WebServices Timeout Issue – Added logic to optimize timeout values for profile lookups.

This is an update to the following issue reported under EE-1967 in hotfix 9.3.0-22.

Data Store Connection Issue – Addressed an issue causing intermittent problems in the Identity Platform when the connected data store is slow or unreliable.

WebServices Timeout Issue – Added logic to optimize timeout values for profile lookups.

This is an update to the following issue reported under EE-1967 in hotfix 9.3.0-22.

Data Store Connection Issue – Addressed an issue causing intermittent problems in the Identity Platform when the connected data store is slow or unreliable.

Web Service Realm Issue – Resolved an issue that caused disabled WebService realm to continue to function if the username and password existed.

Install this hotfix if you have:

• Web Service (Multi-Datastore) integration disabled on the Data tab

Security Optimization  – OIDC authorization with PKCE optimized for security best practices.

This hotfix is required  for 9.3 deployments.

Security Optimization – Redirect pages optimized for security best practices.

This hotfix is required for 9.3 deployments.

Install this hotfix if you have:

• OIDC / OAuth2 integrations

WS-Federation Update – In realms that use WS-Federation, this update requires allow-listing of URLs for the wreply field.

If a wreply setting is configured, the hotfix will use the host of this setting for the new allow-list.

There is also a new optional setting to support allow-listing of more than one URL by using a comma-delimited list.

Install this hotfix if you have:

• WS-Federation integrations

Self-Service Account Update Theme Issue – There were some missing labels on the AccountUpdate.aspx page using 2016 or 2019 Themes.

Install this hotfix if you have:

• Self-service Account Update page configured
• 2016 or 2019 Theme selected in the Overview tab

Security Optimization – OIDC authorization with PKCE optimized for security best practices.

This hotfix is required for all 9.3 deployments.

Submit Form Post Issue Update – Update to a previous hotfix for this issue. The Submit Form Post realm incorrectly removes password data following certain special characters.

Install this fix if you have:

• Submit Form Post configurations

Transformation Engine Support for OIDC/OAuth2 Workflows – Transformation Engine now supports OIDC / OAuth2 workflows.

Install this fix if you have:

• OIDC / OAuth2 integrations

Security Issue – Resolved security issue with request parameters.

This hotfix is required for all customers on SecureAuth IdP version 9.3 to ensure the security of the appliance.

Data Store Connection Issue – Resolves intermittent data store connection issues to an Application realm created in the New Experience UI.

Install this hotfix if you have:

• Application realm created in the New Experience UI

OIDC / OAuth2 Workflow Session Issue – OIDC queries in OAuth workflows are now read correctly when a user has two browser tabs open when authenticating into a resource.

Install this fix if you have:

• OIDC / OAuth2 integrations

Submit Form Post Issue – The Submit Form Post realm no longer removes password data following certain special characters.

Install this fix if you have:

• Submit Form Post configurations

Security Fix – Resolved XSS security vulnerability in path resolution.

This hotfix is required for all customers on SecureAuth IdP version 9.3 to ensure the security of the appliance.

Database Logging Issue – Resolves issue in which database logs experiencing a table lock stopped writing new log entries.

Install this hotfix if you have:

• Database logging enabled in the Logs tab

Token Issue – Resolves token caching issues impacting logins for admin realms in the New Experience UI.

Install this hotfix if you have:

• Admin realm created in the New Experience UI

Performance Optimizations – Realms created in the Classic UI are now optimized to reduce latency.

Install this hotfix if you have:

• Realms created using the Classic UI experience.

Security Optimization – Sanitize sensitive data in Debug Logs.

This hotfix is required for all customers on SecureAuth IdP version 9.3 to ensure the security of the appliance.

Adaptive Authentication Licensing – The Adaptive Authentication settings were not displaying the correct license information.

Install this hotfix if you have: 

• Adaptive Authentication rules enabled in the Adaptive Authentication tab

Security Fix – Implemented additional input validation to prevent double curly brackets ( {{ or }} ) in form input fields, including the UserID field.

This hotfix is required for all customers on SecureAuth IdP version 9.3 to ensure the security of the appliance.

Debug Log Cleanup – Debug logs required changes.

This hotfix is required for all 9.3 appliances.

Chrome 404 Error on Manage Accounts Page – Chrome browser would give a 404 error to users on the Manage Accounts (help desk) page if the page timed out and user logs back in, whereas other browsers would redirect them back to the page after authentication.

Install this hotfix if you have:

• Manage Accounts page configured in the Post Authentication tab
• Users employing Chrome browser

Content and Localization Spacing Issue – Resolves issue in which after making customizations that include leading spaces, the spacing presents as expected until content and localization is edited at a later point, where then the spacing is removed.

Install this hotfix if you have:

• Changes in the Content and Localization

SAML Request Signature Validation – In certain SAML workflows, signature validation was not successful.

Install this hotfix if you have:

• SAML applications configured in the Application Manager
• SAML applications configured in the Post Authentication tab

SameSite Cookie attribute support – Required for compatibility with Google Chrome 80. 

This hotfix is required for all 9.3 appliances.

Ensure that the Microsoft .NET patch is applied prior to installing this hotfix. Read https://support.secureauth.com/hc/en-us/articles/360038330652 for more information.

Help Desk Page Input Requirements – Resolves issue on the Help Desk client-side page, where some fields were acting as required to update the user profile even though they were configured to be “Show Disabled”.

Install this hotfix if you have:

• Help Desk / Manage Accounts page configured in the Post Authentication tab with group restrictions on the Data tab

OIDC Workflow Wipes KBAs – After authenticating in an OIDC workflow with consent storage, users’ knowledge-based answers is no longer deleted from their profile.

Install this hotfix if you have:

• OIDC workflows with consent storage configured in the Post Authentication tab
• Knowledge-based questions and answers enabled as an authentication method in the Multi-Factor Methods tab

Inline Password Reset Issue – Resolves issue with using the 2016 Light Theme, where the Inline Password Reset function was not working as expected for all use cases.

Install this hotfix if you have:

• Inline Password Reset enabled in the Password Settings of the Workflow tab

Inline Password Reset Forced Updates – Resolves issue in which users were being forced to update their password even though their password had not yet expired.

Install this hotfix if you have:

• Inline Password Reset enabled in the Password Settings of the Workflow tab

IP Evaluation Update – The IP Eval service now uses the appropriate IP address for WS-Trust requests when using a load balancer.

Install this hotfix if you have:

• IP address evaluation enabled in Adaptive Auth in the Policy OR in the Adaptive Authentication tab
• WS-Trust integrations

API Password Reset – IdM API password reset did not always work if user account was locked.

Install this hotfix if you have:

• Password Reset IdM API endpoint enabled in the API tab

Updates to Secure Storage – Updates made to Secure Storage to avoid corruption.

This hotfix is required for all 9.3.0 appliances.

Updates to Audit Logging for OIDC – Audit Logging updated for OIDC workflows to provide more clarity.

Install this hotfix if you have:

• OIDC integrations

Adaptive Auth API Response Updates – Resolved issue when using the Authentication API for adaptive authentication calls; not all actions were available to enable the desired workflow.

Install this hotfix if you have:

• Authentication API enabled in the API tab
• Adaptive Authentication rules enabled and used via the API

EE-1434

Yubikey Enrollment with Proxy – Resolved issue in which Yubikey enrollments were not honoring the proxy settings configured in the realm, which led to user verification failures.

Install this hotfix if you have:

• Yubikey enrollment configured as a Begin Site in the Workflow tab
• Proxy settings configured in the System Info tab
• SecureAuth IdP appliance that can only reach the api.yubico.com endpoints via configured proxy

Help Desk Verification Unmasking – When typing in the help desk verification answer on the Self-service Account Update page, there is now an option to “unmask” the answer, as there is with knowledge-based answers.

Install this hotfix if you have:

• Help Desk Verification enabled as an option for the Self-service Account Update page

Enhancements to User Risk Logging – Enhancements were made to logging for user risk information gathered during adaptive authentication, to provide more clarity.

Install this hotfix if you have:

• User Risk enabled in a Policy OR
• User Risk enabled in the Adaptive Authentication tab

Web.config Updates for SISU – Web.config updates required for SISU to work properly.

Install this hotfix if you have:

• Attempted to set up a 9.3 version of SecureAuth IdP on a 19.07 image

Last Access Time Issue – For device enrollments (Authenticate app), issue is resolved in which an enrollment was not replaced when the end user reached the maximum number of enrollments allowed. 

Install this hotfix if you have:

• End users employing Authenticate app for multi-factor authentication (MFA)
• Defined maximum number of device enrollments allowed per end user
• "Replace by Last Access Time" enabled for device enrollments 

TRX Performance Issue – When there is latency reaching the SecureAuth TRX cloud endpoint, it no longer causes application latency, which would impact user login performance.

This hotfix is required for all 9.3 appliances.

mS-DS-ConsistencyGUID Support for Office 365 Integration – The mS-DS-ConsistencyGUID attribute is now supported by SecureAuth IdP to be used as the ImmutableID value for integrations with Office 365.

Install this hotfix if you have:

• Integration with Office 365
• Issues using objectGUID as the ImmutableID

Enhance Device Recognition Logging – Device Recognition logging was enhanced to make the results of the analysis clearer. 

Install this hotfix if you have:

• Realms that use Device / Browser Fingerprinting as the Client Side Control (Workflow configuration)

Geo-velocity Cloud Communications Error – When comparing previous and current IP addresses, some logins were generating an “unavailable” result.

Install this hotfix if you have:

• Geo-velocity enabled as an Adaptive Authentication step

Symbol-to-Accept API Support – The Symbol-to-Accept MFA method is now supported in the Authentication API.

Install this hotfix if you have:

• Enabled Authentication API in the API tab
• Users employing the Authenticate mobile app for authentication
• Symbol-to-Accept enabled as an authentication method

QR Code Enrollment False Error – The hotfix resolves an issue where the QR Code App Enrollment page was inaccurately displaying an error (“Invalid Code. Please try again.”), despite successful enrollment. This was caused by double-clicking before the page finished loading.

Install this hotfix if you have:

• SecureAuth App Enrollment (QR Code) configured in the Post Authentication tab
• and 2016 Light Theme selected in the Overview tab of the enrollment realm

Arbitrary File Upload Vulnerability – An authenticated privileged user can no longer upload arbitrary file types.

NOTE: This vulnerability applies ONLY to the Web Admin application.

This hotfix is required for all customers on SecureAuth IdP version 9.3 to ensure the security of the appliance.

Authentication API Updates for User Risk – When using the Authentication API for adaptive authentication, the User Risk feature is now effectively accessed during analysis.

Install this hotfix if you have:

• Authentication API enabled in the API tab
• and (same realm) User Risk enabled in the Adaptive Authentication tab

OATH Token JSON Encryption Issue – Data is now correctly read when JSON encryption is selected as the OATH Token Data Format method.

Install this hotfix if you have:

• JSON selected as the Data Format in the Profile Fields section of the Data tab for OATH Tokens
• Time-based Passcodes (OATH Tokens) enabled as an MFA method for users in the Multi-Factor Methods tab
• Users employing SecureAuth Authenticate app or third-party TOTP applications for MFA

Password Throttling Count Issue – The saved count for Password Throttling now effectively clears the bad password attempts to make way for the valid password entries.

Install this hotfix if you have:

• Password Throttling enabled and configured in the Workflow tab

Logging Updates – Adaptive Authentication logging now correctly writes actual parameters instead of dictionary lines for certain requests.

Install this hotfix if you have:

• Adaptive Authentication rules enabled in the Adaptive Authentication tab
• Logging enabled (Logs tab) in realms where Adaptive Authentication is in use

New userAccountControl Values – SecureAuth IdP now has the most up-to-date userAccountControl values to ensure that certain account statuses are handled appropriately in transactions between LDAP providers and SecureAuth IdP.

Install this hotfix if you have:

• LDAP directory integrations such as Active Directory (AD) and so on
• Help Desk functionality to manage LDAP user accounts by means of SecureAuth IdP

Mobile Cookie Name – Mobile cookies that include spaces in the name now process correctly.

Install this hotfix if you have:

• Realms using Mobile Enrollment and Validation as the Integration Method (Workflow configuration)

Google Social ID Login – Modifications made to support Google API updates for Social ID login.

Auto-encrypt Tools Issue – Issue resolved in which auto-encrypting the web.config caused SecureAuth tools to not function effectively.

QR Enrollment Issue – Addressed issue when using an email address during login to the QR enrollment page. 

Install this hotfix you have:

• Multi-Factor App Enrollment – QR Code realm

OTP Value Reusability – Resolves issue when using the API OTP validate endpoint, it was possible to reuse the same OTP at a later time.

Install this hotfix if you have:

• Authentication API enabled
• Any OTP MFA method enabled

Security Optimization – Redirect pages optimized for security best practices.

This hotfix is required for 9.2 deployments.

QR Code Registration Support – Addressed an issue to support offline QR code registration for OTP in air-gapped appliances to work with SecureAuth Authenticate app. 

Install this hotfix if you have: 

• Air-gapped installation of SecureAuth IdP 9.2
• Multi-Factor App Enrollment – QR Code realm
• Users who use SecureAuth Authenticate app

Install this hotfix if you have:

• Windows Auth IIS settings changed from the SecureAuth default

OIDC Claim Format Issue – The email_verified claim should be sent as a boolean value.

Install this hotfix if you have:

• OIDC / OAuth2 integrations

This hotfix is required for all customers on SecureAuth IdP version 9.2 to ensure the security of the appliance.

This hotfix is required for all customers on the SecureAuth IdP version 9.2 to ensure the security of the appliance.

WS-Federation Update – In realms that use WS-Federation, this update requires allow-listing of URLs for the wreply field.

If a wreply setting is configured, the hotfix will use the host of this setting for the new allow-list.

There is also a new optional setting to support allow-listing of more than one URL by using a comma-delimited list.

Install this hotfix if you have:

• WS-Federation integrations

OIDC / OAuth2 Workflow Session Cleanup – Sessions are not properly cleared when user has two browser tabs open when authenticating into a resource.

Install this fix if you have:

• OIDC / OAuth2 integrations

Security Fix – Resolved XSS security vulnerability in path resolution.

This hotfix is required for all customers on SecureAuth IdP version 9.2 to ensure the security of the appliance.

WS-Fed and SAML Valid Hours Issue – When the SAML Valid Hours is set to a non-integer value, it does not work for WS-Fed integrations.

Install this fix if you have:

• WSFed integrations

Security Fix – Implemented additional input validation to prevent double curly brackets ( {{ or }} ) in form input fields, including the UserID field.

This hotfix is required for all customers on SecureAuth IdP version 9.2 to ensure the security of the appliance.

Chrome 404 Error on Manage Accounts Page – Chrome browser would give a 404 error to users on the Manage Accounts (help desk) page if the page timed out and user logs back in, whereas other browsers would redirect them back to the page after authentication.

Install this hotfix if you have:

• Manage Accounts page configured in the Post Authentication tab
• Users employing Chrome browser

Debug Log Cleanup – Debug logs required changes.

This hotfix is required for all 9.2 appliances.

Azure AD Email Lookup Failure – SecureAuth IdP was not able to effectively retrieve the email address from the Azure AD data store.

Install this hotfix if you have:

• Azure AD integrated in the Data tab
• Email 1 property mapped to an Azure AD attribute

Corrupted CyberArk Username – When using CyberArk for the directory credentials, the username would become corrupted during simultaneous connections.

Install this hotfix if you have:

• CyberArk integration for the directory integration credentials on the Data tab

WS-Trust Blocking Update – Resolves issue where the WS-Trust Blocking service was not using the appropriate IP address for requests when using a load balancer.

Install this hotfix if you have:

• WS-Trust Blocking service enabled
• WS-Trust integrations

IP Evaluation Update – Resolves issue where the IP Eval service was not using the appropriate IP address for WS-Trust requests when using a load balancer.

Install this hotfix if you have:

• IP address evaluation enabled in Adaptive Auth in the Policy OR in the Adaptive Authentication tab
• WS-Trust integrations

SameSite Cookie attribute support – Required for compatibility with Google Chrome 80.

This hotfix is required for all 9.2 appliances.

Ensure that the Microsoft .NET patch is applied prior to installing this hotfix. Read https://support.secureauth.com/hc/en-us/articles/360038330652 for more information.

Azure AD UPN Domain Check – Resolves issue with unnecessary uppercase and lowercase domain name check in username.

Install this hotfix if you have:

• Azure AD integrated with SecureAuth IdP

OIDC Session Cleanup – Resolves issue in which sessions were not properly cleared in OIDC realms, making it impossible to log into multiple clients due to values being cached from the first session.

Install this hotfix if you have:

• OIDC integrations

Updates to Audit Logging for OIDC – Audit Logging updated for OIDC workflows to provide more clarity.

Install this hotfix if you have:

• OIDC integrations

Adaptive Auth API Response Updates – Resolved issue when using the Authentication API for adaptive authentication calls; not all actions were available to enable the desired workflow.

Install this hotfix if you have:

• Authentication API enabled in the API tab
• Adaptive Authentication rules enabled and used via the API

Transformation Engine Group Handling – Resolves issue in which the Transformation Engine could not correctly filter groups by full and common name when used together.

Install this hotfix if you have:

• Transformation Engine enabled and configured

TRX Performance Issue – When there is latency reaching the SecureAuth TRX cloud endpoint, it no longer causes application latency, which would impact user login performance. 

This hotfix is required for all 9.2 appliances.

Authenticate App Enrollment Error – URL enrollments no longer fail on devices using iOS 12+ and when push notifications are not allowed for the application.

Install this hotfix if you have:

• iOS devices using OS versions 12+
• SecureAuth App Enrollment realm using URL enrollment (versus QR code enrollment)

Arbitrary File Upload Vulnerability - Resolves issue in which an authenticated privileged user could upload arbitrary file types.

This hotfix is required for all customers on SecureAuth IdP version 9.2 to ensure the security of the appliance.

Inline Initialization Attribute Clearing – When using Conditional Access for Azure, the Active Directory attribute values that were added during the Inline Initialization self-service process are no longer being cleared.

Install this hotfix if you have:

• Conditional Access setup
• Inline Initialization enabled

mS-DS-ConsistencyGUID Support for Office 365 Integration – The mS-DS-ConsistencyGUID attribute is now supported by SecureAuth IdP to be used as the ImmutableID value for integrations with Office 365.

Install this hotfix if you have:

• Integration with Office 365
• Issues using objectGUID as the ImmutableID

Authentication API Updates for User Risk – When using the Authentication API for adaptive authentication, the User Risk feature is now effectively accessed during analysis.

Install this hotfix if you have:

• Authentication API enabled in the API tab
• AND (same realm) User Risk enabled in the Adaptive Authentication tab

New userAccountControl Values – SecureAuth IdP now has the most up-to-date userAccountControl values to ensure that certain account statuses are handled appropriately in transactions between LDAP providers and SecureAuth IdP.

Install this hotfix if you have:

• LDAP directory integrations such as Active Directory (AD) and so on
• Help Desk functionality to manage LDAP user accounts by means of SecureAuth IdP

Enhance Device Recognition Logging – Device Recognition logging was enhanced to make the results of the analysis clearer.

Install this hotfix if you have:

• Realms that use Device / Browser Fingerprinting as the Client Side Control (Workflow configuration)

Reporting Page Time Picker – On the Reporting Page, the time picker functionality now works correctly for realms using the 2016 Light Theme.

Install this hotfix if you have:

• Reporting Page(s) using the 2016 Light Theme

Windows SSO Adaptive Auth Redirect – Realms with Windows SSO for pre-authentication now effectively redirect users per Adaptive Authentication rules.

Install this hotfix if you have:

• Realms using Windows SSO as a Begin Site
• AND (same realm) using Adaptive Authentication redirect rules

Third-party JavaScript Libraries Vulnerability – jQuery, Bootstrap, and AngularJS have been upgraded due to a flaw in these libraries that may result in XSS.

This hotfix is required for all customers on SecureAuth IdP version 9.2 to ensure the security of the appliance.

Incomplete Revocation of App Enrollments – User device enrollments that are revoked on the self-service page are correctly removed when the user immediately re-registers the same device. 

Install this hotfix if you have:

• Users who employ SecureAuth Authenticate mobile app for multi-factor authentication (MFA)
• Self-service Account Update realm(s) that include OATH Token revocation
• Multi-Factor App Enrollment realm(s)

QR Code Missing Secret – Upon successful login to a QR code app enrollment realm, users are now presented with a correct QR Code when a page is refreshed. 

Install this hotfix if you have:

• Multi-Factor App Enrollment – QR Code realm(s)
• Users who employ SecureAuth Authenticate mobile app for MFA

Enhance Device Recognition Logging – Device Recognition logging was enhanced to make the results of the analysis clearer.

Install this hotfix if you have:

• Realms that use Device / Browser Fingerprinting as the Client Side Control (Workflow configuration)

Non-issue changes:

• Installation of FileBeat, MetricBeat, and Cloud Transport Service components which gather information about appliance statistics, software configuration, and end-user authentication events, which are submitted to SecureAuth Cloud.
• Web.config enhancements to enable the configuration of advanced adaptive capabilities powered by machine learning. Learn more: https://docs.secureauth.com/x/Z5XQAg

EE-839

Windows SSO Enhancement – Some IIS settings necessary for Windows SSO / authentication must be manually entered in the web.config, but SecureAuth IdP would remove all these settings if a change was subsequently made on the Workflow tab.

Novell eDirectory Lookup – During login, a user’s profile was not being accessed successfully.

CyberArk Vault Credential Lookup – In multi-domain environments, SecureAuth IdP was not able to retrieve credentials successfully.

Security Issue – Resolved security issue with request parameters.

This hotfix is required for SecureAuth IdP 9.1 deployments.

Security Optimization – Redirect pages optimized for security best practices.

This hotfix is required for SecureAuth IdP 9.1 deployments.

OIDC / OAuth2 Workflow Session Cleanup – OIDC queries in OAuth workflows are not read correctly when a user has two browser tabs open when authenticating into a resource.

Install this fix if you have:

• OIDC / OAuth2 integrations

Security Fix – Resolved XSS security vulnerability in path resolution.

CVSS Score: 5.3

This hotfix is required for all customers on SecureAuth IdP version 9.1 to ensure the security of the appliance.

WS-Fed and SAML Valid Hours Issue – When the SAML Valid Hours is set to a non-integer value, it does not work for WS-Fed integrations.

Install this fix if you have:

• WSFed integrations

Security Fix – Implemented additional input validation to prevent double curly brackets ( {{ or }} ) in form input fields, including the UserID field.

CVSS Score: 2.0

This hotfix is required for all customers on SecureAuth IdP version 9.1 to ensure the security of the appliance.

Updates to Audit Logging for OIDC – Audit Logging updated for OIDC workflows to provide more clarity.

Install this hotfix if you have:

• OIDC integrations

Transformation Engine Issue – Resolves issue in which the Transformation Engine did not work correctly when used with WS-Federation.

Install this hotfix if you have:

• Transformation Engine enabled and configured

Session Timeout Length – Increased session timeout length to accommodate specific use cases.

Install this hotfix if you have:

• A need for longer session timeout lengths

SameSite Cookie attribute support – Required for compatibility with Google Chrome 80.

This hotfix is required for all 9.1 appliances.

Ensure that the Microsoft .NET patch is applied prior to installing this hotfix. Read https://support.secureauth.com/hc/en-us/articles/360038330652 for more information.

OTP Value Reusability – Resolves issue when using the API OTP validate endpoint, it was possible to reuse the same OTP at a later time.

Install this hotfix if you have:

• Authentication API enabled
• Any OTP MFA method enabled

Enhanced Device Recognition Logging – Device Recognition logging enhanced to make the results of the analysis clearer.

Install this hotfix if you have:

• Realms that use Device / Browser Fingerprinting as the Client Side Control (Workflow configuration)

Device Recognition NULL Values – Resolves issue where “NULL” is returned in the Device Recognition profile as a score for a field, and the profile fails to match.

Install this hotfix if you have:

• Realms that use Device / Browser Fingerprinting as the Client Side Control (Workflow configuration)

API Update for Hashed PIN – Using the API to update a user’s PIN no longer fails when the PIN is stored hashed.

Install this hotfix if you have:

• PIN enabled as an MFA method
• PIN hashing turned on
• IdM API enabled for account update

mS-DS-ConsistencyGUID Support for Office 365 Integration – The mS-DS-ConsistencyGUID attribute is now supported by SecureAuth IdP to be used as the ImmutableID value for integrations with Office 365.

Install this hotfix if you have:

• Integration with Office 365
• Issues using objectGUID as the ImmutableID

Cross-Site Request Forgery Vulnerability – CSRF tokens have been added to the administrative web interface.

CVSS Score: 4.7

This hotfix is required for all customers on SecureAuth IdP version 9.1 to ensure the security of the appliance.

RBAC Group List – Resolves issue where a list of groups are created for a specific role type and not all groups were available to select, even after typing the full group name.

Install this hotfix if you have:

• RBAC rules configured
• High number of Active Directory groups (reported by customers with 1000+ groups)

AuthCode Validity Issue – Only one AuthCode can be used in OIDC workflows for a client to obtain an access_token.

Install this hotfix if you have:

• OIDC integration realms configured in the Post Authentication tab
• Consent Storage enabled in OIDC integration (required for this verification)

Cross-Site Request Forgery Vulnerability – CSRF tokens have been added to the administrative web interface.

CVSS Score: 6.7
NOTE: This fix applies ONLY to the Web Admin application.

This hotfix is required for all customers on SecureAuth IdP version 9.1 to ensure the security of the appliance.

Arbitrary File Upload Vulnerability – An authenticated privileged user can no longer upload arbitrary file types.

CVSS Score: 8.4
NOTE: This vulnerability applies to the Web Admin application ONLY.

This hotfix is required for all customers on SecureAuth IdP version 9.1 to ensure the security of the appliance.

Device Recognition Data Storage Issue – When storing the Device Recognition Profiles (Device Fingerprints) in the SQL data base in JSON format, all data is now correctly stored.

Install this hotfix if you have:

• SQL data base integrated with SecureAuth IdP on the Data tab
• JSON selected as the Data Format in the Profile Fields section of the Data tab
• Device / Browser Fingerprinting selected as the Client Side Control on the Workflow tab
• SQL Tables and Stored Procedures using JSON format

New userAccountControl Values – SecureAuth IdP now has the most up-to-date userAccountControl values to ensure that certain account statuses are handled appropriately in transactions between LDAP providers and SecureAuth IdP.

Install this hotfix if you have:

• LDAP directory integrations such as Active Directory (AD) and so on
• Help Desk functionality to manage LDAP user accounts by means of SecureAuth IdP

Third-party JavaScript Libraries Vulnerability – jQuery, Bootstrap, and AngularJS have been upgraded due to a flaw in these libraries that may result in XSS.

CVSS Score: 5.2

This hotfix is required for all customers on version 9.1 to ensure the security of the appliance.

EE-1028
EE-1120

Create User Failure for eDirectory – Create User page integrated with eDirectory was not functioning due to hardcoded attribute information.

NOTE: This fix enables the creation of users, but certain functionalities of the page are not supported for eDirectory at this time.

Proxy Settings for OIDC Encryption Key Retrieval – Proxy settings configured in SecureAuth IdP are not applied when retrieving OIDC encryption keys.

Create User Group Designation SQL – Create User page with SQL data store integration does not associate users to groups on the page during creation.

NOTE: This fix requires a new stored procedure provided by SecureAuth Support (see contact information below).

Novell eDirectory Lookup – During login, a user’s profile was not accessed successfully and the self-service password reset was unsupported.