Advanced Authentication 6.3 Service Pack 5 Release Notes

Settings to Allow Third-Party SAML Service Providers to Select the Authentication Chain

The option, Enable chain selection is introduced in the Web Authentication policy. This option allows third-party SAML service providers to select the preferred authentication chain with which users can authenticate.

For more information, see Disabling the Authentication Chain Selection policy in the Advanced Authentication - Administration guide.

Option to Lock Users Who Fail While Testing the Enrolled Methods

The Lock if authenticator test was failed option is introduced in the Lockout Options policy. This option enables you to lock the users who have failed the authenticator test in the Self-Enrollment portal for the number of attempts specified in Attempts failed.

For more information, see Lockout Options in the Advanced Authentication - Administration guide.

Enhanced VDA Profile Editor

This release introduces the following enhancements in the VDA:

Administration Portal

The Advanced Authentication log contains many instances of the following message:

level=error msg="Failed to log msg \"\" for logger fluentd: fluent#appendBuffer: Buffer full, limit 1048576

Administration Portal

After upgrading to Advanced Authentication 6.3 SP4, the administrators encounter the following error in the Dashboard and Reports on the servers of the secondary sites:

400 search_phrase_execution_exception.

For more information about fixing the index which is already broken, see TID 7025148.

Administration Portal

During backup schedule configuration, both the celery_long.log and celery_long_beat.log store the passwords in plain text.

Administration Portal

Advanced Authentication integration with MSS (Host Access Management and Security Server) that is based on REST API, is broken and the authentication fails. This issue occurs after upgrading to Advanced Authentication 6.3 SP4.

Administration Portal

During massive use of the fingerprint method, the fingerprint authentication begins to fail after some hours, and the following error recorder in the logs:

ERROR [aucore.views] Public HTTP error: status = 400 Bad Request, title = AuError, description = Timeout (AFIS service), path = /api/v1/logon/{}/do_logon.

This issue happens due to the memory leak.

Administrative Portal

The aucore container cannot start due to "Elasticsearch is not ready". The logs of the aucore container contain the following warning:

WARNI [aucore.scripts.wait_elastic] ConnectionTimeout caused by - ReadTimeoutError(HTTPSConnectionPool(host='127.0.0.1', port=9200): Read timed out. (read timeout=1))

For more information, see TID 7025172.

Configuration Portal

During upgrade to 6.3.4.1, when the Docker service is updating, it stops all the running dockers and does not start them after the update.

Device Service

After booting, there is a delay of 10 seconds to process the first request of Device Service. This issue occurs in Advanced Authentication 6.3 SP3 and 6.3 SP4.

Enrollment Portal

When a user tries to enroll the TOTP authenticator and chooses manual TOTP, the TOTP secret field is blank instead of populating the auto-generated secret.

Enrollment Portal

The New Enrollment Portal does not open behind the load balancer, and the following error message is displayed:

Error: An OAuth2 application was not specified by the client.

Linux PAM Client

Preconditions:

When the users uninstall the Linux PAM Client and try to install it again, an error message that states, file content for the log are already defined is displayed. This error occurs in CentOS 7 and Ubuntu 18 environments.

NPS plug-in

The NPS plug-in fails to establish a connection with the server and due to this the RADIUS authentication is rejected. The NPS logs display the following errors:

Failed to establish connection with server. Message: Exception: Invalid JSON: 'utf-8' co-dec can't decode byte 0xb0 in position 75: in-valid start byte, code: 499.

RDP

Precondition:

The card.forceVirtualChannels is set to true.

In the RDP session when a user tries to authenticate, after clicking OK, instead of displaying proper error message, the following error message was displayed:

Exception

Now the following error is displayed:

Device cannot be redirected via VirtualChannel.

Risk Service

On an Advanced Authentication appliance where the Risk Service related license is not applied, every second, the following log messages are shown:​

rbacollector

RiskService collector Waiting for Riskservice dataservice container to be ready

rbanotification

RiskService notification Waiting or RiskService dataservice container to be ready

rbainterset

RiskService interset Waiting for RiskService dataservice container to be ready

rbacore

RiskService core Waiting or RiskService dataservice container to be ready

rbaui

RiskService Waiting for RiskService dataservice container to be ready

Smartphone Authentication

After upgrading to Advanced Authentication 6.3 SP4, while logging in to Advanced Authentication portals, the Smartphone authentication does not initiate the push notification automatically. It requires the user to click Next.

Also, if you expand the Offline OTP section the LDAP password is pre-filled in the respective field. This issue occurs on the Firefox browser.

Web Authentication

When users try to authenticate using SAML, the authentication fails.

This issue occurs because the Advanced Authentication replaces the space character in the SAML assertion with question mark(?).

Windows Client

When a user tries to authenticate to Windows Client, it freezes in the  Please wait screen after providing the username.

This issue happens only in Windows machines with external Nvidia Quadro graphics cards and their drivers installed.

For more information, see Windows Client Freezes When A User Authenticates to an Application with UAC in the Advanced Authentication - Windows Client guide.