Authentication Service and Privilege Elevation Service 5.9.0 Release Notes (Verify Privilege Server Suite 2022)

About this Release

Authentication Service and Privilege Elevation Service, part of the product category IBM Security Verify Privilege Server Suite (previously called Centrify Infrastructure Services or Centrify Zero Trust Privilege Services), centralize authentication and privileged user access across disparate systems and applications by extending Active Directory-based authentication, enabling use of Windows Group Policy and Single-Sign-On. With IBM Security Verify Privilege Server Suite, enterprises can easily migrate and manage complex UNIX, Linux, and Windows systems, rapidly consolidate identities into the directory, organize granular access and simplify administration. IBM Security Authentication Service, through IBM Security's patented Zone technology, allows organizations to easily establish global UNIX identities, centrally manage exceptions on Legacy systems, separate identity from access management and delegate administration. IBM Security's non-intrusive and organized approach to identity and access management results in stronger security, improved compliance and reduced operational costs.

The Upgrade Guide describes the correct order to perform updates such that all packages continue to perform correctly once upgraded.

The product related release notes and documents are available online at https://docs.delinea.com/.

Delinea software is protected by U.S. Patents 7,591,005; 8,024,360; 8,321,523; 9,015,103; 9,112,846; 9,197,670; 9,378,391 and 9,442,962. (Ref: CS-44575)

Feature Changes in this Release

For a list of the supported platforms by this release, refer to the "Supported Platforms" section in the Verify Privilege Server Suite Release Notes.

For a list of platforms that IBM Security will remove support in upcoming releases, refer to the 'Notice of Termination Support' section in the Verify Privilege Server Suite Release Notes.

General

Verify Privilege Server Suite and its component services have been changed to use the new IBM Security name and logo.

For more information about Delinea, see Delinea Announcement

Security Fix

Verify Privilege Server Suite DirectControl Agent for *NIX

NSS and adquery now supports NTLM name lookup for users from one-way trusted forests.

Enhanced the Domain Controller failover algorithm so that now the default behavior is that the UNIX Agent (adclient) will try to pick up Domain Controllers based on weighted random selection and re-establish LDAP bindings every 12 hours if adclient.binding.refresh.force is true.

DirectControl Command Line Utilities

IBM Security cURL is upgraded based on cURL v7.75.0 instead of v7.70.0.

Configuration Parameters

New Parameters

The new parameters are:

  • smartcard.pkcs11.module (replaces rhel.smartcard.pkcs11.module)
  • smartcard.login.force (replaces rhel.smartcard.login.force)
  • dzdo.timestamp_type
Modified Parameters

The following configuration parameters are deprecated (but are still supported for backward compatibility) :

  • rhel.smartcard.pkcs11.module
  • rhel.smartcard.login.force

Audit Trail Events

Verify Privilege Server Suite Access Manager

Verify Privilege Server Suite Access Module for PowerShell

Verify Privilege Server Suite Group Policy Management

Verify Privilege Server Suite Licensing Service

Verify Privilege Server Suite OpenLDAP Proxy

Verify Privilege Server Suite OpenSSH

DirectControl Openssh was upgraded based on openssh-8.8p1.

Verify Privilege Server Suite OpenSSL

OpenSSL was upgraded from 3.0.0 to 3.0.1 with the CVE-2022-0778 patch applied.

Verify Privilege Server Suite Report Services

You can now set gMSA as a service account through Report Service Silent Configuration.

Verify Privilege Server Suite Smart Card

Added Smart Card Support for Ubuntu 21.10.

Verify Privilege Server Suite Windows Installer

Verify Privilege Server Suite Windows SDK

Verify Privilege Server Suite Zone Provisioning Agent

Fixed Issues in this Release

General

Fix an issue where newly provisioned zone users were not listed as their parent zone groups' members. This issue occurred with AD users that were already added to the corresponding AD groups but were newly provisioned in the zone.

Fixed an issue where the user could not do an MFA log in with RADIUS MFA authentication.

Fixed an issue where the pass-through feature didn't work when a user tried to log in using MFA ssh.

Security Fix

Verify Privilege Server Suite DirectControl Agent for *NIX

Fixed adclient so that it respects what is set in the "adclient.group.ignore.blocked.domain.member" configuration parameter so that adclient ignores groups from intentionally blocked domains when checking computer role groups.

Fixed an issue where the UNIX Agent (adclient) or CLIs produced the "No credentials found with supported encryption types" Kerberos error message after some customers changed the "adclient.krb5.permitted.encryption.types" and "adclient.krb5.tkt.encryption.types" settings.

Fixed an issue where, in some situations, the kset.altupn and krb5.conf settings were not updated as expected.

Fixed an issue where the NSS user lookup fails sometimes to find an zone user when the configuration "nss.user.group.prefer.cache: true" is in place and the corresponding AD user account is from another forest.

Fixed a library conflict between OpenSSL and DB2 server on AIX. This fixed a problem with using the DirectControl DB2 GSSAPI Kerberos plugin (Single Sign On) on AIX.

DirectControl Command Line Utilities

Fixed an issue where dzdo could not login using single sign-on to a remote host to run a command.

Fixed some issues in the CAPI cache, which is used by the DirectControl add-on packages (such as the adbindproxy and DB2 plugins), smart card support and macOS. Note that the CAPI cache is disabled by default prior to DirectControl version 5.8.1.

Fixed an issue where ssh SSO login failed when working with gssproxy.

DirectControl Installation

Fixed a problem where some services may not be registered after installing the packages on Solaris 10.

Audit Trail Events

Verify Privilege Server Suite Access Manager

Verify Privilege Server Suite Access Module for PowerShell

Verify Privilege Server Suite Group Policy Management

Verify Privilege Server Suite Licensing Service

Verify Privilege Server Suite NIS

Fixed an issue with the NIS daemon loading snapshot files. You can now make the NIS daemon load all the snapshot files into memory. Doing this can be more efficient to respond ypGetAll, but it will also have a bigger memory footprint. Please contact support if you want to use this feature.

Fixed an issue where adnisd sometimes would get incomplete group NIS maps.

Verify Privilege Server Suite OpenLDAP Proxy

Verify Privilege Server Suite OpenSSH

Enhanced the GSSAPIKexAlgorithms to support more algorithms. Now DirectControl Openssh supports the following 7 algorithms:

  • "gss-group1-sha1-"

  • "gss-group14-sha1-"

  • "gss-group14-sha256-"

  • "gss-group16-sha512-"

  • "gss-gex-sha1-"

  • "gss-nistp256-sha256-"

  • "gss-curve25519-sha256-"

Fixed an issue where the DirectControl Openssh systemd service file is not installed on SuSE15 SP3.

Fixed an issue where the DirectControl Openssh match block set in group policies were lost in sshd_config.

Verify Privilege Server Suite Report Services

Verify Privilege Server Suite Smart Card

Fixed an issue with Citrix VDA smartcard authentication on Debian or Ubuntu systems where some customers are using 3rd-party pkcs11 libraries.

Verify Privilege Server Suite Windows Installer

Verify Privilege Server Suite Windows SDK

Verify Privilege Server Suite Zone Provisioning Agent

Fixes in Release 2022 Component Update (2022.0.12 / July 2024)

  • Fixed issues related to CVE-2024-6387 and CVE-2024-6409 by creating a patch for OpenSSH. (Ref: 582230)

    This Component Update will deprecate the previous version, Component Update (March 2024).

Fixes in Release 2022 Component Update (March 2024)

  • Fixed issues related to CVE-2023-42465 by creating a patch for Dzdo. (Ref: 553568)

    This Component Update will deprecate the previous version.

Fixes in Release 2022 Component Update

Fixed issues related to CVE-2023-5363 by creating a patch to OpenSSL 3.0.7. (Ref: 541352)

Fixed several critical security fixes by upgrading 'Centrify OpenSSL' to 3.0.7. (Ref: 469890)

Fixed issues related to CVE-2022-42915 by upgrading cURL to 7.86.0. (Ref: 469891)

Fixed an issue where if you were using Release 2021 (5.8.0) or earlier and you upgraded to the Release 2022 (5.9.0) GA, you might have encountered a cache upgrade issue. The issue caused login failures for offline upgrades and had a negative impact on *NIX agent performance for large Active Directory environments. If you're planning to upgrade, we highly recommend that you use this updated version. You know you have the updated version when you run adinfo -v and you get CentrifyDC 5.9.0-159.

Applied the patches of CVE-2022-1292, CVE-2022-1473, CVE-2022-1434 and CVE-2022-1343 to Centrify OpenSSL.

If the domain controller has installed Windows updates dated November 9, 2021 or later and set the new registry value "PacRequestorEnforcement" as "2", resetting passwords by way of Kerberos would fail. As a result, DirectControl adjoin, adkeytab and adpasswd command line utilities would fail to reset the accounts' password. Microsoft has confirmed this issue, please see the Known issues section of this article. This release has a solution to bypass that issue.

Known Issues

The following sections describe common limitations or known issues associated with this Authentication Service and Privilege Elevation Service release.

For the most up to date list of known issues, please login to the Customer Support Portal at https://www.delinea.com/support and refer to Knowledge Base articles for any known issues with the release.

Verify Privilege Server Suite DirectControl Agent for *NIX

  • Known Issues with Multi-Factor Authentication (MFA)

    If MFA is enabled but the parameter "adclient.legacyzone.mfa.required.groups" is set to a non-existent group, all AD users will be required for MFA. The workaround is to remove any non-existent groups from the parameter. (Ref: CS-39591b)

  • Known Issues with AIX

    On AIX, upgrading DirectControl agent from 5.0.2 or older versions in disconnected mode may cause unexpected behavior. The centrifydc service may be down after upgrade. It's recommended not to upgrade DirectControl agent in disconnected mode. (Ref: CS-30494a)

    Some versions of AIX cannot handle username longer than eight characters. As a preventive measure, we have added a new test case in the adcheck command to check if the parameter LOGIN_NAME_MAX is set to 9. If yes, adcheck will show a warning so that users can be aware of it. (Ref: CS-30789a)

  • Known issues with Fedora 19 and above (Ref: CS-31549a, CS-31730a)

    There are several potential issues on Fedora 19 and above:

    1. The adcheck command will fail if the machine does not have Perl installed.
    2. Group Policy will not be fully functional unless Text/ParseWords.pm is installed.

  • Known issues with RedHat

    When logging into a RedHat system using an Active Directory user that has the same name as a local user, the system will not warn the user of the conflict, which will result in unpredictable login behavior. The workaround is to remove the conflict or login with a different AD user. (Ref: CS-28940a, CS-28941a)

    • Known issues with rsh / rlogin (Ref: IN-90001)
    • When using rsh or rlogin to access a computer that has DirectControl agent installed, and where the user is required to change their password, users are prompted to change their password twice. Users may use the same password each time they are prompted, and the password is successfully changed.

  • Known issues with compatibility

    Using DirectControl 4.x agents with Access Manager 5.x (Ref: IN-90001)

    • DirectControl 4.x agents can join classic zones created by Access Manager 5.x. It will ostensibly be able to join a DirectControl 4.x agent to a hierarchical zone as well, but this causes failure later as such behavior is undefined.

    Default zone not used in DirectControl 5.x (Ref: IN-90001)

    • In DirectControl 4.x, and earlier, there was a concept of the default zone. When Access Manager was installed, a special zone could be created as the default zone. If no zone was specified when joining a domain with adjoin, the default zone would be used.
    • This concept has been removed from DirectControl 5.0.0 and later as it is no longer relevant with hierarchical zones. In zoned mode, a zone must now always be specified.
    • A zone called "default" may be created, and default zones created in earlier versions of Access Manager may be used, but the name must be explicitly used.

Smart Card

  • Release 18.8 includes an update to Coolkey to support Giesecke & Devrient 144k, Gemalto DLGX4-A 144, and HID Crescendo 144K FIPS cards. However, this has caused known issues that may cause CAC cards to only work sporadically. A workaround for CAC cards is to wait for it to prompt for PIN and Welcome, without removing the card, and then try again. (Ref: CC-58013a)

  • There is a Red Hat Linux desktop selection issue found in RHEL 7 with smart card login. When login with smart card, if both GNOME and KDE desktops are installed, user can only log into GNOME desktop even though "KDE Plasma Workspace" option is selected. (Ref: CS-35125a)

  • On RHEL 5.10 and 5.11, if "Smart Card Support" is enabled and a smartcard is inserted on the login screen, a PIN prompt may not show up until you hit the "Enter" key. The workaround is to replace libsoftokn3.so with the old one on RHEL 5.9, which is a shared object file in NSS package. (Ref: CS-35038a)

  • On RHEL 5.10 and 5.11, if "Smart Card Support" is enabled and "Card Removal Action" is configured as "Lock", the screen will be locked several seconds after login with smart card. The workaround is to replace libsoftokn3.so with the old one on RHEL 5.9, which is a shared object file in NSS package. (Ref: CS-33871a)

  • When a SmartCard user attempts to login on Red Hat 6.0 with a password that has expired, the authentication error message may not mention that authentication has failed due to an expired password. (Ref: CS-28305a)

  • On RedHat, any SmartCard user will get a PIN prompt even if he's not zoned, even though the login attempt will ultimately fail. This is a divergence from Mac behavior - On Mac, if a SmartCard user is not zoned, Mac doesn't even prompt the user for PIN. (Ref: CS-33175c)

  • If a SmartCard user's Active Directory password expires while in disconnected mode, the user may still be able to log into their machine using their expired password. This is not a usual case, as secure SmartCard AD environments usually do not allow both PIN and Password logins while using a Smart Card. (Ref: CS-28926a)

  • To login successfully in disconnected mode (Ref: CS-29111a):

    • For a password user:
      • A password user must log in successfully once in connected mode prior to logging in using disconnected mode. (This is consistent with other DirectControl agent for *NIX behavior)
    • For a SmartCard user:
      • The above is not true of SmartCard login. Given a properly configured RedHat system with valid certificate trust chain and CRL set up, a SmartCard user may successfully login using disconnected mode even without prior successful logins in connected mode.
      • If certificate trust chain is not configured properly on the RedHat system, the SmartCard user's login attempt will fail.
      • If the SmartCard user's login certificate has been revoked, and the RedHat system has a valid CRL that includes this certificate, then the system will reject the user.

  • After upgrading from DirectControl version 5.0.4 to version 5.1, a Smartcard user may not be able to login successfully. The workaround is to run the following CLI commands:

    sudo rm /etc/pam_pkcs11/cacerts/*

    sudo rm /etc/pam_pkcs11/crls/*

    sudo rm /var/centrify/net/certs/*

    then run adgpupdate. (Ref: CS-30025c)

  • When CRL check is set via Group Policy and attempting to authenticate via Smartcard, authentication may fail. The workaround is to wait until the Group Policy Update interval has occurred and try again or to force an immediate Group Policy update by running the CLI command adgpupdate. (Ref: CS-30090c)

  • After upgrading from DirectControl agent Version 5.0.4 to version 5.1.1, a SmartCard user may not be able to authenticate successfully. The workaround is to perform the following CLI command sequence:

    sctool -d

    sctool -e

    sudo rm /etc/pam_pkcs11/cacerts/*

    sudo rm /etc/pam_pkcs11/crls/*

    sudo rm /var/centrify/net/certs/*"

    adgpupdate

and then re-login using the SmartCard and PIN. (Ref: CS-30353c)
  • A name-mapping user can unlock screen with password even though the previous login was with PIN. (Ref: CS-31364b)
  • Need to input PIN twice to login using CAC card with PIN on RedHat. It will fail on the first input but succeed on the second one. (Ref: CS-30551c)
  • Running "sctool –D" with normal user will provide wrong CRL check result. The work-around is to run it as root. (Ref: CS-31357b)
  • Screen saver shows password not PIN prompt (Ref: CS-31559a)

Most smart card users can log on with a smart card and PIN only and cannot authenticate with a username and password. However, it is possible to configure users for both smart card/PIN and username/password authentication. Generally, this set up works seamlessly: the user either enters a username and password at the log on prompt, or inserts a smart card and enters a PIN at the prompt.

However, for multi-user cards, it can be problematic when the screen locks and the card is in the reader. When a user attempts to unlock the screen, the system prompts for a password, not for a PIN, although the PIN is required because the card is in the reader. If the user is not aware that the card is still in the reader and enters his password multiple times, the card will lock once the limit for incorrect entries is reached.

On RHEL 7, an authenticated Active Directory user via smart card cannot login again if the smart card is removed. This is due to a bug in RHEL 7, https://bugzilla.redhat.com/show_bug.cgi?id=1238342. This problem does not happen on RHEL6. (Ref: CSSSUP-6914c)

Report Services

  • N/A

Additional Information and Support

In addition to the documentation provided with this package, see the IBM Security Knowledge Base for answers to common questions and other information (including any general or platform-specific known limitations), tips, or suggestions. You can also contact IBM Security Support directly with your questions through the IBM Security Web site, by email, or by telephone.

The IBM Security Resources web site provides access to a wide range of information including analyst report, best practice brief, case study, datasheet, ebook, white papers, etc., that may help you optimize your use of IBM Security products. For more information, see the IBM Security Resources web site.

You can also contact IBM Security Support directly with your questions through the IBM Security Web site, by email, or by telephone. To contact IBM Security Support or to get help with installing or using this software, send email to support@delinea.com or call 1-202-991-0540. For information about purchasing or evaluating IBM Security products, send email to info@delinea.com.