SecurID Product Release Notes

[#1]

Release notes provide information about what's new in each release of each RSA SecurID Access component, including feature descriptions, product enhancements, and fixed issues.

• Cloud Authentication Service
• RSA Authentication Manager
• Authentication Agents
• Token Authenticators

Cloud Authentication Service

Release	What's New
August 2021	New look for the Cloud Administration Console user interface  Improved status messages for the identity router Reminder: update identity routers to software version 12.12.x and SLES 12 SP5 Changes to identity source synchronization Cloud Administration Console URLs expected to change in October 2021 release
July 2021	New Cloud Administration APIs for managing SID700 hardware tokens Identity source synchronization changes begin July 12, 2021 Cloud Administration Console URLs expected to change in October 2021 Improved security for approve notifications in SecurID Access Federal Edition
June 2021	Prepare for unification – the new SecurID app is coming! Native support for SID700 hardware tokens Identity router update versions and schedule Identity router updates available for the SUSE Linux Enterprise Server (SLES) operating system Identity source synchronization changes beginning July 2021 Cloud Administration Console URLs expected to change in September 2021 release RSA now enforces TLS 1.2 for all Cloud Authentication Service connections
May 2021	Fixed issues.
April 2021	Improved email templates for device registration and emergency access. Support for passwordless authentication through the MFA Agent 2.1 for Microsoft Windows. RSA to enforce TLS 1.2 for all Cloud Authentication Service connections Beginning May 15, 2021.
March 2021	Administrators can initiate user on-boarding with enhanced just-in-time synchronization. New REST API identifies anomalous users. Improved retrieval of license usage information. Cloud Administration Console support ended for Internet Explorer on March 16, 2021.
February 2021	Support for constant multivalued attributes in the SAML assertion
January 2021	Cloud Administration REST API retrieves product usage analytics Ability to view anomalous users in the Identity Confidence Dashboard. Ability to find and add unsynchronized users Ability to request a Cloud Authentication Service account directly from the Security Console in RSA Authentication Manager RSA Authentication Manager provides emergency failover when the Cloud Authentication Service cannot be reached Bug fixes for RSA SecurID Authenticate 3.7.0 app for iOS
November 2020	Security updates. Enhanced visibility into active users. Ability to disable the Remember This Browser prompt. Enhanced Identity Confidence Dashboard to track user behavior over time. RSA SecurID Authenticate 3.6 app for iOS provides security enhancements and bug fixes.
October 2020	Enhanced Identity Confidence Dashboard. Ability to copy the authentication endpoint URL directly from the Cloud Administration Console and paste it in a secure place for delivery to web client developers.  Improved communication for Cloud Authentication Service updates. RSS SecurID Authenticate 3.5 App for Windows provides security enhancements and bug fixes.
September 2020	Improved integration options for customers with SAML-based applications who cannot use the SAML Authentication Context attribute to assign an access policy based on a condition such as the user group and/or resource being accessed. Secure sign-in to the Cloud Administration Console through federation by extending the identity provider (IdP).
August 2020	Identity router update includes miscellaneous improvements. The RSA Cloud Administration APIs support FIDO. You can enable commercial and custom applications to enroll FIDO Tokens leveraging these APIs in addition to using RSA SecurID Access for FIDO-based authentication. RSA SecurID Access Application Portal has been redesigned with the same modern look-and-feel that users already see in the web authentication and My Page screens. If your Cloud Authentication Service deployment was integrated with RSA Authentication Manager and it allows users with RSA SecurID Tokens to access cloud-protected resources, you can now delete unused connections.
July 2020	Cloud Administration Retrieve License Usage API allows administrators to access the number of MFA licenses used, the number of users with third-party FIDO authenticators, and the total number of SMS and Voice Tokencodes sent for the current month.
July 2020	RSA SecurID Authenticate 3.6 for Android app supports face recognition.
Archive	Release notes prior to July 2020.

RSA Authentication Manager

Release	What's New
Version 8.6	SecurID Authentication Manager 8.6 uses FreeRADIUS as the basis for the SecurID RADIUS server, instead of Steel-Belted RADIUS (SBR). FreeRADIUS is the most popular open source RADIUS server in the world. SBR has reached end-of-life and required replacement. SBR is no longer supported after August 2023. SecurID Authentication Manager 8.6 includes customer-requested features and enhancements: The VMware virtual appliance now offers 500 GB of disk space for storage. You can provide your own Quick Setup Access Code for VMware virtual appliance deployment. The Distributed Token Requests Report includes a new "Distributed On" column.
Version 8.5, Patch 5	Adds the ULU (Unlock Users) command that allows AMBA to find and unlock up to a maximum of 500 locked users at the same time. To unlock more users, run the command again.
Version 8.5, Patch 4	Adds the ability to hide or show agents in the User Dashboard.
Version 8.5, Patch 3	Ability to Disable PIN Prompts for Authenticate Tokencode Users.
Version 8.5, Patch 2	High availability with RSA SecurID Authentication or Authenticate Tokencode when the Cloud Authentication Service is not available. Replica instance administrative tasks. Request a Cloud Authentication Service Account through the Security Console.
Version 8.5, Patch 1 Security Update 1	Updated the Oracle WebLogic and Java components used by RSA Authentication Manager 8.5 to prevent potential security vulnerabilities.
Version 8.5, Patch 1	Administrative roles have separate permissions to unlock an account or enable and disable accounts
Version 8.5	Easy deployment as a secure proxy server and failover node for the Cloud Authentication Service. Embedded identity router allows for faster setup and connection to the Cloud Authentication Service. Collecting usage date to improve customer satisfaction. No personal identifiable information (PII) or sensitive information is collected. Direct upgrade to RSA Authentication Manager 8.5 from version 8.2 SP1, 8.3, or 8.4
Version 8.4	(Patch 4) New features in RSA Authentication Manager 8.4 Patch 4 make it easier than ever for you to adopt modern multifactor authentication from RSA with minimal infrastructure updates to your deployment. Obtain the Azure virtual appliance from the Azure Marketplace Easier access to RSA SecurID-protected resources for multifactor authentication users Major platform upgrades to enhance security, including upgrades to FIPS compliance Ability to delete a console or virtual host certificate Upgrade path from version 8.3
Version 8.3	Amazon Web Services deployment Token distribution and management enhancements Agent reporting enhancements Authentication Manager Bulk Administration (AMBA) utility integrated into Authentication Manager for Enterprise Server license customers. Upgrade path from version 8.2 SP1
Version 8.2 SP1	Cloud Authentication Service users can access on-premise resources protected by SecurID agents. Remotely restore original system settings to an RSA SecurID Appliance 250 hardware appliance Numerous additional improvements  Upgrade path from version 8.2
Version 8.2	Includes support for: Upgrade path from version 8.1 SP1 with or without patches. Direct migration from version 6.1 or 7.1 is not supported. Ability to create a custom token expiry notification that calculates when tokens must be ordered based on the number of tokens available, the number of tokens that are assigned, and the number of tokens that are expiring within a specified time. IPv6 addresses for RADIUS clients. Extending the lifetime of a distributed software token that has expired or will expire soon. Ability to display a custom logon banner before users log on to the Operations Console, the Security Console, the Self-Service Console, or the appliance operating system with a Secure Shell (SSH) client.  “FIPS-inside” by including FIPS-compliant cryptographic library module RSA BSAFE® Crypto-J 6.1 (NIST Certificate # 2058). Internal SHA-256 certificates for communication between components, such as primary and replica instances and the web tier.  The Transport Layer Security (TLS) 1.2 cryptographic protocol for secure network communications.  Integration with RSA Via Access (now the Cloud Authentication Service), a cloud-based authentication service.  On the virtual appliance, uploading an Evaluation License during Quick Setup automatically creates 25 temporary software tokens that expire after 6 months. The Hyper-V virtual appliance on a Microsoft Windows 2012 host machine and a Microsoft Windows 2012 R2 host machine. The Authentication Manager Bulk Administration (AMBA) utility automates administrative operations for large new token deployments or token replacements, and simplifies the bulk administration of users, user groups, tokens, and agents. Additional trusted realm support. Use of nonstandard email domains. List user group membership in reports. Qualified on VMware ESXi 5.5 and 6.0. OpenLDAP qualified to run as an external identity source. Authentication Manager Bulk Administration (AMBA) utility added to the Extras kit. A downloadable ISO file provides a method for restoring a hardware appliance. Factory Reset is no longer supported.
Version 8.1 SP1	Hyper-V virtual appliance support. Support for SUSE Linux Enterprise Server (SLES) 11 Service Pack 3 with a fully patched SP 2 kernel. Support for Web tiers on Microsoft Windows Server 2012 R2 When you deploy dynamic seed provisioning, you can choose to distribute a CT-KIP URL and activation code encapsulated in a QR Code. Active Directory in Windows Server 2012 R2 has been qualified to run as an external identity source with RSA Authentication Manager 8.1 SP1. Security enhancements and fixes. Software fixes in the cumulative Patch 5 for version 8.1. Additional appliance platform support. Version 8.1 SP1 is pre-installed on the Hyper-V virtual appliance. Version 8.1 is pre-installed on the VMware virtual appliance and the hardware appliance.
Version 8.1	Includes support for: Upgrade path from RSA Authentication Manager 8.0 with or without patches. A hardware appliance and a virtual appliance. Factory reset. Ability to upgrade RSA SecurID Appliance 3.0 (SP 4 or later) to RSA Authentication Manager 8.1 on the Dell PowerEdge R210, R210XL, R710, or the R710XL. Ability to configure an additional network interface card (NIC). Promoting a replica instance while the original primary instance is  and functioning. New report templates. Unrestricted agent access using an alias. Quick Setup Access Code. BlackBerry 10.

Authentication Agents

Release	What's New
Version 2.1.1 MFA Agent for Microsoft Windows	Users can sign in online and offline using SID700 hardware token (managed in Cloud Authentication Service) by selecting RSA SecurID Token authentication method.
Version 2.1 MFA Agent for Microsoft Windows	Users can sign in to their computers without using a password. This update to the Agent enables passwordless authentication to Windows 10 laptops and desktops using a FIDO2 security key with a USB connector for both online and offline authentication. For more information, see this blog.
Version 2.0.3 MFA Agent for Microsoft Windows	Resolves customer-reported issues.
Version 2.0.2 MFA Agent for Microsoft Windows	Expands the set of user name formats that can be sent to either RSA Authentication Manager or the Cloud Authentication Service to include User Principal Names and email addresses.
Version 2.0.1 MFA Agent for Microsoft Windows	Connects to both Cloud Authentication Service and RSA Authentication Manager 8.5. Provides offline emergency access. New configuration and control settings to better manage load-balancing and fail-over mechanisms, user access with challenge groups, and password order changes.
Version 1.2.1 MFA Agent for Microsoft Windows	Coexists with Windows Hello for Business on Windows 10, versions 1803 and 1809. Adds support for the Device Biometrics, RSA SecurID Token, SMS Tokencode, Voice Tokencode, and Emergency Tokencode authentication methods. Supports the reserve password.
Version 1.3 MFA Agent for macOS	You can install RSA MFA Agent on macOS computers running with Apple M1 ARM based processors on the macOS Big Sur (11.1 or later) operating system. Users can sign in online and offline using SID700 hardware tokens (managed in Cloud Authentication Service) by selecting RSA SecurID authentication method. Users can check their remaining offline days by using the RSA MFA Agent icon in the macOS menu bar. You can configure Agent to display the notification. Users can also refresh their offline days using the RSA MFA Agent icon and the notification message. You can specify if the Agent appends additional information as a suffix to the user name and sends it to Cloud Authentication Service for authentication.
Version 1.2 MFA Agent for macOS	Support for offline Emergency Tokencode. Allow users to unlock their computers with macOS authentication or only a macOS password. Online help is available when users sign in and unlock their macOS computers using RSA SecurID Access.
Version 1.1 MFA Agent for macOS	Adds support for Device Biometrics for online authentication. You can ask your users to test authentication with the RSA Agent Control Center.
Version 1.0 MFA Agent for macOS	Requires users to perform additional authentication to the Cloud Authentication Service when accessing macOS computers. Supports the Approve, RSA SecurID Authenticate Tokencode, and RSA SecurID Token methods for online authentication. No fail-open offline authentication with Authenticate Tokencode. Agent customization using the RSA Agent Control Center. Online Emergency Access using the Emergency Tokencode authentication method.
Version 2.0.5 Microsoft AD FS	Includes software updates to resolve customer issues.
Version 2.0.4 Microsoft AD FS	Includes software updates to resolve customer issues.
Version 2.0.3 Microsoft AD FS	Support for Emergency Tokencode. Ability to configure a web proxy for authentication requests.
Version 2.0.2 Microsoft AD FS	Updates the RSA GPO Templates to allow users to set a Windows Hello for Business PIN. Corrects cosmetic issues with Windows Server 2019.
Version 2.0.1 Microsoft AD FS	Adds support for Windows Server 2019, which allows you to select RSA SecurID as the primary authentication method. Fixed a potential problem with device biometrics authentication.
Version 2.0 Microsoft AD FS	Includes support for: Authentication using RSA Authentication Manager and the Cloud Authentication Service  Reporting FIPS environment Data collection used to establish a level of identity confidence for a user. Coexistence with ADFS Agent Version 1.0.2
Version 1.0.2 Microsoft AD FS	Includes support for: Microsoft AD FS 2016 in Windows Server 2016. Transport Layer Security (TLS) 1.2 when registering the AD FS Agent with RSA Authentication Manager 8.2.
Version 8.0.5 for Web for Apache	Bug fixes and support for Red Hat Enterprise Linux 8.0 (64-bit) and 8.1 (64-bit) with Apache 2.4.x.
Version 8.0.4 for Web for Apache	Includes a content security policy (CSP) and CSP headers. Adds support for Red Hat Enterprise Linux 7.6 (64-bit) and 7.7 (64-bit) with Apache 2.4.x. Qualifies Security-Enhanced Linux (SELinux) on Red Hat Enterprise Linux 7.6 and 7.7 with Apache 2.4.x.
Version 8.0.3 for Web for Apache	Security-Enhanced Linux (SELinux) support on Red Hat Enterprise Linux 7.1 or later (64-bit only) with Apache 2.4.x..
Version 8.0.2 for Web for Apache	Includes security fixes and other software updates.
Version 8.0.1 for Web for Apache	Includes support for: Apache Web Server version 2.2.x and Apache Web Server version 2.4.x on Red Hat Enterprise Linux 6.6 (32-bit and 64-bit) and Red Hat Enterprise Linux 7.1.x (64-bit only). Event, prefork, and worker mode on Apache Web Server 2.2.x and Apache Web Server 2.4.x. TCP/IP and IPv6
Version 7.1.4 for Web for Apache	Includes bug fixes and support for Apache Web Server 2.2 with Red Hat Enterprise Linux 6, 32-bit and 64-bit.
Version 7.3.3 for Microsoft Windows	Includes support for: Multiple Remote Desktop applications, in addition to Microsoft’s “Remote Desktop Connection”. Ability to configure the RSA Credential Provider credential tile to use the standard Windows image for Windows 7 and Server 2008.
Version 7.3.2 for Microsoft Windows	Supports Windows Server 2016. Accepts credentials from remote applications such as Citrix® XenApp® and Microsoft Remote Desktop Connection. Users who are not required to authenticate with RSA SecurID do not need to enter credentials twice when using those applications. Bug fixes.
Version 7.3.1 for Microsoft Windows	Includes GPO template files in .admx/.adml format, which is required when importing files to the group policy Central Store. Bug fixes.
Version 8.1.4 for PAM	Added support for Solaris 11.4 x86 (64-bit). Upgraded third-party components used by Solaris 10.11 x86 (32-bit) and Solaris 11.4 x86 (32-bit and 64-bit). Other operating systems, such as AIX, Solaris SPARC and RHEL, are not updated by this release.
Version 8.1.3 for PAM	Adds support for RHEL 8.3 (64-bit). In Cloud Authentication Service mode, users can authenticate with Emergency Tokencode when the users cannot use other methods, for example, if the users do not have mobile phones or when the users lose the RSA SecurID Token.
Version 8.1.2 for PAM	Ability to configure case-sensitivity for user names when determining challenge group membership. By default, user names are case-sensitive. You can configure the PAM agent to not consider case. Adds Ubuntu 18.04 (64-bit) and Ubuntu 20.04 (64-bit) support.
Version 8.1.1 for PAM for Solaris SPARC	Adds support for Solaris SPARC 11.4 (32-bit and 64-bit) with 64-bit tools Also supports Solaris SPARC 10.5 (32-bit and 64-bit) or Solaris SPARC 11.2 (32-bit and 64-bit)
Version 8.1 for PAM	In Cloud Authentication Service mode, users can authenticate using the SMS Tokencode and Voice Tokencode authentication methods. Updated operating system version support: RHEL 6.10 (32-bit and 64-bit) and RHEL 7.5 (64-bit) CentOS Linux 7.5 (64-bit) Oracle Linux 6.10 (64-bit) and Oracle Linux 7.5 (64-bit) SUSE Linux Enterprise Server 11 SP4 (32-bit and 64-bit), SUSE Linux Enterprise Server 12 SP3 (64-bit), and SUSE Linux Enterprise Server 15 (64-bit) Solaris SPARC 10.5 (32-bit and 64-bit) with Zones and Solaris SPARC 11.2 (32-bit and 64-bit) Solaris x86 10.5 Update 11 (32-bit) and Solaris x86 11.2 (32-bit) AIX 7.1 TL3 (SP5) Power 6 (32-bit and 64-bit) and AIX 7.2 TL1 (SP2) Power 8 (32-bit and 64-bit)
Version 8.0 for PAM	Ability to authenticate to the Cloud Authentication Service (in REST mode) or RSA Authentication Manager (in REST mode or UDP mode). In REST mode, the PAM agent can send additional information to RSA Authentication Manager for agent reporting. Version 8.0 includes RSA SecurID Authentication Agent 7.1 for PAM features, such as support for SELinux, support for Exponential Backoff, and an option for a silent, unattended installation. Support for the following operating systems: AIX 7.1 TL3 (SP5) Power 6: 32-bit and 64-bit and AIX 7.2 TL1 (SP2) Power 8: 32-bit and 64-bit  RHEL 6.8: 32-bit and 64-bit, RHEL 7.1: 64-bit and RHEL 7.3 64-bit  Oracle Linux 6.8 64-bit and Oracle Linux 7.3 64-bit  Solaris SPARC 10 (32-bit and 64-bit), for which RSA recommends Update 8 or later, Solaris SPARC 10.5 (32-bit and 64-bit) with Zones, Solaris SPARC 11.2 (32-bit and 64-bit), Solaris x86 10.5 Update 11 (32-bit), and Solaris x86 11.2 (32-bit)  SUSE Enterprise Linux Server version 11 SP3 or later (32-bit and 64-bit) and SUSE Enterprise Linux Server version 12 (64-bit)
Version 7.1.0 Patch 2 for PAM	Includes support for: Red Hat Linux 7.3 Oracle Linux 6.8 64-bit and 7.3 64-bit IBM AIX 7.1 64-bit and 7.2 32-bit and 64-bit Silent Installation
Version 7.1 for PAM	Includes support for: SELinux on RHEL Exponential Backoff
Version 7.0.2 Patch 1 for PAM	Supports Exponential Backoff.
Version 2.0 for Citrix Storefront	The agent supports three authentication modes: Cloud Authentication Service. RSA Authentication Manager with REST Protocol. RSA Authentication Manager with UDP Protocol.
Version 1.5 for Citrix Storefront	Supports Citrix StoreFront version 3.12 and 3.13. The process to configure RSA SecurID authentication in the Citrix Storefront Management Console has been updated for Citrix StoreFront version 3.12 and 3.13.
Version 1.0.2 for Citrix Storefront	Provides RSA SecurID and RSA Authentication Manager Risk-Based Authentication (RBA) for authenticating users inside and outside of the corporate firewall.
Version 8.0.5 for Web for IIS	Bug fixes.
Version 8.0.4 for Web for IIS	Includes a content security policy (CSP) and CSP headers. Adds Windows Server 2019 support. Supports  Outlook Web Access (OWA) Cumulative Updates on Windows Server 2012 R2.
Version 8.0.3 for Web for IIS	Ability to register nonstandard URLs that don’t support cookies so that the Web Agent can accept them. Web Agent logging for applications without local administrator or local system privileges for IIS. Support for SharePoint Server 2016 on Windows Server 2012 R2 (64-bit) with Internet Information Services 8.5 and Windows Server 2016 (64-bit) with Internet Information Services 10.
Version 8.0.2 for Web for IIS	Security fixes and other software updates. Supports Windows Server 2016, Internet Information Services 10, and Outlook Web App on Windows Server 2016 (64-bit only).
Version 8.0.1 for Web for IIS	Includes support for: Microsoft Exchange Server 2016 and Microsoft SharePoint Server 2013 SP1 on Windows 2008 R2 SP1 with IIS 7.5. Back-end SharePoint Web App Servers. Expanded wildcard support for long-term persistent cookie URLs. Idle timeout support for persistent cookies. SharePoint sign out command deletes all session cookies and persistent cookies Ability to disable the RSA Response Interceptor Module.
SDK 8.6 for C	Includes support for: FIPS New APIs for TCP Additional Windows and Linux platforms Direct migration from the SDK 8.1 and SDK 8.5 Backward compatibility IPv6
SDK 8.6 for Java	Includes support for: FIPS  New Java methods LINUX and Windows Direct migration from the SDK 8.1 and 8.5 IPv6
API 8.5.1 for C	Bug fixes.
API 8.5 for C	Includes support for: IPv6 Backward compatibility Improved cryptography New agent-server trust model Synchronous calls for asynchronous calls Round-robin load balancing
API 8.5 for Java	Includes support for: IPv6  Backward compatibility Improved cryptography New agent-server trust model New agent management Round-robin load balancing

Token Authenticators

Release	What's New
SecurID 3.0 for iOS and Android App	The new SecurID 3.0 app makes it easier than ever for iOS and Android users to manage multiple software tokens, generate tokencodes, and view token information all in one place.
RSA SecurID Software Token 2.8.0 for Android	Qualified for Android 11. Bug fixes.
RSA SecurID SDK 2.8.0 for Android	Bug fixes.
RSA SecurID SDK 2.5.0 for iOS	The SDK is now a dynamic framework for uses RSA BSAFE Micro Edition Suite (MES) 4.4
RSA SecurID Software Token 2.4.8 for iOS	Supports iOS 13 and iPadOS. New minimum supported version is iOS 10. Resolves issue SWTIPHONE-292, which prevented users from importing tokens distributed with file-basedprovisioning.
RSA SecurID 800 Hardware Token Registry Update	Bug fixes.
RSA SecurID Software Token 2.4.0 for Android	Bug fixes.
RSA SecurID SDK 2.4.0 for Android	The file jcmandroidfips.raw was added. The file jcm.jar was removed.
RSA SecurID Software Token 1.0 for Blackberry 10	Qualifies OS 10.3.x. Supports BlackBerry OS version 10.2.0.1155 or later. Bug fixes.
RSA SecurID Software Token 2.4.7 for iOS	Bug fixes.
RSA SecurID SDK 2.4.0 for iOS	Supports two new instance methods, changeDataAccessMode and getDataAccessMode.
RSA SecurID Software Token 1.0 for Windows Phone	Allows users to install the SecurID Software Token application on the Windows Phone and access a tokencode (a random number that changes every 30 to 60 seconds) to log on to resources protected by RSA SecurID.
RSA SecurID Software Token 2.3 for Windows Mobile	Includes support for: Windows Mobile 6.1 Dynamic Seed Provisioning Fob-style software tokens Additional customization options
RSA SecurID Software Token with Automation 4.1.2 for Windows and Mac OS X	Supports 64-bit Windows and Mac OS operating systems. Allows 64-bit VPN applications to integrate with the 64-bit SecurID application.
RSA SecurID Software Token 4.1 (desktop application)	Includes support for: Additional operating systems SecurID integration with additional VPN client applications Additional logon methods with VPN client applications Device binding enhancements Additional customization policies Additional web browser plug-ins Logging enhancements Improvements for screen readers Token provisioning enhancements New installation options RSA SecurID 800 authenticator with RSA Smart Card Middleware. Resolved issues with RSA SecurID 800 authenticator
RSA SecurID Desktop Token 5.0.3 for Microsoft Windows	Resolves customer-reported issues.
RSA SecurID Desktop Token 5.0.2 for Microsoft Windows	Changed location for the Device Name and Device Serial Number registry entries.
RSA SecurID Desktop token 5.0.1 for Microsoft Windows	When the application is installed in the default location on the local hard drive, then launching the application for the first time creates registry entries for the token storage device name and the device serial number.
RSA SecurID Software Token Converter 3.1	You can convert an SDTID file to a QR Code for RSA SecurID Software Token 2.0 for iOS and apps built with the RSA SecurID SDK 2.0 for iOS.