IntelliTrust Rename​

As of release 5.11, the name of IntelliTrust has been changed to Identity as a Service. There is no change in functionality of your existing instance of IntelliTrust apart from the features and functionalities mentioned in these release notes.

Transaction Context Risk Support with Resource-based Authentication​

Risk-based authentication has been enhanced to verify whether transaction details included in an authentication request match the transaction rules defined in the resource rules. Transactions that do not match the transaction rules add risk to the authentication. Only authentications using the Authentication API support Transactions.

SAML Signing Certificate Enhancements​

SAML Signing Certificates have been enhanced to support certificates issued by a CA and existing self-signed certificates. To replace the default self-signed certificate with a certificate issued by a CA, there is an option to generate a PKCS#10 certificate-signing request (CSR). Your CA uses the CSR to generate a certificate which is returned to Identity as a Service as either a PKCS#7 certificate response or a list of certificates. The existing Download option has been enhanced to support options to export the SAML certificate, the root CA certificate, or the entire PKCS#7 certificate chain.

SAML Integrations​

New SAML application templates have been added for Coupa and WhiteSource.

Administration Restrictions based on Group Membership​

Administration roles have been enhanced to include restrictions on the groups an administrator can access. A role can be configured to have access to all groups, own groups (the groups the administrator belongs to), or a specific list of groups. An administrator can only access users and user authenticators that belong to a group to which they have access. Additionally, unassigned grids and tokens can be assigned to groups with similar access restrictions. Related to these changes, the ability to filter by group has been added to the assigned and unassigned grid and token list pages.

Disable Single Sign-On for Portal Applications​

It is now possible to disable Single Sign-On for portal applications. Previously, this was only available for SAML and OIDC applications. This option is enabled by default for new accounts.

Support user-based lock instead of authentication-based​

The General Settings page includes a Lockout Mode setting. This settings controls whether a locked out authenticator locks the user or only locks the authenticator. Previously only the authenticator was locked out.

Changes to Identity as a Service APIs​

The following changes have been made to the Authentication APIs:

• A new attribute transactionDetails has been added to the UserAuthenticateQueryParameters object.This attributes passes in transaction details for resource-based authentication based on transaction rules.

The following changes have been made to the Administration APIs:

• The validateUserPassword API response attribute adComplexity now returns true or false based on the contents of the password. Previously, if the AD Complexity password setting was disabled, the result would always return true.
• New objects TransactionContext and TransactionRuleRisk have been added as part of resource-based authentication support for transaction rules.
• A new attribute transactionContexts has been added to the ResourceRuleParms object. It defines the transaction rules with resource-based authentication.
• A new attribute transactionContexts has been added to the ResourceRule object. It associates transaction rules with resource-based authentication.
• A new API endpoint GET /api/web/v1/transactionrules (getTransactionRulesUsingGET) has been added that returns a list of configured transaction rules. A transaction rule is defined by a new object TransactionRuleDescription. Transaction rules are used with Resource-based authentication.
• A new API endpoint POST /api/web/v1/tokenspaged/unassigned (unassignedTokenPageUsingPOST) has been added. This endpoint provides the ability to list unassigned hardware tokens with server side searching and paging.
• A new API endpoint PUT /api/web/v1/tokens/{tokenid} (modifyTokenUsingPUT) and new object TokenParms has been added. This endpoint provides the ability to modify the group membership of an unassigned hardware token.
• A new API endpoint PUT /api/web/v2/grids/{gridid} (modifyUnassignedGridUsingPUT) and new object GridParms has been added. This endpoint provides the ability to modify the group membership of an unassigned grid.
• A new search criteria groupId is now supported in SearchParms when listing assigned or unassigned grids or tokens. This attribute allows you to list grids or tokens in a specified group.
• A new attribute groups has been added to Token. When fetching unassigned hardware tokens, the groups attribute returns the hardware token group membership.
• A new attribute groups has been added to Grid. When fetching unassigned grids, the groups attribute returns the grid group memberships.
• A new attribute groups has been added to GridCreateParms. When creating unassigned grids, the groups attribute can be used to optionally specify the group membership of the new grids.
• New attributes groupManagement and groupIds have been added to Role. When fetching a role these attributes specify the groups that the role can manage.
• A new attribute lockoutMode has been added to GeneralSettings. The attribute is returned when fetching general settings and can be set when modifying the general settings.

API Deprecations​

The following API endpoints are deprecated and will be removed in Identity as a Service 5.14:

| Name | Operation | Replacement | | ------------------------------- | ---------------------------- | ---------------------------- | | List Unassigned Hardware Tokens | listUnassignedTokensUsingGET | unassignedTokenPageUsingPOST | | List Assigned Hardware Tokens | listAssignedTokensUsingGET | assignedTokenPageUsingPOST |

SAML Attribute Editor​

IntelliTrust has a new SAML Attribute Editor. Using the editor, administrators can customize the SAML assertions sent to Service Provider applications with additional user attributes, groups, or authenticators.

IntelliTrust Oracle Eloqua Integration​

A new application template has been added for Oracle Eloqua integration. Use this application template to quickly configure Oracle Eloqua for SAML authentication through IntelliTrust.

Usage Notifications​

IntelliTrust now notifies the tenant and its MSP about the usage of user entitlements. Email will be sent to tenant and its MSP when their consumption has reached 50%, 75%, 95% and 100% of their entitlements.

Users Expiration Notifications​

IntelliTrust now notifies the tenant and its MSP about the expiry of Production and Unknown accounts. Email will be sent to tenant and its MSP when their expiry is due in 8, 4 and 2 week(s).

Microsoft Certificate Authority Proxy Upgrade​

The Microsoft Certificate Authority (CA) Proxy has been upgraded to version 1.6.0. If you are using a Microsoft CA with Smart Credentials, you should upgrade the Microsoft Proxy to 1.6.0 and the Enterprise Service Gateway to 5.10.

See the Administration Guide for complete details on how to upgrade your Microsoft CA Proxy.

• Admin Guide

IntelliTrust AD Connector​

A link has been added to the Gateways page for downloading the latest version of the IntelliTrust AD Connector.

Warnings for Insecure Authenticator Policies​

IntelliTrust will now warn you when you are attempting to save an insecure policy for your authenticators. These authenticators include:

• Password
• Grid
• OTP
• Temporary Access Code (TAC)

Note: IntelliTrust will not block you from using these policies, a warning will be displayed when you click on the Save button. Use policies that meet your security requirements.

Issuance Accounts​

The following capability has been added to Issuance accounts:

• Ability to crop photographs during enrollment automatically using face detection or manually

Changes to IntelliTrust APIs​

The following deprecated API operations have been removed per the deprecation schedule:

• listAssignedGridsUsingGET
• auditEventReportUsingPOST
• listUnassignedGridsUsingGET
• usersUsingGET
• getTenantsUsingGET

SAML Metadata Import​

IntelliTrust now supports importing SAML metadata files when configuring SAML applications. Some SAML Service Providers provide metadata XML files that contain the details on how to configure the application. Supported fields include:

• Assertion Consumer Service URL
• Service Provider Entity ID (Issuer)
• Single Logout Service URL
• SAML Signing Certificate
• SAML NameID Encoding Format

User Last Authentication Time​

An administrator now has the ability to see the last authentication time of a user. When an administrator lists users in the admin portal, the last authentication time displays in a column in the Users list.

Push Authentication Support for RADIUS EAP Applications​

IntelliTrust now supports push authentication for EAP-enabled RADIUS applications. This can be used with the Entrust Soft Token and Mobile Smart Credential authenticators.

Preview - IntelliTrust AD Connector​

You can now incrementally sync users from an on-premises Active Directory using the lightweight AD Connector native Windows application.

AD Connector will detect any changes for users and groups inside your Active Directory and send only the required updates to your IntelliTrust tenant.

Note: This feature is being released as a preview. See the Known Issues and Limitations page for more details.

Smart Credential Revocation Enhancement​

When a smart credential (or the user who owns the smart credential) is deleted or disabled, the associated certificates are revoked in the CA. If the CA is not available, the smart credential cannot be deleted or disabled in IntelliTrust. A new setting "Skip Revocation" has been added to the CA configuration. When selected, if revocation fails, IntelliTrust continues to delete or disable the smart credential. If not selected, the delete or disable operation fails. If IntelliTrust does not revoke the certificates, administrators should revoke the certificates directly in the CA.

New Apache Authentication Integration​

A new integration has been added that allows you to configure your Apache HTTP server to use IntelliTrust for multi-factor authentication.

See the Apache Filter technical integration guide for details on how to configure your Apache server.

Issuance Accounts​

The following capabilities have been added to Issuance accounts:

• Support for defining credential designs
• Enrolling applicants for credentials including support for bulk enrollment and enrollment from mobile devices
• Printing credentials
• Issuing mobile flashpass credentials to Apple iOS and Google Android devices
• Improvements for printer management including enhanced printer onboarding and print queue support
• Support for Sigma and DTC printers

Miscellaneous Improvements​

• When authenticating, clicking on the "Resend OTP" button will now display a visual confirmation that a new OTP was sent. In addition, the "Resend OTP" button will be disabled for 5 seconds in order to prevent multiple OTPs from being delivered in a short period of time.
• The Password Settings have been updated to use more inclusive language. "Password Blacklist" has been renamed to the "Password Blocklist".
• The Scheduled Reports page now includes an option to enable and disable reports.
• It is now possible to schedule a usage report using the filters applied on the Tenants list page.

Changes to IntelliTrust APIs​

The following have been added to the Administration APIs:

• The following changes to roles and permissions have been made in this release: - a new Directory Password permission has been added, which gives a right to read AD Connector directory password. - new permissions Credential Designs, Enrollments and Bulk Enrollments have been added. These permissions apply to Issuance accounts and controll access to the corresponding capabilities. - a new default role AD Connector has been added with the minimum required permissions for the AD Connector application to function. - new default roles Issuance Designer and Issuance Supervisor have been added to Issuance accounts.
• A new user attribute lastAuthTime has been added - which gives a right to display users last authentication time on the Users List page.
• New SearchByAttribute operators EXISTS and NOT_EXISTS have been added, NOT_EXISTS is mapped to Never for user's last authentication time.

The following changes have been made to the Issuance APIs:

• new methods to access and manage Print Queues have been added
• the following APIs have had non-backwards compatible changes: - the controller getPrintStatus no longer takes the printer Id as an argument. It is now GET /api/web/v1/printers/print/{printStatusId} - the controller updatePrint no longer takes the printer Id as an argument. It is now PATCH /api/web/v1/printers/print/{printStatusId}
• new options tactileFront and tactileBack have been added to PrinterPreferences related to tactile impression support. These preferences can be set for a printer or specified when submitting a print job.

SAML Relay State Support​

IntelliTrust now supports the ability to configure a list of relay state values for SAML applications. The configured relay states will appear on a user's My Profile page.

Smart Credential Self-Registration​

The registration settings now include support for allowing users to self-register a Smart Credential.

Dashboard System Alerts​

The dashboard now displays an alert if IntelliTrust is unable to deliver an email using your custom mail server after five attempts.

Directory Attribute Mappings​

In previous versions of IntelliTrust, when configuring the directory attribute mappings you had to provide a mapping for all IntelliTrust System attributes regardless of whether they were mandatory attributes. Custom attributes could be optionally mapped regardless of whether the Custom attribute was mandatory.

This has been changed so that you must only provide directory attribute mappings for attributes (system or custom) that are mandatory. If an attribute is not mandatory, then you do not need to provide a directory attribute mapping for that attribute.

As in previous releases, any users in Active Directory that are missing mandatory attributes will not be synced to IntelliTrust.

Advanced Gateway Agent Settings​

It is now possible to control some of the advanced settings of your Gateway Instances. This includes:

• Password Agent Worker Threads: Set the number of worker threads the Password Agent uses to handle Active Directory password requests.
• RADIUS Agent Worker Threads: Set the number of worker threads the RADIUS agent uses to handle RADIUS authentication requests. Note: In order to change this setting the Enterprise Service Gateway (ESG) must be at least version 5.8.
• RADIUS Agent Message Queue Max Time: Set the maximum amount of time a RADIUS message is in the queue waiting to be processed by the RADIUS Agent.

Preview - Azure AD Cloud Sync​

You can now sync users directly from Azure Active Directory without the Enterprise Service Gateway.

IntelliTrust will sync users directly from Azure into your IntelliTrust account. Users synced from Azure can also change and reset their Azure AD password through the IntelliTrust portal.

Note: This feature is being released as a preview. See the Known Issues and Limitations page for more details.

RADIUS EAP Improvements​

IntelliTrust now supports password for first-factor authentication to EAP-enabled applications. When password is configured, the user is prompted for their IntelliTrust or Active Directory password. Note: EAP password authentication requires Enterprise Service Gateway version 5.8 or later. With earlier versions of the Gateway, RADIUS authentication will fail if PASSWORD is configured as the first-factor.

This release also introduces support to allow users to select the second-factor authenticator they want to use to authenticate to an EAP-enabled application. When enabled, the VPN client prompts the user for the second-factor authenticator from the user's list of available authenticators.

RADIUS Agent Password Authentication Affinity​

This release includes a the ability to enable Password Agent affinity for RADIUS applications.

If enabled, Active Directory password authentication and change requests that are initiated as part of RADIUS authentication will be handled by the Gateway instance that initiated the request.

If disabled, the request will be handled by any Gateway instance in the gateway.

Allow Lowering of Entitlements​

Service Providers can now lower the entitlement quantity of a tenant to a value lower than the current number of users in that tenant.

Service Provider Contract Mode​

This release includes a new Contract Mode feature that allows the creation of Production and Trial tenant accounts. Trial accounts include predefined entitlements that cannot be changed. Trial accounts that are not converted to Production accounts within 30 days are permanently suspended.

Existing accounts are categorized as Unknown. Service Providers should review their accounts and categorize them accordingly as Production or Trial accounts.

Service Provider Usage Reports​

This release includes a Usage Report feature. Usage Reports can be scheduled and downloaded in a CSV file.

API Deprecations​

The following API endpoints are deprecated and will be removed in IntelliTrust 5.10:

| Name | Operation | Replacement | | --------------------- | --------------------------- | ---------------------------- | | List Unassigned Grids | listUnassignedGridsUsingGET | unassignedGridsPageUsingPOST | | List Assigned Grids | listAssignedGridsUsingGET | assignedGridsPageUsingPOST | | List Audit Events | auditEventReportUsingPOST | auditEventPageUsingPOST | | List all users | usersUsingGET | usersPagedUsingPOST | | List Tenants | getTenantsUsingGET | getTenantsPageUsingPOST |

Changes to IntelliTrust APIs​

The following have been added to the Administration APIs:

• A new endpoint /v1/directorycommons has been added that returns a list of on-premise and Azure AD directories.
• The following changes to tenant related methods have been made in this release: - a new version of the create tenant method "POST /api/web/v2/tenants" has been added. - the entitlement argument of this API is now required for both Authentication and Issuance accounts. Previously it was not required for Issuance accounts. - the entitlement argument must specify a contractMode value of either PRODUCTION or TRIAL - if the v1 version of this API is called, the new tenant is created with a contractMode of UNKNOWN - a new method that lists a page of tenants "POST /api/web/v1/tenantspaged" has been added. It replaces the existing list tenants method that returned all tenants which has been deprecated and will be removed in a future release. - a new method that lists usage information for the tenant and its child tenants "POST /api/web/v1/tenants/entitlements/usage" has been added. - all service provider controllers that return a tenant (including create, get and list) include the new contractMode value. For existing tenants that don't have a value set for this value, the contractMode will have the value UNKNOWN.

Smart Credential Revocation​

The following enhancements have been made to revoke or hold certificates associated with smart credentials in IntelliTrust:

• when a smart credential is deleted all certificates associated with that smart credential are permanently revoked. When a user is deleted this applies to all smart credentials owned by that user.
• when a smart credential is unassigned all verification certificates associated with that smart credential are permanently revoked.
• when a smart credential is disabled all verification certificates associated with that smart credential are revoked for hold. When a user is disabled this applies to all smart credentials owned by that user.
• when a smart credential is enabled all verification certificates associated with that smart credential are unheld. When a user is enabled this applies to all smart credentials owned by that user.

The existing IntelliTrust Certificate Authority setting "Immediately Publish CRL Upon Revocation" is obeyed for these operations". For an Entrust Managed PKI, your XAP credentials must have permission to issue RLs if you enable this setting.

In this release, these changes are only supported with Entrust Managed PKIs. Support for Microsoft CAs will be added in a future release. Certificates can always be revoked from the CA.

When performing these operations, if the certificate revocation operation fails for any reason then the entire IntelliTrust action will fail. For example, if you are trying to delete a user and the CA is not running causing a certificate revocation to fail, the IntelliTrust user will not be deleted.

Grid Bulk Enhancements​

The Assign Grids Bulk Operation now supports the use of SerialNumber or serialNumber as the header column for serial numbers, in addition to Serial Number.

The Import Grids Bulk Operation now displays the first failed row and what the corresponding error was.

The Import Grids Bulk Operation now supports the use of group as the third column header in the import file. This column header value can be used to ignore the use of this column during grid import processing. This allows the exporting of unassigned cards directly from Entrust IdentityGuard when this column header value is set.

Get Service IP Addresses API​

A new API getServiceIPAddresses has been added to the Administration API. When called, the API returns a list of public IP addresses being used by the IntelliTrust services. These IP addresses will be the source IP addresses of any request sent by IntelliTrust to an external service such as a customer's CA or email server. These values can be used by a customer who wants to whitelist IP addresses that their service will accept requests from. Note that the list of IP addresses may change dynamically so this API should be called periodically to get an up-to-date list.

Grid Card Enhancements​

IntelliTrust now supports the PENDING and CANCELED grid states from Entrust IdentityGuard.

• A PENDING grid card is a grid card that has not yet been used for authentication. Once the grid card is used for the first time, the state of the grid card automatically changes to ACTIVE.

• A CANCELED grid card is a grid card that can no longer be used. When a grid card is canceled it can no longer be unassigned from the user and it can no longer be used for authentication. CANCELED grid cards still count toward a user's Maximum Grid Cards policy setting (See Settings -> General).

IntelliTrust now prevents grid cards from being unassigned if the grid card has been used. This prevents used grid cards from accidentally being assigned to another user.

Bulk Operation Enhancements​

The following Bulk Operations have been enhanced:

Import Users

The Import Users Bulk Operation now supports the following new columns: locked and group.

The locked column supports importing users in the locked state. This column is a boolean value which can be TRUE or FALSE. When this is set to TRUE, all of the user's authenticators will be locked when the user is created. This column is optional. If this value is set to FALSE, is empty, or is omitted, the user will not be locked when created.

The group column supports assigning users directly to a group without having to run a separate User/Group assignment Bulk Operation. If provided, the user will be created and assigned to the specified group. The group must already exist in IntelliTrust. If not, the user will fail to be imported. This column is optional. If the value is empty, or is omitted, the user will not be assigned to a group.

Import Grid Cards

The Import Grid Cards Bulk Operation now supports importing grids in the PENDING and CANCELED states. In addition, this Bulk Operation now supports importing all Entrust IdentityGuard grid states. The Entrust IdentityGuard grid states are converted to IntelliTrust grid states as follows:

| IdentityGuard Grid State | IntelliTrust Grid State | | ------------------------ | ----------------------- | | CURRENT | ACTIVE | | HOLD | INACTIVE | | HOLD_PENDING | INACTIVE | | PENDING | PENDING | | CANCELED | CANCELED |

Notes:

• When importing unassigned grid cards, the state column will be ignored.
• When importing grid cards with a state value of ACTIVE, INACTIVE, CURRENT or HOLD, the last used date is set to a very early date to identify the card as being previously used.

Changes to IntelliTrust APIs​

The following API endpoints now have new versions in order to support the new Grid states:

• /v2/gridspaged/assigned
• /v2/users/{userid}/grids
• /v2/grids/{gridid}
• /v2/grids/sernum/{sernum}
• /v2/grids/{gridid}/changestate
• /v3/users
• /v3/users/multiple
• /v3/users/{id}
• /v3/users/userid
• /v3/users/externalid
• /v3/userspaged

The previous version of these endpoints will continue to be supported; however, they will not return the new grid states.

The new APIs will return a Grid object with a State whose values can now also be set as PENDING or CANCELED. Previous APIs will return the value ACTIVE and INACTIVE, respectively, for these.

Get User API

The Get User API now returns detailed lockout information for each authenticator that a user has in the lockoutStatus parameter.

The lockoutStatus for each authenticator contains following information:

• type: The authenticator type.
• remaining: The number of authentication attempts remaining before the authenticator is locked.
• lockoutDate: The date the authenticator was locked.
• lockoutExpire: The date the lockout will expire.

Transaction Details

When using transaction details with OTP or TOKEN authentication, a successful authentication response AuthenticatedResponse will now contain a corresponding TransactionReceipt object.

Smart Login​

Smart Login capability has been added to allow Passwordless authentication. When enabled, a user with a Mobile Smart Credential paired to their account can authenticate to their intelliTrust account or a SAML/OIDC application integrated with IntelliTrust without the need to provide a username and password.

New User Attribute: User Principal Name​

IntelliTrust now supports User Principal Name as a system user attribute. It can be used like any of the other system user attributes.

Smart Credential definitions can update their upn variable default value and set it to <User Principal Name>.

If there was an existing custom user attribute named User Principal Name it will be renamed as User Principal Name----Renamed----. All uses of this custom user attribute will remain as is.

All directory configurations will be updated to map the Active Directory userPrincipalName user attribute into the new system User Principal Name user attribute. This will occur at the next scheduled synchronization or it can be manually triggered by an administrator through a forced synchronization.

Microsoft CA Gateway Enhancements​

• IntelliTrust now supports key backup and recovery when using a Microsoft CA with Smart Credentials. The Key Management certificate template can be configured to support these features.

• The Certificates List page has been updated to include support for displaying Microsoft CA configuration and connectivity information.

• The previous limitation of properly synchronizing a user's DN value when ESG versions prior to 5.5 existed has been resolved. The automatic synchronization of a user's DN value is supported for versions of ESG 5.5 and later. When using a directory associated with an ESG 5.5 or later, the user's DN value will always be synchronized. When using a directory associated with an ESG 5.4 or earlier, the user's DN value will not be synchronized.

See the Administration Guide for complete details on how to configure your IntelliTrust account to use a Microsoft CA.

• Admin Guide

Smart Credential Enhancements​

IntelliTrust now supports cloning of Smart Credential definitions.

Custom Email Server​

You can configure IntelliTrust to use your own SMTP mail server for sending emails from IntelliTrust.

RADIUS Authenticator Challenge​

A new setting "Authenticator Challenge" has been added to RADIUS applications. When enabled, users authenticating to a RADIUS application will be prompted to enter the name of the second-factor authenticator they want to be authenticate with after which they will be challenged to answer their second-factor authentication challenge.

Disable Machine Authentication​

A new setting has been added to the Machine Authenticator settings to enable or disable Machine Authentication. When enabled, a user will see a Remember Me button on the login screen.

Bulk Operation Enhancements​

The following Bulk Operations have been enhanced:

Import User/Groups​

In previous versions of IntelliTrust, if a user already had a group assigned then the that user record in the Bulk Operation would fail. This restriction has been removed.

Import Grid Cards​

Support for setting the state of the Grid Card being imported has been added. A Grid Card can be imported in the ACTIVE or INACTIVE states. This value must be provided in the 4th column of the Bulk Import CSV file (see example below). If omitted, the Grid Card will be imported in the ACTIVE state. Below are examples with and without the state column.

Without the state column:

markup Card #,serialNumber,userId,,A1,B1,C1... 1, 1, alice,, P1, NH, EX...

With the state column:

markup #,serialNumber,userId,state,A1,B1,C1... 1, 1, alice, ACTIVE, P1, NH, EX... 2, 2, bob, INACTIVE, QW, 5H, EK...

Administration API for Create OTP​

IntelliTrust now provides an Administration API to create and return an OTP. This can be used in place of the Authentication API challenge for OTP-only based authentications. The retrieved OTP can then be sent by the caller to the user. The API also provides support for OTPs using PSD2.

Changes to IntelliTrust APIs​

The following have been added to the Administration APIs:

• A new method createOTPUsingPOST has been added that allows you to create and return an OTP.
• New attribute userPrincipalName in been added to the User and UserParms objects. This attribute contains the userPrincipalName of the user if that user was synchronized from a directory.

Smart Credential Provisioning Improvements​

• IntelliTrust now supports the ability to automatically provision a Smart Credential for new users when they are added to IntelliTrust. This is supported for users added through the Administrator Portal, Active Directory Sync, or Bulk Import.

• The User Portal Registration settings have been enhanced to allow users to add a Smart Credential authenticator to their account. Previously only Administrators could provision a Smart Credential for a user.

IdentityGuard Migration Support for User Creation​

The IdentityGuard User Migration has been enhanced to create users if they do not exist in IntelliTrust. The following IntelliTrust user attributes will be populated from Entrust IdentityGuard's user and contact information attributes:

• User ID
• First Name
• Last Name
• Mobile Number
• Phone Number
• Email
• Groups
• User Alias

Entrust IdentityGuard Mobile App - Custom Logo Support​

The Entrust IdentityGuard Mobile App (Android, iOS) will now display the logo from your IntelliTrust account.

Note: The IntelliTrust logo will only be displayed when registering a new Entrust Soft Token. Existing Entrust Soft Tokens will continue to display the existing logo.

IntelliTrust ForgeRock Integration​

A new application template has been added for a native IntelliTrust ForgeRock integration. Use this application template to quickly configure ForgeRock for IntelliTrust authentication.

Password Change Support for RADIUS Applications​

When authenticating to a RADIUS application using your password, the end user will now be prompted to change their existing password if it has expired or has been set to require change.

RADIUS Response Attributes​

A RADIUS application can be configured so that the RADIUS response returned to the VPN server includes additional attributes, including information such as the user's group membership.

Identity Proofing​

IntelliTrust now provides APIs that can be used to validate the identity of a person using a government-issued identity document, such as a driver's license or a passport.

Active Directory Sync Fixes​

In prior versions of IntelliTrust, Super Administrator user accounts could be disabled or deleted by the Directory Desynchronization Policy. This has been fixed so that Super Administrator accounts will not be deleted or have their state changed regardless of the Directory Desynchronization Policy.

Swedish and Danish Locales​

The IntelliTrust User Portal now has support for the Swedish and Danish languages.

Office 365 Support for Multi-Domain Federation​

The Office 365 SAML application has been enhanced to support federating with multiple domains.

This option is also available in the Generic SAML Application template.

Enterprise Service Gateway Memory Increase​

Microsoft CA Support​

The Certificates List page has been updated to include support for Microsoft Certificate Authorities (CAs).

Smart Credentials can be created using a Smart Credential definition with Digital ID configurations that are associated with a Microsoft CA.

The use of a Microsoft CA requires the installation and configuration of a Microsoft CA Proxy service running on a domain-joined Windows server.

Please review the Administration Guide for complete details on how to configure your IntelliTrust account to use a Microsoft CA.

The following limitations apply:

• Any update or refresh to the Microsoft CA configuration in the IntelliTrust Administration Portal will be propagated to the CA Gateway and a restart of the CA Gateway will occur. Current requests, for example, authentication or enrollment, to the CA Gateway will fail and need to be re-executed. Similarly, if the Password Agent or CA Gateway is restarted manually, the latest Microsoft CA configuration will also be propagated.
• Any update to the certificate template configuration in the Microsoft CA requires the Microsoft CA to be refreshed in the IntelliTrust Administration Portal.
• Certificate revocation check is supported using CRLs that use either LDAP and/or HTTP. Both protocols need to be accessible by the ESG. This requires configuring anonymous access to the LDAP CRL.
• This release does not support key recovery. Microsoft CA certificate templates should be configured without key backup/archive enabled. Support for key recovery, which includes the use of Microsoft CA key recovery agents, will be available in a future release.

More Information:

• Admin Guide

Gateway Web UI​

Version 5.5 of the Enterprise Service Gateway (ESG) provides a new web-based interface for registering the ESG with your IntelliTrust account. When the ESG boots up, a configuration URL is displayed. Administrators can open that URL in their browser and configure the ESG without having to use the CLI.

Entrust Soft Token Activation Improvements​

A new setting has been added to the Entrust Soft Token authenticator settings that allows an Administrator to select the activation methods included in the Entrust Soft Token activation email.

Options include:

• Activation link
• QR code
• Manual activation

At least one activation method must be selected.

Users will no longer automatically receive an activation email if they add a new Entrust Soft Token or a Google authenticator. They must now click a button in the activation dialog box to receive an activation email.

Changes to IntelliTrust APIs​

The following have been added to the Administration APIs for Microsoft CA support:

• DigitalIdConfig contains a new caType (EDC or MS), certTemplates (array of DigitalIdConfigCertTemplate), and dnFormatSearchbaseIncluded (boolean) properties.
• A new type DigitalIdConfigCertTemplate was added with digitalIdConfigId (string), id (string), name (string), and pivContainer (PivAuth, CardAuth, DigSig, KeyMgmt, and None).
• User contains a new dn (string) property.

IntelliTrust Desktop for Windows integration and offline token support (AAAS-8656)​

This release includes a new template to support IntelliTrust Desktop for Windows integration. This integration includes support for offline token authentication to Windows desktops.

Control Available Authenticators (AAAS-16074)​

A new setting has been added to the Registration page that allows administrators to configure the authenticators users are allowed to add to their profile. For example, if you do not want users to be able to add KBA to their account then you can remove KBA from the allowed authenticators.

Directory sync details (AAAS-17935)​

The directory sync details have been enhanced to include the Upload Results that show the metrics for new, changed, desynced, and failed results of the synchronization. Improvements have also been made to the performance of directory synchronization, including avoiding unnecessary calls to Active Directory, removal of the database, and the ability to turn off the automatic sync by setting the crawl frequency to 0.

Grid bulk operations (AAAS-17881)​

A new Bulk Operation has been added to allow administrators assign grid cards in bulk.

Audit results​

The Audit results have been enhanced so that when a Token or Smart Credential push authentication is cancelled from the mobile application, it is now audited in IntelliTrust. Previously only the Concern or Complete operations were audited.

Previously in the audits, the last column was named Message and showed the Message id of the audit. Now the last column is named Event and shows the Event Type of the audit. The Event Type is a searchable field.

Unlink users​

A new operation has been added to the Administrator Portal that allows an administrator to unlink any user who was previously synchronized from a directory.

Role Management (AAAS-18464)​

The Roles List page has been refreshed.

A new action has been added to the Roles List page that allows Administrator to clone existing roles.

Changes to IntelliTrust APIs​

The following have been changed in the IntelliTrust Authentication APIs.

Changes related to the offline token feature:

• New attribute offlineTokenResponse is added as part of authentication complete response.