76 posts tagged with "Release"

IDaaS Release Notes

Release 5.40

April 2025 · 12 min read

New in this release

Device Verified Entrust Soft Token Activation

Entrust Soft Token now supports device verification during activation. When enabled, the user's device must have a device certificate issued from a trusted Certificate Authority. This feature ensures token activation occurs only on authorized devices.

Application Verified Entrust Soft Token Activation

Entrust Soft Token now supports application verification during activation. When enabled, an attestation from Apple or Google is provided that validates the mobile application performing the activation. This feature ensures token activation occurs only from trusted mobile applications.

Disallow Previously Compromised Passwords

When setting a new password, IDaaS now blocks previously compromised passwords reported by HaveIBeenPwned. This addresses a NIST recommendation for password security documented in SP 800-63B.

IDaaS provides an option in the password settings to "Allow Compromised Passwords" but Entrust recommends that customers do not use this option unless necessary. As an example, customers who have very short passwords or passwords consisting of just digits may find all possible password values are compromised.

Previously compromised passwords are disallowed by default for existing customers. This means existing end users may encounter this new behavior after IDaaS 5.40 is deployed.

OTP Delivery using WhatsApp and WeChat

IDaaS now supports OTP delivery using WhatsApp and WeChat. Customers that want to use these capabilities must provide their own WhatsApp or WeChat business account.

Token Challenge/Response Authenticator

A new Token Challenge/Response authenticator has been added to IDaaS. In Token Challenge/Response authentication, IDaaS generates a challenge that is provided to the end user. The user enters the challenge into the token, and then the token uses the challenge to generate the OTP.

Only users who have been assigned hardware tokens that support Token Challenge/Response (like Entrust CR300 tokens) will have access to the Token Challenge/Response authenticator.

Token Challenge/Response authentication is supported by all IDaaS authentication applications, including the User portal, SAML applications, OIDC and OAuth applications, RADIUS applications, and Auth API applications. For RADIUS applications, the customer must update to the 5.40 Enterprise Service Gateway. For Auth API applications, the client application must be updated to support TOKENCR.

Override Certificate Lifetime for PKIaaS

When configuring smart credential digital IDs when using a PKIaaS CA, the customer can now configure the certificate lifetime in IDaaS if they want to override the lifetime configured by their CA.

Improvements for Desktop Credential Provider Offline Token

IDaaS provides the ability for the Entrust Desktop Credential Provider to download future token responses that can be used by DCP to allow offline login. This feature has been enhanced to support download of offline token responses when token authentication was not required by the resource rule. For example, if the resource rule requires password-only for low risk and password+token for high risk, offline token responses can now be downloaded in the low risk scenario.

This feature needs the upcoming release of Entrust Desktop Credential Provider before it can be used.

Mobile OIDC Developer Guide

A new document Integrating IDaaS OIDC with a mobile app using AppAuth has been added to the IDaaS Developer Portal. This document describes how OIDC authentication using IDaaS can be added to a customer's mobile application.

Increase size of IP List

An IP List can now include up to 2000 IP addresses. Previously the limit was 500.

New Passkey/FIDO2 Algorithms

IDaaS PassKey/FIDO2 now supports the Ed25519 & RS256 algorithms. These algorithms are used by Windows Hello and some newer hardware.

Certificate Expiry Notification Improvements

The Certificate Expiry Notification email now includes more instructions including a link to the documentation describing how to update the certificates.

RADIUS Unknown User Cache Audit Changes

The audits generated by the RADIUS Unknown User Cache (introduced in 5.39) have been changed. Previously, an audit was generated for each unknown user that tried to authenticate in a given period of time. Now a single audit including a count of the number of unknown users who tried to authenticate in that period of time is generated instead.

Entrust Identity Security Whitepaper Updates

The Entrust Identity Security Whitepaper has been updated. This document can be accessed from the IDaaS Admin Portal Documentation Menu at Whitepapers > Identity as a Service Platform Security.

Fixed or changed in this release

Bulk import of unassigned grids failed. (35516, 37401)
Gateway status in Dashboard shows warning instead of error icon when the SSL certificate has expired. (37669)
User portal session timeout dialog shows negative timeout after session has expired. (34100, 38392)
RADIUS Push authentication fallback to grid not working. (37233)
Audit for change to FIDO Settings fidoRelyingPartyAllowlist showing wrong value when subdomainsAllowed is not checked. (37101)
User Portal Authenticators List Filter for Types should not include authenticators not allowed in User Portal policy. (37561)
User created by Azure synchronization is not getting provisioned by SCIM. (37769)
Clicking on the QR Code in the Google Authenticator activation email will now launch the Google Authenticator app on mobile. (37386)
Email value format is not validated in the UI if the email attribute is optional. (29804)
For SAML IDP authentication, the redirect message is not translated. (39359)
The Passkey/FIDO2 category in the Group Policy categories list is not sorted correctly. (34800)
Certificate validation added to the Directory SSL Certificate import rejects certificates with RSA-1024 and EC2 keys. These keys are now allowed. (38755)
During SAML authentication, if a user gets locked they are redirected to the IDaaS login page instead of back to the SAML service provider. (38285)
User certificate authentication failing on Mac Safari. (38761)
Test for external risk engine now returns error http_connector_execution_failed if it is unable to connect to the external risk service. Previously a general error was returned. (37965, 38495)
Password reset performed from Entrust Identity mobile app fails for passwords synchronized by AD Connector. (38081)

Changes to Identity as a Service APIs

Authentication API

The following changes have been made to support TOKENCR authentication.

The value TOKENCR has been added to the list of available authenticators. This value can be passed as an argument to userChallengeUsingPOST and userAuthenticateUsingPOST indicating which authentication type to use. It can be returned in the attributes authenticationTypes and availableSecondFactor in UserAuthenticateQueryResponse returned from userAuthenticatorQueryUsingPOST indicating which authentication types are available. The resource rules of authentication API applications that don't support TOKENCR authentication should not be configured to include TOKENCR.
The attribute challenge has been added to the model TokenChallenge. For TOKENCR authentication, this attribute includes the challenge to be entered into the token.

The following changes have been made to support OTP delivery using WeChat or WhatsApp.

The values WECHAT and WHATSAPP have been added to the attribute otpdeliveryType in the model AuthenticatedResponse.
The values WECHAT and WHATSAPP have been added to the attribute type in the model OTPContactValue.
The values WECHAT and WHATSAPP have been added to the attributes otpDefaultDelivery and availableOTPDelivery in the model OTPDetails.
The values WECHAT and WHATSAPP have been added to the attribute otpDefaultDelivery in the model UserAuthenticateQueryResponse.

These attributes specify when WeChat/WhatsApp are available to be used to deliver OTPs and to request that they be used to delivery OTPs.

The following changes have been made to support download of offline token responses.

New method POST /api/web/v1/self/tokens/offline (getOfflineTokenResponsesUsingPOST) - Given the auth token returned from a previous authentication request for an application that allows offline token download, download offline token responses for the specified token.
New model GetOfflineTokenAuthenticateParms - contains the parameters passed to the method getOfflineTokenResponsesUsingPOST.

Administration API

The following changes have been made to support managing FIDO Settings.

The method GET /api/web/v1/settings/fido (getFIDOSettingsUsingGET) has been added. This method gets the requested FIDO Settings.
The method PUT /api/web/v1/settings/fido (updateFIDOSettingsUsingPUT) has been added. This method updates the specified FIDO Settings.
New model FIDOAuthenticatorSettings. This model contains the values returned from the method getFIDOSettingsUsingGET.
New model FIDOAuthenticatorSettingsParms. This model contains the parameters passed to the method updateFIDOSettingsUsingPUT.
New model FIDOAllowedRpid. This model defines one of the attributes included in FIDOAuthenticatorSettings and FIDOAuthenticatorSettingsParms.

The following changes have been made related to Device Verification.

The attribute requireDeviceVerificationOnActivation has been added to EntrustSTAuthenticatorSettings. This setting indicates whether device verification must be performed when an Entrust Soft Token is activated.
The attribute deviceVerified has been added to Token. This setting indicates if the token was device verified during activation.

The following changes have been made related to Application Verification.

The attribute appVerificationRequired has been added to EntrustSTAuthenticatorSettings. This setting indicates whether application verification must be performed when an Entrust Soft Token is activated.
The attribute appVerificationIOSBundleId and appVerificationIOSTeamId have been added to EntrustSTAuthenticatorSettings. These settings identify the trusted Apple mobile application.
The attribute appVerificationAndroidPackageName has been added to EntrustSTAuthenticatorSettings. This setting identifies the trusted Android mobile application.
The attribute appVerified has been added to Token. This setting indicates if the token was application verified during activation.

The following changes have been made related to the Smart credential certificate lifetime feature.

The attribute lifetime has been added to DigitalIdConfigCertTemplate. This setting indicates the lifetime (in months) to use when requesting certificates from the CA if the default lifetime is not used.
The attribute useCaDefaultCertLifetime has been added to DigitalIdConfigCertTemplate. This setting indicates if the CA default certificate lifetime should be used.

The following changes have been made related to Face Biometric authenticators.

The method POST /api/web/v1/users/{userid}/face (createFaceUsingPOST) has been deprecated.
The method POST /api/web/v2/users/{userid}/face (createFaceAuthenticatorUsingPOST) has been added. This method is used to create a new Face Biometric authenticator and replaces createFaceUsingPOST.
New model FaceCreateResponse. This model contains the response from createFaceAuthenticatorUsingPOST.
The attribute returnQRCode has been added to FaceCreateParms. This setting indicates if a QR code used to launch Face Biometric authenticator registration should be returned.

The following changes have been made related to TOKENCR authentications.

The value TOKENCR has been added to the attributes idpLoginSecondStep and userLoginSecondStep in the models AuthenticationFlow and AuthenticationFlowParms. These attributes specify when the authenticator TOKENCR is allowed in an authentication flow.
The value TOKENCR has been added to the attributes highRiskSecondStep, mediumRiskSecondStep, and lowRiskSecondStep in the models ResourceRule and ResourceRuleParms.
The value TOKENCR has been added to the attribute authenticators in the model PasswordResetSettings. This model lists authenticators that can be used for password reset.
The value TOKENCR has been added to the attribute lockedAuthenticatorTypes in the model User. This attribute lists locked out authenticators for a User.
The value TOKENCR has been added to the attribute type in the model UserAuthenticatorLockoutStatus. This model provides details about authenticator lockout status for a User.

The following changes have been made related to supporting WeChat/WhatsApp for OTP delivery.

The values WECHAT and WHATSAPP have been added to the attribute otpDefaultDelivery in the model OTPAuthenticatorSettings. This attribute specifies the default OTP delivery type.
The attributes otpWechatDefaultDeliveryAttribute and otpWhatsappDefaultDeliveryAttribute have been added to the model OTPAuthenticatorSettings. These attributes specify the user attribute to use by default for OTP delivery using WeChat or WhatsApp.
The values WECHAT and WHATSAPP have been added to the attribute otpDeliveryType in the model OTPCreateParms. This attribute specifies how an OTP is delivered when an OTP is created if delivery is enabled.
The values WECHAT and WHATSAPP have been added to the attribute name in the model OTPDeliveryMethod. This model is used to define the allowed delivery methods in OTPAuthenticatorSettings.
The values OTP_WECHAT and OTP_WHATSAPP have been added to the attribute type in the model OTPVerificationChallengeValue. This model is passed as an argument to the method contactVerificationChallengeUsingPOST to validate the value for a user contact attribute.
The values OTP_WECHAT and OTP_WHATSAPP have been added to the attribute type in the models UserAttribute, UserAttributeParms, and UserExtraAttribute. These values specify the type of user attribute used to store a WeChat or WhatsApp contact value.

Supported TLS Ciphers

IDaaS supports the following TLS Ciphers.

TLSv1.3:

TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)

TSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)

Clients should stop using the following TLS Ciphers. Support for them will be removed in a future release.

TLSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.40 and the three previous releases 5.37, 5.38, and 5.39). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

In-place upgrade of the ESG is only supported for versions 5.33 or later. Versions of ESG older than 5.33 are no longer supported. To upgrade versions of ESGs older than 5.33 to the new version, use the following procedure:

Download the latest Gateway OVA or Hyper-V file from IDaaS and install on a new VM instance.
Add a new Gateway instance to the existing Gateway in IDaaS.
Register the new Gateway instance with IDaaS.
Disable the old Gateway instance.
Repeat these steps to replace all the Gateway instances that use older versions of the ESG.

Once the upgrade is complete, the Gateway instances corresponding to the old ESGs can be deleted from IDaaS and the VMs for those ESG instances can also be deleted.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service ceased support for Internet Explorer 11 after May 2023.

Release 5.39

February 2025 · 14 min read

New in this release

Locking and Removal of Production Accounts with Expired Entitlements

Starting in this release, production accounts will be locked when their entitlements expire and removed after 6 months if the entitlement has not been renewed. IDaaS will send notification emails to account owners when entitlements approach the expiry date and then when they expire.

Customers can view the status of their account entitlements by clicking on the Entitlements icon on the Administration Portal Dashboard.

The default Customer Support Agent service provider administrator role has been modified to include permission to modify entitlements. This allows a support agent to address customer entitlement issues if their entitlement has expired.

SMS/Voice Entitlements Are Required

Starting in this release, entitlements are required to use SMS/Voice delivery for OTPs. Previously, accounts without an entitlement were allowed to use SMS/Voice delivery. Email delivery of OTPs does not require an entitlement.

Customers can view the status of their account entitlements by clicking on the Entitlements icon on the Administration Portal Dashboard.

SAML Identity Providers

IDaaS can be configured to support SAML Identity Providers in addition to the currently supported OIDC Identity Providers. The following are included as part of this new feature:

An Authentication Flow that enables identity providers to select either OIDC or SAML identity providers, or both.
Global and Group-Based User Verification Policies that configure identity providers can select either OIDC or SAML identity providers, or both.

Flexible External Risk Engines

A new external risk engine type has been added to IDaaS. The new risk engine type allows the customer to integrate 3rd-party external risk engines into IDaaS with a no-code solution. IDaaS supports third-party risk engines that accept HTTPS requests and returns the risk results as a JSON formatted response.

Pass-through Authenticator

A new pass-through authenticator type has been added to IDaaS allowing the customer to integrate third-party authenticators into IDaaS with a no-code solution. The pass-through authenticator forwards the authentication requests from IDaaS to a customer-operated authentication service. This feature allows a customer to integrate an application using the IDaaS authentication API with existing authentication services.

Group Attribute Support

An attribute can be defined for IDaaS groups. This attribute can be mapped into SAML assertion attributes and OIDC claims depending on the group membership of the authenticating user.

These new capabilities include support for the Danish OIOSAML Web SSO Profile 3.0 for interoperation with Kombit Context Handler 2. Information defining privilege and constraint information can be defined in the IDaaS group attribute. This information can be encoded and returned in a SAML assertion as defined in OIOSAML and returned to Kombit Context Handler 2.

When defining a SAML attribute, the NameFormat can now be specified. Previously it was left undefined. This is required for OIOSAML but is applicable to any SAML attribute.

Maximum Password Length Policy

A new maximum password length policy has been added to Password settings. When set, this policy enforces the maximum length of the user's password when a new password is set. By default, IDaaS does not enforce a maximum password length.

A customer may want to enforce a maximum password length if they have clients that cannot accept longer passwords.

Outbound SCIM Provisioning Enhancements

Previously, IDaaS outbound SCIM provisioning only supported OAuth to authenticate to the service to which users were provisioned. Now, IDaaS also supports authentication using API keys.

Improved User/Audit Searching for Large Customers

For large customers, the list/search operations in the Administration portal have been redesigned to avoid timeouts that may be encountered. These issues are more likely when complicated search criteria are specified. The user experience of the administrator using the Administrator portal is unchanged.

Webhooks for User Creation

IDaaS now supports webhooks where IDaaS will send a signal to an external service when an event happens. In this release, webhooks are supported for user create events.

IDaaS JWT OIDC Grant Type

A new IDaaS JWT grant type has been added to OIDC and OAuth applications. This grant type allows a customer application to use the IDaaS authentication API to authenticate a user. When using this grant type, the client application does the following:

Calls the OIDC/OAuth authorize endpoint to begin authentication specifying the new grant type. This will return an authRequestKey value.
Calls the IDaaS authentication APIs to authenticate the user. The authRequestKey is passed as an argument. The authentication API will return an IDaaS JWT when the user is authenticated.
Calls the OIDC/OAuth token endpoint to get an OAuth access token. The IDaaS JWT and authRequestKey are passed as arguments. This call returns an OAuth access token that can be used to interact with the customer's backend service.

This new grant type provides the following capabilities not available with standard OIDC:

The customer can implement their own authentication UI allowing them to customize the UI to meet their requirements.
The customer can access IDaaS risk authentication capabilities, such as transaction verification that require customer transaction values to be provided. When transaction values are provided, the returned OAuth access token can be configured to include these transaction values as a claim.

RADIUS Agent Caching

Recently some IDaaS customers have experienced attacks on their VPN servers where bad actors perform large numbers of authentication attempts using the same userid and different passwords in an attempt to find a valid userid and password. The error returned from IDaaS does not indicate if the error is because the user does not exist or if the password was invalid. This means that these attacks generate large numbers of IDaaS requests resulting in unknown user errors.

For customers whose VPN server or network infrastructure does not provide capabilities to filter out these kinds of requests before they reach the IDaaS RADIUS agent and then IDaaS, the IDaaS RADIUS agent now provides the following caches to block this traffic before it reaches IDaaS:

An unknown user cache that blocks RADIUS authentication requests with a userid that previously generated a user not found error.
A client IP rate limiter that restricts the number of RADIUS authentication requests that will be accepted from a client IP address.

For customers that allow this traffic to reach IDaaS, Entrust may be forced to rate limit the authentication traffic for that account. This rate limiting would block both valid and invalid authentication requests.

Customers will need to upgrade to the 5.39 version of the Enterprise Service Gateway to have these features available.

Token Delete Bulk Operation

A new bulk operation to delete tokens has been added.

The menu search capability now supports all levels of the Administrator portal menu instead of just the top level menus. The menu search field has been moved to the menu.

IDaaS Logo Change

The IDaaS logo displayed by default on the login page has changed.

Service Provider Tenant Management Improvements

When a service provider configures a tenant for tenant management, there is now an option to select the OIDC key/certificate to be used.

Improved OIDC Error Information

OIDC requests that fail due to configuration issues or due to unsupported requests now return additional information to the client in the error description indicating the cause of the error.

New Integrations

The following integrations have been added.

A new SAML application template for Bonusly.
A new SAML application template for ProdPad.

Fixed or changed in this release

The Save button should be disabled in the password change UI if the New Password matches the Current Password. Submitting the request results in a server error as expected. (10826, 36622)
User search criteria in the Administrator portal should not display the Organization filter for administrators who do not have permission to view Organizations. (37314)
Changes to the Geolocation allow list in resource rules were not saved. (37856)
User Certificate was missing from the User Authenticator Notifications settings. (37159)
Allow the default OIDC certificate to be deleted if it is not used, and it is not the only OIDC key. (37728)
Edit the Tenant Management configuration for a tenant from a service provider fails. (37982)
The User Attributes VIEW permission has been added to the default SCIM Provisioning role. (37596)
Remove sample values of API keys from IDaaS OpenAPI files. These sample values trigger customer vulnerability scanners. (38107)
If Face Biometric registration is cancelled during User Registration it is marked complete. (37747)
OIDC Server Application should not have the Show Login Redirect URL in My Profile option. (37646)
Administrator in Helpdesk role was not allowed to remove groups from a user. (37459)
Japanese version of Reset Password email is missing text. (10566)
Localized versions of User State Change email contains English text. (33749)
User created in IDaaS after authentication from an Identity Provider is ignored by SCIM outbound provisioning. (37635, 38082)
If creation of a user in IDaaS after authentication from an Identity Provider fails, authenticators created for that user are left behind. (37636)
Delete users bulk operation fails with "Bulk operation already started" error. (37353)
When entering the name of an Organization, the UI does not validate if the name is a duplicate. This results in an error being returned from the server. (36439)
Encoding smart credentials on YubiKey tokens with firmware version 5.7.1 or greater fails. (37412)
In the Administrator Portal, the list of groups to add to a user were not sorted. (37408)
When the Directory configuration has a list of SSL certificates, it now indicates which SSL certificate is being used. (37619)
Unlocking a user fails if the user was locked out due to User Certificate authentication failure. (37153)
Audits without an Error Description display a value of undefined. (37315)
Smart credential encoding fails for PKIaaS CAs when the smart credential definition only specifies one digitalId Config. (38121)
Magiclink fails when case of provided email address differs from user's email address. (38391)

Changes to Identity as a Service APIs

The CSharp SDK dropped support for .NET 6.0 in this release.

Authentication API

The following changes have been made to support the Pass-through Authenticator.

The following models have been added:

PassthroughAuthenticationResponse. This model defines information returned to the client application from a pass-through authenticator. It consists of a list of PassthroughAuthenticationResultItems. The list of items returned is defined in the Pass-through Authenticator configuration in IDaaS.
PassthroughAuthenticatorParms. This model defines information passed from the client application to the pass-through authenticator. The model consists of a list of PassthroughAuthenticatorPlaceholder. The Pass-through Authenticator configuration in IDaaS specifies how these values are mapped into the requests sent to the Pass-through Authenticator.

The following models have been updated:

The attribute passthroughAuthenticationResponse has been added to AuthenticatedResponse. This attribute contains the information returned to the client application from a pass-through authenticator.
The attribute passthroughAuthenticatorParms has been added to UserChallengeParameters and UserAuthenticateParameters. This attribute contains the information passed from the client application for a pass-through authenticator.

The following changes have been made to support the IDaaS JWT OIDC Grant Type.

The following models have been updated:

The attribute authRequestKey has been added to UserAuthenticateQueryParameters. This attribute is provided by the OIDC/OAuth authorize endpoint when using the IDaaS JWT grant type and is required to use the IDaaS authentication APIs for that grant type.
The attribute maxAge has been added to UserAuthenticateQueryParameters. If an existing authToken is provided, the maxAge parameter can be used to indicate if re-authentication is required for an authentication. If the specified requestTime (or current system time if requestTime is not specified) is more than maxAge seconds after the time which the authToken was issued then re-authentication will be required.
The attribute requestTime has been added to UserAuthenticateQueryParameters. Used when comparing maxAge to the authToken issue time to determine if re-authentication is required. If not specified, the system current time is used.
The attribute authRequestKey has been added to UserAuthenticateParameters. This attribute is provided by the OIDC/OAuth authorize endpoint when using the IDaaS JWT grant type and is required to use the IDaaS authentication APIs for that grant type.

Administration API

The following models related to authentication flows have been updated:

An attribute identityProviderIds has been added to AuthenticationFlowParms. This value specifies the identity providers associated with the authentication flow. The attribute oidcIdentityProviderIds has been deprecated.
An attribute identityProviders has been added to AuthenticationFlow. This value specifies the identity providers associated with the authentication flow. The attribute oidcIdentityProviders has been deprecated.

The following APIs have been added to manage identity providers:

GET /api/web/v1/identityproviders (listIdentityProvidersUsingGET) - List identity providers.

The following models related to identity providers have been added:

IdentityProvider - The results returned from the list API.

The following APIs have been added to manage SAML identity providers:

GET /api/web/v1/identityproviders/saml (listSamlIdentityProvidersUsingGET) - List identity providers.
POST /api/web/v1/identityproviders/saml (createSamlIdentityProviderUsingPOST) - Create an identity provider.
DELETE /api/web/v1/identityproviders/saml/{id} (deleteSamlIdentityProviderUsingDELETE) - Delete an identity provider.
GET /api/web/v1/identityproviders/saml/{id} (getSamlIdentityProviderUsingGET) - Get an identity provider.
PUT /api/web/v1/identityproviders/saml/{id} (updateSamlIdentityProviderUsingPUT) - Modify an identity provider.

The following models related to SAML identity providers have been added:

SamlIdentityProviderParms - The parameters passed to the create and update APIs.
SamlIdentityProvider - The results returned from the create, get, list, and update APIs.

The following models related to webhooks have been added:

WebhookParms - The parameters passed when creating or updating a webhook.
Webhook - The parameters returned when listing or getting a webhook.
WebhookEvent - Specifies the event types supported by the webhook. Currently for IDaaS, this will always be user.create.

The following APIs have been added to manage Webhooks:

GET /api/web/v1/webhooks (getWebhooksUsingGET) - List all webhooks.
POST /api/web/v1/webhooks (createWebhookUsingPOST) - Create a webhook.
POST /api/web/v1/webhooks/test/{id} (testWebhookUsingPOST) - Test a webhook by trying to deliver a dummy payload.
GET /api/web/v1/webhooks/{id} (readWebhookUsingGET) - Get the specified webhook.
PUT /api/web/v1/webhooks/{id} (updateWebhookUsingPUT) - Update the specified webhook.
DELETE /api/web/v1/webhooks/{id} (deleteWebhookUsingDELETE) - Delete the specified webhook.

The following change has been made to other models:

The attribute 'maximumLength' has been added to UserPasswordSettings which defines the maximum length of the password.
The attribute attribute has been added to Group and GroupParms which provides access to the attribute value associated with a group.

Supported TLS Ciphers

IDaaS supports the following TLS Ciphers.

TLSv1.3:

TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)

TSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)

Clients should stop using the following TLS Ciphers. Support for them will be removed in a future release.

TLSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.39 and the three previous releases 5.36, 5.37, and 5.38). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

Download the latest Gateway OVA or Hyper-V file from IDaaS and install on a new VM instance.
Add a new Gateway instance to the existing Gateway in IDaaS.
Register the new Gateway instance with IDaaS.
Disable the old Gateway instance.
Repeat these steps to replace all the Gateway instances that use older versions of the ESG.

Once the upgrade is complete, the Gateway instances corresponding to the old ESGs can be deleted from IDaaS and the VMs for those ESG instances can also be deleted.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service ceased support for Internet Explorer 11 after May 2023.

Release 5.38

January 2025 · 6 min read

New in this release

Identity Verified Activation of Entrust Soft Tokens

IDaaS can be configured to require users to perform Face Biometric authentication when activating an Entrust Soft Token. Identity verification ensures that the expected user is activating the soft token.

Passkey/FIDO2 Enhancement to Block Synced Passkeys

Passkey/FIDO2 policy can now be configured to block synced passkeys from being registered. Customers may want to only allow their users to use passkeys, such as physical FIDO2 tokens, whose keys are not backed up to the cloud.

Locking and Removal of Production Accounts With Expired Entitlements

Starting in 5.39 release, production accounts will be locked when their entitlements expire and removed after 6 months. Accounts with entitlements that have already expired will be immediately locked and then removed after 6 months. IDaaS will send notification emails to account owners when entitlements approach the expiry date and then when they expire.

In 5.38, the expiry notifications will be sent to account owners, but the accounts will not be locked.

Identity Proofing Management Removed

The identity proofing management capabilities have been removed.

Directory and Gateway SSL Certificate Enhancements

The following enhancements related to SSL Certificate configuration have been made for Directories and Gateways that have SSL configured:

The Directories and Gateways tiles on the dashboard indicate if any SSL certificates are expired.
The status of the SSL certificate is shown in the Directory list.
A new View SSL Certificates action is available that shows a list of all SSL certificates configured for the directory.
A new View SSL Certificate action is available for each Gateway instance.
Certificate expiry notification emails sent by IDaaS now include notifications for Directory and Gateway SSL Certificates.

New Integrations

The following integrations have been added.

A new SAML application template for Keeper Security.
A new SAML application template for LeaveWizard.
A new SAML application template for ShareFile.

Fixed or changed in this release

ESG log not rolling over causing disk to fill. (37181, 37320)
ESG disks partition for /opt too small. Customers will need to reinstall ESG for this fix to apply. (37239)
When OTP Voice delivery is used, the wrong type displays on the user's login page. (37330, 37406)
The X-Xss-Protection header is no longer included in IDaaS API responses. (37455)
The sample value for the machine fingerprint value in the API was incorrect. (37329)
Validation of device certificate fails if it contains a ExtendedKeyUsage value marked critical. (36968)
Address issues with SCIM user provisioning. Some errors were not properly handled resulting in the operation not completing and preventing future operations from starting. (37187, 37228, 37240, 37262, 37305)
Enhance the User Authenticator Update email notification so that it can distinguish between an authenticator being locked and a user being locked. (37481)
Customized name for Google Authenticator is HTML encoded. (37531)
Face Biometric activation audit is missing mobile platform. (37261)
Group policy category list in Admin portal not sorted. (37238)
Face Biometric push transaction details are not translated. (37236)
Microsoft Azure AD has been renamed to Microsoft Entra ID. (37529)
Missing error message if Face Biometric authentication times out. (36456)
Save user profile with alias generates blank error message. (37302)
Password reset dialog has two scrollbars for some locales. (37223)
Pressing User Certificate login button twice generates an error. (37100)
Group names not sorted in Group Policies list. (36963)
Add extra contact info entry in Admin portal is too short. (36679)
When editing an application, the Next button should not be enabled if all authentication flows are disabled. (35322)

Changes to Identity as a Service APIs

Administration API

ID Proofing capabilities have been removed from IDaaS. The following methods have been removed from the Administration API.

idProofingInitUsingPOST (POST /api/web/v1/idproofing/init).
idProofingImageUsingPUT (PUT /api/web/v1/idproofing/{requestId}/image/{side}).
idProofingCompleteSelfieUsingPUT (PUT /api/web/v1/idproofing/{requestId}/completeselfie).
idProofingCompleteUsingPUT (PUT /api/web/v1/idproofing/{requestId}/complete).
idProofingRequestUsingGET (GET /api/web/v1/idproofing/{requestId}).
idProofingRequestsPagedUsingPOST (POST /api/web/v1/idproofing).

Token activation for Google Authenticator has been enhanced to support activation of a token with a specified token secret. This allows a customer to import existing Google Authenticator tokens into IDaaS. The following model has been changed.

The attribute secret has been added to ActivateParms. If specified when activating a token, this attribute specifies the seed of a token.

Methods used to configure the Onfido account used for Face Biometric authenticator have been added to the Administration API. The following changes have been made.

The method getFaceAccountSettingsUsingGET (GET /api/web/v1/settings/face/account) has been added. This method fetches the current Onfido account settings.
The method setFaceAccountSettingsUsingPUT (PUT /api/web/v1/settings/face/account) has been added. This method updates the Onfido account settings.
The model FaceAccountSettings has been added. This model contains the Onfido account settings.

Supported TLS Ciphers

IDaaS supports the following TLS Ciphers.

TLSv1.3:

TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)

TSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)

Clients should stop using the following TLS Ciphers. Support for them will be removed in a future release.

TLSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.38 and the three previous releases 5.35, 5.36, and 5.37). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

Download the latest Gateway OVA or Hyper-V file from IDaaS and install on a new VM instance.
Add a new Gateway instance to the existing Gateway in IDaaS.
Register the new Gateway instance with IDaaS.
Disable the old Gateway instance.
Repeat these steps to replace all the Gateway instances that use older versions of the ESG.

Once the upgrade is complete, the Gateway instances corresponding to the old ESGs can be deleted from IDaaS and the VMs for those ESG instances can also be deleted.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service ceased support for Internet Explorer 11 after May 2023.

Release 5.37

October 2024 · 11 min read

New in this release

Face Biometric Authentication with Entrust Identity Mobile

The IDaaS Face Biometric Authenticator has been enhanced to support Face Biometrics registered and authenticated from the Entrust Identity Mobile application. Face Biometric authenticators managed on the Entrust Identity Mobile application can be configured so that the user's biometric information is stored on the mobile device rather than in the Onfido cloud.

Face Biometric authentication using the Entrust Identity Mobile app has a user experience similar to token push authentication.

The user gets a notification on the mobile device.
The mobile app is launched.
From the mobile app, the user performs a workflow that does a motion capture of the user's face.
The user is authenticated if the motion capture matches their previously registered biometric.

Face Biometric authentication has the option to include a mutual authentication challenge to prevent the user from accidentally responding to an attacker's authentication request.

User Certificate Authentication Matching Policy Update

IDaaS has enhanced its User Certificate Authentication matching policy, enabling fine-grained control for user matching. The new settings allow the configuration of one-to-one mappings between certificate components and user attributes.

The list of supported certificate components has been expanded to include both strong and weak components:

Strong components: securityId, sha256PublicKey, subjectKeyIdentifier, serialNumber
Weak components: commonName, rfc822Name, userPrincipalName, directoryName, subjectDN

Entrust highly recommends using strong components for user matching. When only weak components are configured, all matching rules must be satisfied to successfully authenticate a user.

In addition, the settings support specifying mandatory and prohibited certificate policy OIDs, ensuring that only certificates with the appropriate policies can be used. This applies to both certificates issued by trusted Certificate Authorities and IDaaS-issued smart credentials.

Support for Entrust Identity Mobile Features

The following changes have been made to IDaaS to support new functionality in Entrust Identity.

The latitude and longitude of push notification transactions are included in the information sent to the mobile app so that it can display the location from which the transaction was launched.
A new policy "Allow Device Biometric Authentication" has been added for Entrust Soft Tokens. This allows an administrator to disable the use of the device biometric for unlocking the mobile app.

User Portal / Admin Portal Enhancements

An end user can select favorite applications in the user portal. Favorite applications are displayed first on the Applications page.

The admin portal has been enhanced to support searching the menu.

Microsoft Entra ID Read-Only Authorization

When adding a Microsoft Entra ID directory to IDaaS for user synchronization, the option to select Read-Only Authorization is provided.

Authentication Notification Enhancements

When enabling User Authenticator Notifications, the administrator can now select which authenticators cause notifications.

FIDO/Passkey Enhancements

FIDO/Passkey authenticators now support subdomains for Relying Party IDs. For example, IDaaS can be configured so that an authenticator registered from register.mydomain.com can be used to authenticate from authenticate.mydomain.com. The Allowed Relying Party ID hostnames policy allows subdomains to be specified.

SAML/OIDC Enhancements

The following enhancements have been made for SAML and OIDC applications

When configuring a SAML application, a new setting, SAML Max Authentication Age, can be specified. If configured, this setting specifies the maximum time before a user needs to reauthenticate.
The ForceAuthn parameter in SAML authentication requests is now supported. If set to true, reauthentication by the user will be required.
SAML ForceAuthn or OIDC max_age in a request that force a re-authentication will now preserve an existing IDaaS session.
Resource rules that disable SSO no longer apply to reauthenticating the same SAML or OIDC application. Setting the application max authentication age to 0 will disable SSO for the application.
If the IDP max authentication age is configured, then a SAML ForceAuthn or OIDC max _age request is propagated to third-party IDPs. The smaller value is used.
A new option "Include Authentication Claims" has been added to the OAuth Resource Server configuration. If enabled The acr, amr, and auth_time claims are included in the OAuth access token.
A new option "Show Login Redirect URL in My Profile" has been added to OIDC applications. This setting controls whether the OIDC application with the redirect URL displays in the User portal.
OIDC applications with an expired or expiring certificate are now flagged with an icon in the Application List page.
When SAML attribute encryption is enabled for a SAML application, the default algorithm is now RSA-OAEP instead of RSA version 1.5.

Token Report Enhancements

The token report now includes additional fields, including the platform for Entrust Soft Tokens and an indication of whether the token supports push notification.

Service Provider Role Updates

Permission to delete tenants has been added to the Service Provider On-boarding Administrator role.

New Integrations

The following integrations have been added.

A new SAML application template for Air.
A new SAML application template for Druva.
A new SAML application template for Freshworks.
A new OIDC application template for Freshworks.

Fixed or changed in this release

The FIDO/Passkey authenticator can now be chosen when configuring resource rules for IDaaS ADFS, IDaaS Apache Filter and IDaaS ISAPI application. (35988)
Add missing descriptions for various Email Template variables. (34070, 34069)
Generate audits for Onfido configuration errors detected when performing Face Biometric operations. (37017)
Improve wording of user/authenticator unlock notification email. (36506)
Audit for user portal settings change should not include settings that have not changed. (36654)
User provisioning using SCIM is now supported for accounts with the PLUS bundle. (36658)
Fix broken links and misleading steps in the Microsoft Entrust ID EAM integration guide. (36805)
Password expiry notification option to mobile should only be available when the user has a token supporting push notification. (34479)
When an option attribute is modified for a user synchronized from AD, the Security ID attribute gets modified to null. (34634)
In the User portal, step-up authentication should not be required to view the details of a Face Biometric authenticator. (36292)
The Dashboard shows the wrong count for expired applications if both OIDC and SAML applications have an expired certificate. (36445)
The SecurityID attribute can be modified using the Admin API when it is mapped from the directory. (34403, 33806)
The Option to add an Entrust Soft Token from the User portal was erroneously disabled when user was locked but lockout was expired. (36692)
IDaaS ESG package registry now includes net-snmp and net-snmp-utils for customers who want to install and configure these packages. (36882)
Offline tokens with Entrust Identity Desktop Credential Provider did not work for the Google Authenticator. (35917)
IDaaS Administration Guide now includes a description of the attributes that can be included in an audit. (36808)
Entrust Soft Token activation audit now includes the platform of the mobile device. (36302)
Add Face Biometric authenticator audit now includes state attribute. (36478)
Option to set Face Biometric authenticator expiry date to Never should not display a date. (36716)
Creating a domain-based Identity Provider is missing the option to select other Identity Providers. (36739)
Identity Provider initiated log in not showing organizations. (36665)
When configuring a Microsoft EAM OIDC application, the JSON configuration is missing the default application ID. (37164)

Changes to Identity as a Service APIs

Authentication API

The following changes have been made to the authentication API to support the enhancements made to Face Biometric authentication.

The following changes have been made to existing models:

the attribute pushMutualChallenge has been added to the models AuthenticatedResponse and UserAuthenticateQueryResponse. This value contains the mutual authentication challenge that should be displayed to the user. This attribute applies to both token and face biometric authentication. This attribute replaces the existing attribute tokenPushMutualChallenge which still exists in both models but has been deprecated.
the attribute pushMutualChallengeEnabled has been added to the models UserAuthenticateQueryParameters and UserChallengeParameters. This value indicates if the client supports mutual authentication challenges. This attribute applies to both token and face biometric authentication. This attribute replaces the existing attribute tokenPushMutualChallengeEnabled which still exists in both models but has been deprecated.
the following changes have been made to FaceChallenge: - the attribute applicantId has been removed. It was not used in previous releases. - the attribute device has been added. This attribute indicates if the Face Biometric was registered on WEB or MOBILE. - the attributes id and qrCode have been added. These attributes are not used for authentication. - the attributes sdkToken and workflowRunId remain. When authenticating for a mobile Face Biometric authenticator, the sdkToken will be null and the workflowRunId will be the transactionId used to call the authenticate complete method to get the authentication response.

In addition to the changes made to support the enhancements to Face Biometric authentication, the following changes have also been made to the authentication API.

The following method deprecated in an earlier release has been removed:

requestPasskeyChallengeUsingPOST (POST /api/web/v1/authentication/passkey)

The following model deprecated in an earlier release has been removed:

PasskeyChallengeParameters

The following changes to existing models have been made:

the attribute registeredCredentialsNameshas been added to FIDORegisterChallenge. This attribute specifies the names of FIDO tokens already registered to the user.

Administration API

The following changes have been made to the administration API to support the enhancements made to Face Biometric authentication.

The following method has been added:

sendFaceActivationEmailUsingPUT (PUT /api/web/v1/face/{faceid}/activation). This method sends an email containing a QR code or link used to launch Face Biometric authenticator activation in the mobile app.

The following changes have been made to existing models:

the following attributes have been added to FaceAuthenticator - created - the date the authenticator was created. - lastUsed - the date the authenticator was last used for authentication. - mobile - a flag indicating if the authenticator was registered in the mobile app. - serialNumber - an external identifier for the Face Authenticator.
the attribute deliverActivationEmail has been added to FaceCreateParms. This flag indicates if an activation email will be sent when a Face Authenticator is created.
the attribute id has been added to FaceUpdateParms. This attribute specifies which Face Biometric authenticator is to be updated. If not specified and the user has a single Face Biometric, that authenticator will be updated. If the user has multiple authenticators, an error will be returned.
the attribute maxFacesPerUser has been added to GeneralSettings. This policy specifies the maximum number of Face Biometric authenticators a user can have.

In addition to the changes made to support the enhancements to Face Biometric authentication, the following changes have also been made to the administration API.

The following method has been added:

deleteTenantEntitlementUsingDELETE (DELETE /api/web/v4/tenants/{tenantid}/entitlements/{type}). This method deletes the specified entitlement from the specified tenant of a service provider.

The following changes to existing models have been made:

The attribute subscriptionLineId has been added to Entitlement. This setting is used internally for configuring entitlements of an account.
The attribute allowDeviceBiometric has been added to EntrustSTAuthenticatorSettings. This setting specifies if an end user is allowed to use the device biometric to unlock the Entrust Soft Token in the Entrust Identity mobile app.
The attribute registeredCredentialsNameshas been added to FIDORegisterChallenge. This attribute specifies the names of Passkey/FIDO2 tokens already registered to the user.
The attribute overageType has been added to SmsVoice. This setting is used internally for configuring SMS/Voice entitlements of an account.
The attribute deleteEntitlement has been added to SmsVoiceParms. This setting is used internally for configuring SMS/Voice entitlements of an account.

Supported TLS Ciphers

IDaaS supports the following TLS Ciphers.

TLSv1.3:

TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)

TSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)

Clients should stop using the following TLS Ciphers. Support for them will be removed in a future release.

TLSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.37 and the three previous releases 5.34, 5.35 and 5.36). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

ESG was updated to use a new OS in 5.33. In place upgrade of ESG is only supported for versions 5.33 or later. Versions of ESG older than 5.33 are no longer supported. To upgrade versions ESGs older than 5.33 to the new version use the following procedure:

Download the latest Gateway OVA or Hyper-V file from IDaaS and install on a new VM instance.
Add a new Gateway instance to the existing Gateway in IDaaS.
Register the new Gateway instance with IDaaS.
Disable the old Gateway instance.
Repeat these steps to replace all the Gateway instances using older versions of the ESG.

Once the upgrade is complete, the Gateway instances corresponding to the old ESGs can be deleted from IDaaS and the VMs for those ESG instances can be deleted.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service ceased support for Internet Explorer 11 after May 2023.

Release 5.36

August 2024 · 9 min read

New in this release

Organizations

IDaaS has been enhanced to support organizations. An IDaaS user can belong to one or more organizations. When the user authenticates using a SAML or OIDC application, the authentication response indicates the organizations to which the user belongs. When a user belongs to multiple organizations, they are also asked to select the organization they are accessing.

Customer applications that support multiple tenants can map their tenants to IDaaS organizations and use this information to determine which tenant the authenticating user is accessing.

Domain-based Identity Provider Selection

Third-party Identity Providers can be configured to be associated with domains.

When an IDaaS authentication flow is configured to support external Identity Providers, they can be configured to use the external Identity Providers associated with a user's domain.

This allows a customer to define a single authentication flow that applies to users using different Identity Providers based on the user's domain.

Face Biometric Authenticator using Onfido

A new authenticator "Face Biometric" has been added to IDaaS. This authenticator uses Onfido technology to perform strong biometric authentication of a user. The Face Biometric authenticator is available when authenticating to SAML and OIDC applications, and to the IDaaS portal.

Step-up authentication for User Portal Update Operations

When configuring the resource rules for the User portal, a separate resource rule can now be specified for User portal update operations. This allows the customer to require separate authentication before a user is allowed to modify their user profile or manage their own authenticators.

User Portal Configuration Enhancements

The User portal can now be configured to restrict the actions are available to the end users. Additionally, the User portal configuration has been reorganized so that all the settings are accessed from the new Policies > User Portal menu.

SAML Enhancements

SAML IDP initiated authentication has been enhanced so that the request can specify the Service Provider the user is authenticated to using the Service Provider Entity ID and the Relay State (if required) by Relay State value. The URL would have the following format.

https://<tenant>/api/saml/SAML2/SSO?spentityid=<spentityid>&RelayState=<RelayState>

This feature allows a customer to generate IDP URLs that can be bookmarked.

Bulk Enhancements

A new bulk operation to delete grids has been added to IDaaS. This bulk operation can delete either assigned or unassigned grids.

Upcoming Cross-Origin Requests (CORS) Handling Changes

IDaaS will be making the following changes to how CORS is handled in IDaaS in a future release. In 5.36, IDaaS will track invalid requests and Entrust will notify customers that will be impacted by these changes.

IDaaS will reject requests that contain an Origin header with a value of null.
The IDaaS Configuration setting "Enable CORS" will be enabled by default meaning that applications that are making cross-origin requests to IDaaS APIs will need to define the list of allowed origins in IDaaS CORS configuration.

Service Provider Management Removed

The service provider management capabilities supported for Google and Box have been removed. User provisioning is now supported using SCIM.

New Integrations

The following integrations have been added.

A new SAML application template for Alibaba Cloud.

Fixed or changed in this release

5.36.1 Patch

OTP authentication for step-up authentication fails under some conditions. (36822)
Default value of IDaaS Face Biometric Authentication Input Name policy does not match new Onfido value for default workflows. (36770)
IDaaS does not accept some valid values for Onfido API key when configuring Onfido. (36883)
When changing Onfido API key or Web Hook token configuration in IDaaS the wrong value is saved unless both values are changed. (36721)
Access to the User Portal Entrust Soft Token activate/reactivate operation now requires the Entrust Soft Token Edit permission instead of the Add permission. This means the user portal can be configured to allow end users to activate or reactivate existing tokens without allowing them to create new tokens. (36908)

5.36

When configuring the network proxy for ESG the Save button should be disabled when the proxy test fails. (36143)
Enterprise Service Gateway heartbeats might not be tracked correctly due to clock skew between ESG and IDaaS. (36066)
Mobile SmartCredential activation dialog updated to reference the Entrust Identity mobile app and not the old Entrust SmartCredential app. (35607)
User report fails for users that have not completed activation. (36626)
User verification fails with error service_authentication.email_template_not_found. (35956)
Authentication flow not displayed correctly in user portal when using Safari. (36058)
The attributes SecurityID and User Principal Name are no longer shown in the User Portal > User Profile. (35321)
Offline token download not working for Desktop Credential Provider. (36049)
Improved audits when a SAML or OIDC application is modified. (35662)
Rename Microsoft Azure AD to Microsoft Entra ID in the IDaaS documentation. (35518)
Administrator should be blocked from upgrading Managed Service Provider from Trial to Production if there are not entitlements available. (34708)
Fix log rotation configuration for Enterprise Service Gateway. (35661)
Directory Test action is now disabled for Gateways with versions prior to 5.35. (35900)
Authentication Flow graphics should not have connection dots for IDPs without second factor. (34972)
Fix sorting in User Certificate Settings page. (36630)
When password is changed from Entrust Identity mobile app, the IDaaS audit is missing the resource name. (34178)
IDaaS Developer Portal includes an extra newline in the section linking to the license. (35960)

Changes to Identity as a Service APIs

Authentication API

The following models have been added to support Face Biometric authentication.

FaceChallenge specifies the attributes needed to launch a Face Biometric authentication.

The following attributes have been added to existing models to support Face Biometric authentication.

the attribute faceChallenge has been added to AuthenticatedResponse.
the attribute faceResponse has been added to UserAuthenticateParameters.

Administration API

The following methods have been added to support management of Face Biometric authenticators.

DELETE /api/web/v1/face/{faceid} (deleteFaceUsingDELETE) - Delete the specified Face Biometric authenticator.
POST /api/web/v1/users/{userid}/face (createFaceUsingPOST) - Create a Face Biometric for the given user.
PUT /api/web/v1/users/{userid}/face (updateFaceUsingPUT) - Update the Face Biometric for the given user.
GET /api/web/v1/users/{userid}/faces (getFacesUsingGET) - Get the Face Biometrics for the given user.
GET /api/web/v1/users/{userid}/settings/face (getUserFaceSettingsUsingGET) - Get the Face Biometric settings for the given user.

The following models have been added for Face Biometric Authenticators.

FaceAuthenticator specifies the attributes for a Face Biometric.
FaceCreateParms specifies the attributes passed when creating a Face Biometric.
FaceUpdateParms specifies the attributes passed when modifying an existing Face Biometric.
UserFaceSettings specifies the settings for the Face Biometric authenticator.

The following methods have been added to support management of Organizations.

POST /api/web/v1/organizations (createOrganizationUsingPOST) - Create an organization.
GET /api/web/v1/organizations/{id} (getOrganizationUsingGET) - Get the specified organization.
PUT /api/web/v1/organizations/{id} (putOrganizationUsingPUT) - Update the specified organization.
DELETE /api/web/v1/organizations/{id} (deleteOrganizationUsingDELETE) - Delete the specified organization.
POST /api/web/v1/organizations/{orgid}/users/{userid} (createUserOrganizationAssociationUsingPOST) - Add the specified user to the specified organization.
DELETE /api/web/v1/organizations/{orgid}/users/{userid} (deleteUserOrganizationAssociationUsingDELETE) - Remove the specified user from the specified organization.
POST /api/web/v1/organizationspaged (organizationsPagedUsingPOST) - List organizations matching the given search criteria.
PUT /api/web/v1/users/{userid}/organizations (modifyUserAOrganizationAssociationsUsingPUT) - Modify the organizations for the specified user.

The following models have been added for Organizations.

Organization specifies the attributes of an organization.
OrganizationPage specifies a page of organizations returned from the list operation.
OrganizationParms specifies the parameters passed when creating or modifying an organization.
UserOrganizationParms specifies the parameters passed when modifying the organizations to which a user belongs.

The following changes to existing models have been made to support Organizations.

the attribute organizationIdshas been added to OidcIdentityProvider and OidcIdentityProviderParms. This attribute specifies a list of organizations to which a user created after authenticating to an external IDP will be assigned.
the attribute organizations has been added to User and UserParms. This attribute specifies a list of organizations to which the user belongs.

The following changes to existing models have been made to support Domain-based IDPs.

the boolean attribute idpDomainBased has been added to AuthenticationFlow and AuthenticationFlowParms. This attribute indicates if the AuthenticationFlow will only use domain-based IDPs.
the attribute domains has been added to OidcIdentityProvider and OidcIdentityProviderParms. This attribute specifies a space separated list of domains associated with the IDP.

When specifying a password value for a user the provided value can now be passed as cleartext (the existing behavior) or provided as a bcrypt protected value (new behavior). This allows a customer to import existing bcrypt protected passwords into IDaaS using the IDaaS administration API. To support this functionality the following changes have been made existing models.

the attribute passwordFormat has been added to UserPasswordParms.

Supported TLS Ciphers

IDaaS supports the following TLS Ciphers.

TLSv1.3:

TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)

TSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)

Clients should stop using the following TLS Ciphers. Support for them will be removed in a future release.

TLSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.36 and the three previous releases 5.33, 5.34 and 5.35). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

Download the latest Gateway OVA or Hyper-V file from IDaaS and install on a new VM instance.
Add a new Gateway instance to the existing Gateway in IDaaS.
Register the new Gateway instance with IDaaS.
Disable the old Gateway instance.
Repeat these steps to replace all the Gateway instances using older versions of the ESG.

Once the upgrade is complete, the Gateway instances corresponding to the old ESGs can be deleted from IDaaS and the VMs for those ESG instances can be deleted.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service ceased support for Internet Explorer 11 after May 2023.

Release 5.35

June 2024 · 8 min read

New in this release

User Certificate Authentication

A new user certificate authenticator has been added to IDaaS. This authenticator can be used in a passwordless login flow or as a second-factor in User Login flow or IDP login flow.

User certificates can be either certificates issued by third-party CAs or certificates in IDaaS-issued smart credentials. The third-party CAs need to be added to the IDaaS Trusted CA list and marked as a user certificate CA. Additionally, to align with the new user certificate authenticator, issuing CAs will no longer be automatically used in device verification. A new option was added to allow specifying issuing CAs to be used in device verification.

User certificates issued by 3rd party CAs are matched against the user's attributes to locate the user in IDaaS. Supported certificate components for this matching process include subject DN, subject alternative Name, and serial number. For user attributes, user ID, user principal name, security ID, and custom attributes are supported. User certificates from IDaaS-issued smart credentials do not use the certificate matching process.

Device Verification Enhancements

IDaaS device verification has been enhanced to support verification performed using the forthcoming release of the Entrust Device Agent (formerly Identity Bluetooth Reader).

Support Microsoft Entra ID External Authentication Method (EAM)

IDaaS has added support for Microsoft Entra ID EAM where IDaaS can provide second-factor authentication for customers authenticating to Microsoft Entrust ID.

IDaaS Password, KBA and IDP authenticators are classified as knowledge type authenticators by IDaaS and so are not accepted by Microsoft Entra ID EAM as acceptable second-factor authenticators.

Directory Configuration Validation

A new Test action has been added for Directories. The Test action tests the directory configuration against the directory and reports on any errors found in the configuration.

Certificate Expiry Notification

When Notifications are enabled in IDaaS (Configuration > Notification) notifications are sent indicating when SAML and OIDC certificates are nearing expiry or have expired.

OIDC/SAML Enhancements

OIDC and SAML now support external authentication as a first-factor optionally without any second-factor authentication. SAML and OIDC applications can be configured to return to the client without user intervention when an error occurs during authentication. These capabilities allow a customer to configure their Service Provider to only use IDaaS risk capabilities to decide whether a user is allowed or denied access.

Customers should only use external authentication when they know that the client is performing first-factor authentication. Additionally, single sign-on should be disabled for a resource rule using external authentication.

When an OIDC authentication fails due to access denied, more error information can be included in the response returned to the client. This is controlled by the existing General setting "Enabled Enhanced Authentication Details."

IDaaS now supports the OAuth 2.0 Web Message Response Mode.

OIDC Authentication Context Class Reference (ACR) and Authentication Methods References (AMR) claims are now populated based on the authenticators used in IDaaS to authenticate the user.

External Risk Enhancements

Support for Generic External Risk Engines has been added to IDaaS. This allows customers to integrate their own risk engines with IDaaS.

Developer Portal Enhancements

The IDaaS Developer Portal has been enhanced with a new Docs section that includes documents describing how to integrate IDaaS with various services. New in this release is Protecting AWS API Gateway.

The IDaaS administration and authentication SDKs are now available by way of a private registry, facilitating easier integration into customer projects. Initially, Java, CSharp, and Python SDKs are available in the registry. Support for the Php SDK has been discontinued. The Python SDK now requires Python 3.7 or higher. The CSharp SDK has been updated to support .NET 8.0. For instructions on adding the private registry into your project, see the IDaaS Developer Portal.

Bulk Enhancements

The locale of the user can now be specified when creating or updating users.

Configure Allowed Smart Credential Definitions

When configuring smart credentials, an administrator can specify a list of allowed smart credential definitions. This allows an administrator to restrict which smart credential definitions can be selected when activating a smart credential.

Enhanced Configuration for IDaaS Desktop Application

When configuring an IDaaS Desktop Application, the administrator can now configure if the client application can determine whether the client IP address is used for Audits but not Resource Rule Conditions.

New Integrations

The following integrations have been added.

A new SAML application template for Amazon Business.
A new SAML application template for Confluent Cloud.
A new SAML application template for SiteMinder.
A new RADIUS application template for OpenVPN.

Fixed or changed in this release

Return a specific error grid_max_num_per_user when assigning a grid to a user who already has the maximum number of grids allowed. (33750)
Improvements to OIDC and IDP audits. (26886, 34533, 34538, 34907, 35123, 35180, 35353)
RADIUS push authentication does not properly handle repeated requests from VPN causing the authentication to be rejected. (35811)
Changes to the user authenticator page in 5.34 added a requirement for the SETTINGS:VIEW permission causing the page to fail to load for administrators without that permission. This permission is no longer required. (35424)
When a user selects a different locale during login they are given an option to set that locale as their default locale. If the user chose not to save that value in some scenarios, it would be saved regardless. (32335)
User list operation filtering for disabled users failed with error that the requested operation could not be performed. (34302)
Custom mail server error still present in UI after OAuth re-authentication. (35139)
URLs in message of the day may be truncated. (34523)
Updates to OTP default delivery settings not displayed in UI after save. (35179)
Alternate OTP delivery options ignored when authenticating for password. (35609)

Changes to Identity as a Service APIs

Authentication API

The following changes have been made to support user certificate authentication:

The model UserCertificateChallenge has been added.
The attribute userCertificateChallenge of type UserCertificateChallenge has been added to AuthenticatedResponse.
The model UserCertificateResponse has been added.
The attribute userCertificateResponse of type UserCertificateResponse has been added to UserAuthenticateParameters.
The type USER_CERTIFICATE has been added as an allowed value where ever authentication types are specified.

Administration API

The type USER_CERTIFICATE has been added as an allowed value where ever authentication types are specified.

The type USER_CERTIFICATE_LOGIN has been added to the list of allowed Login Flow types.

New v2 versions of the following authentication APIs have been created to support the new USER_CERTIFICATE authentication type and the USER_CERTIFICATE_LOGIN login flow.

GET /api/web/v2/authenticationflows (getAuthenticationFlowsUsingGET) - List authentication flows.
POST /api/web/v2/authenticationflows (createAuthenticationFlowUsingPOST) - Create an authentication flow.
DELETE /api/web/v2/authenticationflows/{id} (removeAuthenticationFlowUsingDELETE) - Delete an authentication flow.
GET /api/web/v2/authenticationflows/{id} (getAuthenticationFlowUsingGET) - Get an authentication flow.
PUT /api/web/v2/authenticationflows/{id} (updateAuthenticationFlowUsingPUT) - Modify an authentication flow.

The attribute allowIgnoreIpAddressForRba has been added to AuthApiApplication and AuthApiApplicationParms. This value specifies whether the client can specify that the client IP address is used for audits but not for resource rule conditions. This attribute only applies to IDaaS Desktop applications.

The following APIs have been added:

GET /api/web/v1/scdefns/users/{userId} (listAllowedSCDefnsUsingGET) - List smart credential definitions that are allowed for the specified user.

Supported TLS Ciphers

IDaaS supports the following TLS Ciphers.

TLSv1.3:

TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)

TSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)

Support for the following TLS Ciphers were removed in IDaaS 5.32.

TLSv1.2:

TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048)
TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048)
TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048)

Clients should stop using the following TLS Ciphers. Support for them will be removed in a future release.

TLSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.35 and the three previous releases 5.32, 5.33 and 5.34). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

ESG was updated to use a new OS in 5.33. In place upgrade of ESG is only supported for versions 5.33 or later. To upgrade versions ESGs older than 5.33 to the new version use the following procedure:

Download the latest Gateway OVA or Hyper-V file from IDaaS and install on a new VM instance.
Add a new Gateway instance to the existing Gateway in IDaaS.
Register the new Gateway instance with IDaaS.
Disable the old Gateway instance.
Repeat these steps to replace all the Gateway instances using older versions of the ESG.

Once the upgrade is complete, the Gateway instances corresponding to the old ESGs can be deleted from IDaaS and the VMs for those ESG instances can be deleted.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service ceased support for Internet Explorer 11 after May 2023.

Release 5.34

March 2024 · 10 min read

New in this release

IDP plus Second-Factor Authentication

When using a third-party identity provider for authentication, IDaaS second-factor authentication can now be included in the authentication flow.

Step-Up Authentication to Edit User Profile

The User portal can be configured to require step-up OTP authentication before a user is allowed to edit their user profile. The user attributes that receive the OTP can be configured in the policy.

OIDC Certificate Management

The certificates used for OIDC applications can now be managed, including having them certified by a Certificate Authority.

Grid Delivery Address Selection

When the end user or an administrator chooses to deliver a grid, the email address to use can now be selected. The allowed addresses can be configured in the policy.

Restrict OTP Delivery Types

The OTP delivery types that are available for OTP authentication can now be specified in the policy.

Administrator Support for Entrust Soft Token Manual Activation

When an administrator activates an Entrust Soft Token from the Administration portal, they now have the option to view the manual activation parameters.

Automatically Send Registration Magic Link

The Registration Magic Link can now be configured so that it is automatically delivered when a user is created.

User ID Quick Search

The user list in the admin portal now has a "Search for User ID" quick search option.

New Integrations

The following integrations have been added.

A new RADIUS application template for PAM RADIUS Plug-in.
A new SAML application template for Fastly
A new SAML application template for Lucidchart
A new SAML application template for Soloinsight

The following Identity as a Service integrations have been renamed from IntelliTrust to IDaaS:

IDaaS AD FS Adapter
IDaaS Apache Filter
IDaaS Desktop
IDaaS ISAPI Filter

The Identity as a Service integration IntelliTrust ForgeRock has been removed. The OIDC ForgeRock application is still available.

Fixed or changed in this release

When creating a tenant from a managed service provider, the country of the tenant and the mobile phone number of the first administrator are now optional. (34504)
When creating a tenant from a managed service provider, tenant creation fails if the service provider's entitlements are expired. The entitlement is now verified before trying to create the tenant. (34224)
Improved the performance of token queries and reports when the tenant has a large number of tokens. (34584, 34916)
Improved the performance of user export for tenants with a large number of users. (33632)
Device verification is now fully supported for Passkey, IDP, and Smart Login authentication. (34273, 34274, 34275)
Device verification caused unexpected errors if the user entered an invalid password during password change. (34528)
The tab titles in the User portal and Administration portal have been changed to use black instead of the primary account color. (34284)
Fixed the ESG setup_static_ip.sh script. (35025)
Previously an imported PKIaaS CA only supported OCSP for certificate revocation. Now CRLs are also supported. (34672)
Smart login now supports single sign-on. (33162)
The User portal operations to verify ownership of a phone number now consume SMS/Voice entitlements. (26751)
SAML metadata download fails when "All Certificates" is selected. (35034)
Addressed issues where travel velocity was performed for IP addresses without a location. (34364)
Improved the display of the Message of the Day in the login page on mobile devices. (34005)
Smart Login is now available for managed service provider tenants. (34581)
Fixed an issue with directory sync where errors could result in the user entitlement counts to be incorrect until the daily entitlement verification task was performed. (29178, 31441)
Addressed some issues in how authentication flows display in the Administration portal. (34807)
The subject name for a SYNCADD user audit should be clickable. (34478)
The IDP remove audit should not include all the details of the removed IDP. (34688)
Return a better error message when a duplicated trusted CA certificate is added. (33108)
Improve the formatting of authentication audits containing device certificate risk factor evaluation results so that the device certificate DN displays properly. (32896)
Improve the formatting of the Passkey button text on Safari. (34058)
Optional custom user attributes synchronized from the directory could be modified using the Administration API. (34402, 34405)
OTP authentication settings modify audit contained attributes whose values did not change. (34685, 34698)
The audit generated when a user is created or a soft token is created as part of user creation after an IDP authentication has the wrong subject name. (34524, 34534)
The audit generated when an inactive user authenticates with Passkey/FIDO2 was missing the Authenticator value. (31770)
PKIaaS CA actions on Issuing CA list page should be disabled for administrators that do not have permission to perform the action. Performing the action caused a permission denied error. (32930)
When configuring an Identity Provider, the JWKS Endpoint is now required for all IDPs except for Twitter. (34585)
The wrong error was displayed in the Administration portal if the administrator tried to remove a synchronized group from the user. (34379)
Passkey authentication did not work for managed service providers authenticating to a child account. (34277)
Some strings in the user portal were not translated for all locales. (34362, 34532)
Make the mobile application name consistent between the Activate Smart Credential and Activate Soft Token dialogs. (34648)
The "Add Client Credential Grant" option should be disabled for administrators that do not have permission to perform the operation. Performing the action results in a no permission error. (34509)
Improve the audit generated when a custom mail server is updated with a new password to indicate that the password was changed. (32904)
Fix password reset for AD passwords for users whose DN contains values that need to be escaped. (34285)
Only audits that have a subject name that are user IDs should be clickable. (34521)
The reset password audit shows the forceUpdate attribute even though it has not changed. (33042)
Changing the state of the ESG password agent could fail. (34641)
Creating a Generic Server OIDC Application is now only available in an account with the premium bundle. (34540)
Identity Provider configuration now supports acr values request. Supply a space separated list of acr values. If supplied then at least one of specified ones must be returned from the IDP to be successful. (34620)
If an OIDC request specifies a claims request for acr or amr as essential with specified values, then if at least one of the specified values cannot be achieved, the request wil fail. (34673)
Fixed an issue where the name and description of a resource rule containing groups synchronized from AD could not be updated. (34594)
Fixed an issue where the FIDOTOKEN add permission could not be set when creating or editing a role in the admin portal. (35259)
Updated phone number validation that was rejected phone numbers with new area codes for some countries. (35223)

Changes to Identity as a Service APIs

Authentication API

The attribute ignoreIPAddressForRBA has been added to UserAuthenticateQueryParameters, UserChallengeParameters, and UserAuthenticateParameters. When this attribute is set to true, the IP address provided to an authentication request is included in authentication audits but is not used for risk-based authentication. By default, the IP address is used for both audits and risk-based authentication.

The attribute expires has been added to UserAuthenticateQueryResponse. It specifies the expiry time of the authentication token.

Administration API

The following changes have been made to support selecting which email attribute is used when delivering a grid to a user.

The model EmailParms has been added.
The API deliverAssignedGridByEmailUsingPOST now takes EmailParms as a parameter.
The attribute emailParms of type EmailParms has been added to the model GridAssignParms. This attribute is used when calling the API assignGridByIdUsingPUT and assignGridBySerialNumberUsingPUT.
The attribute emailParms of type EmailParms has been added to the model GridCreateParms. This attribute is used when calling the API createGridUsingPOST.

The following changes have been made to define the OTP Settings policy used to define which delivery types can be used to deliver OTPs.

The model OTPDeliveryMethod has been added. It defines an OTP delivery method and indicates if that method can be used for delivering OTPs.
The attribute deliveryMethodshas been added to the model OTPAuthenticatorSettings. It defines an ordered list of OTP delivery methods that can be used for delivery OTPs. The first entry in the list is the default delivery method.
The attribute otpDefaultDelivery in the model OTPAuthenticatorSettings has been deprecated and is replaced by deliveryMethods.

The following changes have been made to support defining IDP plus second-factor authentication and other improvements to Identity Providers.

The attribute idpLoginSecondStep has been added to AuthenticationFlow and AuthenticationFlowParms. This attribute defines the list of authenticators that are required for IDP second-factor authentication.
The attribute acrValues has been added to OidcIdentityProvider and OidcIdentityProviderParms. This attribute defines a list of authentication context request values to include in the authentication request to the 3rd-party IDP.
The attribute descriptions for OidcIdentityProvider and OidcIdentityProviderParms have been improved.

Other changes made to the Administration API:

The attribute companyCountry in the model TenantParms is no longer required when creating a new tenant.
The attribute mobile in the model UserParms used to create the first administrator of the tenant is no longer required when creating a new tenant.
The version of the method createTenantAsyncUsingPOST has been updated from v4 to v5. The non-compatible changes requiring this change are not related to authentication clients and will not impact IDaaS customers.

Supported TLS Ciphers

IDaaS supports the following TLS Ciphers.

TLSv1.3:

TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)

TSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)

Support for the following TLS Ciphers were removed in IDaaS 5.32.

TLSv1.2:

TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048)
TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048)
TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048)

Clients should stop using the following TLS Ciphers. Support for them will be removed in a future release.

TLSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.34 and the three previous releases 5.31, 5.32 and 5.33). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

ESG was updated to use a new OS in 5.33. In place upgrade of ESG is only supported for versions 5.33 or later. To upgrade versions ESGs older than 5.33 to the new version use the following procedure:

Download the latest Gateway OVA or Hyper-V file from IDaaS and install on a new VM instance.
Add a new Gateway instance to the existing Gateway in IDaaS.
Register the new Gateway instance with IDaaS.
Disable the old Gateway instance.
Repeat these steps to replace all the Gateway instances using older versions of the ESG.

Once the upgrade is complete, the Gateway instances corresponding to the old ESGs can be deleted from IDaaS and the VMs for those ESG instances can be deleted.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service ceased support for Internet Explorer 11 after May 2023.

Release 5.33

February 2024 · 13 min read

New in this release

Authentication Flows

IDaaS supports several authentication flows:

The standard userID authentication flow where the user enters their userID and is then prompted for an optional first-factor password followed by a selection of second-factor authenticators.
The Passkey authentication flow where the user uses their Passkey token to authenticate. Their userID is provided by the Passkey token.
The Smart Login authentication flow where the user uses their Entrust Identity Smart Credential to authenticate to IDaaS. Their userID is provided by the smart credential.
The Identity Provider (IDP) authentication flow where the user uses a third-party Identity Provider to authenticate. Their userID is provided by the IDP.

Prior to 5.33, some authentication flows (userID and Smart Login) were configured in the resource rules and some authentication flows (Passkey and IDP) were defined outside the resource rules in the applications. In 5.33, the authentication flows are now defined as a separate entity and linked to the resource rules. These changes provide the following benefits:

Configuration of all authentication flows is the same.
All authentication flows now support single-sign on and user registration and verification.
Resource rule contexts, which can be used to deny access to an application apply to all the authentication flows. Prior to 5.33, Passkey and IDP authentication were not restricted by the context rules in the resource rule.
Authentication flows can be shared with multiple resource rules.

The IDaaS portal authentication UI has been updated as part of this feature. Only the authentication flows defined for the application are shown. For example, the User portal can be configured so that only IDP authentication is shown.

The IDaaS user portal and administration portal can have different authentication flows. A user browsing to the account URL (ex: https://mycompany.us.trustedauth.com) will see the authentication flow for the user portal which may not be an authentication flow that allows access to the administration portal. In this scenario, a user wishing to access the administration portal can do so by adding ?action=admin to their URL. For example https://mycompany.us.trustedauth.com/#/?action=admin.

As part of these changes, the existing Resources menu has been split into two top-level menus. A new Security menu includes items related to authenticating to applications, including a new Authentication Flows menu item for managing authentication flows. The existing Resources menu includes items related to managing resources such as Grids, Tokens, and Smart Credentials.

When IDaaS 5.33 is deployed, existing resource rules will be converted. Where necessary, new authentication flows will be created and linked to resource rules.

Support Entrust Identity Mobile Hardware Storage for Smart Credentials

An upcoming version of Entrust Identity Mobile will support storing smart credential private keys in hardware. Hardware storage on iOS only supports Elliptic Curve (EC) keys. When configuring smart credentials in IDaaS, there is now an option to select EC as the key type in addition to RSA. Additionally, there is new policy for smart credentials to indicate to Entrust Identity Mobile that smart credential private keys must be stored in hardware storage or will be stored in hardware storage if available. Existing versions of Entrust Identity Mobile will fail to encode the smart credential if EC keys are specified and will not store private keys in hardware even if required by IDaaS policy.

FIDO2/Passkey Authenticator Improvements

An "Allowed Relying Party ID Hostnames" list has been added to FIDO2/Passkey policy. This list restricts the hostnames that can register FIDO2/Passkey tokens.

Strict Access Option for Resource Rules

In IDaaS if a user matches multiple resource rules, if one or more resource rules allows access then the user is allowed access using those resource rules. A new "Enable Strict Access for Application" option has been added to resource rules. If enabled and the resource rule denies access and the user is denied access even if other resource rules allow access.

Magic Link Redirect

An application creating an IDaaS Registration Magic Link can now include a redirect URL. After registration completes, the user's browser is redirected to that URL. The Magic Link policy now includes a policy to enable Redirect and to list URLs that are allowed for redirect.

Redirect URLs are only supported with Magic Links created using the administration API. They cannot be specified for Magic Links created from the administration portal.

Support Existing Entrust PKIaaS CAs

IDaaS has been supporting Entrust PKIaaS CAs created by IDaaS. Now customers can use Entrust PKIaaS CAs created from Entrust Certificate Services.

Customize Google Authenticator Name

Most 3rd-party soft tokens are compatible with Google Authenticator for activation and authentication. This means that customers using 3rd-party soft tokens with IDaaS can use the IDaaS Google Authenticator with those tokens. IDaaS now allows a customer to customize the name of the authenticator to match the token that the customer is using.

User Registration Enhancements

The following enhancements have been made to user registration:

User registration can now include an option to create a new grid for the user.
User registration can now include an option to perform password management for the user. If the user does not have a password, they can create a password. If the user has a password that is expired or set for forced update, the user can change it. Currently, password creation is only supported for IDaaS-managed passwords and not for AD passwords.

Support Multiple Smart Credential Definitions in User Portal

When activating a smart credential in the IDaaS User portal, if multiple smart credential definitions are configured, the user is now asked to choose which smart credential to use. The user no longer needs to choose between activating for mobile or physical smart credentials. That information is provided by the selected smart credential definition.

Enhance Password Expiry Notification

An upcoming version of Entrust Identity Mobile will support handling password expiry notifications. In IDaaS, support for delivering password expiry notifications to mobile has been added. This includes a new Mobile option for the Password Expiry Notifications policy.

Azure AD Directory Permission Changes

When authenticating to Azure AD, IDaaS no longer requests all the permissions required to perform all directory-related operations (synchronizing users and groups, changing or resetting user passwords). Instead, IDaaS requests minimal permissions and is given the permissions allowed for the authenticating directory credentials. If IDaaS does not have permission to perform an operation, the operation fails. This allows, for example, a customer to configure their directory to only provide read permissions supporting user synchronization without having write permission to support password change.

Enterprise Service Gateway (ESG) Platform Update

ESG has been updated to use a new OS. Versions of ESG prior to 5.33 are still supported for 3 versions after release, but they can not be upgraded in place. To upgrade existing ESGs to the new version use the following procedure:

Download the latest Gateway OVA or Hyper-V file from IDaaS and install on a new VM instance.
Add a new Gateway instance to the existing Gateway in IDaaS.
Register the new Gateway instance with IDaaS.
Disable the old Gateway instance.
Repeat these steps to replace all the Gateway instances using older versions of the ESG.

Once the upgrade is complete, the Gateway instances corresponding to the old ESGs can be deleted from IDaaS and the VMs for those ESG instances can be deleted.

New Integrations

The following integrations have been added.

A new SAML application template for FortiSIEM
A new SAML application template for Gong
A new SAML application template for Huddle
A new SAML application template for Mimecast
A new SAML application template for Netskope
A new SAML application template for Ziflow

Fixed or changed in this release

Push authentication in RADIUS did not fall back to token authentication when the push transaction expired. (34332, 34308, 34196)
Administrators logging into the IDaaS portal using device certificate authentication were only given access to the User portal. (34190, 33919)
User attributes synchronized from AD should be read-only when editing the user profile in the Administrator or User portal. (34300, 34291)
Magic Link email not using user locale for email subject and expiry date. (33924, 33556)
Audits for IDP initiated SAML/OIDC logins now include the application name in the audit. (34099)
The IntelliTrust Desktop application can now be configured to support FIDO2/Passkey authentication. (33783)
The activation email for mobile smart credential now includes a link to the Entrust Identity mobile application instead of the old Entrust Smart Credential mobile application. (33676, 33621, 33512)
IDaaS did not correctly handle incoming SAML requests if the RelayState parameter was not URL encoded. (33673)
Hardware tokens were not unassigned as expected when a synchronized user is deleted because they were removed from the directory. (33627)
The Administrator portal removed spaces from user aliases that contained multiple spaces. (33209)
Smart login authentication not saved in location history or counted in the authentications per application statistics. (33166, 33169)
Passkey login authentication not saved in location history or counted in the authentications per application statistics. (33168, 33167)
Check that the same Trusted Certificate Authority is not added twice. (32614)
When directory synchronization was configured to synchronize "Group Matching Group Filter" and the group filter was empty, all groups were synchronized. It should not synchronize any groups. (33201)
Improvements to policy caching to ensure policy changes are applied immediately. (33773)
IDaaS allows groups in a directory group filter that differ only with leading or trailing whitespace. (22843)
Improve message in failure audit if authentication fails because there are no active resource rules. (34134)
IDaaS accounts with Standard bundle were unable to add SAML applications. (33852)
The basic authentication option has been removed from Secure Device Provisioning. (30691)
The refresh option on the managed service provider tenant list page now displays all tenants being created rather than just tenants created in the current session. (33652)
Improved error message of synchronization from Azure AD fails because authentication token has expired. (32283)
Improved error in change password indicating that the password has matched an alias. (31644)
OIDC Authorization should only be accessible in accounts with the PREMIUM bundle. (34481)

Changes to Identity as a Service APIs

Authentication API

The authentication type PASSKEY has been added to the AuthenticatorType enumerated type. Previously when performing PASSKEY authentication, the API POST /api/web/v1/authentication/passkey (requestPasskeyChallengeUsingPOST) was used. This API has been deprecated. Instead, call POST /api/web/v2/authentication/users/authenticate/{authenticator} (userChallengeUsingPOST) with authenticator set to PASSKEY. The parameter userId in UserChallengeParameters is now optional. It is required when calling non-passwordless authenticators but is not required for PASSKEY.

The attribute relyingParyId has been added to FIDOToken which is returned from the APIs completeFIDORegisterUsingPOST and getSelfFIDOTokenUsingGET.

Administration API

The following APIs have been added to manage authentication flows:

GET /api/web/v1/authenticationflows (getAuthenticationFlowsUsingGET) - List authentication flows.
POST /api/web/v1/authenticationflows (createAuthenticationFlowUsingPOST) - Create an authentication flow.
DELETE /api/web/v1/authenticationflows/{id} (removeAuthenticationFlowUsingDELETE) - Delete an authentication flow.
GET /api/web/v1/authenticationflows/{id} (getAuthenticationFlowUsingGET) - Get an authentication flow.
PUT /api/web/v1/authenticationflows/{id} (updateAuthenticationFlowUsingPUT) - Modify an authentication flow.

The following models related to authentication flows have been added:

AuthenticationFlowParms - The parameters passed to the create and update APIs.
AuthenticationFlow- The results returned from the create, get, list, and update APIs.

The following APIs have been added to manage OIDC identity providers:

GET /api/web/v1/identityproviders/oidc (listOidcIdentityProvidersUsingGET) - List identity providers.
POST /api/web/v1/identityproviders/oidc (createOidcIdentityProviderUsingPOST) - Create an identity provider.
POST /api/web/v1/identityproviders/oidc/configuration (fetchOidcConfigurationUsingPOST) - Get configuration information for an identity provider.
DELETE /api/web/v1/identityproviders/oidc/{id} (deleteOidcIdentityProviderUsingDELETE) - Delete an identity provider.
GET /api/web/v1/identityproviders/oidc/{id} (getOidcIdentityProviderUsingGET) - Get an identity provider.
PUT /api/web/v1/identityproviders/oidc/{id} (updateOidcIdentityProviderUsingPUT) - Modify an identity provider.

The following models related to OIDC identity providers have been added:

OidcIdentityProviderParms - The parameters passed to the create and update APIs.
OidcIdentityProvider - The results returned from the create, get, list, and update APIs.
OidcConfigurationParms - The parameters passed to the configuration API.
OidcConfigurationResponse - The results returned from the configuration API.

A new version of the following APIs to manage resource rules have been created. The new v2 version of the APIs manage resource rules linked to authentication flows. The old v1 version of the APIs have been deprecated and will be removed in a future release.

GET /api/web/v2/resourcerules (getResourceRulesUsingGET) - List all resource rules.
POST /api/web/v2/resourcerules (createResourceRuleUsingPOST) - Create a resource rule.
GET /api/web/v2/resourcerules/resource/{id} (getResourceRulesForResourceUsingGET) - List all resource rules for the specified resource.
DELETE /api/web/v2/resourcerules/{id} (removeResourceRuleUsingDELETE) - Delete a resource rule.
GET /api/web/v2/resourcerules/{id} (getResourceRuleUsingGET) - Get a resource rule.
PUT /api/web/v2/resourcerules/{id} (updateResourceRuleUsingPUT) - Update a resource rule.

The models ResourceRule and ResourceRuleParms related to resource rules have been modified.

The attributes highRiskAuthenticationFlow, mediumRiskAuthenticationFlow, and lowRiskAuthenticationFlow have been added. These attributes specified the authentication flows associated with this resource rule for the different risk levels. These attributes are managed by the v2 version of the resource rule APIs.
The attributes highRiskEnableSmartLogin, highRiskFirstStep, highRiskSecondStep, mediumRiskEnableSmartLogin, mediumRiskFirstStep, mediumRiskSecondStep, lowRiskEnableSmartLogin, lowRiskFirstStepand lowRiskSecondStep have been deprecated. These attributes have been replaced by the corresponding authentication flow attributes and will be removed in a future release. These attributes are managed by the v1 version of the resource rule APIs.

Once a resource rule has been updated by the v2 version of the resource rule APIs (including the IDaaS Administrator portal), it can no longer be accessed by the v1 version of the APIs.

The following models have been changed:

An attribute relyingPartyId has been added to FIDOToken. This value specifies the relying party from which the token was registered.
The attribute passkeyEnabled in AuthApiApplication and AuthApiApplicationParms has been deprecated. It is no longer used.
The attribute keyType has been added to DigitalIdConfigCertTemplate. This value specifies whether the key type RSA or ECC should be used.
The attribute redirectUrl has been added to MagicLinkCreateParms. This value specifies the optional redirect URL that can be included in a Magic Link.
The attributes lockedAuthenticatorTypes in User and type in UserAuthenticatorLockoutStatus have been updated to include the new authenticator types IDP, PASSKEY, and SMART_LOGIN.

Supported TLS Ciphers

IDaaS supports the following TLS Ciphers.

TLSv1.3:

TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)

TSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)

Support for the following TLS Ciphers were removed in IDaaS 5.32.

TLSv1.2:

TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048)
TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048)
TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048)

Clients should stop using the following TLS Ciphers. Support for them will be removed in a future release.

TLSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.33 and the three previous releases 5.30, 5.31 and 5.32). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service ceased support for Internet Explorer 11 after May 2023.

Release 5.32

November 2023 · 9 min read

New in this release

Administrator Role Defined by Group Membership

IDaaS has a new group-based policy category that defines an Administrative role. This allows a customer to assign all members of a group an administrative role.

Registration Settings UI Restructured

The Registration Settings page has been restructured so that each category has its own page.

Magic Link for Registration

IDaaS now provides Magic Links that allow a user to register authenticators without requiring a password to authenticate. Magic Links can be delivered by email from IDaaS to the user or returned to customer applications using the Administration API.

Account Rename

The hostname for an account can now be modified by the Service Provider of that account. To support migration between hostnames, there is an option to keep the old hostname available.

Group Provisioning using SCIM

SCIM can now be used to provision groups and to provision group membership of users in IDaaS.

New Default SCIM Provisioning Role

There is now a new default role "SCIM Provisioning." This role contains the permissions required to perform provisioning to IDaaS using SCIM.

Asynchronous Account Creation

New account creation is now performed asynchronously. To support this, the account creation UI in the Service Provider portal has been extensively changed.

New APIs to support asynchronous account creation have been added to the Administration API. The existing APIs have been deprecated and will be removed in a future release.

Directory Synchronization Improvements

The following improvements have been made to directory synchronization.

User aliases can now be populated from a list of one or more directory attributes.
IDaaS attributes can now be defined as a composite of multiple directory attributes (for example, '<givenName> <sn>' to specify the user's full name) or a combination of directory attributes and static values (for example, 'ENTRUST\<samAccountName>' to specify the user's domain qualified userID).

Replace Deleted Applications

When creating an Authentication API application, the administrator can now specify the unique ID of the application. This allows an administrator to recreate an application that was deleted with the same unique ID so that existing clients do not need to be reconfigured.

New Integrations

The following integrations have been added.

A new SAML application template for 15Five
A new SAML application template for Forest Admin
A new SAML application template for Freshservice
A new SAML application template for HubSpot
A new SAML application template for Jenkins
A new SAML application template for Miro
A new SAML application template for Onfido
A new SAML application template for ReviewInc
A new SAML application template for Splunk SOAR

Additionally, an integration guide is now available for the Epic Hyperdrive integration that was added in 5.31.

Fixed or changed in this release

Fixed an issue where Java clients using the IDaaS APIs could not deserialize null arrays. (33036)
Addressed issues in the Google Workspace integration guide. (32947, 33082)
Updated the bulk import user sample to include securityId. (32872)
Disabled the refresh operation for PKIaaS CAs for administrators that do not have permission to perform the operation. (32931)
Removed the Referrer-Policy header that was added in 5.31. It caused issues with some IDaaS clients. (33110)
Renamed the "SCIM Provisioning Management" role permission to "Outbound Provisioning Management". (32862)
The audit generated when directory attributes are modified now includes the old and new values. (32859)
When updating a SAML application when Override SAML Audience is checked, the Audience value is now required. (33034)
Addressed issues in the "Integrate Microsoft Azure AD" Technical Guide. (32738, 33137)
Improvements to SCIM User Provisioning documentation. (32933)
Fixed broken link in "Integrate Nets E-Ident IDP Broker" section of Technical Guide. (33144)
Addressed FIDO token registration issues using Safari on Mac. (32702, 32700)
In the Service Provider portal, disable the Tenant report option for administrators that do not have permission. (33233)
Users added to IDaaS by directory synchronization did not receive their new grid. (32811)
Userid search options were disabled for accounts with more than 1 million users. The limit is now 3 million users. (33484)
When creating a new SAML application, the Signature Type now defaults to the expected value. (33187)
When creating a new SAML application, if only one SAML signing certificate is defined, it is automatically selected. (33188)
IDaaS now allows the Authorization Bearer token passed to authenticated endpoints to contain more than one space. The standard specifies a single space but some clients include multiple spaces. (33107)
Fixed language selection issue where a user was asked to confirm a change when the default language selected. (33286)
Fixed an issue where changing the default account locale can result in the Admin portal displaying that locale instead of English. (32915)
Improved text in Gateway download dialog to make it clear that the OVA can be installed onto more than just VMWare vSphere. (32069)
When a FIDO token is registered, its origin is now audited. (31237)
Changed the Registration page so that the authenticators are sorted. (30794)
Improved validation of input on My Authenticator page. (15217)
Fixed the issue on Password Reset policies page that prevented an administrator from unchecking Allow Email OTP Delivery. (33109)
Enabling/updating tenant management configuration failed in some cases. (33200)
When configuring an IDP, Security ID should not be allowed as an attribute used to identify the user. (33146)
Improved the formatting of the Risk Factor Evaluation Results in authentication audits. (32497)
The authenticator filter in the user list search criteria should only show authenticators that the administrator has permission to access. (31887)
Fixed an issue that prevents the custom email server configuration from being saved when the OAuth is reauthorized. (32536)
In the User list, when the Last Authenticated before criteria is used it includes users who have never authenticated. The UI now includes a note to indicate this. (32266)
Users are unable to use the OTP authenticator because they do not have contact information were not getting the expected error response when Enable Enhanced Authentication Details was checked. (32628)

Changes to Identity as a Service APIs

Authentication API

The following models have been changed in this release.

serialNumbers in GridChallenge has been deprecated. Use gridInfo instead.

Administration API

The following APIs to support asynchronous account creation have been added in this release.

POST /api/web/v4/async/tenants (createTenantAsyncUsingPOST)
GET /api/web/v4/async/tenants/{id}/createstatus (getCreateTenantAsyncStatusUsingGET)
GET /api/web/v4/async/tenants/{id}/createresult (getCreateTenantAsyncResultUsingGET)

To create a new tenant from a Service Provider:

call createTenantAsyncUsingPOST to start the tenant creation.
call getCreateTenantAsyncStatusUsingGET repeatedly until the returned status indicates that the tenant creation is complete.
call getCreateTenantAsyncResultUsingGet to get the tenant creation result.

The following APIs to support registration of FIDO tokens using the administration API have been added in this release.

GET /api/web/v1/fidotokens/challenge/{id} (startCreateFIDOTokenUsingGET)
POST /api/web/v1/fidotokens/complete/{id} (completeCreateFIDOTokenUsingPOST)

The following APIs to support the management of Magic Links for registration have been added in this release.

PUT /api/web/v1/users/{userid}/magiclink (createMagicLinkUsingPUT)
DELETE /api/web/v1/users/{userid}/magiclink (deleteMagicLinkUsingDELETE)

The following APIs have been deprecated in this release.

POST /api/web/v4/tenants (createTenantUsingPOST). Tenants should be created using the new asynchronous methods described above.
GET /api/web/v1/serviceipaddresses (getServiceIPAddressesUsingGET). IDaaS accounts now have fixed IP addresses.

The following models have been added in this release.

CreateTenantSyncStatus contains the information returned from getCreateTenantAsyncStatusUsingGET.
FIDORegisterChallenge contains the information returned from startCreateFIDOTokenUsingGET.
FIDORegisterResponse contains the information passed to completeCreateFIDOTokenUsingPOST.
MagicLinkCreateParms contains the parameters passed to createMagicLinkUsingPUT.
MagicLinkResponse contains the information returned from createMagicLinkUsingPUT.
UserAlternateEmails contains information about alternative email addresses available to a user.

The following models have been modified in this release.

id has been added to AuthApiApplicationParms. When creating an authentication API application, the unique UUID of the application can be specified. If an ID is not specified, a random unique ID is generated for the new application.
created and lastModified have been added to Group. These values specify the date when the Group was created and last modified.
lockedAuthenticators in User has been deprecated. Use lockedAuthenticatorTypes instead.
alternateEmails has been added to User. This value lists all the alternate email addresses defined for the user.
magicLinkEnabled has been added to User. This flag indicates whether magic links are enabled for the user.
aliasMappingName has been added to Directory. This value specifies the list of directory attributes whose values will be mapped to user aliases.
previousHostname has been added to Tenant. If set, this value specifies the previous hostname of an account after it has been renamed.

Changes to Identity as a Service SDKs

The order of parameters in the API functions may change. Refer to the clients' documentation for the correct order.
The python SDK no longer supports accessing properties using dictionary keys. Access properties using object attributes.
IDaaS no longer accepts paths that end in /. For example, previously both /api/web/v4/async/tenants and /api/web/v4/async/tenants/ would have been accepted. Now only /api/web/v4/async/tenants will work.
The 5.30 and 5.31 Java SDKs did not support models from newer versions of IDaaS that contain new attributes. This issue has been fixed in the 5.32 SDKs.

Supported TLS Ciphers

IDaaS supports the following TLS Ciphers.

TLSv1.3:

TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)

TSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)

Support for the following TLS Ciphers were removed in IDaaS 5.32.

TLSv1.2:

TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048)
TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048)
TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048)

Clients should stop using the following TLS Ciphers. Support for them will be removed in a future release.

TLSv1.2:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ecdh_x25519)

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.32 and the three previous releases 5.29, 5.30 and 5.31). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service ceased support for Internet Explorer 11 after May 2023.

Release 5.31

August 2023 · 13 min read

New in this release

Device Verification using Certificates

A new Device Certificates risk factor has been added to Resource Rules. When configured, this risk factor requires that the client be able to perform client-authenticated SSL with a certificate issued from a trusted CA to pass.

When configuring Certificate Authorities, the customer can now configure Issuing CAs which is the existing capability of configuring CAs to issue smart credentials and Trusted CAs which is a new capability for configuring CAs that have issued the certificates on the user's devices.

Device certificates are supported for SAML and OIDC applications as well as the IDaaS portals.

Certificate Details for mPKI CA Smart Credentials

A new Certificate action is available for Smart Credentials using a mPKI CA. The Certificate action lists the certificates issued to the selected Smart Credential and allows an administrator to manage those certificates. Previously this action was only available for Smart Credentials using a PKIaaS CA.

Resource Rule Risk-factor Enhancements

The Risk-factors in resource rules have been enhanced to include a Deny Access option. When the Deny Access option is enabled for a risk factor, access to the application is denied if that risk factor fails regardless of the results of the other risk factors.

OIDC Claim Enhancements

Custom OIDC Claims can be defined and associated to any OIDC application. Claims can be defined to always be returned with User Info or with the ID Token. The way attributes are mapped to OIDC claims has been improved.

Microsoft AD Strong Authentication

Microsoft Windows is changing to require that certificates used for smart-card login include the user's security identifier as an extension. IDaaS has been enhanced to include a new user attribute to store the user's security identifier and to encode this value into smart credentials. Additionally, AD and Azure directory sync have been enhanced to retrieve this value from the customer's directory and store it for IDaaS users.

If you have a CA that was created before this release you will need to update the CA configuration to support Security Identifiers.

For an Entrust PKIaaS CA, there is a new Refresh action available from the IDaaS Issuing Certificate Authority list. This will update the necessary CA configuration.
For Entrust mPKI or Microsoft CA the certificate profiles managed from the CA will need to be updated.

Identity Provider Enhancements

The following enhancements have been made to identity providers:

A new identity provider IDVaaS has been added supporting integration with Entrust's Identity Verification as a Service.
When configuring an identity provider, additional checks can be configured that ensure IDP claim values match existing IDaaS user attributes to successfully complete IDP authentication.

Administration API Long-Lived Token

An administration API can be configured to support long-lived tokens. When creating an administration API or refreshing its shared secret, a long-lived token is available if enabled for the application. When invoking an administration endpoint, instead of passing the authentication token returned from the administration API authentication endpoint, the long-lived token can be passed instead. The long-lived token does not expire, meaning that client applications do not need to refresh the authentication token periodically.

User Provisioning using System for Cross-Domain Identity Management (SCIM)

IDaaS users can now be managed by 3rd-party clients using SCIM.

SAML Enhancements

The following enhancements have been made to SAML applications:

A SAML application can now define multiple Assertion Consumer Service (ACS) URLs.
Each SAML application now has a public endpoint that returns the SAML metadata for the application. This endpoint can be used by SAML service providers that automatically fetch the SAML metadata.
SAML applications can now be configured to specify the audience returned in SAML assertions. The audience can either be specified in IDaaS or requested from the SAML SP as a parameter.

Manage Inactive Users

IDaaS now allows a customer to have users be blocked from authenticating if the user has not authenticated in a period of time.

User Search/Report Enhancements

The following enhancements have been made to user search/export capabilities:

The user search criteria have been enhanced to allow an administrator to search for users who have not authenticated in a period of time. Previously, only searching for users who had authenticated in a period of time was supported.
The user export operation has been enhanced to allow an administrator to export customer defined attributes.

Phone/Email Verification APIs

New administration APIs have been added that allow a customer application to verify that a user owns a given phone number or email address.

User Portal Improvements

The following enhancements have been made to the user portal:

Users synchronized from AD were unable to modify any contact values. Now they are only blocked from modifying contact values synchronized from AD. Other contact values can be modified.

New Passkey/FIDO2 Registration Policies

The following new policies have been added to the Passkey/FIDO2 Authenticator policies to control registration.

User Verification - controls if the user must be verified or not.
Resident Key (User ID stored) - controls if the user ID is stored on the token during registration. This is required if the token is to be used for passwordless Passkey authentication where the user does not need to enter their user ID.
Authenticator Attachment (platform or cross-platform) - controls whether a platform type, cross-platform type or either type of token can be registered.

Additionally, the option to select whether the User ID is stored during registration has been removed from the token registration dialog. The behavior is now controlled by policy.

Rate Limiting

Rate limiting is now enforced for trial accounts. The current limits are:

Authentication requests: 5 requests per second (50 requests in a 10-second time window)
Request to retrieve audits: 1 requests per second (10 requests in a 10-second time window)
Administration requests: 3 requests per second (30 requests in a 10-second time window)

New Integrations

The following integrations have been added.

A new OIDC application template for ConnectWise
A new SAML application template for ConnectWise ScreenConnect
A new SAML application template for Epic Hyperdrive. This template is designed to be used with the Entrust Epic Hyperdrive plugin.
A new SAML application template for Fivetran
A new SAML application template for Pingdom
A new RADIUS application template for Sophos XG Firewall

Additionally, the existing RADIUS integration Fortinet has been renamed to Fortinet-FortiGate.

Fixed or changed in this release

Some dates in IDaaS API responses included milliseconds and some did not. Now all date values are consistent and do not include milliseconds. (31481)
Refreshing the page after changing the user locale in the User portal prompts the user to change the locale back to the original value. (31955)
Changing the locale on the login page is not always correctly applied. (31962, 32025, 32107)
The TLS configuration of the IdentityGuard Agent on the Enterprise Service Gateway (ESG) has been updated. It now supports TLSv1.2 and TLSv1.3 and the ciphers TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384. (16301, 31970)
When importing Mobile SDK push notification credentials into IDaaS, the credentials were rejected if they contained extra fields not used by IDaaS. Now those fields are ignored and the credentials are imported. (32040)
When configuring the Knowledge-Based Authenticators Minimum Challenge Size and Default Challenge Size a value of 1 should be allowed. (32523)
The error message displayed when trying to delete a group assigned to an unassigned grid card was incorrect. (31475)
The messages displayed in the Service Provider portal for the delete tenant dialog and the reset resource rule dialogs were incorrect. (31950)
The smart credential activation dialog was not formatted correctly for some locales. (31590)
When creating a CA the UI now prevents the administrator from entering a duplicate name. (32507)
When creating a custom role the UI crashes when trying to add a group. (32061)
When a locale is selected during authentication it is not used if the user needs to register. (32015)
When a service provider unlocks administrators of a tenant it should not make service provider administrators in that tenant active. (32382)
The audit generated when removing a RADIUS application should not list all the attributes of the application. (31133)
Improve the formatting of the Registration Settings page. (31974)
When a user has a FIDO/Passkey token registration for another application, the user portal registration should require that the user register a FIDO/Passkey token for the user portal. (31606)
The audit displayed when a user used a temporary access code as a replacement for a token erroneously stated Grid authentication instead of Token authentication. (32018)
The UI now trims leading and trailing whitespace for the Password Expiry Notification Days setting. (31983)
Improved handling if the user currently logged into the user portal does not match the userid specified in the password expiry link. (31927)
Improved how the number of days until your password expires shown in the password expiry notification email is calculated. (31976)
The smart credential unblock dialog has been refreshed. (31363)
If a duplicate expected location is added to the RBA settings an error is now returned. Previously duplicates were removed without error. (29346)
Improvements made to the OIDC application audits to remove some UUID values that were audited. (24876)
When change the password in the portal for user's in a group with group specific policy for the password expiry the password expiry date from the global policy was used. (32341)
Client Credentials Grant for OAuth2 resources are now sorted. (31520)
Change Password dialog displayed wrong password rules for Include Lowercase set to Not Allowed. (32383)
The User Portal session expiry warning dialog can display negative values until expiry. (32019)
Users with alternative email addresses for OTP may not see the Alternative Authentication option during login. (32647)
The default Group Name Attribute for AD directory synchronization has been changed from sAMAccountName to cn. This change only applies when creating new directories and not to existing directories. (31090)
Access to the user location history page in the Administration portal required the settings View permission which should not be required. (31545)
The Export Audits dialog in the Administration portal does not display the Filters value if it is set to 1 Hour. (31944)
AD Connector page may crash in the UI the if administrator does not have the necessary permission to view it. (32633, 32656)
Dates included in Emails are in English and do not use the user's locale. (15278, 31769)
ActiveSync Device authentication issues have been addressed. Only OAuth authentication is supported now. (32199, 32730)
Prepare Identity as a Service for Salesforce link in Technical Integration Guide is broken. (32060)
Email template preview triggers browser console error. (31899)
Unable to set the attribute mapping for an Azure directory configuration. (32512)
For APIs that do not return a result, the API guides in the developer portal now show the response as "Successful" instead of "No Response". (31024)

Changes to Identity as a Service APIs

Authentication API

The following models have been updated in this release:

authToken has been added to UserAuthenticateQueryParameters. If passed to the authentication query, the query will determine if authentication is allowed with the given auth token.
authenticationCompleted has been added to UserAuthenticateQueryResponse. It indicates if further authentication is required when the auth token was passed as a parameter.
deviceCertAuthDesired has been added to UserAuthenticateQueryResponse. This attribute is currently not used by the public authentication API.
deviceCertAuthDesired has been added to AuthenticatedResponse. This attribute is currently not used by the public authentication API.
registrationAuthenticatorAttachment, registrationRequireResidentKey and registrationUserVerification have been added to FIDORegisterChallenge. These attributes are arguments that describe how the FIDO token should be registered.

Administration API

The following APIs have been added in this release:

POST /api/web/v1/contact/verification/challenge (contactVerificationChallengeUsingPOST)

Given a phone or email contact value this method sends an OTP challenge to the contact using email or SMS.
POST /api/web/v1/contact/verification/authenticate (contactVerificationAuthenticateUsingPOST)

Validate the challenge generated by a previous call to contactVerificationChallengeUsingPOST.

The following models have been added in this release:

OTPVerificationChallengeValue contains the parameters passed to contactVerificationChallengeUsingPOST.
OTPVerificationChallengeResponse contains the response returned from contactVerificationChallengeUsingPOST.
OTPVerificationAuthenticateValue contains the parameters passed to contactVerificationAuthenticateUsingPOST.
OTPVerificationAuthenticateResponse contains the response returned from contactVerificationAuthenticateUsingPOST.
DeviceCertificateContext defines the device certificate context for a resource rule.

The following models have been updated in this release:

inactivityGracePeriod has been added to GeneralSettings. This attribute specifies the amount of time an administrator can grant to a user who has been deactivated due to inactivity to authenticate.
manageInactiveUsers has been added to GeneralSettings. This attribute specifies if inactive users are blocked from authenticating.
userInactivityThreshold has been added to GeneralSettings. This attribute specifies the amount of time a user has to be inactive before they are blocked from authenticating.
frozen has been added to User. This attribute specifies if a user has been frozen (blocked from authenticating) due to inactivity.
frozenGracePeriod has been added to User. If a user blocked from authenticating due to inactivity has been granted a grace period for the administrator this attribute specifies when that grace period expires.
securityId has been added to User and UserParms. This attribute specifies the users security identifier and is used to encode the value into the certificates of their smart credentials which will become a requirement to support Microsoft Windows smart-card login.
userCreationTime and lastModifiedhave been added to User. These attributes specify the date the user was created and last modified.
applyGracePeriod has been added to UserParms. This attribute is used to specify a grace period to users who have been blocked from authenticating due to inactivity.
allowLongLivedToken has been added to AdminApiApplication and AdminApiApplicationParms. This attribute specifies if a long-lived token can be used to authenticate to this admin API application.
denyAccess has been added to DateTimeContext, DeviceCertificateContext, IpContext, KbaContext, LocationContext, LocationHistoryContext, MachineContext, TransactionContext and TravelVelocityContext. This attribute specifies if access to the application associated with the resource rule is denied if this context does not pass evaluation.
deviceCertificateContext has been added to ResourceRule. This attribute returns the device certificate context of a resource rule.
deviceCertificateContext and removeDeviceCertificateContext have been added to ResourceRuleParms. These attributes allow the device certificate context of a resource rule to be set or deleted.

Enterprise Service Gateway Deprecation

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version 5.31 and the three previous releases 5.28, 5.29 and 5.30). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway Operating System.

Microsoft Windows 2012 Deprecation

Microsoft will stop supporting Windows Server 2012 and Windows Server 2012 R2 in October 2023. At that time, Identity as a Service will no longer support clients running on these platforms where they do not support up-to-date TLS ciphers.

Browser Deprecation

Microsoft no longer supports Internet Explorer 11. Identity as a Service ceased support for Internet Explorer 11 after May 2023.

New in this release​

Device Verified Entrust Soft Token Activation​

Application Verified Entrust Soft Token Activation​

Disallow Previously Compromised Passwords​

OTP Delivery using WhatsApp and WeChat​

Token Challenge/Response Authenticator​

Override Certificate Lifetime for PKIaaS​

Improvements for Desktop Credential Provider Offline Token​

Mobile OIDC Developer Guide​

Increase size of IP List​

New Passkey/FIDO2 Algorithms​

Certificate Expiry Notification Improvements​

RADIUS Unknown User Cache Audit Changes​

Entrust Identity Security Whitepaper Updates​

Fixed or changed in this release​

Changes to Identity as a Service APIs​

Authentication API​

Administration API​

Supported TLS Ciphers​

Enterprise Service Gateway Deprecation​

Browser Deprecation​

New in this release​

Locking and Removal of Production Accounts with Expired Entitlements​

SMS/Voice Entitlements Are Required​

SAML Identity Providers​

Flexible External Risk Engines​

Pass-through Authenticator​

Group Attribute Support​

Maximum Password Length Policy​

Outbound SCIM Provisioning Enhancements​

Improved User/Audit Searching for Large Customers​

Webhooks for User Creation​

IDaaS JWT OIDC Grant Type​

RADIUS Agent Caching​

Token Delete Bulk Operation​

Administrator Portal Menu Search Improvements​

IDaaS Logo Change​

Service Provider Tenant Management Improvements​

Improved OIDC Error Information​

New Integrations​

Fixed or changed in this release​

Changes to Identity as a Service APIs​

Authentication API​

Administration API​

Supported TLS Ciphers​

Enterprise Service Gateway Deprecation​

Browser Deprecation​

New in this release​

Identity Verified Activation of Entrust Soft Tokens​

Passkey/FIDO2 Enhancement to Block Synced Passkeys​

Locking and Removal of Production Accounts With Expired Entitlements​

Identity Proofing Management Removed​

Directory and Gateway SSL Certificate Enhancements​

New Integrations​

Fixed or changed in this release​

Changes to Identity as a Service APIs​

Administration API​

Supported TLS Ciphers​

Enterprise Service Gateway Deprecation​

Browser Deprecation​

New in this release​

Face Biometric Authentication with Entrust Identity Mobile​

User Certificate Authentication Matching Policy Update​

Support for Entrust Identity Mobile Features​

User Portal / Admin Portal Enhancements​

Microsoft Entra ID Read-Only Authorization​

Authentication Notification Enhancements​

FIDO/Passkey Enhancements​

SAML/OIDC Enhancements​

Token Report Enhancements​

Service Provider Role Updates​

New Integrations​

Fixed or changed in this release​

Changes to Identity as a Service APIs​

Authentication API​

Administration API​

Supported TLS Ciphers​

Enterprise Service Gateway Deprecation​

Browser Deprecation​

New in this release​

New in this release

Device Verified Entrust Soft Token Activation

Application Verified Entrust Soft Token Activation

Disallow Previously Compromised Passwords

OTP Delivery using WhatsApp and WeChat

Token Challenge/Response Authenticator

Override Certificate Lifetime for PKIaaS

Improvements for Desktop Credential Provider Offline Token

Mobile OIDC Developer Guide

Increase size of IP List

New Passkey/FIDO2 Algorithms

Certificate Expiry Notification Improvements

RADIUS Unknown User Cache Audit Changes

Entrust Identity Security Whitepaper Updates

Fixed or changed in this release

Changes to Identity as a Service APIs

Authentication API

Administration API

Supported TLS Ciphers

Enterprise Service Gateway Deprecation

Browser Deprecation

New in this release

Locking and Removal of Production Accounts with Expired Entitlements

SMS/Voice Entitlements Are Required

SAML Identity Providers

Flexible External Risk Engines

Pass-through Authenticator

Group Attribute Support

Maximum Password Length Policy

Outbound SCIM Provisioning Enhancements

Improved User/Audit Searching for Large Customers

Webhooks for User Creation

IDaaS JWT OIDC Grant Type

RADIUS Agent Caching

Token Delete Bulk Operation

Administrator Portal Menu Search Improvements

IDaaS Logo Change

Service Provider Tenant Management Improvements

Improved OIDC Error Information

New Integrations

Fixed or changed in this release

Changes to Identity as a Service APIs

Authentication API

Administration API

Supported TLS Ciphers

Enterprise Service Gateway Deprecation

Browser Deprecation

New in this release

Identity Verified Activation of Entrust Soft Tokens

Passkey/FIDO2 Enhancement to Block Synced Passkeys

Locking and Removal of Production Accounts With Expired Entitlements

Identity Proofing Management Removed

Directory and Gateway SSL Certificate Enhancements

New Integrations

Fixed or changed in this release

Changes to Identity as a Service APIs

Administration API

Supported TLS Ciphers

Enterprise Service Gateway Deprecation

Browser Deprecation

New in this release

Face Biometric Authentication with Entrust Identity Mobile

User Certificate Authentication Matching Policy Update

Support for Entrust Identity Mobile Features

User Portal / Admin Portal Enhancements

Microsoft Entra ID Read-Only Authorization

Authentication Notification Enhancements

FIDO/Passkey Enhancements

SAML/OIDC Enhancements

Token Report Enhancements

Service Provider Role Updates

New Integrations

Fixed or changed in this release

Changes to Identity as a Service APIs

Authentication API

Administration API

Supported TLS Ciphers

Enterprise Service Gateway Deprecation

Browser Deprecation

New in this release