What’s new

Hardware OTP token bulk operations [SSA-13659]: You can perform administrative operations (for example, deleting tokens) on multiple tokens simultaneously. You can select several tokens on a page of the Hardware (one-time password) OTP authenticator list, all tokens on a page, or all tokens on the list.

Multiple users per HW token [SSA-13889]: To accommodate users who have more than one AD account, Enterprise Connect Passwordless Server now supports enrollment of multiple users with a single hardware OTP token.

HW OTP support for RADIUS sign on [SSA-13930]: You can now use hardware OTP tokens to authenticate to RADIUS services.

Nginx server security enhancements [SSA-13235] [SSA-12938]: Enterprise Connect Passwordless Server version 5.8.2 supports use of optional enhanced security settings for the Nginx server. After installing the server, you can enforce these settings by simply uncommenting the relevant lines in the following files:

Shared user accounts [SSA-12370]: Designated users can now log into a generic account on a shared workstation using their personal credentials and devices. This feature facilitates smooth sign on while enhancing authentication security for specific groups of personnel (such as IT, DevOps, manufacturing floor workers, and others) who use shared workstations.

Hardware OTP token support [SSA-13179]: Enterprise Connect Passwordless Server now supports use of HW OTP tokens for sign on to Windows and the user portal, in online or offline mode. New functionality in the Management Console enables the system admin to import lists of supported tokens, and users then enroll using their unique device.

Strong authentication per service [SSA-13514]: You can now override global settings for adaptive authentication for specific services in the New Devices tab of the service settings. You can enable or disable adaptive authentication for a service, or change individual settings within the mechanism (such as length of verification code) as required.

Legacy mode support per ADPA service [SSA-12880]: You can now override the global setting for legacy workstation agent support (enabled or disabled) for individual Active Directory authentication services. Legacy workstations run versions below Windows Agent 3.3 and Mac Agent 2.3.0.

List paging and scrolling enhancements [SSA-13230]: You can now use new paging and navigation features in many menus of the Enterprise Connect Passwordless Server console to choose how many items to display on a page (10, 20, 50, or 100) and immediately navigate to any page of the list by selecting the relevant page.

Enhanced Database Server support [SSA-13232]: Enterprise Connect Passwordless Server version 5.8 supports PostgreSQL 15.

Option for controlling upgrade of external components [SSA-13714]: The Enterprise Connect Passwordless Server installation file now supports an optional parameter to prevent upgrade of various external components during the installation process, including the Nginx web server, the Redis server and the Node.js runtime environment.

Option for disabling auto-search [SSA-13405]: To reduce load on the database, a new parameter in the production.json file can now be set to disable autocomplete when searching for users in the Enterprise Connect Passwordless Server Console.

Content Security Policy: Helps protect your site from XSS attacks by whitelisting sources of approved content.

Referrer Policy: Allows your site to control how much information the browser sends to destination servers with navigation away from a document.

Permissions Policy: Allows your site to control which features and APIs can be used in the browser.

# add_header Content-Security-Policy "default-src 'self'; script-src 'self'
'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:";
# add_header Referrer-Policy 'origin';
# add_header Permissions-Policy
geolocation=(),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),
fullscreen=(self),payment=()";

Alternative ACS URL parameter: A new custom parameter for generic SAML services, altAcsUrl, enables you to route SAML requests originating from a mobile device to a dedicated assertion consumer service (ACS) URL. When you set the parameter, the system checks the user-agent header of the request. If it detects a mobile user-agent, it uses the altAcsUrl value instead of the ACS URL defined in the service settings.

Workstation limit per user: You can now define a limit on the number of workstations an end user can authenticate from. After the end user reaches the limit, authentication to other workstations fails. To accommodate users who need access to many workstations, the Override Workstation Limit setting in a user’s details (Security tab) enables you to specify a limit for each user.

DMZ delegation support: You can now enable authentication servers in the demilitarized zone (DMZ) to communicate directly with a server within the network.

Reporting authenticator plugin: You can enable a third-party authenticator to be the designated reporting authenticator. The third-party authenticator receives workstation authentication event logs so you can view the log reports in a third-party platform.

Management console minimum password length support: For on-prem deployments, you can now define the minimum number of characters required for local user passwords to access the management console. You specify the value in a new parameter in the configuration file.

Automatic password sync: Users can use a new setting that allows them to authenticate using the mobile app even when the AD password has changed. When the agent detects a mismatch, the authentication server sends a password-reset request, and the user must approve the authentication request to log in successfully. Enable this setting in the management console under corporate directory settings.