Support for user aliases (AAAS-13023)​

In this release, a user can have one or more aliases in addition to the mandatory userID. Wherever a userID is specified in administration or authentication APIs, an alias can be specified instead. The userID and aliases are mutually unique. See the IntelliTrust Admin Online Help for more information.

Support for FIDO2 authentication (AAAS-12299)​

This release supports FIDO2 tokens for authentication to SAML and OIDC applications as well as the IntelliTrust Administration and User portals. FIDO2 token authentication is available using the latest versions of Chrome, Microsoft Edge, and Firefox. See the IntelliTrust Admin Online Helpand User Help for more information.

Support for RADIUS IP attribute (AAAS-13024)​

An optional field is available in the RADIUS application to select the RADIUS IP Attribute. The attribute specifies the IP address which can be used by IntelliTrust for RBA, including determining the user location. See the IntelliTrust Admin Online Help for more information.

Support for custom Mobile app activation schemes (AAAS-14126)​

This release includes a new Scheme setting for smart credential and soft token apps to allow custom mobile applications instead of the Entrust Datacard mobile apps. See the IntelliTrust Admin Online Help for more information.

Gateway upgrade (AAAS-10547)​

For post 4.3 releases, a Gateway upgrade button will be available to upgrade the gateway without having to reinstall, configure, and activate the gateway. Upgrades for earlier releases must continue to replace their existing gateway with the new one. It is strongly recommended that you upgrade to IntelliTrust Enterprise Service Gateway 4.3 to take advantage of this feature going forward.

Rename gateway and gateway instance (AAAS-12780)​

This release supports renaming gateways and gateways instances.

Regenerate shared secret in Administration API applications (AAAS-12270)​

This release supports regenerating an Administration API application shared secret.

Changes to IntelliTrust APIs (AAAS-13501, AAAS-13688, AAAS-13689)​

• You can specify a user alias anywhere a userID is specified in the API. For example, this includes specifying a userID in any of the authentication API controllers. - In the administration API, new attributes have been added to the User and UserParms structures to specify user alias values when fetching or modifying users. - In the administration API, new controllers have been added to manage FIDO tokens for users. This includes the ability to get, delete, and update FIDO2 tokens. - In the administration API, new controllers have been added to do paged searching of audits and assigned tokens with search criteria. Additionally, a new option to search for locked users has been added to the user search criteria.

All changes are backwards compatible. A customer application written to use the APIs provided with 4.2 will continue to work without change.

Back end pagination end points (AAAS-12871)​

This release supports pagination and seaching list end points. See the Administration API Guide for more information.

User grid serial number (AAAS-13031)​

This release supports adding a user grid card with a serial number. See the Administration API Guide for more information.

Splunk SIEM integration (AAAS-12161)​

This release includes an integration with Splunk SIEM to allow users to use IntelliTrust Splunk add-on on Splunkbase to pull IntelliTrust audit events into their Splunk logs.

Mobile Transaction Verification (AAAS-12127)​

TOKENPUSH and SMARTCREDENTIALPUSH Authentication APIs support adding transaction details. Mobile Push Authentication from the portal includes details about the client performing authentication, such as Location and Web Browser. See the IntelliTrust Authentication API Guide for more information.

Note: RADIUS applications do not support request details in this release.

Theme Page (AAAS-13021)​

The Theme page has been simplified.

Logo customization (AAAS-13022)​

Logo customization includes an upload button and resize and reposition options.

Change the state of individual agents (AAAS-12842)​

The Gateway Instance Details page now includes the option to enable and disable agents.

Change the state of gateway instances (AAAS-12843)​

The Gateways page now includes the option to enable and disable gateway instances.

Barracuda Web Application Firewall VPN template (AAAS-9482)​

A Barracuda Web Application Firewall template is now available. Use this application template to quickly configure Barracuda for IntelliTrust authentication.

Azure AD Conditional Access Controls (AAAS-11032)​

IntelliTrust can now be plugged in as an authentication mechanism with Azure AD using conditional access. With this feature administrators can augment their Azure AD authentication flow with IntelliTrust second factor authenticators on a per application basis.

Grid card support for IdentityGuard applications (AAAS-9804)​

IntelliTrust now supports grid card authentication for Entrust IdentityGuard integrations. You must upgrade your gateway to version 4.1 to take advantage of this feature.

Improved Gateways User Interface (AAAS-12779)​

This release introduces a new look for the gateways list. It presents the current status of all your gateways in a single, easy to use page.

TLS 1.2 Support for Radius EAP (AAAS-8834)​

The Enterprise Service Gateway now supports the use of TLS 1.2 for Radius clients using the EAP protocol such as NetMotion.

Reset Active Directory password during authentication (AAAS-10960)​

IntelliTrust users synchronized to an Active Directory can reset Active Directory password when prompted to complete a password authentication challenge. This allows users who have forgotten their password to reset it and complete the password challenge. Password reset can also be used to create a new password for those without one. IntelliTrust account settings must be modified to enable password reset. See the IntelliTrust Administrator Help for more information.

Users can self-assign grid cards (AAAS-9804)​

Users can now self-assign grid cards assigned to them by entering the grid card serial number and responding to an authentication challenge using the grid card. See the IntelliTrust User Help for more information.

Synchronize users from all directory SearchBases (AAAS-11376)​

It is now optional to specify searchbases when configuring a directory. When left blank, IntelliTrust will search all SearchBases of the directory for users. See the IntelliTrust User Help for more information.

New report Dashboard (AAAS-18138)​

The Report page has been replaced with a Dashboard page that provides details on account entitlements and audit logs. Data can be filtered by date range or keyword search. See the IntelliTrust Administrator Help for more information.

Azure AD LDAP support (AAAS-11545)​

IntelliTrust users can connect to Azure AD using LDAP and then import users from Azure AD to allow them to password-authenticate into IntelliTrust. See the IntelliTrust Administrator Help for more information.

Message of the Day (AAAS-10234)​

Administrators can customize the log in page of IntelliTrust with information for users , such as the help desk phone number, email address, and special messages. Users see the messages when they access the IntelliTrust log on page. See the IntelliTrust Administrator Help for more information.

OIDC app login into separate tab in browser (AAAS-12276)​

In previous releases, the OIDC application would open in the current tab. By default, it now opens in a new tab.

Applications that do not have a resource rule (AAAS-12542)​

The Applications List page now shows a warning icon next to applications that do not have a Resource Rule configured. By clicking the icon the user is brought to the Add Resource Rule page with that application preselected.

Grid Card enhancements (AAAS-9804)​

IntelliTrust has been enhanced to support more grid card features, including:

• Keep track of the assigned and unassigned grid cards on your account from the Grid Cards page. - Generate unassigned grid cards that can be assigned to new users. - Recycle grid cards on your account by unassigning grid cards from one user and assigning them to another.

Reset password during authentication (AAAS-10960)​

Users can reset their IntelliTrust password when prompted to complete a password authentication challenge. This allows those who have forgotten their password to reset it and complete the password challenge. Password reset can also be used to create a new password for those without one. IntelliTrust account settings must be modified to enable password reset. See the IntelliTrust Administrator Help for more information.

Run IntelliTrust Gateway on Microsoft Hyper-V Servers (AAAS-11470)​

IntelliTrust Enterprise Service Gateways can now be run on Microsoft Hyper-V using a virtual hard disk (VHD). IntelliTrust provides the VHD which is available for download from Home > Gateways List.

Integrate applications using IntelliTrust Administrator APIs (AAAS-10859)​

Administrators can integrate IntelliTrust user administration into their application by using the IntelliTrust Administrator REST APIs. Using this IntelliTrust API allows administrators to seamlessly perform administrative actions on IntelliTrust users, such as creating users and assigning authenticators, without navigating to IntelliTrust. For details on integrating using the API, see the IntelliTrust Administrator API Guide available from the help menu in IntelliTrust.

New Authenticator: Grid Cards (AAAS-9804)​

Entrust Datacard's patented grid card is a new addition to the rainbow of authenticators supported by IntelliTrust. A grid card is a low-cost and easy to use authenticator that doesn't require a mobile device or specialized hardware. Grid cards can be printed and distributed to users for authentication.

Include user-related attributes in SAML assertions and OIDC claims (AAAS-10416)​

Administrators can customize the SAML assertions and OIDC claims sent to third party applications with two additional user-related attributes. These new attributes allow you to share user group membership information and the list of authenticators used to authenticate the session with third party applications.

Migrate user authenticators from Entrust IdentityGuard to IntelliTrust (AAAS-8847)​

Authenticators configured in an Entrust IdentityGuard account can be moved to, and reused on, an IntelliTrust account. This allows those migrating from Entrust IdentityGuard to IntelliTrust to avoid paying for new authenticators. Entrust Datacard supports migrating knowledge-based authenticators (including question and answer (Q&A) pairs), assigned hardware and software tokens, and unassigned hardware tokens. Entrust IdentityGuard passwords, Token Push authenticators, Smart Credentials, Grid Cards, location history, and registered machine fingerprints cannot be migrated.

Integrate applications using IntelliTrust Authentication APIs (AAAS-10461)​

Administrators can integrate IntelliTrust authentication into their application by using the IntelliTrust Authentication REST APIs. Using the IntelliTrust API allows end users a seamless authentication experience without being redirected from the application they are trying to access. For details on integrating using the API, refer to the Developer Guide available from the help menu in IntelliTrust.

Log in using Temporary Access Codes (AAAS-10884)​

Temporary Access Codes allow users to log in when they cannot access their primary authenticators. For example, users who forget their mobile device at home can log in with a Temporary Access Code instead of using SMS OTP or Mobile Soft Token. Temporary Access Codes can be used to logon to the IntelliTrust portal, SAML applications, OpenID Connect applications and Radius integrations.

Support for encrypted SAML assertions (AAAS-10414)​

IntelliTrust now supports encrypting SAML assertions. Encrypting assertions adds an extra layer of security by making the information unreadable to anyone other than the intended SAML Service Provider. While this feature is provided generically for any SAML application, the only built-in service provider that supports this feature currently is SalesForce.

Signed SAML metadata (AAAS-10413)​

When downloading SAML metadata from IntelliTrust, it is now signed using the SAML signing certificate. SAML service providers that validate metadata signatures will have a high level of assurance that the metadata has not been tampered with.

Web proxy support added to Enterprise Service Gateway (AAAS-8783)​

The IntelliTrust Gateway has been enhanced to support outbound connections (including 443) using a web/authentication proxy. The gateway's configuration tool now includes options to set your proxy settings. See the IntelliTrust Administrator Help for instructions on configuring an Enterprise Gateway to use a proxy.

Access ADFS application using second factor authentication (AAAS-10347)​

Users can now use IntelliTrust two factor authentication to access Active Directory Federation Services (ADFS). ADFS provides single sign-on access organizational systems and applications. Additional configuration is required within the IntelliTrust and ADFS accounts to enable IntelliTrust authentication to the ADFS plugin.

Single Logout (SLO) for CitrixOnline application (AAAS-345)​

Logging out of a CitrixOnline account automatically logs the user out of their integrated IntelliTrust account. This allows users to save time by not having to log out of their CitrixOnline and IntelliTrust accounts consecutively. Logging out from an IntelliTrust account does not automatically log the user out of their CitrixOnline account.

Single Logout (SLO) for Salesforce and Office 365 applications (AAAS-345)​

Logging out of a Salesforce or Office 365 account automatically logs the user out of their integrated IntelliTrust account. This allows users to save time by not having to log out of their SAML and IntelliTrust accounts consecutively. Logging out from an IntelliTrust account does not automatically log the user out of their SAML account.

Log in to RADIUS applications using Knowledge-based authentication (KBA) (AAAS-8714)​

Applications integrated using the RADIUS Agent in the Enterprise Service Gateway can now use knowledge-based authentication (KBA). The application must be connected to an IntelliTrust gateway instance version 3.5 or later and have its resource rule configured appropriately to support knowledge-based authenticators.

Customize resource rules for the IntelliTrust user and administration portals (AAAS-9413)​

Administrators can now modify the system-defined resource rules controlling access to the IntelliTrust user and administration portals. This provides greater control over an IntelliTrust account authentication requirements. System-defined resource rules can be modified to support two-factor authentication or first-factor password authentication. They can also be modified to allow or deny access to users logging in from a specific geographic location. Additional resource rules can be created that control access to IntelliTrust based on group membership.

Support for Active Directory Lightweight Directory Services (AAAS-9082) (AAAS-9311)​

IntelliTrust now supports Active Directory Lightweight Directory Services (AD LDS) as an IntelliTrust synchronization directory. This allows users to be synchronized from AD LDS into IntelliTrust and authenticate user passwords stored in AD LDS.

Support for Desktop IdentityGuard 11.0 (AAAS-8249)​

The IdentityGuard Agent in Enterprise Service Gateway version 3.4 has been updated to include support for the V11 APIs required by Entrust Desktop IdentityGuard 11.0. With Desktop IdentityGuard 11 and IntelliTrust, you can now use Email/SMS OTP authentication while online and knowledge-based authentication while offline. IntelliTrust requires Entrust IdentityGuard Desktop 11.0 Patch 299835 or later be installed.

Knowledge-based authentication (KBA) now supported for IdentityGuard applications (AAAS-8652)​

Applications integrated using the IdentityGuard Agent in the Enterprise Service Gateway can now use Knowledge-based authentication. The application must be connected to an IntelliTrust gateway instance version 3.4 or later and have its resource rule configured appropriately to support knowledge-based authenticators.

Increased administrative role security (AAAS-9357) (AAAS-9452)​

IntelliTrust now has increased role security by allowing administrative roles to be restricted from managing accounts with administrative roles. Each role can be given the ability to manage administrators with any role or administrators with specific roles.

Support for Microsoft Office 365 desktop and mobile applications (AAAS-8939)​

IntelliTrust now supports the desktop and mobile Microsoft Office applications. The authentication requirements for logging in to the application account are controlled by the resource rule of the O365 application on IntelliTrust. This support leverages the Active Directory Authentication Libraries (ADAL) and integration through SAML to support authentication.

Provision IntelliTrust users on Box and G Suite accounts (AAAS-8659)​

IntelliTrust now supports managing users within your Box and G Suite accounts. Actions performed on IntelliTrust users are automatically performed on the users within the Box or GSuite account. Users created, deleted, or modified on IntelliTrust are automatically created, deleted, or modified on Box or G Suite. This allows for the state of IntelliTrust and Box or G Suite users to remain consistent without any administrative overhead.

Unlock mobile smart credential authenticators through facial recognition (AAAS-8946)​

IntelliTrust now supports using facial recognition to unlock mobile Smart Credential authenticators instead of using a PIN. Facial recognition is supported in the Entrust IdentityGuard Mobile Smart Credential 3.2 application installed on iOS and Android devices. IntelliTrust includes new Smart Credential authenticator settings that allow administrators to control whether facial recognition is allowed.