RSA Identity Governance and Lifecycle 7.2.1.x Release Notes

The Data Access Governance module now supports data access data collection from Varonis DatAdvantage using a new out-of-the-box collector template. The collector configuration wizard allows you to configure a connection to the Varonis API easily through the user interface.

The Varonis data access collector collects permissions for both domain accounts and domain groups. Folder owners are collected as suggested owners, and added as resource owners.

RSA Identity Governance and Lifecycle 7.2.1 provides a new, out-of-the-box StealthAudit data access collector, which replaces the previous StealthAudit collector. The new StealthAudit collector encompasses the following changes:

• Unlike the old StealthAudit collector, the new collector does not require the use of compatibility views delivered as an instance job within the StealthAudit product. The new version does support the use of compatibility views, but RSA recommends recreating views using the out-of-the-box views.
• The new StealthAudit collector collects only the folders and shares to only those on which accounts or groups have direct permissions. The previous version of the collector collected all folders and shares that had been gathered by StealthAudit, and, as a result of the change, the first run with the new collector template may collect significantly fewer resources and entitlements than with the old.
• The new StealthAudit collector calculates suggested owners based on users' activity for specific folders and shares. Previously, the calculation of suggested owners required a licensed product from Stealthbits that used a proprietary function to calculate suggested owners.

The deprecated StealthAudit collector template is no longer available when creating a new data access collector. However, existing implementations of the deprecated collector type continue to work and can be edited until migrated to the new template.

You can migrate an existing, active StealthAudit collector to the new template using the Migrate button next to the Data Source Type field on the collector's General page to open the collector configuration wizard. The wizard automatically changes the Data Source Type from Data Entitlement Aggregator to StealthAudit. To complete migration, follow the prompts to review the collector details, changing any configuration details if needed. For further details, see "Migrate to the New StealthAudit Collector" in the Online Help.

RSA Identity Governance and Lifecycle now supports OAuth 2.0 authentication for both inbound and outbound email connections. OAuth allows RSA Identity Governance and Lifecycle to receive and send mail using a third-party account, such as Gmail or Office 365, without knowing or providing the credentials for that account.

You configure OAuth 2.0 support by registering the RSA Identity Governance and Lifecycle client with your email provider, and then configuring authentication using the System Email Settings page. For more information, see "Managing System Email Settings" in the Online Help.

You can now configure the outbound email server to use the STARTTLS email protocol command to request to secure an insecure connection between the email server and client. STARTTLS must be supported by your email provider to use this feature.

When STARTTLS is enabled, it is invoked after the email server and client have connected but before any credentials are exchanged. You enable this command on the System Email Settings Page. For more information, see "Managing System Email Settings" in the Online Help.

The way RSA Identity Governance and Lifecycle handles tasks when the system is in maintenance mode has been updated. The following table describes the way in which RSA Identity Governance and Lifecycle handles each type of task during maintenance mode.

Remote AFX and agents do not work after upgrading Java 1.8 JDK to u241 or higher. This patch updates the generation of the self-signed certificates for RSA Identity Governance and Lifecycle.

If you have applied this patch and upgraded to Java version JDK 8u241 or higher, you must download or regenerate the self-signed certificates for RSA Identity Governance and Lifecycle into your environment and restart the server.

1. Log in to RSA Identity Governance and Lifecycle, and go to Admin > System > Security. In a clustered environment, perform this step on the single system operations node (SON).
2. Click Change Certificate Store, and click OK to change the root certificate and CA.
3. Click Download and save the server.keystore file to a location on your computer.
4. Go to AFX > Servers, click Change Certificate Store, and click OK to change the client certificate.
5. Click Download and save the client.keystore file to a location on your computer.
6. Stop the ACM and AFX servers.
7. Copy the new server.keystore file to the location on the server where your web server reads the keystore. For example, $AVEKSA_HOME/keystore.
8. Copy the new client.keystore file to the AFX server under <AFX-server-root>/esb/conf.
9. Update the client.keystore files from the remote agents after you download the corresponding client.keystore from RSA Identity Governance and Lifecycle.
10. Restart the ACM and AFX servers and verify connectivity with the endpoints.