Advanced Authentication 6.2 Release Notes

Improved Database Export and Import for a Cluster

The database export and import process has been improved to keep the cluster configuration intact while importing the database.

You can refer to the Disaster Recovery procedure if the cluster is lost while importing the database. For more information, see Recovering from a Disaster in the Advanced Authentication - Administration guide.

An Option to Configure the Whitelist IP Address for Endpoint Registration

Advanced Authentication facilitates an administrator to add a preferred IP addresses to the Whitelist IP Address. This helps to register a trusted endpoint from these IP addresses with the administrator’s credentials.

The endpoint registration request from any other IP address that is not included in the whitelist are blocked automatically.

For more information, see the Endpoint Management Options policy in the Advanced Authentication - Administration guide.

An Option to Disable the LDAP Cache

In one of the previous versions, a 5 minute LDAP caching on the server was implemented. This increased performance and solved issues for environments where the connection to LDAP servers was unstable or slow. However, the caching opened a security issue because within these 5 minutes a locked or a deleted user, or a user with an expired password was able to authenticate.

In this release, the LDAP caching is disabled by default to enhance security but introduces an option LDAP caching, which allows you to enable the LDAP caching to improve performance.

For more information, see the Login Options policy in the Advanced Authentication - Administration guide.

Customized Permissions for Sharing the Authenticators

Previously, a Helpdesk administrator was allowed to share authenticators by default. This resulted in security issues because the helpdesk administrator can misuse the authenticators of users.Now, only when assigned as a member in the SHAREAUTH ADMINS role, a Helpdesk administrator can share the authenticators.

For more information, see Local Repository in the Advanced Authentication - Administration guide.

An Option to Use Repositories Instead of Groups

This release introduces an option that allows you to use repositories in place of groups. You can use a group of users in a specific repository or all the users of the repository.

For more information, see Creating a Chain in the Advanced Authentication - Administration guide.

An Option to Migrate a Repository

This release introduces the command line migration tool RepoMigrationtool that allows you to migrate user’s data from a repository to another repository. This helps customers who plan for migrating one repository to another to retain authenticators and avoid re-enrollment.

For more information, see Migrating the Repositories in the Advanced Authentication - Repo Agent guide.

Improved RADIUS Authentication

The RADIUS logic has been changed from Freeradius plug-in to AuCore REST API. In addition, the RADIUS logs have been enhanced.

An Option to Send SamAccountName in the SAML Response

The samAccountName attribute can now be sent as a NameID element in the SAML response from the Advanced Authentication server. This option has been added for the integration with CyberArk when Advanced Authentication is used as the SAML identity provider.

For more information, see “Creating a SAML 2.0 Event” in the Advanced Authentication - Administration guide.

New Widgets

This release introduces the following widgets on the dashboard:

These widgets help administrators to analyze information about the number of logged in users for each event.

For more information, see “Total Users” and “Total Users Per Event” in the Advanced Authentication - Administration guide.

Customizing the Prompts of Authentication Method Required for RADIUS Client

Advanced Authentication now allows customization of the prompt message specific to the authentication method that is displayed on the RADIUS Client.

For example, In Custom Messages policy, the administrator customizes the prompt message for SMS OTP method that is mapped to the RADIUS event. When a user initiates authentication to a RADIUS event using the SMS OTP method, the customized prompt message is displayed on the RADIUS Client.

For more information, see “Customizing Prompt Messages of the Authentication Methods for RADIUS Event” in the Advanced Authentication - Administration guide.

Log Level of the SQL Alchemy Are Revised

Previously, in the Background tasks tab of Logs, an enormous number of log entries are stored for the SQL alchemy commit and new transactions.

Log level of SQL alchemy transactions have been revised so that the debug transactions are not stored in the Background tasks.

An Option to Display the Serial Number of an Enrolled Token

This release introduces an option to allow users to view the serial number of an enrolled token for the HOTP and TOTP methods on the Self-Service portal.

Pre-installed Netcat

With this release, a fresh installation of Advanced Authentication appliance includes the Netcat pre-installed for resolving the possible network connectivity issues.

The Netcat package is not available when you upgrade Advanced Authentication from version 6.1 or earlier versions.

Resend OTP Option Added to the Web Authentication for All the OTP Based Methods

In the Web authentication, a Resend OTP button has been added to allow users to resend OTP for all the OTP based methods such as SMS, Voice, and so on.

1:N Support for Mac

Now, Advanced Authentication supports the 1:N feature on the macOS. It allows to automatically detect the username when user presents an enrolled card or PKI token.

For more information, see Disabling 1:N in the Advanced Authentication - Mac OS X Client guide.

Username Disclosure Support for Cached Login

This release extends support to the Username disclosure option for a Client cache login. The Username disclosure option allows administrators to conceal the valid user names and prevents security vulnerabilities.

Enhanced Logging for Windows Client

Now, along with the details for the successful login attempts, log files include details for failed login attempts.

For more information, see “Logging for Windows Specific Advanced Authentication Events” in the Advanced Authentication - Windows Client guide.

An Option for U2F Timeout

An option has been added to configure the U2F timeout for authentication on all the Clients.

For more information, see “Configuring Timeout for the U2F Authentication” in the Advanced Authentication - Windows Client guide.

Ability to Configure Timeout for the Authentication Agent Window After Successful Authentication

Now, Advanced Authentication administrators can set the duration of the Authentication Agent window display after a user authenticates using the Authentication Agent.

For more information, see “Configuring Time to Close the Restricted Browser” in the Advanced Authentication - Windows Authentication Agent guide.

Support for Synchronizing the HOTP Token Counter

With this release, Public API has been enhanced to provide an ability to synchronize the HOTP token counter during the enrollment of HOTP authenticator.

REST API to Clone Users

With this release, REST API has been enhanced to provide an ability to migrate users of an existing LDAP repository to an another repository (LDAP or External repository for Repo Agent).

XSS Vulnerability in React Router Fixed

XSS vulnerabilities in the react router have been fixed.

Slow HTTP POST Vulnerability Fixed

The Slow HTTP POST vulnerability for the Denial of Service (DoS) attack has been fixed.

Ability to Disable the Key-Pair Generation for PKI Authentication

You can now disable the key-pair based enrollment of the PKI device and enforce the PKI enrollment using only a user certificate issued by the CA.

For more information, see “Disabling the Key-Pair Option” in the Advanced Authentication - Administration guide.

Permissions Added to Access Cache Files by the System Account Only

Permission have been added to access the Cache Files by the System account only.

Settings to Secure Digital Certificate of the PKI Authenticator

This release introduces two security settings on the Device Service that prevents access to the digital certificates of a PKI authenticator. This enhances the security by protecting the digital certificates.

For more information, see “Configuring the Security Settings” in the Advanced Authentication - Device Service guide.

Write Permission Removed for the Configuration File of Linux PAM Client

The write permission has been removed for the configuration file pam_aucore.conf of the Linux PAM Client.

Database Migration from Version 5.x Stopped Working With 5.6 Patch Update 7

Importing the database from Advanced Authentication 5.6 Patch Update 7 to version 6 does not work. The migration has been fixed and this will work from Advanced Authentication 5.6 Patch Update 8 to 6.2.

The Advanced Authentication Server Does Not Return Available Authenticators for Clients

There are specific conditions that involve the offline login and use of more than one user on a workstation. In these conditions, the server does not return the available authenticators for Clients and login or unlocking the operating system is not possible.

Phone Numbers and Emails of Users for the Web Authentication Events Are Not Masked

Web Servers Not Able to Communicate with the Database Servers

An Error Occurs When Logging In to the Administration Portal After Updating

An error TypeError NoneType object is not iterable (Unknown Error) is displayed after installing the patch while logging in to the Administration portal. The issue does not occur after up to 30 minutes.

Heartbeat or Replication Issues

Customized Chain Names Are Not Applicable for Web Authentication

Custom localization of method and chain names does not work in the Web Authentication.

Filters Do Not Work Appropriately for Widgets in the Dashboard

When you apply filters for Widgets on Dashboard, sometimes the filters are not reflected, and the Dashboard fails to display the information according to the configured filters.

A Repository Sync Updates the Login Options Policy

When a full synchronization or a quick synchronization is done for a repository, the repository name gets updated in the Logins Options policy.

No Response Received After Authentication in the Advanced Authentication - NetIQ Access Manager Integration

After authentication, NetIQ Access Manager does not get a proper JSON response back from Advanced Authentication to indicate that the user is authenticated. (Bug 1109606)

An Error is Displayed in the User Report Section of the Helpdesk Portal

A 503 error is displayed when navigating to the User Report tab of the Helpdesk portal on a web server.

Addition of two eDirectory Repositories with the Same Base DN Fails

In an Advanced Authentication server repository configuration, addition of two eDirectory repositories with the same admin base DN does not work.

Short Names of the Chains Are Displayed Instead of Custom Names for Web Authentication

When custom names are used for chains in the Web authentication, the short names of the chains are displayed in place of the custom names during authentication.

RADIUS Authentication Does Not Work When Username Contains Spaces

When the username contains spaces, the RADIUS authentication does not work.

A Blank Screen Is Displayed While Unlocking a Windows Client

A blank screen is displayed without any controls when users try to unlock a workstation if some combination of the following Microsoft policies are used:

Login to Windows Clients Fails If the Domain Password Is Expired

Keystrokes Delay In the Password Field

Unable to Unlock the Client Workstation If Verification of Certificate Is Enabled

Sign-In Button Is Displayed After Tapping the Card During Windows Login

Windows Sign-In Text Is Displayed on Background of the Lock Screen

While unlocking a Windows workstation, if users delay in selecting the authentication chain, a Windows sign-in text is displayed when the Microsoft Interactive logon policy is configured as follows:

An Error Message Is Displayed During Windows Login

When users try to log in to the Windows Client for the first time, an error message Internal Server Error is displayed. This is due to the Firewall settings that blocks all outbound connections.

Now, the Cache Service creates the required records in the Windows firewall.

Users Cannot Change the Login Credentials on a Terminal Client for a Remote Session

The U2F Method Does Not Work When Used In a Second Factor Authentication

When the U2F method is used along with another method (for example, Password and U2F), the login screen does not respond after a user authenticates to the first method.

Switch User with the Card

Show Password Icon Is Not Displayed on the Login Screen

Sometimes, in the Windows Client login and unlock screen, the show password icon is not displayed when a user specifies the password in the Password field. This icon helps users to validate the specified password.

Mac OS Does Not Cache the Repository Name of the Last Logged In User

Mac OS does not cache the repository name of the last logged in user.

Caps Lock Notification Is Not Displayed on Mac OS

The Mac OS login page does not display the notification when Caps Lock in on.

Uninstalling a Client Does Not Remove Respective Endpoint from the Server

When a Client is uninstalled, the respective endpoint is not removed from the Advanced Authentication server. This issue happens because of the Firewall settings that blocks all outbound connections.

Customized Messages Are Not Displayed on Mac OS

when an administrator customizes a message in Custom Messages policy, the customized messages are not displayed on Mac OS Client.

Customized Messages Are Not Displayed on the Linux Terminal

When an administrator customized a message in the Custom Messages policy, the customized messages are not displayed on the Linux Terminal.

Unable to Authenticate with the Face Recognition Method on a Terminal Client

When users try to log in to the terminal client with Face Recognition method for a remote session, an error message face service is not available is displayed.

Unable to Enroll the FIDO 2.0 Method on the Microsoft Edge Browser

DigitalPersona Reader Not Accessible for a Third Party Application

Fingerprint Authentication Fails After a Migration from Version 5

Sometimes the Device Service May Hang or Crash After a Restart

Sometimes Advanced Authentication Device Service may hang or crash when an administrator restarts the service.

Issue with the PKI Plug-in After Upgrading Device Service

In Windows, after upgrading Advanced Authentication Device Service 6.0 to version 6.1, the PKI plug-in with card reader does not work.

The Backspace Key Does Not Work If the Language Is Hebrew

In Windows, users are unable to delete the incorrect password with the Backspace key when the language is set to Hebrew.