Cloud Access Manager 8.1 - Release Notes

Dell™ One Identity Cloud Access Manager 8.1

These release notes provide information about the Dell™ One Identity Cloud Access Manager 8.1 release.

•	About Dell™ One Identity Cloud Access Manager 8.1

•	New features

•	Enhancements

•	Resolved issues

•	Known issues

•	System requirements

•	Browser support

•	Product licensing

•	Getting started with One Identity Cloud Access Manager 8.1

•	Globalization

•	About Dell

•	Legal notices

About Dell™ One Identity Cloud Access Manager 8.1

Cloud Access Manager delivers real productivity gains to your end users, while minimizing the effort needed to control access to your on-premise applications and cloud service accounts. Cloud Access Manager offers:

•	Password wallet and identity federation functions that provide your users with the convenience of single sign-on to all applications, whether they run on your private network or in the public cloud.

•	Web access management functionality using its web proxy technology, allowing you to expose your internal web applications securely to external users.

•	An easy-to-use customizable application portal that provides your users with a convenient launchpad, allowing them to see and navigate to the applications they have access to.

•	Identity federation with home realm discovery that allows you to grant access to users in other forests within your own organization and in other external organizations.

•	For extra security you can configure Cloud Access Manager to require two-factor authentication for external users, or to protect sensitive applications.

•	Just-in-time provisioning which means that your users get access to the applications they need when they need them and not before, giving you cost savings in license seats, while at the same time reducing the administrative burden of application account provisioning.

•	Dell™ vWorkspace™ integration to seamlessly bring application virtualization to the Cloud Access Manager environment, allowing vWorkspace application links to be displayed in the application portal, along with other web applications.

•	High availability deployment options for continuity of service and scalability to millions of users.

•	Dell’s Security Analytics Engine enabling access control rules based on a risk score calculated using a combination of different security information streams.

Cloud Access Manager 8.1 is a minor release, with enhanced features and functionality. See New features and Enhancements.

New features

The following is a list of new features implemented in Cloud Access Manager 8.1.

 

•

Two-factor authentication using one-time passwords generated by Dell’s Defender-as-a-Service. You can require your users to enter a Defender-as-a-Service one-time password as an additional method of authentication when accessing sensitive applications. Users can receive a one-time password using SMS text message, or by automated phone call, or by using a mobile app.

 

•	Support for Windows Azure™ Active Directory® as an Identity Provider.

 

•

Integration with Microsoft SharePoint®. Cloud Access Manager ships a module which integrates with the SharePoint People Picker, so that an administrator can easily manage authorization policy for federated users. Tools are provided to facilitate establishment of a federated trust between Cloud Access Manager and SharePoint.

 

•

Support for unauthenticated access to proxied applications. Some applications do not require user authentication, and for others, it is desirable for user authentication to be performed by the application itself, rather than by Cloud Access Manager. For these applications, Cloud Access Manager now allows an application to be proxied, without requiring the user to authenticate in order to access it.

 

•	Customization.

o

Application Portal. Cloud Access Manager now provides the ability to customize the styling of the app portal using CSS, and to upload a logo image to be displayed in the banner of the app portal. Optionally, the app portal can be styled differently, according to which Front-End Authenticator was used to log in.

 

o

Home Realm Discovery and Login Pages. Cloud Access Manager now makes available the HTML and CSS for the home realm discovery page and the login page of the built-in authenticators for full customization. This allows for changes to styling, addition of images, messaging and controls, and JavaScript logic.

 

o	Error Pages. Cloud Access Manager outputs error pages when the user is not authorized to access an application. It also shows an error page when a system error has occurred. This release introduces the ability to customize the text on both of these pages, as required.

 

•

Federated logout. Cloud Access Manager now supports WS-Federation and SAML2 Logout Profiles for federated applications. If this option is enabled, when a user logs out of a federated application, or when he logs out from the app portal, then Cloud Access Manager logs the user out of all other federated applications.

 

•	Internationalization support for app portal. Cloud Access Manager now provides the facility for customers to translate the app portal interface into other languages as required.

 

•

Password wallet API method to set application password for a newly-provisioned user. An API has been introduced which allows the caller to insert an entry into a given user's password wallet. This would allow other business processes to set a password wallet entry for a newly-provisioned application user account.

The following is a list of new features implemented in the Security Analytics Engine.

•

New method for calculating risk scores - An enhanced calculation method is now used for determining the threat level of an access attempt. This calculation method takes into account the severity of each condition as well as the impact it has on all other conditions within a risk policy. As a result, the risk score will now be represented as a percentage from 0-100%.

 

•

New configuration capabilities - Risk policies now allow modifiers to be applied to conditions in order to increase or lessen the affect a condition has on a risk score. When modifiers are triggered during an access attempt they only impact the condition they are associated with rather than the entire risk score.

 

•

New condition types - The following types of conditions are available in the Security Analytics Engine: Abnormal Authentication, Abnormal Browser, Abnormal Location, Abnormal Time, Role List, Associated w/ Application Category, Associated w/ Application Threat Level, Associated w/ Blacklist, Associated w/ Country, Associated w/ Malware, Dynamic Blacklist, Last Logon, LDAP Group, Country List, Authentication List, Network List.

 

•	New LDAP plugin - The LdapPlugin is used for gathering and storing information from the LDAP server.

 

•	New shared risk policies - Create risk policies which can be used by multiple applications while managed from a single place.

 

•	Alerting - Email alerts can now be sent when a certain risk score or condition score is surpassed during an access attempt.

 

•	Expanded reporting capabilities - Lists of audit events can now be downloaded directly from the Security Analytics Engine.

 

•	New Botnet monitoring capabilities - The SonicWALLPlugin (previously called the MalwareDetectionPlugin) can now monitor for connections with Botnet command and control servers.

See also:

•	Enhancements

•	Resolved issues

Enhancements

The following is a list of enhancements implemented in Cloud Access Manager 8.1.

Table 1. General enhancements

Enhancement	Issue ID
Improve messaging from LDAP Front-End Authenticator when connected to Active Directory using Virtual Directory Services	STS2060
Audit login of fallback administrator	346359
Document OAuth single sign-on for native mobile phone apps	360433
Support multiple email suffixes in Subject Mapping	366197
Administration interface update	367427
Improve end user experience when the database connection is down	372351
Accessibility: add skip links	376899
Allow trust certificates to be replaced	379881
Application groups: rename and delete	382830
Sort the applications list alphabetically	393005
Configurable absolute session timeout	412403
Provide ability to customize session expired page	413179
Add "request an application" link on app portal	413996
Provide the option to redirect back to the last-accessed application on session expiry	415999
Reports are now only executed when requested explicitly	417436
User mapping and deprovisioning lists are now only built when requested explicitly	417438
Report date format localization	417439
Warn administrator that primary credentials not captured when using Kerberos	417991
Send username to password manager when user elects to change password after expiry	418833
Improvements to the handling of signing and encryption certificates for SAML applications	424072
Support for multiple password manager instances	424465
Prompt administrator to upgrade remaining STS and proxy hosts following an upgrade	430116
Support form-fill single sign-on to single-page applications by using CSS selectors	431484
Use Dell standard licensing module for licensing functions	434054
Validate the domain name when entering proxy URLs	434310
Administration debug logging warning	434356
Support signed SAML authentication request on HTTP redirect binding	436637
Make encryption strength configurable for SAML applications	436638
Send sid and email context information to Security Analytics Engine	436742
Allow signing policy to be relaxed on SAML authentication requests	436929
Administration function to delete selected users and deprovision application user accounts	437956
Remove redundant option to trial Security Analytics Engine	441938
Add internationalization support to status pages	442030
vWorkspace: import app "folders", convert into Cloud Access Manager app "sections", move icons into other sections	442067
Warn that OpenID Connect redirect URI is an exact string	447583
Security Analytics Engine risk scores change from 1-7 to 0-100	447674
Allow the session expiry message text to be customized	450236
Include application/javascript in proxy javascript filter	451491
Improve reporting of object name in admin audit report	451648
Indicate in audit report that login was via a social authentication	451652
Sign all certificates with SHA-2	453631
OAuth v2.0 / OpenID Connect token lifetime configuration	454047
OAuth v2.0 / OpenID Connect support for opaque access tokens	454050
OAuth v2.0 / OpenID Connect refresh tokens	454052
Set secure flag when clearing CAM_SID and .ASPXAUTH cookies	455645
Support for IIS 10	464135
OpenID Connect: Allow claims to be included in id tokens on a per application basis	464756
Include the content length for compressed responses in the proxy access log	465301
Write performance statistics to the proxy logs	465558
Remove RC4 cipher suite from default supported list	465700
OpendID Connect - Add access token expiry time claim (exp) to userinfo endpoint	466045
Add objectSid to the default user attributes for Front End Authenticators	466210
OpenID Connect: Allow claims to be included in by value Access Tokens	469058
When replacing an existing certificate, prefill existing certificate domain name	469327
OAuth V2 tokens persisted in database	471060
Performance improvements to the login process for Active Directory® logins	472318
Limit access to unprotected content to public and backup folders	472681
Allow hyphens in header names	474102
Allow application links for OAuth applications regardless of client type	474996
Add version number to dbsnapshot	478735
Adjust default values for Security Analytics Engine risk	479180
New application configuration template for Dell One Identity Manager 7.0.	496099