Release 2023.07.0 - What's New

Release 2023.07.0 - What's New

RapidIdentity 2023.07.0 new features, enhancements and notable issue resolutions.

Notable Enhancements and New Features

Ability to Configure the Timezone in Connect Jobs

The ability to set a Timezone when scheduling a Connect Job has been added in Connect > Jobs > Details > Schedule

Directory Schema Updates

A series of attributes have been added to extend the options available around User based fields. For a complete list of attributes, please refer to this article.

New additions to the Directory Schema are designated with a note stating: Introduced in amazon-ricloud-2023-07-01

Improved Support for External Authentication Realms

To reduce onboarding friction, Active Directory can be used as an External Authentication Realm in RapidIdentity. This will allow users to authenticate with RapidIdentity using their current password, which can be synced with Active Directory. The User Experience when utilizing an External Authentication Realm with Active Directory is explained below.

When using an external authentication realm, RapidIdentity should comply with the external authentication realm’s requirement for the user to reset their password AND RapidIdentity should also comply with the internal realm’s requirement for the user to reset the password. If neither the internal realm or external realm requires the user to reset their password, RapidIdentity should not prompt the user to reset their password. If either the internal realm or external realm requires the user to reset their password, RapidIdentity should prompt the user to reset their password.

New Entitlement Option to Extend or Restart the Time

A new Allow Entitlement to be Reset option has been added to the Entitlement Configuration in Requests for Time-based entitlements.

When an Entitlement Expiration Type is set to Time-based the option to Allow Entitlement to be Reset becomes visible and, if checked, an appropriate Reset Workflow and Reset Workflow Form can be selected.

To Request an Entitlement Reset, select the entitlement and click the Request Reset button from the bottom Action Menu.

Reset requests, grants, denials and expirations are included in the history of the user's Entitlement.

New ISAPI Filter for SSO with Internal Applications

To enable MFA and SSO with RapidIdentity Cloud and internal IIS web applications, a new RapidIdentity ISAPI filter can be installed in the web application's IIS server to authenticate users with RapidIdentity before accessing the application.

With the RapidIdentity ISAPI filter installed in the application's IIS web server, users attempting to access the application will be required to authenticate with RapidIdentity if they do not already have an authenticated browser session with RapidIdentity. When the user has an authenticated browser session with RapidIdentity, they will be passed directly into the application.

Use the following instructions to install the RapidIdentity ISAPI Filter and configure RapidIdentity Cloud to use the ISAPI Filter:

Install the RapidIdentity ISAPI Filter
Instructions for installing the ISAPI Filter are here

Configure RapidIdentity Cloud for the ISAPI Filter

A new configuration section called Authentication has been added under General > Settings for administrators to configure the Service Identity and Key that has been created for the ISAPI Filter.

Password Policy Enhancements

In a continuation of the Password Policy Enhancements made recently, the User Experience of this module has also been refreshed. With this release, administrators will enjoy an updated interface that includes expanded details regarding the new Password Policy Features now available in RapidIdentity.

Let's take a look at those new options in more detail:

• Password Policy Manager
  The Password Policy Manager Screen has been redesigned for an enhanced User Experience. The Default Password Policy is listed at the top of the screen, and can be modified using the Edit link.

  Custom Password Policies are listed in order by priority. New customized policies can be added using the Add Policy button, and they can also be reordered in the list to meet your User's needs.

  

• Password Expiration Policy
  For a Password Policy, Administrators are now able to determine a Password Maximum Age and set a timeline for 'Expiration Warnings'.

  The Password Maximum Age is configured in days, and determines the maximum length of time a User is able to keep the same password. After that amount of time elapses, the User will be required to reset their password.

  Administrators also are able to set an Expiration Warning, which determines how many days in advance of a password expiration the User will be notified that they will need to reset their password soon.
  

  Note:

  Existing policies will have Password Expiration automatically set to None when RapidIdentity is upgraded with the 2023.07.0 release and administrators can update them as appropriate.

• Password Reuse Policy
  Administrators are now able to determine if a Password History is kept for Users in a specific policy, and set the number of passwords that will be remembered in that history. When configured, users will be unable to reuse a password that currently exists in their Password History.

  If 'No Restriction' is selected in the 'Passwords Remembered', users in that policy will not be restricted from reusing passwords.
  

  Note:

  Existing policies will have Restrict Password Reuse automatically set to No Restriction when RapidIdentity is upgraded with the 2023.07.0 release and administrators can update them as appropriate.

• Enhanced Support for Utilizing Regular Expressions
  Regular Expressions, or Regex, is a sequence of symbols or characters expressing a string or pattern to be searched for within a longer piece of text. Within a Password Policy, an Admin can provide a Regex to add restrictions on what words or series of characters can be used within a password.

  By adding examples of Regular Expressions and how they affect Restricted Passwords, Administrators are enabled to utilize this feature when customizing their Password Policies.
  

As with any settings that will affect the security of accounts and the User Experience, we recommend referring to the NIST Digital Identity Guidelines.

It is also important to reflect upon the technical capacity of the individuals who are affected by the policy to ensure a positive experience.

People Module Navigation Enhancements

Another Module that has undergone a redesign to improve the User Experience is the People Module. Previously, the Action Options appeared in the bottom Navigation bar. Now, you will be able to access these options from a dropdown menu accessible via a right-click or the kabob icon.

The options have also been streamlined, while maintaining functionality, resulting in a short list to manage. There are three specific Action Item changes to keep in mind:

• QR Code: Secure and Insecure QR Codes can be generated from this consolidated option.
  

• Mobile Device: This sidebar menu contains the ability to Enroll, Update, and Delete a mobile device.
  

• WebAuthn: The options to Add/Manage and Delete a WebAuthn device are all available in this sidebar menu.
  

PKCE Support added in OAuth/OIDC Authorization Flow

PKCE, "pixy", is an abbreviation for Proof Key for Code Exchange, an extension to the OIDC Authorization flow that enables applications to authenticate users without them needing to have a client secret.

PKCE is an optional setting on an OIDC Federation Partner configuration that can be enabled by checking the Enable Proof Key for Code Exchange (PKCE) checkbox in the OpenID Connect Configuration section of the Federation Partner configuration page.

To create or update an OIDC Federation Partner navigate to Configuration > Security > Identity Providers > Federation Partners and click Add Federation Partner to create one new or click the ellipses next to an existing one and select Edit to update it

Search Entitlements Catalog

A search bar has been added to the Entitlements Catalog page for users to more easily find the entitlements they're looking for.

To search, enter any part of the Entitlement Name and press Enter or click the search icon.

Search is performed against any part of the Entitlement Name

Click the Reset Search button to re-display the full list of entitlements.

ShieldID User Interface Updates

• The ShieldID Rules Overview page has been updated to show a description for each rule

  

• The block-unlisted-countries rule name has been changed to country-rule and a new Rule Condition setting has been added to either block the countries or allow the countries that are listed.

  

Studio OAuth 2.0 REST Target Timeout

A new configuration setting, ACCESS TOKEN TIMEOUT has been added in Studio for OAuth 2.0 REST target applications.

This new configurable setting can be used to extend the default one hour timeout on OneRoster REST API connections using OAuth 2.0 client credentials to accommodate extremely large amounts of rostered information.

WebAuthn Support for Biometric Authentication Devices

The default WebAuthn UserVerificationRequirement setting in RapidIdentity has been changed from discouraged to preferred to ensure that WebAuthn devices that are capable of authenticating the user, biometric devices for example, perform that verification.

For more information regarding UserVerificationRequirement click here

New WebAuth Configuration Settings

A new WebAuthn configuration section has been added under Configuration > Policies > Authentication to enable Tenant Administrators to control the UserVerificationRequirement and EnrollmentVerification settings.

Verification Options

• Required - Only devices capable of user verification will be supported
• Preferred - Instructs the device to verify the user if capable but verification is not required
• Discouraged - Considers the presence of the device to be sufficient

Significant Issues Resolved

• Inability for Membership Managers to update Static Includes has been resolved
• Fixed non-working Export and Print buttons in Grid View for Other Sponsored Accounts
• Connect adminPasswordReset() Action now returns a proper error condition when Password Validation fails