Access Manager 4.4 Service Pack 1 Release Notes

Transcription

1 Access Manager 4.4 Service Pack 1 Release Notes March 2018 Access Manager 4.4 Service Pack (4.4.1) includes enhancements, improves usability, and resolves several previous issues. Many of these improvements are made in direct response to suggestions from our customers. We thank you for your time and valuable input. We hope you continue to help us ensure our products meet all your needs. You can post feedback in the Access Manager forum on our community website that also includes product notifications, blogs, and product user groups. For information about the previous release, see Access Manager 4.4 Hotfix 1 Release Notes ( accessmanager44-hf1-releasenotes.html). For more information about this release and for the latest release notes, see the Documentation page. To download this product, see the Product ( page. For information about Access Manager support lifecycle, see the Product Support Lifecycle page. Section 1, What s New?, on page 1 Section 2, Installing or Upgrading, on page 7 Section 3, Verifying Version Number After Upgrading to 4.4.1, on page 8 Section 4, Supported Upgrade Paths, on page 8 Section 5, Known Issues, on page 8 Section 6, Contact Information, on page 12 Section 7, Legal Notice, on page 12 1 What s New? The following sections outline the key features and functions provided by this version, as well as issues resolved in this release: Section 1.1, Enhancements, on page 1 Section 1.2, Operating System Upgrade, on page 3 Section 1.3, Updates for Dependent Components, on page 3 Section 1.4, Software Fixes, on page Enhancements This release introduces the following enhancements: Section 1.1.1, Public Cloud Support, on page 2 Section 1.1.2, Microsoft Azure Active Directory Support, on page 2 Section 1.1.3, Simplified Access Manager Connector for Cloud, on page 2 Access Manager 4.4 Service Pack 1 Release Notes 1

2 Section 1.1.4, Business-to-Consumer Capabilities, on page 3 Section 1.1.5, Support for OpenID Connect Hybrid Flow, on page 3 Section 1.1.6, Support for Invisible recaptcha, on page Public Cloud Support This release adds support for deploying the following Access Manager components as services on Amazon Web Services (AWS) EC2 and Microsoft Azure: Administration Console Identity Server Access Gateway NOTE: Deployment of Access Gateway Appliance and Analytics Server is not supported on AWS EC2 and Microsoft Azure. You can deploy Access Manager in AWS EC2 and Microsoft Azure on any of the following operating systems: SUSE Linux Enterprise Server (SLES) 12 SP3 Red Hat Enterprise Linux (RHEL) 7.4 For more information about deploying Access Manager on AWS EC2, see Deploying Access Manager on Amazon Web Services EC2 in the NetIQ Access Manager 4.4 Installation and Upgrade Guide. For more information about deploying Access Manager on Microsoft Azure, see Deploying Access Manager on Microsoft Azure in the NetIQ Access Manager 4.4 Installation and Upgrade Guide Microsoft Azure Active Directory Support This release adds support for Microsoft Azure Active Directory as the user store when Access Manager is deployed on Microsoft Azure Simplified Access Manager Connector for Cloud Access Manager provides a connector that simplifies the procedure for creating a SAML 2.0 federated connection between an on-premises Access Manager setup and a cloud-based Access Manager setup. This connector helps you to configure single sign-on (SSO) for the on-premise applications and cloud-based applications of an organization and provides seamless login experience to users. For more information, see Configuring the Application for Access Manager on the Public Cloud in the Access Manager Applications Configuration Guide Access Manager 4.4 Service Pack 1 Release Notes

3 1.1.4 Business-to-Consumer Capabilities This release introduces a demo interface that simplifies the Access Manager configuration process for the Business-to-Consumer (B2C) capabilities. This demo provides a single page to configure Access Manager-side options that are required for enabling B2C. You do not need to configure various settings on multiple pages, as was required in Access Manager 4.4. Using the demo wizard, you can configure the following items for B2C in Access Manager: Reverse proxy Certificate Virtual attribute Advanced Authentication server configuration Self Service Password Reset server configuration Identity Injection policies for Advanced Authentication and Self Service Password Reset Risk-based policy For more information, see Business To Consumer Wizard: Sample Configuration in the NetIQ Access Manager 4.4 Administration Guide Support for OpenID Connect Hybrid Flow You can now use the hybrid flow for the OpenID authentication. For more information about this flow, see Authentication by Using Hybrid Flow in the NetIQ Access Manager 4.4 Administration Guide. For information about using the hybrid flow for requesting and getting responses, see the API documentation ( Support for Invisible recaptcha This release supports invisible recaptcha. For information about invisible recaptcha, see Google developer guide for recaptcha ( 1.2 Operating System Upgrade In addition to the existing supported platforms, this release supports installation of Access Manager components on Windows Server NOTE: For more information about system requirements, see System Requirements in the NetIQ Access Manager 4.4 Installation and Upgrade Guide. 1.3 Updates for Dependent Components This release adds support for the following dependent components: edirectory Java 1.8.0_162 Access Manager 4.4 Service Pack 1 Release Notes 3

4 NOTE: Java 1.8.0_162 supports TLS Session Hash and Extended Master Secret Extension. This provides an additional security layer for TLS/SSL communications. This additional security may impact the performance of loading the user portal login page. For an environment that does not require additional security, you can perform the steps mentioned in Section 5.4, The User Portal Login Page Takes Longer Time to Load, on page 9. Apache OpenSSL 1.0.2n Tomcat imanager NOTE: Access Manager by default supports Tomcat and OpenSSL 1.0.2n, but Administration Console uses Tomcat version due to dependency on imanager. 1.4 Software Fixes Access Manager includes software fixes for the following components: Section 1.4.1, Administration Console, on page 4 Section 1.4.2, Identity Server, on page 5 Section 1.4.3, Access Gateway, on page Administration Console The following issues are fixed in Administration Console: XSS Vulnerability in Administration Console (CVE ). For more information, see TID ( Section , Cannot Create Certificate After Installing Access Manager on Windows 2012 R2, on page Cannot Create Certificate After Installing Access Manager on Windows 2012 R2 After completing the installation when you try to create a certificate from the Administration Console Dashboard by using Security > Certificates > New, the Error creating certificate:class.java.lang.nullpointerexecption error message is displayed. For more information about this issue, see TID ( doc.php?id= ). (Bug ) With this release, you can create a certificate after Installing Access Manager on Windows 2012 R2 platform. 4 Access Manager 4.4 Service Pack 1 Release Notes

5 1.4.2 Identity Server The following issues are fixed in Identity Server: Cross-Site Request Forgery (CSRF) on User Portal Login Page (CVE ). For more information, see TID ( Section , Access Manager Shows Digesting and Signing SAML Assertions with SHA1 Algorithms, on page 5 Section , Changing Encryption Certificate for SAML Service Provider Does Not Change the Encryption Algorithm in the Metadata, on page 5 Section , Office 365 Applications Cannot Render Default Login Page with Access Manager, on page 5 Section , Hibernation Code Gives an Exception When Accessing or Adding Device Fingerprint, on page 5 Section , Identity Server Does Not Accept Passwords Containing Accents over Letters (åäö) Correctly, on page 6 Section , The Login Page Does Not Render Properly After a Kerberos Authentication Method Failure, on page 6 Section , SAML 2 Token Does Not Include the Format Attribute When Using WS-Trust for Authentication, on page 6 Section , Identity Server Fails to Validate the SAML 2 Authentication Request that Does Not Include the X509 Certificate, on page 6 Section , Identity Server Throws a Null Pointer Exception on WS-Federation Logout Request, on page 6 Section , BasicSSO Connector Fails with MobileAccess but Works with Browser Based Portal, on page Access Manager Shows Digesting and Signing SAML Assertions with SHA1 Algorithms If you set the SAML advanced option SAML2 SIGN METHODDIGEST SHA256 to false, the signature method and the digest method in the assertion sent to the service provider uses SHA1 algorithm. (Bug ) Changing Encryption Certificate for SAML Service Provider Does Not Change the Encryption Algorithm in the Metadata Assigning a new encryption certificate to a service provider does not change the encryption algorithm in the metadata for IDPSSODescriptor. (Bug ) Office 365 Applications Cannot Render Default Login Page with Access Manager Javascript errors on login page prevent the proper display of Access Manager default login page. (Bug ) Hibernation Code Gives an Exception When Accessing or Adding Device Fingerprint Identity Server throws errors when loading roles for users while executing Risk Based Authentication because of unavailability of roles. (Bug ) Access Manager 4.4 Service Pack 1 Release Notes 5

6 Identity Server Does Not Accept Passwords Containing Accents over Letters (åäö) Correctly A filter is added to the web.xml file to allow the Identity Server to accept the passwords that contain accents over letters. (Bug ) In the web.xml file, uncomment or add the following content to enable this filter. This filter is disabled by default. <filter> <filter-name>encodingfilter</filter-name> <filterclass>org.apache.catalina.filters.setcharacterencodingfilter</filter-class> <init-param> <param-name>encoding</param-name> <param-value>utf-8</param-value> </init-param> </filter> <filter-mapping> <filter-name>encodingfilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> The Login Page Does Not Render Properly After a Kerberos Authentication Method Failure Issue: The fallback login page is not rendered properly after a Kerberos method authentication failure. (Bug ) Fix: The fallback login page now renders properly and retains customization as well. You no longer need to follow the configuration steps mentioned in TID ( doc.php?id= ) SAML 2 Token Does Not Include the Format Attribute When Using WS-Trust for Authentication When an STS client requests for a SAML 2 token with WS-Trust, Identity Server does not include the format attribute with the SAML2 NameID element. Therefore, the service provider cannot consume the assertion. (Bug ) Identity Server Fails to Validate the SAML 2 Authentication Request that Does Not Include the X509 Certificate Identity Server does not validate the SAML 2 authentication request when a service provider sends signed SAML 2 AuthnRequest without embedding the X509 certificate. (Bug ) With this release, even if the SAML 2 AuthnRequest does not include X509 certificate, Identity Server validates the assertion by using the service provider s metadata Identity Server Throws a Null Pointer Exception on WS-Federation Logout Request The absence of wtrealm parameter in the WS-Federation logout request causes the Identity Server to throw a NullPointerException error. (Bug ) BasicSSO Connector Fails with MobileAccess but Works with Browser Based Portal With this release, the BasicSSO connectors are updated and it works with MobileAccess. (Bug ) 6 Access Manager 4.4 Service Pack 1 Release Notes

7 1.4.3 Access Gateway The following issues are fixed in Access Gateway: Section , After Upgrading to Access Manager 4.4 and After the First Successful Tunnel Connection, All Subsequent Tunnel Connections Fail, on page 7 Section , Access Gateway Health Process Crashes While Unlocking the Mutex Lock, on page 7 Section , Duplicate Strict-Transport-Security Headers Are Present in the Requests to ESP and Identity Server, on page After Upgrading to Access Manager 4.4 and After the First Successful Tunnel Connection, All Subsequent Tunnel Connections Fail The connection pool now gets initialized and multiple tunnel connections are allowed. (Bug ) Access Gateway Health Process Crashes While Unlocking the Mutex Lock Health process crashes when the health thread tries to unlock the mutex without checking if it was locked properly. (Bug ) Duplicate Strict-Transport-Security Headers Are Present in the Requests to ESP and Identity Server With this release, if the request contains multiple Strict-Transport-Security headers, one is passed on and the remaining headers are removed. (Bug ) 2 Installing or Upgrading After purchasing Access Manager 4.4.1, log in to the NetIQ Downloads ( page and follow the link that allows you to download the software. The following files are available: Table 1 Files Available for Access Manager Filename AM_44_SP1_AccessManagerService_Linux64.tar.gz AM_44_SP1_AccessManagerService_Win64.exe AM_44_SP1_AccessGatewayAppliance.iso AM_44_SP1_AccessGatewayAppliance.tar.gz AM_44_SP1_AccessGatewayService_Win64.exe AM_44_SP1_AccessGatewayService_Linux64.tar.gz Description Contains Identity Server and Administration Console.tar file for Linux. Contains Identity Server and Administration Console.exe file for Windows Server. Contains Access Gateway Appliance.iso file. Contains Access Gateway Appliance.tar file. Contains Access Gateway Service.exe file for Windows Server. Contains Access Gateway Service.tar file for Linux. Access Manager 4.4 Service Pack 1 Release Notes 7

8 Filename AM_44_SP1_AnalyticsServerAppliance.iso AM_44_SP1_AnalyticsServerAppliance.tar.gz Description Contains Analytics Server Appliance.iso file. Contains Analytics Server Appliance.tar file. For information about the upgrade paths, see Section 4, Supported Upgrade Paths, on page 8. For more information about installing and upgrading, see the NetIQ Access Manager 4.4 Installation and Upgrade Guide. IMPORTANT: Ensure that you do not use the BTRFS filesystem for installing Administration Console. For more information, see Section 5.6, The Administration Console Installation Fails on a SLES 12 Platform, on page 11. If you are upgrading from the Access Manager version that uses BTRFS, perform the steps mentioned in TID ( 3 Verifying Version Number After Upgrading to After upgrading to Access Manager 4.4.1, verify that the version number of the component is indicated as To verify the version number, perform the following steps: 1 In Administration Console Dashboard, click Troubleshooting > Version. 2 Verify that the Version field lists Supported Upgrade Paths To upgrade to Access Manager 4.4.1, you need to be on one of the following versions of Access Manager: 4.2 Service Pack Service Pack Service Pack Hotfix 1 For more information about upgrading Access Manager, see Upgrading Access Manager in the NetIQ Access Manager 4.4 Installation and Upgrade Guide. 5 Known Issues NetIQ Corporation strives to ensure our products provide quality solutions for your enterprise software needs. The following issues are currently being researched. If you need further assistance with any issue, please contact Technical Support ( Section 5.1, Identity Server Cannot Retrieve Shared Secret Value from the edirectory User Store, on page 9 Section 5.2, JCC Hangs After Adding or Deleting Appmarks through REST API, on page 9 Section 5.3, Cannot Launch the Analytics Server Control Center, on page 9 8 Access Manager 4.4 Service Pack 1 Release Notes

9 Section 5.4, The User Portal Login Page Takes Longer Time to Load, on page 9 Section 5.5, The Secondary Administration Console Prompts for Authentication Even After Providing the Correct Credentials, on page 10 Section 5.6, The Administration Console Installation Fails on a SLES 12 Platform, on page 11 Section 5.7, Saving Few Modified Settings of Administration Console Take Longer Time, on page 11 Section 5.8, The B2C Wizard Does Not Work on a Windows Platform, on page 11 Section 5.9, Some Operating System Commands and Access Manager Utilities May Fail After Upgrading Administration Console on the SLES 12 Platform, on page 11 Section 5.10, recaptcha Does Not Work After Upgrading Access Manger to 4.4.1, on page Identity Server Cannot Retrieve Shared Secret Value from the edirectory User Store Issue: Identity server cannot retrieve shared secret value from edirectory user store after upgrading Access Manager. (Bug ) Workaround: Perform the following steps: 1 In the Identity Server global options, set the SAML2 SIGN METHODDIGEST SHA256 property to false. 2 Click Devices > Identity Servers > Servers > Edit > SAML Under Service Providers, change the SAML2 SIGN METHODDIGEST SHA256 property of each service provider to true. 4 Update the Identity Server. 5.2 JCC Hangs After Adding or Deleting Appmarks through REST API Issue: When you create or delete multiple appmarks rapidly using REST API, JCC hangs. (Bug ) Workaround: Add a delay of 1 second between the successive REST API calls to add or delete the appmarks. 5.3 Cannot Launch the Analytics Server Control Center Issue: The Analytics Server control center does not open if it is accessed from a client machine that uses Java 9. (Bug ) Workaround: To use control center you require to launch it from the client machine that uses Java The User Portal Login Page Takes Longer Time to Load Issue: This release includes Java 1.8.0_162, which supports TLS Session Hash and Extended Master Secret Extension for additional security (RFC 7627). When a user logs in to the user portal page from a browser that does not support RFC 7627, the user may encounter a delay in loading the user portal login page. (Bug ) Workaround: It is recommended to upgrade the client browsers to the latest version that supports TLS Session Hash and Extended Master Secret Extension. Access Manager 4.4 Service Pack 1 Release Notes 9

10 If you do not require the additional security, you can disable the extensions on Identity Server by using the following steps: For Linux: 1 Edit /opt/novell/nam/idp/conf/tomcat.conf. 2 Add JAVA_OPTS="${JAVA_OPTS} -Djdk.tls.useExtendedMasterSecret=false" at the end of the file. 3 Restart the Identity Server by using the following command: /etc/init.d/novell-idp restart For Windows: 1 Go to C:\Program Files\Novell\Tomcat\bin, then click Tomcat8w. 2 On the Apache Tomcat properties dialog box, click Java. 3 In the Java Options field add the following: -Djdk.tls.useExtendedMasterSecret=false 4 Click OK, then restart the Apache Tomcat 8.0 Tomcat8 service from the Services window. 5.5 The Secondary Administration Console Prompts for Authentication Even After Providing the Correct Credentials Issue: When you log in to a secondary Administration Console, Administration Console keeps prompting for authentication. This issue occurs when you install the secondary Administration Console on Windows 2016 Server. (Bug ) Workaround: To work around this issue, perform the following steps: 1 Generate an LDIF file by using the following command: C:\Novell\NDS\ice.exe -v -C -n -S LDAP -v -L C:\Novell\NDS\DIBFiles\CertServ\SSCert.der -s <Secondary AC IP> -p 636 -d <FQDN> -w <password> -F "(objectclass=ldapgroup)" -a "ldapallowcleartextpassword" -D LDIF -v -f "<path_to_ldif>" Here, FQDN should be in the cn=admin,o=novell format. 2 Edit the generated LDIF file with the following changes: Search for the ldapallowcleartextpassword entry, then set it to TRUE. Remove the remaining entries. The LDIF file will look similar to the following: changetype: modify replace: ldapallowcleartextpassword ldapallowcleartextpassword: TRUE 3 Reset the parameter by using the following command: C:\Novell\NDS\ice.exe -v -C -n -S LDIF -v -f "<path_to_edited_ldif>" -D LDAP - v -L C:\Novell\NDS\DIBFiles\CertServ\SSCert.der -s <Secondary AC IP> -p 636 -d <FQDN> -w <password> Here, FQDN should be in the cn=admin,o=novell format. 4 Restart the edirectory and the tomcat services. 10 Access Manager 4.4 Service Pack 1 Release Notes

11 5.6 The Administration Console Installation Fails on a SLES 12 Platform Issue: The Administration Console installation fails when you install it on a SLES 12 platform with the BTRFS filesystem, which is the default filesystem. This issue occurs because the supported version of edirectory does not allow creating database files on a BTRFS filesystem. (Bug ) Workaround: To workaround this issue, ensure that before installing Administration Console you change the filesystem from BTRFS to any other available filesystem. 5.7 Saving Few Modified Settings of Administration Console Take Longer Time Issue: When saving changes to some of the settings of Administration Console configuration such as SAML 2.0, the browser may display the Waiting for <public ip_address of virtual machine> message for 2 minutes before proceeding to implement the changes. For more information about this issue, see TID ( (Bug ) Workaround: When accessing the Administration Console from a browser, use a DNS name in the URL instead of an IP address. Also, ensure that the Administration Console virtual machine resolves this DNS name to its internal IP address, not to a public IP address that is assigned to the virtual machine. 5.8 The B2C Wizard Does Not Work on a Windows Platform Issue: When you configure the Business to Consumer setup for Access Manager by using the B2C demo wizard, the configuration does not work. This issue occurs when Access Manager is installed on a Windows platform. (Bug ) Workaround: To use the B2C setup, you must configure the settings manually. For more information about configuring the B2C setup manually, see Business to Consumer Access Management in the NetIQ Access Manager 4.4 Administration Guide 5.9 Some Operating System Commands and Access Manager Utilities May Fail After Upgrading Administration Console on the SLES 12 Platform After upgrading Administration Console on a SLES 12 platform, the curl and the zypper commands fail with the DEFAULT_SUSE error. For more information about this issue and how to resolve it, see TID ( and TID ( recaptcha Does Not Work After Upgrading Access Manger to Issue: After upgrading Access Manger to 4.4.1, the following message is displayed if you had enabled recaptcha before the upgrade: This site key is not enabled for the invisible captcha. This issue occurs because Access Manager onwards the invisible recaptcha is supported, which breaks the existing recaptcha v2 configuration. Access Manager 4.4 Service Pack 1 Release Notes 11

12 Workaround: To workaround this issue you must configure recaptcha again to use invisible recaptcha after the upgrade. For more information, see TID ( support/kb/doc.php?id= ). 6 Contact Information Our goal is to provide documentation that meets your needs. If you have suggestions for improvements, please Documentation-Feedback@netiq.com (mailto:documentation- Feedback@netiq.com). We value your input and look forward to hearing from you. For detailed contact information, see the Support Contact Information website ( support/process.asp#phone). For general corporate and product information, see the NetIQ Corporate website ( For interactive conversations with your peers and NetIQ experts, become an active member of our community ( The NetIQ online community provides product information, useful links to helpful resources, blogs, and social media channels. 7 Legal Notice For information about legal notices, trademarks, disclaimers, warranties, export and other use restrictions, U.S. Government rights, patent policy, and FIPS compliance, see company/legal/. Copyright 2018 NetIQ Corporation. All Rights Reserved. 12 Access Manager 4.4 Service Pack 1 Release Notes