Skip to main content

12.4.0

Features and improvements

Installation

  • Added the installation options for ska-x64.msi for "VPN test page URL" and "VPN test page search words" to use to test for and establish a VPN connection when a SaaS Pass server is used for the instance.

  • Improved setup to allow it to install successfully on Amazon Multi-AZ environments.

Python

  • Added support for Python 3.10.x for Bravura Security Fabric.

  • Upgraded 3rd party libraries in idmilb/extras to newer versions in order to support Python 3.10.

Search

  • Complete overhaul of SearchFilter plugin interface, components using add_expression or manually altering query will need to be rewritten using the new builder interface.

    • This applies to components that provide for either SEARCH_FILTER_PLUGIN or SAVED_SEARCH_PLUGIN.

    • Augmentation to SearchFilter's include/exclude interface to support better separation and combination if multiple components are using include/exclude for the same search engine.

  • Optimization for stored procedure ReqBatchSearch to improve its performance when requesting groups memberships.

Discovery

  • Idmlib discovery module:

    • do not read 'extra.dat' in the constructor.

    • require extra data to be explicitly added instead of being implicitly appended on 'commit'.

  • Added the "Copy data from these targets, separated by commas, during auto-discovery" target system option and a sample script file to add the ability for a target system to copy the listing data from one or more other targets instead of listing data itself.

  • Optimized loading of discovered computers into database during discovery.

  • Improved handling of diff-based discoveries (such as persistent listing) for object relationships when deleting an object as opposed to moving it out of scope.

Replication

  • Added improved error reporting around cases where replication is automatically suspended or halted.

  • Improved database service resilience around unexpected restarts or crashes.

  • Improved performance of file replication.

  • Include target list db files to default replication blacklist.

  • Improved the error logging in the "iddb-failed-procs" logs.

  • Improved replicated upgrades to not require a manual step to start idfilerep if leaving worker services offline.

Guacamole

  • Updated Guacamole Docker container base images:

    • Guacamole is now built on tomcat:9-jre8 (previously tomcat:7-jre8)

    • guacd is now built on fedora:34 (previously fedora:33)

User Interface

  • Added default robots.txt to block webcrawlers.

  • Added default X-Robots-Tag response headers.

  • Added configurable response headers by using a setupiis.cfg in the psconfig directory.

Other

  • Added a feature to Bravura IVR that allows it to update individual audio files on Asterisk as needed, rather than requiring a complete resynchronization.

  • Updated ajaxsvc to include the session user ID in the log where applicable.

  • Improved transaction handling in dbapi.

  • Updated default SQL provider to connect to SQL Server using Microsoft OLE DB Driver, allowing for support for Amazon Multi-AZ listener-based failover.

  • The network resource exit traps for NR CREATE FAILURE, NR CREATE SUCCESS, NR DELETE FAILURE, NR DELETE SUCCESS, NR MOVE FAILURE, NR MOVE SUCCESS, NR UPDATE FAILURE, and NR UPDATE SUCCESS are now exposed in the user interface.

  • The Red Hat Enterprise Linux package for CentOS 8.x x64 architecture has been added for idmunix-rhel-el8.x64.tar.gz.

  • Added support for the CentOS 8.x x64 architecture for the Linux idmunix package for the mobile proxy server.

  • Added a new system variable "Automation Enabled" (defaulted to true) to control whether automation requests should be issued. This applies to all automation paths, including any idapi submitted requests.

  • Updated the error message to be more meaningful when an invalid preqid is used in api call WFRequestSubmit.

  • Fixed the s etup-mobproxy.sh script for the Bravura One mobile proxy server when prompting for an SSL/TLS certificate or to have the script generate a self-signed certificate.

Identity

  • Revised the Certification App to display the shortid instead of groupdesc for the group description.

  • Allow authorizers the same access as groups owners for the management of groups.

  • If a segregation of duties rule is deprecated or disabled after a certification campaign, which includes violations of this rule is initiated, these violations will automatically be marked as complete either on the loading of the campaign or when the item is clicked on to trigger the resolution wizard.

  • Added support for request and resource expressions in component im_policy_authorization .

  • Corrected issue with a handful of loaddb components where ACCT methods would not be called for target IDs that contain hyphen character.

Privilege

Components

  • Added pam_system_type_mssql to support MSSQL system type for team management.

  • pam_attribute_ma_name : increase the length of the MA_NAME attribute to 80 characters

  • hid_batch_request_submit : moved the raw SQL query into a stored procedure.

  • pam_team_management: optimized "get_managed_systems" and "get_managed_accounts" helper functions in team_utils.py.

  • pam_team_management: improve the user experience when submitting pre-defined requests over API. The following improvements are included:

    • account onboard, update, offboard requests automatically expand the SELECT_MA attribute into ACCOUNT and HOSTID

    • create pam util api user request no longer requires optional MS_ID and MS_NAME values

    • system offboard request now always tries to fill in REQUEST_TEAM from RESATTR_TEAM managed system attribute

    • account offboard request now always tries to fill in REQUEST_TEAM from RESATTR_TEAM managed account attribute for non-personal accounts

    • account onboard request now fills in REQUEST_TEAM attribute from validated MA_TEAM for non-personal accounts

    • system onboard request now fills in REQUEST_TEAM attribute from validated MS_TEAM

    • account update request now fills in REQUEST_TEAM attribute from either:

      • RESATTR_TEAM managed account attribute if moving from non-personal into personal MSP

      • RESATTR_TEAM managed account attribute if the destination is missing or identical to the source

      • MA_TEAM if moving from personal into non-personal MSP

    • system update request now fills in REQUEST_TEAM attribute from RESATTR_TEAM managed system attribute if the destination is missing or identical to the source.

Other

  • Modified behavior so that administrators with specific Bravura Privilege privileges have access to Privileged Access menu options in the Manage the system module (PSA).

  • Modified behavior so that only superusers can add/modify/delete managed account associated with target system credentials.

  • Added registry-definable global override key, DisableAllOTP, to disable OTP randomization for all accounts.

  • Optimized Privilege upgrades when upgrading from pre-11.0.

Reports

  • Added a new report, Configuration completion percentage in the Certification of configurations category. The report shows progress in completing currently active configuration certification campaigns.

  • Added new report, Configuration certification details in the Certification of configurations category. This report enables the user to list the details of configuration certification campaigns.

  • Added a new report, Orgchart certification progress to the Certification of entitlements category. The purpose of the report is to display the progress that reviewers have made on Orgchart based certification campaigns.

  • Added the following search filters to the Scheduled jobs report:

    • Command to run

    • Repeat type

    • Last run status

    • Filter results by last finish date

    • Filter results by next run date

  • Enhanced the Authentication chains report to add a column in detailed mode to display the IP address.

  • Added new report ' Resources not in saved configuration certification setups ' to the Certification of configurations category.

    • This report displays, for a given resource type (role, segregation of duties rule), the list of resources not included in any saved configuration certification setup.

  • Profile attribute of type Managed group is now supported in reporting.

Resolved issues

UI

  • Fixed loading of extra columns provided by search filter plugin.

  • Fixed saved search menu when extra columns is added by search filter plugin.

  • Fixed the broken login UI when Scenario.hid_remember_userid is enabled.

  • Fixed the password reveal function by switching the built-in reveal password feature in Edge with the product reveal password feature.

  • Fixed an issue where the network resource icon was sometimes being shown too large for higher resolutions.

IDM library

  • idmlib(wfobject): improve the account module:

    • properly implement the __eq__ method and improve its performance

    • fix the is_group_member method to actually work

    • efficiently implement the is_owner_of_group method

    • throw a ValueError instead of silently returning a bogus value

    • add unit tests for the module

  • Improved the get_groups method of the idmlib.wfobject.Profile class to only return managed user groups. Furthermore, the method would now return a correct hostid for direct cross-target memberships.

Replication

  • Fixed file replication not working for shared schema nodes.

  • Fixed incorrect replication behavior around bulk loads that were retried due to an error.

Group App

  • Fixed a bug in GroupApp Update Members wizard for resource attribute of type Account group memberships and of Child group memberships, when clearing value in the input box does deselect the checkbox.

  • Fixed an issue where uploading members in the Groups app would get stuck when there were unmapped profile attributes.

  • Fixed the instdump utility to be able to handle a Bravura Security Fabric -only license.

Components

  • Fix a bug in installed components where status read only of column ComponentOwnerFQN in one component should still be read only after un-installing another component having the same column and status.

  • Fix export_data_components error caused by export script occasionally attempting to export objects that no longer exist.

  • im_corp_automated_attribute_flow:

    • added an option to propagate attribute removals

    • re-added the existence checks to resources and attributes properties

Upgrade

  • Fixed an issue where upgrades could behave incorrectly when retrying or skipping multiple SQL statements.

  • Updated the installer to verify that it successfully renamed and deleted the design/src/ui directory of the installed node when it is upgraded, allowing the user to retry or skip the installer action or abort the upgrade if there is an issue either renaming or deleting the directory. Also fixed the post-installation skin generation task to determine if an error occurred during the task.

  • Fixed an error message that interrupted upgrades with the "Backup before upgrade" option enabled, stating that the database needs the Service Broker enabled.

API

  • Fixed IDAPI function OTPAPIUserCreate so that it sets the OTP IDAPI caller user's 'otpcaller' attribute to true.

  • Added IDAPI function OTPAPIUserPasswordUpdate for updating an existing OTP caller user's password.

Reports

  • Fixed no summary report type for the Pre-defined requests report in order to display the correct information.

  • Updated profile attribute of type File to show correctly in Request event log report.

  • Fixed a bug in the search, which no longer fails on dates with the format yyyy-mm-dd hh:mm:ss (UTC), in report Profile and request attributes.

  • Added user IDs are now correctly displayed in Group owner field in Groups changes report.

  • Updated Completion percentage report to exclude certification campaigns that have not been launched.

  • Corrected handling of date widgets values in the search criteria text file attachment generated with emailed report results.

Authentication

  • Fixed the Help users (IDA) module to load applicable question sets based on the helpdesk authentication chain status.

  • Fixed an authentication issue that could occur on environments with both mobile proxy and Azure MFA authentication configured.

Other

  • Changed the log level to avoid dormant service warnings for the iddb service.

  • Fixed iddiscover to delete queue files when discovery client disconnects abnormally to avoid accumulation of queue files.

  • Fixed migratedata , which previously returned error about missing response table data when attempting to import data using only -qaconfig option.

  • hid_extdb : remove debug logging messages that cause a performance regression.

  • Fixed issue where w3wp.exe would not close handles correctly.

  • Modified View and update profile (IDR) wizard to handle values with incorrect case for user attributes with case-insensitive restricted values.

  • Fixed an issue in psupdate where scheduling changes were reverted to defaults after running a discovery.

Bravura Pass

Modified the Update attributes pre-defined request to include all application attribute groups for Bravura Pass instances.

Bravura Privilege

Components

  • Fixed a bug in password policy to check the minimum password length when creating or updating vault accounts manually or via batch request.

  • Updated pam_account_management_disclosure* components so that the corresponding access disclosure plugins are automatically added to the standard policy.

Other

  • Privilege-only instances fixed to follow workflow for update profile requests.

  • The password policy rule Not be one of the last N passwords is now enforced.

  • Modified idmlib.dll so that password overrides submitted using the new v1 REST API endpoint (PUT /managedAccounts({managedAccountKey})/secrets('password')/value) will result in a failed operation when randomizations are disabled (either for the account's managed system policy or globally).

  • Removed the 'synchronouswrite' config option and related logic from pamutil . By default, pamutil will wait and see if operations such as randomize and override will finish and return the result.

  • Update ImportRule_set to check whether the 'checkorder' value already exists

  • Modified behavior so that administrators with specific PAM privileges have access to Privileged Access menu options in PSA.

  • Modified behavior so that only superusers can add/modify/delete managed account associated with target system credentials.

  • Fixed issue so that accounts cannot be onboarded from a system that has been archived.

  • Modified IDAPI function ManagedAccountOverridePassword to prevent password overrides when randomizations are disabled (either for the account's managed system policy or globally).

In this section: