been added to models in the Administration API.

spIdp has been added to Tenant. This setting specifies whether a Service Provider authentication to Tenants using Identity Provider authentication has been enabled.
userIdStored has been added to FIDOToken. This value indicates if the user's user ID was stored on the FIDO2 token when it was registered.
newPassword has been added to UserPassword. This value contains the user's new password generated by IDaaS if the client requested it be returned.
returnPassword has been added to UserPasswordParms. This value allows a client to request the new password generated by IDaaS be returned.
allowedIpList, deniedIpList and type have been added to IpContext. These values show where IPLists are defined in a Resource Rule context.
enableEnhancedAuthenticationDetails has been added to GeneralSettings. This setting indicates if additional information about the user's lockout state are returned from authentication requests.

The following models have been added to the Administration API.

SpIdentityProvider contains information returned from getSpIdentityProviderUsingGET.
SpIdentityProviderParms contains information passed to setSpIdentityProviderUsingPUT.
GroupsPage contains information returned from groupsPagedUsingPOST.
GridExport contains information returned from getSingleGridExportUsingGET.

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.27 and the three previous releases 5.24, 5.25 and 5.26). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

Microsoft Windows 2012 Deprecation

Release 5.26

October 2022 · 11 min read

New in this release

User Contact Notification

IDaaS now supports sending user notification emails when a user's contact information has been changed.

As part of this feature, the preexisting user contact notification feature that sent a notification when the end user changed their contact and the corresponding email templates have been removed.

Entrust Service Gateway Changes

The command-line interface used to register the gateway has been removed. The browser-based UI is now the only supported interface for managing the gateway.

SAML Username Parameter

IDaaS has added support for passing the IDaaS user ID as part of a SAML authentication request using the SAML Request NameID element value. Set the SAML Username Parameter value to NameID to use this option.

SAML Session Timeout

IDaaS has added support for configuring the session timeout value for a SAML assertion. Set the SAML Session Timeout value to the timeout length in minutes. To exclude the session timeout in the SAML assertion, set the value to 0. The maximum is 720 minutes.

Enhanced Geolocation

IDaaS now provides an option to use enhanced geolocation information with more accurate locations for IP addresses and the detection of anonymous IP addresses. With this capability, tenants can configure resource rules to disallow anonymous IP addresses. Contact Entrust for details on enabling this feature.

User Onboarding

The user onboarding of Identity as a Service has been enhanced to support the mapping of groups or a role from an OIDC Identity Provider.

The following new settings have been added:

New settings to request claims in an ID token or user information response. These settings can be used in addition to requesting claims using scopes.
New settings for mapping groups or a role from an OIDC Identity Provider.

When configuring an OIDC Identity Provider note the following:

Create user allows anyone with access to your chosen Identity Provider to create a user in your IDaaS account. Depending on your IDaaS configuration, new users created by your IDP could be able to access all the resources controlled by your IDaaS account. This may be a concern if your Identity Provider has no limits on who can create an account or if it has a large user base. Analyze the risks before enabling this option.
Update user allows anyone with access to your chosen Identity Provider to update a user in your IDaaS account. Depending on your IDaaS configuration, updated users could be able to access all the resources controlled by your IDaaS account. This may be a concern if your Identity Provider has no limits on who can create an account or if it has a large user base. Analyze the risks before enabling this option.
Group Mapping allows anyone with access to your chosen Identity Provider to have their IDaaS groups include the groups defined by the Identity Provider. Groups set the policies applied to users. Enabling this setting could result in users having access to unexpected policies, especially if your Identity Provider has different user access policies than IDaaS. Analyze the risks before configuring this option.
Role Mapping allows anyone with access to your chosen Identity Provider to have their IDaaS account role defined by the Identity Provider, including the super administrator role that has access to all the resources controlled by your IDaaS account. Enabling this setting could result in unexpected access, especially if your Identity Provider has different user access policies than IDaaS. Analyze the risks before configuring this option.

Consumer Bundle Enhancement

Identity Provider capability is now supported for Consumer tenants.

Token Push Notification Authentication

Entrust Soft Token push notification authentication now supports mutual authentication.

YubiKey PIV Smart Cards

IDaaS now supports encoding smart credentials to YubiKey PIV Smart Cards.

To encode YubiKey smart cards, you must use Entrust Entelligence Security Provider for Windows version 10.0.91 build 30 or newer.

Token Labels

A label can now be set for assigned tokens. The label can be used by an administrator or the end user to give a meaningful label to the token.

Group Bulk Delete

A new group delete bulk operation has been added.

Directory Sync Enhancements

The following enhancements have been made to directory sync.

When specifying group filters, a value with a value followed by a * (for example, Gr*) will match all groups that start with the specified value.
When configuring directory sync an optional user unique attribute can be specified. If defined, the value specifies the name of the directory attribute that contains the directory entry unique id.

Documentation Enhancements

The integration documentation have been removed from the administration guide and are now in a separate Technical Integration Guide.

Admin/User Portal Improvements

The following improvements have been made to the portal.

A link from user audits to the user profile has been added.
The Smart Credential Details dialog has been refactored.
A customized logo is now centered.
All applications now appear on the User My Applications page.
Validation on the Identity Provider configuration page has been improved.

New SAML Applications

A new SAML application template has been added for Zuora

Fixed in this release

The following issues have been fixed in this release:

Characters in userIDs or aliases that differ just by an accent character (for example, o and ö) should be treated as the same character, but they were not. This lead to unexpected errors when creating or synchronizing users. (29200, 28365, 29424)
When configuring Identity Providers, the JWKS URI value should be made mandatory for IDPs that require it. (28958)
The setting "Allow Facial Authentication" in Smart Credential Settings has been renamed to "Allow Biometric Authentication". (27006)
Expired grids should not be considered as a second-factor authenticator for registration. (28324)
Fixed an issue delivering push notification to iOS applications using the custom SDK. (27004)
The logging for the IdentityGuard import bulk operation has been improved. (27944)
The password reset dialog did not display the error returned when the password was not reset because the password was reused. (28729)
When creating a tenant from a Service Provider, the specified user count is now validated before the request is submitted. (28925)
The resource rule for an Entrust Desktop Credential Provider now allows the risk rule to be specified with no second-factor authenticator. (29094)
When viewing an Identity Provider as an Auditor, some fields were read/write even though the changes could not be saved. All fields should be read-only. (28864)
Modifying user location history was not allowed as a Help Desk administrator. The UI was checking for the wrong permission. (29485)
Error fetching second-factor challenge for users that do not have OTP authentication available. (29255, 29300)
Error submitting image for ID Proofing. (29306)
The maximum number of user location history entries has been increased from 10 to 30. (28514)
When specifying custom OAuth authorization scopes, the value did not allow the characters y or z or entrust. (28736)
The directory sync agent could block reading from the directory. This would cause the directory to become unresponsive without failing over to another instance. (29511)
When sending transaction details, the default transaction priority is now 9 instead of 0. (27979)
On the Customization page in the Admin portal, the Reset operation changed the language from EN to ES. (28801)
When getting a CA issued certificate for a SAML application, the CSR response was not accepted. (28264)
Address various issues in the Admin portal where an action was shown even though the administrator did not have permission to perform the action and the action failed when submitted. (28899, 28909, 28724)
Various audit improvements for actions, including IDP create/update and Admin API related actions. (28148, 27924, 28726)
The ability to create/update users when Facebook is used as an Identity Provider is now allowed. (28939)
Fixed an issue preventing the soft token activation lifetime from being modified. (29207)
Fixed an issue where the registration password is not returned when activating a soft token. (28738)
Fixed an issue where multiple SAML applications required authentication even though SSO was enabled. (29253)
Fixed an issue where the user entitlement count became out of sync with the actual number of users. (29161)
Identity Providers have been enhanced. When using an IDP, in addition to requesting scopes, a request can now also include id token claim names and userinfo token claim names. (28904)
Identity Provider authentication now works with SAML IDP initiated authentication. (28420)
Fixed an issue preventing creation of Mobile SDK per group policies. (28901)
Admins can view the user's authenticators without requiring password permissions. (29188)
Temporary Access Code settings now display an error for Alphabet when Replace Similar Characters is checked and duplicate characters are present. (28327)
Maximum Uses for Temporary Access Code is now added to a user's authenticators filter. (28328)
For a Twitter Identity Provider, the user related fields are no longer shown since they are not used. (28917)
For an OIDC Generic Device application, validation of the usercode mask in the UI has been improved. (28900)

Changes to Identity as a Service APIs

The following attributes have been added to models in the authentication API.

tokenPushMutualChallengeEnabled has been added to UserChallengeParameters. This attribute is used to indicate whether the token push notification authentication has mutual challenge enabled.
tokenPushMutualChallenge has been added to AuthenticatedResponse. This attribute is the value of the token push notification authentication mutual challenge.
applicationInfo has been added to UserAuthenticateParameters. This attribute specifies a value that is included in the authentication audit.

The following methods have been added to the administration API.

getSubscriberAccountActiveEntitlementsUsingGET. This method returns AccountEntitlement specifying information about the entitlements defined for the account.
getPasswordResetSettingsUsingGET. This method returns PasswordResetSettings specifying password reset settings.
updatePasswordResetSettingsUsingPUT. This method takes PasswordResetSettings as an argument and updates the existing password reset settings.
modifyAssignedTokenUsingPUT. This method takes AssignedTokenParms as an argument and updates attributes of an assigned token.

The method usersPagedUsingPOST has been replaced with a new V4 version. The new version limits the attributes that are returned by default.

The following attributes have been added to models in the administration API.

verificationRequired has been added to AuthApiApplication. This attribute indicates if verification is required for the specified user.
verificationRequired has been added to AuthApiApplicationParms. This attribute indicates whether verification should be required for the specified user.
mutualChallengeAlphabet has been added to EntrustSTAuthenticatorSettings. This attribute is the characters used for the mutual challenge in the token push notification authentication.
mutualChallengeLength has been added to EntrustSTAuthenticatorSettings. This attribute is the length of the mutual challenge in the token push notification authentication.
mutualChallengeEnabled has been added to EntrustSTAuthenticatorSettings. This attribute is used to indicate whether the token push notification authentication has mutual challenge enabled.
mutualChallengeForPercentOfRequests has been added to EntrustSTAuthenticatorSettings. This attribute is the percentage of requests that will have mutual challenge enabled.
mutualChallengeSize has been added to EntrustSTAuthenticatorSettings. This attribute is the size of the mutual challenge in the token push notification authentication.
mobile has been added to ActivateSmartCredentialParms. This attribute allows the client to specify whether a mobile or physical smart credential is being activated so that the activation email can be set accordingly.
userUniqueIDAttribute has been added to DirectorySync. This attribute specifies an optional LDAP attribute that will contain the UUID of the user in the directory.
additionalFeatures has been added to Entitlement. This attribute specifies additional features enabled for the account.
anonymousAllowed has been added to LocationContext. This attribute specifies whether anonymous IP addresses are allowed by a resource rule.
label has been added to Token. This attribute specifies an optional label that can be defined for an assigned token.
acasEndpoint, ozoneEndpoint, and usPassliveEndpoint have been added to IdProofingInitResult. These attributes are additional attributes returned to an ID Proofing client.

Enterprise Service Gateway Upgrade Issue

There is a bug in the 5.25 version of ESG that prevents it from upgrading. There are two ways of resolving this issue.

Instead of upgrading your existing ESG instance, you can create a new 5.26 ESG instance and delete your existing instance.
Before you upgrade your 5.25 ESG instance, log in to the ESG instance and run the following commands: - sudo sh -c 'rm -rf /usr/lib/python2.7/site-packages/certifi* /usr/lib/python2.7/site-packages/requests* /usr/lib/python2.7/site-packages/pam* /usr/lib/python2.7/site-packages/python_pam*' - sudo sh -c 'pip install python-pam==1.8.4 "requests<2.28" "certifi<=2020.4.5.1"'

These commands can be run at any time prior to upgrading the ESG instance.

This issue only applies to the 5.25 version of ESG. There are no issues if you are upgrading from an earlier version of ESG.

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.26 and the three previous releases 5.23, 5.24 and 5.25). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service will cease support for Internet Explorer 11 after May 2023.

Release 5.25

June 2022 · 5 min read

New in this release

Identity Provider Improvements

The following improvement has been made to Identity Providers:

A new option has been added to require signature verification for responses to requests for user information.

SAML Username Parameter

IDaaS now supports optionally passing the IDaaS user ID as part of a SAML authentication request. The value can be passed as a configured parameter, for example "Username=jdoe".

Identity Providers in IDaaS now allows you to configure an Identity Provider with a type which prefills the well-known values. IDaaS also supports Facebook and Twitter as identity providers for you to authenticate now.

User Verification

Identity as a Service has been enhanced to support user verification before the user is allowed to access the IDaaS portal and other applications or register for authenticators. User verification is done by invoking an OIDC Identity Provider.

New settings for user verification have been added to the Registration Settings and Group Policy Settings pages.

A new Set Verification bulk operations for setting user verification for a user has been added to allow administrators to perform two additional actions:

Upload a group file and require user verification in bulk
Upload a group file and set user verification to not required in bulk

The header row in the CSV file contains only one column with Name as the value. Each row in the file must be an existing IDaaS group name. To Set User Verification for all users, use the system "All Users" group name with this new option.

Fixed in this release

The following issues have been fixed in this release.

Phone numbers from some countries were erroneously being rejected as invalid. (28841)
Issues with the regular expressions used to match attributes to be returned in SAML assertions have been fixed (28404)
The OTP expiry date is included in the information returned by the admin API createOTP and getOTP methods. (28332, 28289)
When synchronizing users from Azure AD, group names are now checked case insensitively. (28268)
Password authenticators for users synchronized from Azure AD were not being displayed with a proper state. (28296, 28251, 28248)
The authenticator filter on the user list page was showing some Token type values that were not applicable. These have been removed. (28255)
When the unassigned token list is refreshed, the group filter was not correctly applied. (28211)
Filters for the authenticator list in the user portal are now sorted by localized language. (28316)
The Loading... text for the authenticator list in the user portal is now localized. (28208)
The delete action in the assigned token list is now correctly labelled as Delete instead of delete. (28302)
For the assigned token list, when sorting or filtering on last used date, tokens that have a last used date of Never are now handled correctly. (28177)
When the message of the day is saved, unsupported HTML tags like script are automatically removed. Now, the version displayed on the customization page in the admin portal is now updated with the saved value. (27848)
Some of the wording on the Enroll Domain Controller Certificate dialog has been improved. (28199)
The audit for the Enroll Domain Controller Certificate action now includes the serial number of the certificate. (28184)
The option to use TCP for logging audits using the SIEM Agent in the gateway was being ignored. (28112)
An option to delete questions/answers from the user's knowledge-based authenticator has been added to the user portal. (28058)
A better error message is displayed for OAuth Device Verification if the session has expired. (27671)
Improved handling on the Identity Provider Add/Edit pages in the admin portal if the administrator does not have permission to list applications. (28326)

Changes to Identity as a Service APIs

The following changes have been made to the authentication API:

The following attributes have been added to models in the authentication API.

the attribute verificationRequired has been added to UserAuthenticateQueryResponse. This attribute indicates if verification is required for the specified user.
the attribute userVerificationRequired has been added to AuthenticatedResponse. This attribute indicates if verification is required for the specified user.

The following changes have been made to the administration API:

The following attributes have been added to models in the administration API.

the attribute verificationEnabled has been added to User. This attribute indicates if verification is enabled for the specified user.
the attribute verificationRequired has been added to User. This attribute indicates if verification is required for the specified user.
the attribute emailVerification has been added to UserParms. This attribute indicates that an email should be sent to the user if the specified user is being updated to be verified and requires verification.
the attribute verificationRequired has been added to UserParms. This attribute indicates if the specified user should be updated to be verified.
the attribute otpExpiryDate has been added to OTP. This attribute specifies the expiry date of the OTP.

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.25 and the three previous releases 5.22, 5.23 and 5.24). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

Release 5.24

March 2022 · 4 min read

New in this release

Entrust Soft Token Improvements

Added cryptographic security for soft tokens.

Domain Controller Certificate Request Review

Domain Controller Certificate Management now displays the certificate request to allow you to confirm the request before you enroll or renew it.

RADIUS Attribute Filtering

IDaaS now supports filters for RADIUS response attributes. When defining a RADIUS return attribute that is returning groups, filters can be used to specify which groups are returned and to return a value other than the group name.

Hide Other Applications Setting

RADIUS applications, IDaaS integrations, and custom applications that use the IDaaS API will now be hidden in My Profile. A new setting has been added in User Portal settings to show them.

Token List Improvements

The following enhancements have been made to the Token List.

the assigned token list now includes soft tokens.
an export action has been added to both the assigned and unassigned token lists.
token reports can be exported from the reports page.

Authenticator List Pages

The authenticator list pages for a user in both the Admin and User portals have been replaced with improved versions.

New SAML Integrations

A new SAML application template has been added for SailPoint.

Fixed in this release

The following issues have been fixed in this release:

Domain Controller Certificate Management now supports CAs created before release 5.23. (28128)
The regular expression filters for SAML attributes did not work correctly if the regular expression did not include an end anchor. (27970)
Generic Device OIDC application should be available for the consumer bundle. (27937)
The error displayed when a super administrator tries to change their own role has been improved. (27935)
The create domain controller certificate operation is only supported for PKIaaS CAs. The 2UI now only allows a PKIaaS CA to be selected. (27896)
The create domain controller certificate UI now validates that the entered name is unique. (27893)
The default search filter for audits is now shown as a Filter chip in the audit list. (27529)
Future date options have been added to the expiry date filter of the user location history list. (27197)
The bulk operation to import Entrust Legacy tokens was not generating audits for the loaded tokens. (26709)
The IDaaS login page occasionally returns to the userid login page after the userid was entered. (28056)
When customizing Email messages, the HTML <hr> tag is now allowed. (26811)
The new user email was sent to a new user even though user creation failed because the user has a duplicate userId or alias. (27890, 27909)
Access to the Password Reset capability has been added to the Standard bundle. (27964)
The Entrust IdentityGuard import occasionally failed for very large import files. (28000)
Performance problems with user sync from Azure AD especially when users are in a large number of groups have been resolved. (28231)

Changes to Identity as a Service APIs

The following changes have been made to the Administration API.

the following search criteria have been added to the unassignedTokenPageUsingPOST method. - type - loadDate
the following changes have been made to the assignedTokenPageUsingPOST method. - the method now returns both hard and soft tokens. - the following search criteria have been added: - type - loadDate - lastUsedDate - the existing search criteria state now includes the new value ACTIVATING. - the following new orderByAttribute values have been added: - loadDate - lastUsedDate

The C# SDKs have been updated to target .NET Standard.

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.24 and the three previous releases 5.21, 5.22 and 5.23). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

Release 5.23

February 2022 · 4 min read

New in this release

Domain Controller Certificate Management

Identity as a Service now allows a customer to issue and domain controller certificates when using a PKIaaS CA.

Reset Mail Server

A new "Reset Mail Server" action has been added to the tenant list of service providers. This action allows a service provider to reset the Mail Server configuration of a tenant back to the default IDaaS mail server.

Temporary Access Code Admin. Contact Message

A message telling the end user to contact their administrator to receive their temporary access code can now be enabled in the Temporary Access Code policy. When enabled, a message displays on the Temporary Access Code login page during authentication.

SAML Application Improvements

The following improvements have been made to SAML applications:

A new action "IDP initiated URLs" has been added to the SAML application list. This action lists the URLs for the SAML application and all of the defined relays states. It also provides an option for the administrator export them.
On the application setup page there is now an Enable/Disable option for each relay state. Disabled relay states do not appear on the user's available application page.
When exporting SAML metadata, there is now an option to specify the lifetime of the metadata.
When defining attribute values for SAML applications, regular expressions can now be defined to filter values or to parse out a portion of the value. IDaaS Support user attribute manipulation before sending back the value for SAML applications.

Enterprise Service Gateway CA Gateway and Microsoft Certificate Authority Proxy Upgrades

The Enterprise Service Gateway CA Gateway Service and the Microsoft Certificate Authority (CA) Proxy have both been upgraded to versions 2.5.2. If you are using a Microsoft CA with Smart Credentials, you should upgrade the Microsoft Proxy to 2.5.2 and the Enterprise Service Gateway to 5.23.

See the Administration Guide for complete details on how to upgrade your Microsoft CA Proxy.

Admin Guide

OIDC/OAuth Device Code Application Support

Identity as a Service now supports OIDC/OAuth device code flow applications.

The following OIDC/OAuth endpoint has been added for a client application to initiate the device code flow:

/api/oidc/devicecode

New SAML Integrations

A new SAML application template has been added for ADP.

Fixed in this release

The following issues have been fixed in this release.

The SIEM agent on the gateway has been enhanced to better handle a large backlog of audits. (27189)
The SIEM agent on the gateway now includes modified attributes in the information logged to the SIEM. (27812)
A new password specified in the authentication API was ignored unless the current password was expired or set by an administrator for forced update. Now the password can be changed at any time as long as the minimum lifetime of the existing password has passed. (27333)
Group filtering in the Directory sync agent on the gateway did not work in some situations due to a case mismatch between the group names defined in the filter and the group names defined in the directory. (27400)
The Update KBA Questions dialog in the Admin portal has been refreshed. The old table layout has been replaced with new UI components. (27180)
The full name appears in the email notification when a user updates their contact information. (26901)
Country flags have been added next to the user's delivery contact information. (27078)
Help Desk Administrators are now able to unlock individual accounts. (27560)
Users are no longer redirected to My Profile page when refreshing on the following pages: Authorization, Identity Providers, and IP Lists. (27488)

Changes to Identity as a Service APIs

The following models have been added to the Authentication API:

TempAccessCodeChallenge includes information about a temporary access code, including a flag indicating if the admin. contact message should be displayed.

The following changes have been made to existing models in the Authentication API.

tempAccessCodeChallenge has been added to AuthenticatedResponse. This value is an instance of TempAccessCodeChallenge and is populated for the response to a temporary access code challenge.

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.23 and the three previous releases 5.20, 5.21 and 5.22). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

Release 5.22

December 2021 · 6 min read

New in this release

Offline QR Code Transaction Verification

IDaaS now supports offline transaction verification using Authentication API applications with the Entrust Identity soft token app when a client application submits transaction details.

Identity Provider Integrations

The following Identity Provider integrations are available.

The Nets E-Ident broker service.

Identity Provider Enhancements

The following Identity Provider enhancements are available:

When configuring an Identity Provider, the userinfo endpoint is now optional. The claims used for authentication are based strictly on an ID token.
When configuring an Identity Provider, the configured groups are only associated with a user if a user is created at the time of the authentication. If a user already exists, the user's current group associations are not reset.
When configuring an Identity Provider, a new OIDC max age setting has been added.
When configuring an Identity Provider, a new OIDC authentication method request values setting has been added.
During an Identity Provider login from an OIDC client application, a Go Back button is now available on the login page. This allows a user to return to the OIDC client application without logging in.
During an Identity Provider login, the name of the Identity Provider is now included in the create user and modify user audits.
During an Identity Provider login, any errors during this processing now allow the user to continue and select a different type of authentication if they choose.
During an Identity Provider login, if a mapped IDaaS attribute value from a claim does not exist and a previous IDaaS attribute value exists, that value will remain as is.

OIDC/SAML Authentication Improvements

When a user is authenticating in IDaaS for OIDC or SAML, there is now a Go Back button on the login page. Pressing this button will return the user to the originating client.

When a user is reauthenticating and the existing login session has expired, the userId field will be prepopulated with the userId of the expired session.

Include Grid Expiry Date in Challenge

Select Include Grid Expiry in Challenge to display the grid expiry message. When authenticating with a grid card, a message appears on the authentication challenge page indicating the expiry date of the grid card.

Password Reset OTP Restrictions

Select Allow Email OTP delivery to send an OTP to a user's email address.

Note: This setting appears only if you select One Time Password as a second-factor allowed for password reset.

OTP Delivery Now Asynchronous

Previously, authentication challenge requests were blocked while delivering an OTP using SMS or Email. Now the challenge returns without waiting for the OTP to be delivered. This provides faster response time to the client. If delivery fails, an audit is generated.

Fixed in this release

The following issues have been fixed in this release.

Previously, if you configured and tested the connection for the Enterprise Gateway Proxy without authentication values for username and password and then attempted to retest the connection, it threw an "Unable to connect to proxy server" error. (27172).
Clicking back on the alternative authentication page does not unexpectedly bring you back to the username screen when only one type of OTP delivery is configured. (26419).
When a Group Policy included Machine Authenticator settings that required a device fingerprint, users failed to authenticate or view authenticators in the User Portal.
After restarting the Safari browser, the list of available Identity Providers displays correctly. Previously, if a prior IDaaS session existed prior to a Safari restart, the list of available Identity Providers did not display. (27169)
Some overridden machine authenticator settings in a group policy were ignored and the default settings were used instead. This has been fixed. (27320)
Group policy setting categories now display in sorted order. (27230)
Contact names shown on the OTP Settings page now display in sorted order. (25942)
Some smart credential options were still present in the admin portal for accounts with a Standard or PLUS bundle that do not support smart credentials. These options have been removed. (27146)
Permissions for actions that are not supported in accounts with a Standard or PLUS bundle no longer appear in the Role dialog. (26388)
Email templates for a Trial account with a customer email server can now be customized. (26859)
The list of applications shown in the Identity Provider dialog no longer includes OIDC Generic Server applications. They do not support user authentication. (26140)
The Delete Attribute dialogs for the My Profile page have been improved so that the name of the attribute being deleted always displays. (25923)
The Expire Time search criteria for Audit Archives has been changed to provide date options in the future. (27048)
Remove None as an option for the Date search criteria for Audit list. (27025)
The Password Expiry search criteria for User list did not show the correct value in the chip for some custom values. (26796)
The SIEM agent on the Enterprise Service Gateway has been modified to better handle a large backlog of audit. (27189)

Changes to Identity as a Service APIs

The following models have been added to the Authentication API:

GridInfo includes information about a Grid, including expiryDate and serialNumber. A new attribute gridInfo
TokenChallenge includes information about tokens available to answer a token challenge. A TokenChallenge includes a list of TokenInfo.
TokenInfo includes information about a token available to answer a token challenge. Information returned for a token includes the token serial number. If an offline TVS transaction is being performed, the qrCode and qrCodeUrl values specifying the offline transaction are also included.

The following changes have been made to existing models in the Authentication API.

gridInfo has been added to GridChallenge. This attribute specifies an array of GridInfo describing the grids that can be used to answer the challenge.
tokenChallenge has been added to AuthenticatedResponse. This value is an instance of TokenChallenge and is populated for the response to a token challenge. It describes the tokens available to answer the challenge.
offlineTVS has been added to UserAuthenticateParameters. Set this value to true if you are performing an offline TVS transaction.
offlineTVS has been added to UserChallengeParameters. Set the value to true if you are performing an offline TVS transaction.

The following methods have been added to the Administration API:

createMachineAuthenticatorUsingPOST creates a new machine authenticator for the specified user.

The following models have been added to the Administration API:

createMachineAuthenticatorUsingPOSTreturns MachineAuthenticatorRegistrationResult and includes information about the new machine authenticator.
MachineAuthenticatorRegistration defines the arguments passed to createMachineAuthenticatorUsingPOST.

Microsoft Internet Explorer 11 Deprecation Reversed

In previous releases, Entrust announced that IDaaS would no longer support Microsoft IE 11 starting in August 2021. This decision has been reversed and IDaaS will continue supporting IE11 until further notice. Entrust recommends that customers switch to other browsers.

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.22 and the three previous releases 5.19, 5.20 and 5.21). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

New in this release​

Device Verification using Certificates​

Certificate Details for mPKI CA Smart Credentials​

Resource Rule Risk-factor Enhancements​

OIDC Claim Enhancements​

Microsoft AD Strong Authentication​

Identity Provider Enhancements​

Administration API Long-Lived Token​

User Provisioning using System for Cross-Domain Identity Management (SCIM)​

SAML Enhancements​

Manage Inactive Users​

User Search/Report Enhancements​

Phone/Email Verification APIs​

User Portal Improvements​

New Passkey/FIDO2 Registration Policies​

Rate Limiting​

New Integrations​

Fixed or changed in this release​

Changes to Identity as a Service APIs​

Authentication API​

Administration API​

Enterprise Service Gateway Deprecation​

Microsoft Windows 2012 Deprecation​

Browser Deprecation​

New in this release​

SAML Signing Certificate Enhancements​

SAML Metadata Enhancements​

Authentication Locale Enhancements​

Password Expiry Notification​

FIDO2/Passkey Authentication API Support​

IDaaS Portal Improvements​

Enterprise Service Gateway Updates​

New OIDC Integrations​

New RADIUS Integrations​

Fixed or changed in this release​

Changes to Identity as a Service APIs​

Authentication API​

Administration API​

Enterprise Service Gateway Deprecation​

Microsoft Windows 2012 Deprecation​

Browser Deprecation​

New in this release​

User Provisioning​

Identity Provider Enhancements​

Token Reset Bulk Operation​

New Option on SAML/OIDC Applications to Disable Go Back Button​

Options to configure the User Portal​

Create Grid Action in User Portal​

Fixed in this release​

Changes to Identity as a Service APIs​

Changes in this release​

Authentication API​

Enterprise Service Gateway Deprecation​

Microsoft Windows 2012 Deprecation​

Browser Deprecation​

New in this release​

External Risk Engine Support​

PDF eGrid Automatic Delivery​

Resource Rule Improvements​

Fixed in this release​

Changes to Identity as a Service APIs​

Authentication API​

Administration API​

Enterprise Service Gateway Deprecation​

Microsoft Windows 2012 Deprecation​

Browser Deprecation​

New in this release​

Service Provider Tenant Management Enhancements​

Passkey/FIDO2 Enhancements​

User Authenticator Notification​

PDF eGrids​

Developer Portal​

Resource Rules Improvements​

Group Management Enhancements​

Fixed in this release​

Changes to Identity as a Service APIs​

Authentication API​

Administration API​

Enterprise Service Gateway Deprecation​

Microsoft Windows 2012 Deprecation​

New in this release

Device Verification using Certificates

Certificate Details for mPKI CA Smart Credentials

Resource Rule Risk-factor Enhancements

OIDC Claim Enhancements

Microsoft AD Strong Authentication

Identity Provider Enhancements

Administration API Long-Lived Token

User Provisioning using System for Cross-Domain Identity Management (SCIM)

SAML Enhancements

Manage Inactive Users

User Search/Report Enhancements

Phone/Email Verification APIs

User Portal Improvements

New Passkey/FIDO2 Registration Policies

Rate Limiting

New Integrations

Fixed or changed in this release

Changes to Identity as a Service APIs

Authentication API

Administration API

Enterprise Service Gateway Deprecation

Microsoft Windows 2012 Deprecation

Browser Deprecation

New in this release

SAML Signing Certificate Enhancements

SAML Metadata Enhancements

Authentication Locale Enhancements

Password Expiry Notification

FIDO2/Passkey Authentication API Support

IDaaS Portal Improvements

Enterprise Service Gateway Updates

New OIDC Integrations

New RADIUS Integrations

Fixed or changed in this release

Changes to Identity as a Service APIs

Authentication API

Administration API

Enterprise Service Gateway Deprecation

Microsoft Windows 2012 Deprecation

Browser Deprecation

New in this release

User Provisioning

Identity Provider Enhancements

Token Reset Bulk Operation

New Option on SAML/OIDC Applications to Disable Go Back Button

Options to configure the User Portal

Create Grid Action in User Portal

Fixed in this release

Changes to Identity as a Service APIs

Changes in this release

Authentication API

Enterprise Service Gateway Deprecation

Microsoft Windows 2012 Deprecation

Browser Deprecation

New in this release

External Risk Engine Support

PDF eGrid Automatic Delivery

Resource Rule Improvements

Fixed in this release

Changes to Identity as a Service APIs

Authentication API

Administration API

Enterprise Service Gateway Deprecation

Microsoft Windows 2012 Deprecation

Browser Deprecation

New in this release

Service Provider Tenant Management Enhancements

Passkey/FIDO2 Enhancements

User Authenticator Notification

PDF eGrids

Developer Portal

Resource Rules Improvements

Group Management Enhancements

Fixed in this release

Changes to Identity as a Service APIs

Authentication API

Administration API

Enterprise Service Gateway Deprecation

Microsoft Windows 2012 Deprecation