76 posts tagged with "Release"

New in this release​

Custom Mail Server with OAuth​

Identity as a Service now supports configuring Custom Mail Server settings using OAuth to authenticate a SMTP connection.

Set User Registration in Bulk​

This feature is enhanced to allow administrators to perform two additional actions:

• Upload a group file and require user registration in bulk
• Upload a group file and set user registration to not required in bulk

The header row in the CSV file contains only one column with Name as the value. Each row in the file must be an existing IDaaS group name. To Set User Registration for all users, use the system "All Users" group name with this new option.

Group Policy Registration Settings​

The "Re-Register" action used to force all users to re-register after changing your registration configuration is now removed from the Registration Settings page. The same functionality can be achieved by using the new group-based Set User Registration (see above under new features).

RADIUS Application User ID Domain Processing Option​

RADIUS applications include a new setting to remove the domain value from the user ID during authentication when the user ID provided by the RADIUS client is in the format "domain\username" and the IDaaS user ID is in the format "username". The latest version of the Enterprise Service Gateway is required for this feature.

OIDC Logout Redirect Capability​

Identity as a Service now allows a customer to specify a redirect uri from client applications issuing an OIDC logout.

Location History UI Improvements​

The user location history page has been updated. It now includes the location history expiry date and highlights the value for expired locations.

OTP Audit Improvements​

The audits generated when an OTP authentication is performed have been enhanced to include the address to which the OTP was sent.

SMS OTP Enhancement​

A new option has been added to the OTP settings that allows the customer to optionally include the expiry date of the OTP in the SMS message sent to the end user.

Search Users by Password Expiry​

A new search option "Password Expiry" has been added to the user list search filter. This option allows an administrator to search for users whose passwords will expire in a specified time range. To search on the expiry date of AD passwords, the latest version of the Entrust Service Gateway is required. This feature is only available for Microsoft Active Directory.

Email Customization​

Previously, only Tier 1 production accounts were allowed to fully customize emails when using the IDaaS EMail server. Now all production accounts are allowed to fully customize emails when using the IDaaS EMail server.

Fixed in this release​

The following items have been fixed in this release.

1. Add/Edit RBAC always has one API/URL selected.
2. The performance of user report downloads has been improved especially for very large reports.
3. Attempt to clear password history for an expired password results in an error.
4. Client Credentials Grant action goes back to user portal.
5. Duplicate audit when assigning or unassigning a token to a user.
6. Entrust Legacy Token assign/unassign audit missing.
7. Generate unassigned grid cards for the first time does not refresh the list page.
8. Error when deleting one of multiple resource rules for IntelliTrust AD FS.
9. Pressing "Enter" should log the user in on the KBA screen.
10. It displays "null" on the login page if "Show OTP Delivery Contact" is checked for password reset auth flow.
11. A newly added custom user attribute does not appear in the user portal.
12. Refactoring OTP Delivery Preferences UI.
13. Accounts with the standard feature bundle should not have the OIDC/OAuth token option for users.
14. Unexpected horizontal scroll bar in Add/Edit custom user attribute dialog.
15. RADIUS authentication fails when the RADIUS application is configured for external first-factor authentication and to challenge the user to select the second-factor authenticator. Upgrade to the latest version of the Enterprise Service Gateway for this fix.
16. RADIUS authentication fails when the RADIUS application is configured for fallback from token push or smart credential push authentication. Upgrade to the latest version of the Enterprise Service Gateway for this fix.
17. When configuring a resource rule with first factor password authentication and a second factor authenticator, IP location history for a user is not updated when using RADIUS authentication with a Citrix Netscaler client. Upgrade to the latest version of the Enterprise Service Gateway for this fix.

Changes to Identity as a Service APIs​

The following attributes have been added to models in the administration API.

• includeOtpExpiryDate has been added to OTPAuthenticatorSettings. This new boolean settings indicates if the OTP expiry date should be included in OTP SMS messages.
• passwordExpirationTime has been added to User. This value specifies the expiry date of the user's password. If the user does not have a password or the password never expires this value will be null.
• expiryDate has been added to UserLocation. This value specifies the expiry date of a user location. If the user location does not expire this value will be null.

Enterprise Service Gateway Deprecation​

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version and the three previous releases). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

Browser Deprecation​

Identity as a Service no longer supports Internet Explorer 11.

New in this release​

OAuth Resource Server API Protection via OAuth Roles​

Identity as a Service now supports OAuth roles which provides resource servers with role-based access control (RBAC). OAuth roles can be associated with resource server APIs and scopes. User can then be associated with these OAuth Roles.

A resource server API can be configured with RBAC enabled. In this case, the creation of OAuth access tokens is based on a user's OAuth roles and the scopes permitted by it.

An OAuth role can also extend another OAuth role to provide inheritance of scopes.

There will be a maximum number of 100 OAuth Roles and Resource Server APIs that can be configured in the system.

OAuth All Scope Request Support​

Identity as a Service now supports the scope value all_scopes to indicate that all the scopes supported by a resource server API are being requested.

Identity Provider Authentication​

Identity as a Service now allows a customer to define OIDC Identity Providers which can be used as alternative authentication to authenticate to the IDaaS portal, SAML applications and OIDC applications. Additionally, users can be created or updated in IDaaS based on the information returned from the Identity Provider.

Soft Token SDK Customized Push Message​

Identity as a Service now supports customized push notification messages for customized soft token apps that use the entrust SDK. This feature does not apply to the Entrust Identity soft token app.

Push Notification Sound Notifications for iOS Devices​

Identity as a Service now supports push notification with sound for iOS devices.

Email Customization​

Previously only accounts with a custom email server defined could fully customize emails. Now, tier one production accounts can also fully customize emails even if they are using the default email server. Trial accounts and child accounts of service providers are still restricted.

Bulk Operations​

Two new bulk operations have been added. The Set Users bulk operation supports updating users. It also includes an option to create users that do not exist. The Set Grids bulk operation supports updating the state of assigned grids. Additionally, an option has been added to the Import Users bulk operation to optionally update users that already exist.

AD Connector Improvements​

A new version of AD Connector is available for use with IDaaS. IDaaS has been enhanced to display more information about the AD Connector instance, including the state (active/inactive), version, and hostname.

Smart Credential Push Signature​

Two new APIs have been added to the IDaaS Admin API to support smart credential push signature. Push signature allows an application to sign data using a private key on the end user's mobile smart credential using push transactions. Access to these new APIs is controlled by a new permission "SMARTCREDENTIALSSIGNATURE".

New SAML Integration​

A new SAML application template has been added for New Relic.

Changes in this release​

The following changes have been made to address issues or enhance existing functionality.

1. In 5.18 the behavior of the locked user search criteria changed. It no longer filters out users who were locked out but whose lockout has expired. However because those users are not locked, the unlock action was not available. The unlock action is now enabled for those users.
2. The group list dropdown in the Group Policy Edit page overlaid the title. This has been fixed.
3. Phone entry fields in both the admin and user portal have been improved to indicate the required phone number format.
4. The button in the Add Alias and Add Attribute dialogs in the user profile page has been renamed from Ok to Add.
5. Text entry in the Device Fingerprint dialog did not always register. This has been fixed.
6. The Group and Role selection when creating or editing a user in the Admin portal has been updated.
7. When the group membership in the user profile is modified, the Save button wasn't enabled. This has been fixed.
8. When adding and then removing a group from some group lists (for example, the user group membership) could result in the wrong group being removed.
9. When modifying the second-factor authenticators for Password Reset Settings, the Save button wasn't enabled. This has been fixed.
10. Exporting report files has been improved to support very large reports.
11. The Import User bulk operation has been improved to support importing a large number of users.
12. Issues with importing an IdentityGuard export file with names containing certain character sequences shave been addressed.
13. Issues with importing an IdentityGuard export file with non-North American phone numbers have been resolved.
14. The IdentityGuard Import and User Delete bulk operations now generate log files that can be downloaded. A sample bulk file is now provided for the user delete bulk operation.
15. The error message displayed by the Import User bulk operation when the administrator did not have access to the specified groups was not clear. This has been fixed.
16. The error message displayed by the Token Assign bulk operation when the user has the maximum number of allowed tokens has been improved.
17. An extra space included in the assigned grid export when the | separator is selected has been resolved.
18. Cloning the super admin role resulted in a role that did not have access to administrators. This has been fixed.
19. The Digital Ids listed for a PKIaaS CA were not sorted. This has been fixed.

Changes to Identity as a Service APIs​

The following attributes have been added to models in the authentication API.

• pushMessageIdentifier has been added to UserChallengeParameters. This value allows an application to specify what custom push message should be used for a push authentication.

The following attributes have been added to models in the administration API.

• lock has been added to UserParms. This value allows an administrator to lock all authenticators for a user.
• oauthRoles has been added to User. This value specifies the list of OAuth roles a user has been associated with.
• oauthRoles has been added to UserParms. This value specifies the list of OAuth role ids a user should be associated with.

The following models have been added to the administration API.

• OAuthRole has been added for OAuth roles. This model specifies the attributes of an OAuth role.
• SmartCredentialStartSignParms has been added for smart credential push signature. This model specifies the parameters passed to the start signature operation.
• SmartCredentialStartSignResponse has been added for smart credential push signature. This model specifies the response returned from the start signature operation.
• SmartCredentialCompleteSignParms has been added for smart credential push signature. This model specifies the parameters passed to the complete signature operation.
• SmartCredentialCompleteSignResponse has been added for smart credential push signature. This model specifies the response returned from the complete signature operation.

The following APIs have been added to the administration API.

• modifyUserOAuthRoleAssociationsUsingPUT. This API updates the OAuth role ids associated with a user.
• listOAuthRolesUsingGET. This API lists the OAuth roles.
• startSignSmartCredentialUsingPUT. This API starts a smart credential push signature operation.
• completeSignSmartCredentialUsingPUT. This API complete a smart credential push signature operation.

Enterprise Service Gateway Deprecation​

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version and the three previous releases). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

Browser Deprecation​

In August 2021 Microsoft will no longer support Internet Explorer 11 for Office 365 (Microsoft's statement). At that time, Identity as a Service will also cease support for Internet Explorer 11.

ActiveSync now supported for Microsoft Office 365 with OAuth 2 device code authentication​

Identity as a Service now supports ActiveSync using OAuth 2 device code authentication. A new setting has been added to the ActiveSync Access page to migrate existing administration from using basic authentication to OAuth 2 device code authentication.

Group-based Policy​

The existing Settings menu has been split into two menus: Configuration and Policies.

Configuration settings apply globally to the tenant. Using Policies, administrators can adjust settings on a per group basis. For example, you can configure users in different groups to use different levels of security, such as the length of the OTP and lockout attempts.

One-step Multi-factor Authentication​

One-step multi-factor authentication is been added to RADIUS applications.

New settings have been added under RADIUS Application page to enable one-step multi-factor authentication and to specify the length of second factor response. When enabled, the user must enter their password and second-factor response in the same password field. Only temporary access code and token are supported as second-factor authenticators. Also, the second factor can be opted from the resource rules page. As a second factor authenticator, Soft token and Temporary access code are supported.

Changes to Administration Portal​

The following enhancements have been made to the administration portal:

• The Risk-based authentication (RBA) Location History table has been refreshed to include a delete and add expected location options for each row in the table. In addition, filter options have been added to search by Last Authentication Time and Country.

Trial Account Expiry​

Trial accounts now expire after 60 days instead of 30 days.

Additional enhancements to OTP-based authentication​

Administrators can now set the default OTP delivery attribute for each type of delivery - Email, SMS and Voice.

Users can now set their own OTP delivery attributes in the user portal.

Enterprise Service Gateway Deprecation​

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version and the three previous releases). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

Browser Deprecation​

In August 2021 Microsoft will no longer support Internet Explorer 11 for Office 365 (Microsoft's statement). At that time, Identity as a Service will also cease support for Internet Explorer 11.

Changes to Identity as a Service APIs​

The following changes have been made to the authentication API:

• supportChoosingOtpDelivery has been deprecated from UserAuthenticateQueryParameters. Clients who support choosing OTP delivery can still work without having to supply this flag.
• supportChoosingOtpDelivery has been deprecated from UserAuthenticateQueryParameters. Clients who support choosing OTP delivery can still work without having to supply this flag.

The following changes have been made to the administration API:

The following attributes have been added to models in the administration API.

• otpSmsDefaultDeliveryAttribute has been added to OTPAuthenticatorSettings. This setting specifies the user attribute to be used to deliver the SMS OTP when no attribute is specified.
• otpEmailDefaultDeliveryAttribute has been added to OTPAuthenticatorSettings. This setting specifies the user attribute to be used to deliver the Email OTP when no attribute is specified.
• otpVoiceDefaultDeliveryAttribute has been added to OTPAuthenticatorSettings. This setting specifies the user attribute to be used to deliver the Voice OTP when no attribute is specified.
• the attribute registrationEnabled has been added to User. This attribute indicates if registration is enabled for the specified user.

The value NONE has been deprecated from the enumerated type OTPDeliveryType in OTPAuthenticatorSettings. Use of default attribute specific to delivery mechanism is recommended eg. otpSmsDefaultDeliveryAttribute, otpEmailDefaultDeliveryAttribute"

Feature Bundles​

Identity as a Service tenants are now assigned a feature bundle. The bundle determines the Identity as a Service features available to the Tenant account. See About Service Provider bundles in the Service Provider guide for more information.

Mobile Device Fingerprint​

Identity as a Service now supports validation of machine authentication with Android and iOS device fingerprints.

Enhanced OTP-based authentication with the ability to choose delivery contact​

Administrators can now create custom attributes to allow users to use alternate email, voice, or SMS delivery options for OTP authentication. When configured, an alternative OTP delivery attribute can be set as the default delivery method. If a user has both a default delivery contact and an alternate delivery contact, the user can click Alternative Authentication on the second-factor log in screen and choose another OTP delivery contact.

The OTP delivery options appear on the user login screen with masked values. For email addresses, the first three characters and the domain name are not masked. For example support@entrust.com is shown as sup***@entrust.com. For phone numbers, the last 4 digits are not masked. For example +12345678910 is shown as ******8910. Note that for short email addresses the actual address may be visible.

SIEM Syslog Application​

SIEM integration with Identity as a Service allows audit logs to be sent to syslog through an Enterprise Service Gateway. The Syslog SIEM application downloads audit logs from Identity as a Service into your Enterprise Service Gateway and publishes them to your on-premise SIEM syslog server.

There are two known limitations with this feature:

• the date for the audit logged with SIEM is the time that the audit was written to SIEM rather than the time the audit was generated in Identity as a Service.
• communication from the SIEM agent on the Enterprise Service Gateway to the SIEM system does not use the network proxy if it is configured for the gateway.

Unlock Rate Limitation​

To keep accounts safe, Identity as a Service now only allows unlock password once within a certain period of time. Users must now wait 15 minutes between each password unlock request. A warning appears if the request is issued before the waiting period elapses. When enabled, users receive an email notification for any password lock, unlock, or unlock attempt action on their account.

New Service Provider Roles​

This release includes two new Service Provider roles:

• Users with the Customer Support Agent role can reset resource rules, unlock administrators, view usage reports, and view account entitlements.

• The API Account On-boarding role can add tenants using the administration API calls.

Changes to Administration Portal​

The following enhancements have been made to the administration portal:

• The risk-based authentication (RBA) expected locations table now includes a filter option to search by country and a delete option for each row.

New SAML Integrations​

New SAML application templates have been added for Asana Enterprise, Expensify, monday.com, Sumo Logic and Workfront.

Changes to Identity as a Service APIs​

The following changes have been made to the authentication API:

The following attributes have been added to models in the authentication API.

• otpContactValues has been added to OTPDetails. This attribute lists the contact values that are available for delivering an OTP returned from userAuthenticateQuery.
• otpDeliveryAttribute has been added to OTPDetails. This attribute specifies the default OTP delivery attribute and is returned from userAuthenticateQuery.
• supportChoosingOtpDelivery has been added to UserAuthenticateQueryParameters. If a client supports selecting which contact value to use for delivering the OTP, this attribute should be set to true.
• otpDeliveryAttribute has been added to UserChallengeParameters. It specifies the name of the OTP contact value to use to delivery the OTP if selected by the client.

The following changes have been made to the administration API:

The version of the following administration APIs have been changed to v4. The create tenant and set entitlement APIs now require the bundle type attribute to be set which was previously ignored. The other APIs have not been changed and the versions have only changed to be consistent.

• createTenantsUsingPOST
• removeTenantUsingDELETE
• getTenantUsingGET
• getTenantsPageUsingPOST
• lockTenantUsingPUT
• unlockTenantUsingPUT
• getTenantEntitlementsUsingGET
• getTenantEntitlementUsingGET
• setTenantEntitlementUsingPUT
• getEntitlementUsageInfoUsingPOST

A new value NONE was added to the enumerated type OTPDeliveryType in OTPAuthenticatorSettings. A new version v3 was created for the APIs getOTPAuthenticatorSettingsUsingGET and updateOTPAuthenticatorSettingsUsingPUT to support the enumerated type change.

The following attributes have been added to models in the administration API to support OTP contact value changes.

• otpDefaultDeliveryAttribute has been added to OTPAuthenticatorSettings. This setting specifies the user attribute to be used to deliver the OTP when no attribute is specified.
• showOtpDeliveryContact has been added to OTPAuthenticatorSettings. This setting specifies if the value of the OTP contact value should be shown by the client.
• userExtraAttributes has been added to User and UserParms. These attributes are used to manage the extra OTP contact values for a user.
• type has been added to UserAttribute and UserAttributeParms. This attribute specifies the type of a user attribute indicating if it is phone number or email address when used as an OTP contact value.

Enterprise Service Gateway Deprecation​

Entrust will only support the last four releases of the Enterprise Service Gateway (the current version and the three previous releases). Entrust recommends that customers always upgrade their Enterprise Service Gateway to the latest release because each release contains security updates to the Enterprise Service Gateway O/S.

Browser Deprecation​

In August 2021 Microsoft will no longer support Internet Explorer 11 for Office 365 (Microsoft's statement). At that time, Identity as a Service will also cease support for Internet Explorer 11.

Support PKI as a Service (PKIaaS)​

Entrust now provides a new PKI as a Service (PKIaaS) capability as described in the Entrust PKI as a Service. For Identity as a Service customers who have purchased the Smart Login capability, they now have the option to use PKI as a Service as the CA used to issue certificates to their smart credentials. A PKI as a Service CA can be provisioned and managed from Identity as a Service without additional setup as is required for the other CAs supported by Identity as a Service.

OAuth Resource Server API Protection​

Identity as a Service now supports OAuth (OAuth 2.0 and 2.1) Resource Server API protection. Resource Server APIs and associated scopes can be defined and used with various OAuth use cases, including Authorization Code and Client Credentials grants to issue OAuth access tokens. The existing OpenID Connect (OIDC) applications are now classified as either Web, Single-Page App (SPA), or Server applications. These applications can now also be used with OAuth. Additionally, refresh tokens can now be issued with both OIDC and OAuth access tokens. Refresh tokens can also be revoked.

The following OIDC/OAuth endpoints are deprecated. They will be removed in a future Identity as a Service release. They are replaced with the corresponding endpoints.

• /api/oidc/OIDC/authorize -> /api/oidc/authorize
• /api/oidc/OIDC/token -> /api/oidc/token
• /api/oidc/OIDC/userinfo -> /api/oidc/userinfo
• /api/oidc/OIDC/error -> /api/oidc/errors
• /api/oidc/OIDC/logout -> /api/oidc/endsession

OIDC Grant Type Deprecation​

The Implicit grant type has security implications. It will not be supported with OAuth application flows. It is currently supported with OpenID Connect (OIDC) but is deprecated. It will be removed in a future Identity as a Service release. Applications using the Implicit grant type should use the Authorization Code grant type with Proof Key for Code Exchange (PKCE) instead.

Support for Entrust Mobile Soft Token Transaction Queueing​

Entrust Identity as a Service can now be configured to allow Mobile Soft Token transactions to be queued. Previously, if a transaction was not confirmed before another one was received, the first transaction would be overwritten. Additionally, transactions may now be prioritized as well.

New SAML Integrations and Rebranding​

New SAML application templates have been added for Awardco, Citrix Workspace, Datadog, KnowBe4, Smartsheet and Zoho One. CitrixOnline has been rebranded as LogMeIn GoTo Apps and G Suite has been rebranded as Google Workspace.

SMS OTP Message Changed​

The format of the SMS OTP Message has changed from

12345678 is your Entrust Identity as a Service OTP.

to

Your Entrust Identity as a Service OTP is 12345678.

The service name (Entrust Identity as a Service) can be customized.

Changes to Administration Portal​

The following enhancements have been made to the administration portal:

• for service providers, the last super admin user in the account can no longer be deleted
• when an administrator creates a password for a user, "Change is required on first use" is now checked by default.
• the Unassign action is now available for hardware tokens listed in a user's authenticators list. Previously, Unassign was only available from the Assigned Tokens list.

Changes to IdentityGuard Agent​

The IdentityGuard Agent in the 5.16 gateway has been changed as follows:

• Improved interoperability with IdentityGuard clients performing token push authentication when fallback to token authentication is required.
• Support for TLS versions 1.0 and 1.1 has been removed.
• Support for the TLS ciphers TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, and SSL_RSA_WITH_3DES_EDE_CBC_SHA that don't support perfect forward secrecy have been removed.

Service Provider Expired Trial Account Removal​

Expired Trial accounts are automatically locked and they can no longer be accessed by tenants. Identity as a Service has a new daily process that scans these accounts and performs the following actions:

• Removes Trial accounts that are locked and that have been expired for 180 days. No recovery is possible when this happens.
• Sends an email with the list of accounts that have been removed or that will be removed shortly. Notifications are sent 14 and 7 days before removal. Note that this requires that the service provider account has notifications enabled (see Settings > Notifications).

Changes to Identity as a Service APIs​

The following changes have been made to the authentication API:

• a new attribute priority has been added to the UserChallengeParameters. This attribute can be used to specify the priority of a push transaction.

The following APIs have been added to the administration API. These APIs are currently only supported for certificates associated with smart credentials issued from a PKIaaS CA.

• exportCertificateUsingGET. This API exports a certificate associated with a smart credential.
• holdCertificateUsingPUT. Put a certificate associated with a smart credential on hold.
• revokeCertificateUsingPUT. Revoke a certificate associated with a smart credential.
• unholdCertificateUsingPUT. Remove a certificate associated with a smart credential from hold.

The following APIs have been modified in the administration API.

• a new boolean attribute revocationInfo has been added to the API getSmartCredentialUsingGET. If specified as true, the current revocation status of all the certificates associated with the smart credential being fetched is retrieved from the CA. If the attribute is not specified, it defaults to false. This attribute is only supported for smart credentials issued from a PKIaaS CA.

The following attributes have been added to models in the administration API.

• digitalIdType has been added to DigitalIdCert. This value specifies whether the certificate is associated with the PIV Card Holder or PIV Card Digital ID of the smart credential.
• pivContainer has been added to DigitalIdCert. This value specifies the name of the PIV Container on the Smart Credential in which this certificate (and its private key) is stored.
• status has been added to DigitalIdCert. This value specifies the revocation status of the certificate if retrieved from the CA. Currently this value is only supported for certificates issued from a PKIaaS CA.
• maxNumberOfPushTransactionsQueued has been added to GeneralSettings. This value specifies the maximum number of push transactions that can be queued.
• pushTransactionLifetime has been added to GeneralSettings. This value specifies the lifetime of a push transaction.

Browser Deprecation​

In August 2021 Microsoft will no longer support Internet Explorer 11 for Office 365 (Microsoft's statement). At that time, Identity as a Service will also cease support for Internet Explorer 11.

New SAML Integrations​

New SAML application templates have been added for AppDynamics, Atlassian Access, BambooHR, Envoy, Jamf Pro, MuleSoft, PagerDuty, Snowflake, Splunk.

Generic LDAP Sync​

In addition to the existing Active Directory (AD) and Azure AD sync and password authentication functionality, Identity as a Service now supports user and group synchronization, password authentication, and password management (change, unlock, and reset) from non-AD LDAP directories.

In some LDAP directories, if an account becomes locked due to too many incorrect password attempts, the account unlock feature may return an error preventing the user from unlocking their account. If this occurs, use one of the following workarounds:

1. Disable the User Unlock Account setting and enable the "Enable Forgot Password" setting in the Identity as a Service Password Authenticator Settings (Settings > Authenticators > Password). Doing this allows users to complete the reset password flow and clears the account lock after the password has been successfully reset. See Modify password authenticator settings.
2. Modify your LDAP schema to update the pwdAccountLockedTime attribute to remove the NO-USER-MODIFICATION flag to allow the pwdAccountLockedTime attribute to be removed without requiring a user's password to be changed or reset.

AD Connector enhancements​

• AD Connector can now be used for password authentication, password change and password reset scenarios for the users imported by the AD Connector.
• Redundant instances of AD Connector can now be created to support high availability setups.
• AD Connector can now be used in Cloud App federation integrations (SAML, OIDC) for the users imported by the AD connector by supporting custom AD attributes.
• AD Connector can now optionally import short user aliases together with the other login formats.

Browser Deprecations​

In August 2021 Microsoft will no longer support Internet Explorer 11 for Office 365 (Microsoft's statement). At that time, Identity as a Service will also cease support for Internet Explorer 11.

Changes to Identity as a Service APIs​

The following changes have been made to the Administration APIs:

• A new attribute groupObjectClass has been added to the DirectorySync. This value specifies the directory object class that contains a user's group membership.
• A new attribute type has been added to the Directory with values AD and LDAP. This value specifies the type of directory from which users can be synchronized.

New SAML integrations​

New SAML application templates have been added for Docusign, Dropbox Business, RingCentral, ServiceNow, Tableau, and Zoom.

Browser Deprecations​

In August 2021 Microsoft will no longer support Internet Explorer 11 for Office 365 (Microsoft's statement). At that time, Identity as a Service will also cease support for Internet Explorer 11.

Support for new languages​

Support for the following languages has been added: Dutch, Turkish, and Traditional Chinese.

User Interface improvements​

• You can now enter a list of RADIUS hostnames instead of a single comma-separated list of hostnames.
• The Entrust Soft Token activation process has been improved to make it easier to activate your token on mobile and desktop devices.
• The Google Authenticator activation now displays the manual activation parameters making it easier to activate on an TOTP-compliant application.
• The Add Application page now includes a search bar to make it easier to find the application template you are looking for.

Bulk Operation enhancements​

The import user and import user/group bulk operations now log all results to a file that can be downloaded.

Changes to Identity as a Service APIs​

A new API logoutUsingPOST has been added to the authentication API allowing the application to logout its session.

The following deprecated API endpoints have been removed from the administration API

• listUnassignedTokensUsingGET replaced by unassignedTokenPageUsingPOST
• listAssignedTokensUsingGET replaced by assignedTokenPageUsingPOST

CORS Policy​

In order to improve the security of the platform, the default CORS policy for Identity as a Service has been updated so that it is disabled by default. This may impact some customers who are calling the Identity as a Service APIs from their Web applications. If you are affected, enable CORS in the General Settings page of your Identity as a Service account and add your Web application's origin to the list of allowed Origins.

Email Template Customization​

Identity as a Service has been enhanced to allow full customization of email templates when the account has been configured to use your own mail server. When your account is using the Identity as a Service mail server, only limited email customization is available.

New SAML Integrations​

New SAML application templates have been added for Dell Boomi, Oracle EPM Cloud and Zendesk.

Unlock password without having to reset it​

A new option has been added to the Password Settings to allow users to unlock their password without having to change it when it has been locked.

Password unlock is supported for local users and users synced from On-Premise Active Directory. Password unlock for users synced from Azure AD is not supported at this time.

Get Started Wizard​

A Get Started Wizard has been added to the Dashboard page to help setup Identity as a Service.

Smart Credential Enhancements​

The following enhancements have been made to smart credentials.

• When configuring a smart credential definition, you can now specify the CA of the PIV Content Signer explicitly or you can have the PIV Content Signer come from the same CA as the digital id configurations which is the existing behavior.

• A smart credential can be created without digital id configurations.

• When activating a smart credential using the administration API, enrollment values can be specified. If the values are specified during activation rather than stored with the smart credential, the values are cached instead of stored in the database and are automatically removed after the smart credential is encoded. You may want to use this capability if you are encoding sensitive information onto the smart credential that you do not want stored in the Identity as a Service database.

• A user image can be provided as an additional attribute when activating a smart credential. If present, the user image is encoded onto the mobile smart credential.

External Authentication Bypass Second-Factor Authentication​

A new setting has been added to resource rules to allow users that do not exist in Entrust Identity as a Service to bypass second-factor authentication if the performed first-factor is external authentication.

OATH HOTP Token Support​

Entrust Identity as a Service has added support for OATH HOTP (event-based) hardware tokens to be used as a second-factor authenticator. The event window and reset event window settings for OATH HOTP tokens can be configured in the Hardware Token settings.

Bulk Assign Hardware Tokens​

A new bulk operation to assign hardware tokens to users has been added. The bulk upload is a CSV file containing "userId" and "serialNumber" columns. The following is a sample CSV for bulk assigning hardware tokens:

userId,serialNumber user1,1234567 user2,2345678 user3,3456789

Service Provider Usage Reports​

The Usage Report CSV file includes two new columns for Consumed and Previously Consumed Entitlements. The consumed column value depends on the entitlementType:

| entitlementType | The consumed column value represents | | --------------- | ------------------------------------------------ | | USERS | the number of ACTIVE users | | SMSVOICE | the number of SMS/Voice credits used | | IDPROOFING | the number of ID Proofing transactions completed | | ISSUANCE | the number of credentials successfully printed |

The consumedPrevPeriod column value shows the same values as the consumed column but in the previous month.

The serviceBundle column value for the USERS entitlementType has changed from DEFAULT to PLUS.

Changes to Identity as a Service APIs​

The following changes have been made to the Administration APIs:

• A new attribute corsEnabled has been added to the GeneralSettings. When enabled, cross-origin requests that match the values specified in corsOrigin are allowed. When disabled, cross original requests are not allowed.
• A new attribute corsOrigins has been added to the GeneralSettings. When configuring CORS on the Settings page, it passes a list of allowed CORS origins.
• A new attribute showOnboardingWizard has been added to the GeneralSettings. When enabled, the Onboarding Wizard will be shown on the Admin Portal Dashboard.
• A new attribute skipSecondFactorIfUserNotExist has been added to ResourceRule. When enabled, a user that does not exist will skip second-factor authentication.
• A new attribute algorithmType has been added to Token. This value specified the algorithm used by the token to generate OTPs.
• A new attribute additionalUserInfo has been added to ActivateSmartCredentialParms. This attribute can be used to specify additional parameters passed to the smart credential when it is encoded.

API Deprecations​

The following API endpoints are deprecated and will be removed in Identity as a Service 5.14:

| Name | Operation | Replacement | | ------------------------------- | ---------------------------- | ---------------------------- | | List Unassigned Hardware Tokens | listUnassignedTokensUsingGET | unassignedTokenPageUsingPOST | | List Assigned Hardware Tokens | listAssignedTokensUsingGET | assignedTokenPageUsingPOST |

New SAML Integrations​

A new SAML application template has been added for Workday.

Generate Unassigned Grid Cards​

Identity as a Service has been enhanced to allow you to create a large number of grid cards at a time. The maximum number you can generate at one time is dependent on your entitlement quantity.

Microsoft CA Support​

Support for renewed root and subordinate (i.e, intermediate) CAs has been added.

SMS/Voice Entitlements​

A new credit-based entitlement is introduced for OTP delivery by SMS or Voice. Tenants that want to continue using OTP authentication along with SMS or Voice delivery will require a new contract with their Service Provider. E-mail OTP delivery will still be freely available for users with a valid email address.

Enhancements in LDAP configuration of Entrust managed PKI CA​

You can now use a secure LDAP connection between Entrust and your Entrust Managed PKI CA. You can also optionally provide username and password for the authenticated LDAP connection.

Changes to SAML IDP Initiated Login​

Previously when a SAML IDP Initiated Login was performed, the user was prompted to choose whether to open the application in a new window or use the existing window. This option has been removed and now the application is always opened in a new window.

Changes to Identity as a Service APIs​

The following changes have been made to the Administration APIs:

• A new attribute smsVoice has been added to the EntitlementParms object. It defines the SMS/Voice entitlement attributes.

API Deprecations​

The following API endpoints are deprecated and will be removed in Identity as a Service 5.14:

| Name | Operation | Replacement | | ------------------------------- | ---------------------------- | ---------------------------- | | List Unassigned Hardware Tokens | listUnassignedTokensUsingGET | unassignedTokenPageUsingPOST | | List Assigned Hardware Tokens | listAssignedTokensUsingGET | assignedTokenPageUsingPOST |

IntelliTrust Rename​

As of release 5.11, the name of IntelliTrust has been changed to Identity as a Service. There is no change in functionality of your existing instance of IntelliTrust apart from the features and functionalities mentioned in these release notes.

Transaction Context Risk Support with Resource-based Authentication​

Risk-based authentication has been enhanced to verify whether transaction details included in an authentication request match the transaction rules defined in the resource rules. Transactions that do not match the transaction rules add risk to the authentication. Only authentications using the Authentication API support Transactions.

SAML Signing Certificate Enhancements​

SAML Signing Certificates have been enhanced to support certificates issued by a CA and existing self-signed certificates. To replace the default self-signed certificate with a certificate issued by a CA, there is an option to generate a PKCS#10 certificate-signing request (CSR). Your CA uses the CSR to generate a certificate which is returned to Identity as a Service as either a PKCS#7 certificate response or a list of certificates. The existing Download option has been enhanced to support options to export the SAML certificate, the root CA certificate, or the entire PKCS#7 certificate chain.

SAML Integrations​

New SAML application templates have been added for Coupa and WhiteSource.

Administration Restrictions based on Group Membership​

Administration roles have been enhanced to include restrictions on the groups an administrator can access. A role can be configured to have access to all groups, own groups (the groups the administrator belongs to), or a specific list of groups. An administrator can only access users and user authenticators that belong to a group to which they have access. Additionally, unassigned grids and tokens can be assigned to groups with similar access restrictions. Related to these changes, the ability to filter by group has been added to the assigned and unassigned grid and token list pages.

Disable Single Sign-On for Portal Applications​

It is now possible to disable Single Sign-On for portal applications. Previously, this was only available for SAML and OIDC applications. This option is enabled by default for new accounts.

Support user-based lock instead of authentication-based​

The General Settings page includes a Lockout Mode setting. This settings controls whether a locked out authenticator locks the user or only locks the authenticator. Previously only the authenticator was locked out.

Changes to Identity as a Service APIs​

The following changes have been made to the Authentication APIs:

• A new attribute transactionDetails has been added to the UserAuthenticateQueryParameters object.This attributes passes in transaction details for resource-based authentication based on transaction rules.

The following changes have been made to the Administration APIs:

• The validateUserPassword API response attribute adComplexity now returns true or false based on the contents of the password. Previously, if the AD Complexity password setting was disabled, the result would always return true.
• New objects TransactionContext and TransactionRuleRisk have been added as part of resource-based authentication support for transaction rules.
• A new attribute transactionContexts has been added to the ResourceRuleParms object. It defines the transaction rules with resource-based authentication.
• A new attribute transactionContexts has been added to the ResourceRule object. It associates transaction rules with resource-based authentication.
• A new API endpoint GET /api/web/v1/transactionrules (getTransactionRulesUsingGET) has been added that returns a list of configured transaction rules. A transaction rule is defined by a new object TransactionRuleDescription. Transaction rules are used with Resource-based authentication.
• A new API endpoint POST /api/web/v1/tokenspaged/unassigned (unassignedTokenPageUsingPOST) has been added. This endpoint provides the ability to list unassigned hardware tokens with server side searching and paging.
• A new API endpoint PUT /api/web/v1/tokens/{tokenid} (modifyTokenUsingPUT) and new object TokenParms has been added. This endpoint provides the ability to modify the group membership of an unassigned hardware token.
• A new API endpoint PUT /api/web/v2/grids/{gridid} (modifyUnassignedGridUsingPUT) and new object GridParms has been added. This endpoint provides the ability to modify the group membership of an unassigned grid.
• A new search criteria groupId is now supported in SearchParms when listing assigned or unassigned grids or tokens. This attribute allows you to list grids or tokens in a specified group.
• A new attribute groups has been added to Token. When fetching unassigned hardware tokens, the groups attribute returns the hardware token group membership.
• A new attribute groups has been added to Grid. When fetching unassigned grids, the groups attribute returns the grid group memberships.
• A new attribute groups has been added to GridCreateParms. When creating unassigned grids, the groups attribute can be used to optionally specify the group membership of the new grids.
• New attributes groupManagement and groupIds have been added to Role. When fetching a role these attributes specify the groups that the role can manage.
• A new attribute lockoutMode has been added to GeneralSettings. The attribute is returned when fetching general settings and can be set when modifying the general settings.

API Deprecations​

The following API endpoints are deprecated and will be removed in Identity as a Service 5.14:

| Name | Operation | Replacement | | ------------------------------- | ---------------------------- | ---------------------------- | | List Unassigned Hardware Tokens | listUnassignedTokensUsingGET | unassignedTokenPageUsingPOST | | List Assigned Hardware Tokens | listAssignedTokensUsingGET | assignedTokenPageUsingPOST |