Authentication Service and Privilege Elevation Service 5.8.0 (Release 2021) Release Notes

© 2004-2021 Centrify Corporation.

This software is protected by international copyright laws.

All Rights Reserved.

 

Table of Contents

1.      About This Release. 1

2.      Feature Changes. 1

2.1.       Feature Changes in Authentication Service and Privilege Elevation Service 5.8.0 (Release 2021) 1

General 1

Security Fix. 1

Centrify DirectControl Agent for *NIX.. 1

Centrify Access Manager 1

Centrify Access Module for PowerShell 1

Centrify Windows SDK.. 1

Centrify Group Policy Management 1

Centrify Licensing Service. 1

Centrify OpenLDAP Proxy. 1

Centrify OpenSSH.. 1

Centrify Report Services. 1

Centrify Smart Card. 1

Centrify Zone Provisioning Agent 1

2.2.       Feature Changes in Authentication Service and Privilege Elevation Service 5.7.1 (Release 2020.1)  1

General 1

Security Fix. 1

Centrify DirectControl Agent for *NIX.. 1

Centrify Windows Installer 1

Centrify Licensing Service. 1

Centrify Report Services. 1

3.      Bugs Fixed. 1

3.1.       Bugs Fixed in Authentication Service and Privilege Elevation Service 5.8.0 (Release 2021) 1

General 1

Centrify DirectControl Agent for *NIX.. 1

Centrify OpenSSH.. 1

Centrify OpenLDAP Proxy. 1

Centrify Access Manager 1

Centrify Access Module for PowerShell 1

Centrify Licensing Service. 1

Centrify Group Policy Management 1

Centrify Report Services. 1

Centrify Zone Provisioning Agent 1

3.2.       Bugs Fixed in Authentication Service and Privilege Elevation Service 5.7.1 (Release 2020.1) 1

General 1

Centrify DirectControl Agent for *NIX.. 1

Centrify OpenSSH.. 1

Centrify OpenLDAP Proxy. 1

Centrify Group Policy Management 1

Centrify Report Services. 1

4.      Known Issues. 1

Centrify DirectControl Agent for *NIX.. 1

Smart Card. 1

Centrify Report Services. 1

5.      Additional Information and Support 1

 

1.     About This Release

 

Authentication Service and Privilege Elevation Service, part of the product category Centrify Server Suite (previously called Centrify Infrastructure Services or Centrify Zero Trust Privilege Services), centralize authentication and privileged user access across disparate systems and applications by extending Active Directory-based authentication, enabling use of Windows Group Policy and Single-Sign-On. With Centrify Server Suite, enterprises can easily migrate and manage complex UNIX, Linux, and Windows systems, rapidly consolidate identities into the directory, organize granular access and simplify administration. Centrify Authentication Service, through Centrify's patented Zone technology, allows organizations to easily establish global UNIX identities, centrally manage exceptions on Legacy systems, separate identity from access management and delegate administration.  Centrify's non-intrusive and organized approach to identity and access management results in stronger security, improved compliance and reduced operational costs.

An upgrade application note (/Documentation/centrify-upgrade-guide.pdf) is provided with this release to guide customers who have installed multiple Centrify packages. The document describes the correct order to perform updates such that all packages continue to perform correctly once upgraded. This document is also available online.

The product related release notes and documents are available online at http://docs.centrify.com.

Centrify software is protected by U.S. Patents 7,591,005; 8,024,360; 8,321,523; 9,015,103; 9,112,846; 9,197,670; 9,378,391 and 9,442,962. (Ref: CS-44575)

2.     Feature Changes

 

For a list of the supported platforms by this release, refer to the 'Supported Platforms' section in the Centrify Server Suite release notes.

For a list of platforms that Centrify will remove support in upcoming releases, refer to the 'Notice of Termination Support' section in the Centrify Server Suite release notes.

For a complete list of supported platforms in the latest releases, refer to the 'Centrify Server Suite' section in the document available from www.centrify.com/platforms.

2.1.          Feature Changes in Authentication Service and Privilege Elevation Service 5.8.0 (Release 2021)

General

 

·        Open-Source component upgrade

·        Upgraded .NET framework from v4.6.2 to v4.8. (Ref: CS-48639)

·        Upgraded cURL from v7.70.0 to v7.75.0. (Ref: CS-48932)

§  This includes several security fixes. For details, please refer to https://curl.haxx.se/docs/security.html.

·        Upgraded OpenLDAP from v2.4.50 to v2.4.57 and also applied a patch for CVE-2021-27212. (Ref: CS-49123)

§  For changelog details, please refer to https://www.openldap.org/software/release/changes.html.

·        Upgraded OpenSSH from v8.4p1 to v8.6p1. (Ref: CS-49607)

§  For changelog and vulnerability fix details, please refer to http://www.openssh.com/releasenotes.html and https://www.openssl.org/news/cl111.txt.

·        Upgraded OpenSSL from v1.1.1g to v1.1.1k. (Ref: CS-49218)

§  For changelog and vulnerability fix details, please refer to https://www.openssl.org/news/vulnerabilities.html and http://www.openssh.com/security.html.

·        Upgraded PostgreSQL from v12.0 to v12.5. (Ref: CS-48640)

§  For changelog and vulnerability fix details, please refer to https://www.postgresql.org/ and https://www.postgresql.org/support/security/.

·        Upgraded PuTTY from v0.73 to v0.74. (Ref: CS-48963)

§  This includes several security fixes. For details, please refer to https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html.

·        Upgraded SQLite from v3.31.1 to v3.34.1. (Ref: CS-48827, CS-48988, CS-48685, CS-48580)

§  For changelog details, please refer to https://www.sqlite.org/chronology.html.

·        Upgraded sudo from v1.8.20p2 to v1.9.5p2. (Ref: CS-49538)

§  For changelog details, please refer to https://www.sudo.ws/stable.html#1.9.5p2.

·        Packaging change

·        Starting from this release, the names of the bundles have changed from Centrify-Infrastructure-Services-XXX.iso/zip/tgz back to Centrify-Server-Suite-xxx.iso/zip/tgz to better reflect the product organization. (Ref: CS-49475)

·        Redhat packages are now SHA256 compliant. (Ref: CS-44650)

·        Compatibility (Ref: CS-49384)

This release of Centrify DirectControl Agent for *NIX will work with the following except on Solaris:

·        The latest released Centrify for DB2 and Centrify for Samba. (Ref: CS-44594)

·        Centrify DirectAudit Agent of Release 2017 or later, except

§  On AIX, DirectAudit Agent must be of Release 2020.1 or later. (Ref: CS-49425, CS-49427)

§  Linux PowerPC platforms, DirectAudit Agent must be of Release 2017.3 or later. (Ref: CS-44597, CS-44601, CS-44749)

·        Centrify OpenSSH of Release 19.6. (Ref: CS-45107)

On Solaris, you need to upgrade all packages to Release 2020 or later. E.g., this release of Centrify DirectControl Agent for *NIX will not work with old versions of adbindproxy package, DirectAudit Agent, Centrify OpenSSH, etc., as the location of 64-bit executables is changed (e.g., 'bin/amd64' for x86, and 'bin/sparcv9' for sparc). (Ref: CS-45176)

As Centrify Deployment Manager is already discontinued after Release 18.11, Deployment Manager cannot deploy this release of Centrify DirectControl Agent for *NIX. (Ref: CS-47626)

Security Fix

 

·        N/A

Centrify DirectControl Agent for *NIX

 

·        Deprecated TLS 1.1 support from adclient TLS channel. We now explicitly specify TLS version 1.2 or above for the https connections to cloud connector. (Ref: CS-49589)

·        Added the instrumentation for threadpool information as part of the heartbeat INFO messages to syslog. (Ref: CS-49472)

·        Changed CAPI performance log messages from DEBUG to INFO level for better monitoring. (Ref: CS-49299)

·        Added a new method, ldapFetch, to the Session class in Python pycapi module. The method can fetch an AD object via LDAP. (Ref: CS-49740)

·        Added a performance enhancement that by default user's group membership change triggers group member refreshing for zone enabled groups only. (Ref: CS-49718)

·        Added the support to find out the DirectAudit status of servers in the system. (Ref: CS-6971)

·        Added the support of SELINUX related feature on SuSE with "minimum" and "targeted" policy. (Ref: CS-45558, CS-47998)

·        Added the support of automatically adding local users (users with registry attribute "files") to the user ignore list on AIX. (Ref: CS-49788)

DirectControl Command Line Utilities

·        Enhanced adedit command with the following:

·        Added the support to allow runtime variable substitution (%{u:xxx}) for user fields. (Ref: CS-49347)

·        Added a new sample script to list all AD groups which are assigned with a login sysrights role. (Ref: CS-49722)

·        Enhanced dzdo command with the following:

·        Added the support of SELINUX related feature on SuSE with "minimum" and "targeted" policy. (Ref: CS-43833)

Audit Trail Events

·        N/A

Configuration Parameters

Added the following parameters in centrifydc.conf:

-   adclient.dz.refresh.hook: This parameter specifies the full path of the command that will be executed after adclient finished the DZ cache refresh. (Ref: CS-49610)

Modified the following parameters in centrifydc.conf:

-   N/A

Please refer to the manual, Configuration and Tuning Reference Guide, for details.

Centrify Access Manager

 

·        Added an option to not set the security descriptor when creating a computer object or zone object. (Ref: CS-47739)

·        Added a registry value "UseMemberNisNetGroup" (Registry key: HKLM\SOFTWARE\Centrify\CIMS\Rfc2307NisMap; Type: DWORD) to save sub-NIS-net-groups in the attribute "memberNisNetgroup" if the registry value is greater than 0. By default, this registry value is 0 or empty, which means to save the sub-NIS-net-groups in the attribute "nisNetgroupTriple". (Ref: CS-49680)

·        Added a registry value "AllowedTrusts" (Registry key: HKLM\SOFTWARE\Centrify\CIMS; Type: REG_MULTI_SZ) to manage which foreign trusts are allowed. By default, this registry value is empty. (Ref: CS-49635)

Centrify Access Module for PowerShell

 

·        Added the support of managing delegation scope by introducing a new parameter "AdComputerScope" of Set-CdmDelegation to control delegation scope when users are granted the permission to join computers to the specified zone. (Ref: CS-49535)

Centrify Windows SDK

 

·        N/A

Centrify Group Policy Management

 

·        Added the group policy support for Kerberos cache directory configuration parameter 'adclient.krb5.ccache.dir'. (Ref: CS-45623)

Centrify Licensing Service

 

·        Enhanced the section 'DirectControl Workstation – ALL (summary)' in the Deployment Report to include the count of zoneless systems. (Ref: CS-49565)

·        Changed the word 'Unmanaged' in the Deployment Report to 'Zoneless' to better describe the category. (Ref: CS-49548)

Centrify OpenLDAP Proxy

 

·        N/A

Centrify OpenSSH

 

·        Added a new ssh_config option "ScpBlockUnsafeSpec", to specify whether to deny the scp commands which contain unsafe symbols. The default is "no", meaning not to deny. This option, when set to yes, can avoid the vulnerability mentioned in CVE-2020-15778. (Ref: CS-49406)

·        Added the SELINUX support on SLES with "minimum" and "targeted" policy. (Ref: CS-45563)

Centrify Report Services

 

·        N/A

Centrify Smart Card

 

·        Added the support of smart card login on Debian 9 (x86_64) or later and Ubuntu 18.04 LTS (x86_64) or later. (Ref: CS-49402)

Centrify Zone Provisioning Agent

 

·        Added the support to specify which Domain Controller to use for connection when accessing the zones, users, and groups in the domain. (Ref: CS-40263)

·        Added a registry value "AllowedDomains" (Registry key: HKLM\SOFTWARE\Centrify ZPA; Type: REG_MULTI_SZ) to manage which domains/foreign trusts are allowed. By default, this registry value is empty. (Ref: CS-49635)

2.2.          Feature Changes in Authentication Service and Privilege Elevation Service 5.7.1 (Release 2020.1)

General

 

·        Compatibility (Ref: CS-49383)

This release of Centrify DirectControl Agent for *NIX will work with the following except on Solaris:

·        The latest released Centrify for DB2 and Centrify for Samba. (Ref: CS-44594)

·        Centrify DirectAudit Agent of Release 2017 or later, except

§  On AIX, Linux PowerPC platforms, DirectAudit Agent must be of Release 2017.3 or later. (Ref: CS-44597, CS-44601, CS-44749)

·        Centrify OpenSSH of Release 19.6. (Ref: CS-45107)

On Solaris, you need to upgrade all packages to Release 2020 or above. E.g. this release of Centrify DirectControl Agent for *NIX will not work with old versions of adbindproxy package, DirectAudit Agent, Centrify OpenSSH, etc., as the location of 64-bit executables is changed (e.g. 'bin/amd64' for x86, and 'bin/sparcv9' for sparc). (Ref: CS-45176)

As Centrify Deployment Manager is already discontinued after Release 18.11, Deployment Manager cannot deploy this release of Centrify DirectControl Agent for *NIX. (Ref: CS-47626)

·        Open-Source component upgrade

·        Centrify OpenSSH is upgraded based on openssh v8.4 from v8.2. (Ref: CS-48810)

§  This includes several security fixes and potentially incompatible changes. For changelog details, please refer to http://www.openssh.com/releasenotes.html.

·        Packaging change

·        Enhanced Unix installer to preserve the settings in openssl.cnf during openssl upgrade process. (Ref: CS-49327)

Security Fix

 

·        N/A

Centrify DirectControl Agent for *NIX

 

·        Added two python modules, pylrpc and pycapi, to provide object-oriented APIs to interact with Centrify DirectControl Agent for *NIX from Python programs. (Ref: CS-48517)

·        Added the options "-Y, --ignore-directory <pattern>", and "-E, --ignore-file <pattern>" to the command adfixid to skip directory(s) or file(s) if the pattern matched via POSIX extended regular expression. (Ref: CS-49364)

·        Added the ability to preserve credentials created by the command kinit in Kerberos cache even when renewal fails. (Ref: CS-49368)

Configuration Parameters

Added the following parameters in centrifydc.conf:

-   adclient.krb5.keytab.use.all.etypes: This parameter specifies whether to output all supported encryption types into krb5.keytab file or not. The default is false, meaning to only output types specified in 'adclient.krb5.tkt.encryption.types'. (Ref: CS-49163)

-   nss.program.ignore.check.parents: This parameter specifies whether to recursively check parent processes' names for "nss.program.ignore" parameter. Default is false. (Ref: CS-31472)

Please refer to the manual, Configuration and Tuning Reference Guide, for details.

Centrify Windows Installer

 

·        Installers are updated to detect and install KB2999226 on Windows Server 2012 and 2012R2 for Centrify applications which require the Windows 10 Universal C Runtime to run. (Ref: CS-49226)

Centrify Licensing Service

 

·        Added a new section "Special Local User Profiles Defined Report" to Licensing Report. This section will list out special local user profiles based on the search pattern configured in the registry value "SpecialUserProfilePattern". (Ref: CS-49286)

Centrify Report Services

 

·        Report Service now supports SQL Server 2017 and 2019 too. For this to work, it must be already installed on the machine. (Ref: CS-49323)

3.     Bugs Fixed

3.1.          Bugs Fixed in Authentication Service and Privilege Elevation Service 5.8.0 (Release 2021)

General

 

·        N/A

Centrify DirectControl Agent for *NIX

 

·        Fixed an issue that corrupted the cache DB when storing big keys. (Ref: CS-49756)

·        Fixed an issue that rescue rights is not working after reboot when MFA is enabled. (Ref: CS-49613)

·        Fixed the crash due to exception thrown out of SecureChannel destructor. (Ref: CS-49612)

·        Fixed an issue that sudoers.pl cannot determine sudoers file location due to locale setting. (Ref: CS-49608)

·        Fixed an issue that the properties for custom attributes like 'adclient.custom.attributes.user' are not upgraded correctly after package upgrade. (Ref: CS-49439)

·        Fixed an issue that in Kickstart deployment, the DirectContol maybe installed without systemd support and cannot work after installation. The fix is to add dependency to make sure DirectControl will be installed after systemd. (Ref: CS-49419)

·        Fixed an issue that sshd is stuck at sigchild handler function. (Ref: CS-49749)

DirectControl Command Line Utilities

·        Fixed an issue that the Python module PyLRPC is broken on Ubuntu 18.04. Note: this change breaks backward compatibility. The fix is to correct the wrong return type from previous releases. Certain attributes cannot be returned as string and python supports locale which means we cannot arbitrarily set everything to utf8. Customers who depend on previous return type of string will need to change their logic to match the new return type. (Ref: CS-49592)

·        Fixed an issue that 'sctool -D' crashes when signing test fails. (Ref: CS-49678)

Centrify OpenSSH

 

·        N/A

Centrify OpenLDAP Proxy

 

·        N/A

Centrify Access Manager

 

·        Fixed an issue that roleTime is not updated when the sys right of a role is updated in a zone. (CS-49426)

Centrify Access Module for PowerShell

 

·        N/A

Centrify Licensing Service

 

·        N/A

Centrify Group Policy Management

 

·        N/A

Centrify Report Services

 

·        The SQL Server Availability Group feature in SQL Server 2012 is now supported. (Ref: CS-39674)

Centrify Zone Provisioning Agent

 

·        N/A

3.2.          Bugs Fixed in Authentication Service and Privilege Elevation Service 5.7.1 (Release 2020.1)

General

 

·        Fixed an issue in install.sh in Release 2020 that it reports the wrong CentrifyDC version causing subsequent CentrifyDA or other product upgrade fails. (Ref: CS-49283)

·        Fixed an issue in install.sh to check if pkgadd is available or not before installation. (Ref: CS-49157)

Centrify DirectControl Agent for *NIX

 

·        Centrify DirectControl Agent for *NIX now by default uses Secure RPC for NETLOGON channel. This is related to an elevation of privilege vulnerability in Microsoft’s NETLOGON mentioned in CVE-2020-1472. (Ref: CS-49267)

·        Fixed an issue introduced in Release 19.9 that DirectControl (adclient) always generates krb5.keytab entries of all supported encryption types. Now, it will only generate krb5.keytab entries specified in the configuration parameter "adclient.krb5.tkt.encryption.types", unless a new parameter "adclient.krb5.keytab.use.all.etypes" is set to true. The default is false to match the behavior prior to Release 19.9. Please note this is a change in default behavior comparing to Release 19.9 and Release 2020. (Ref: CS-49163)

·        Fixed an issue that local account management fails to check uid conflict. Now DirectControl will emit an INFO message and skip over the conflicting entry if uid conflict exists. (Ref: CS-49077)

·        Fixed an issue that the adkeytab command sometimes creates a new AD account with PASSWD_NOTREQD(0x32) in its UserAccountControl attribute. (Ref: CS-42257)

·        Fixed an issue that DirectControl (adclient) sometimes fails to update new KDC server record into krb5.conf after a Domain Controller failover. (Ref: CS-49027)

·        Fixed a bug in the application program interface that local user authentication requested by other Centrify applications, such as, Centrify for DB2 plugin, may fail on recent Linux releases, for example RHEL 8.2, due to Kerberos library conflict. (Ref: CS-49178)

·        Fixed an issue that a bad netgroup entry causes adnisd to loop in parsing. (Ref: CS-48922)

·        Fixed an issue that when adnisd bind port fails, it logs the wrong port number. (Ref: CS-49251)

·        Enhanced Centrify DirectControl Agent for *NIX (adclient) to retry LDAP requests when the domain controller returns "server is unavailable" LDAP error. (Ref: CS-48674)

Centrify OpenSSH

 

·        Fixed a Centrify-openssh rekey issue when setting GSSAPIKeyExchange to "yes". (Ref: CS-49334)

Centrify OpenLDAP Proxy

 

·        Fixed an issue that Centrify-ldapproxy cache does not support user-specified search attribute "nisNetgroupTriple" nor "memberNisNetgroup" when handling RFC2307 NisNetGroup searches. (Ref: CS-49257)

Centrify Group Policy Management

 

·        Fixed an issue that the certgp.pl script incorrectly clears its certificate store before it can successfully get certificates from Active Directory. (Ref: CS-48829)

Centrify Report Services

 

·        Fixed an issue that leads to the error, "The service was not able to access the Report Manager URL. Please make sure that the URL is correct and accessible to your existing account.", while running the Centrify Report Services Configuration Wizard. (Ref: CS-49105)

·        Fixed a case-sensitivity issue that causes Centrify Reporting Services installation failure. (Ref: CS-49046)

4.     Known Issues

 

The following sections describe common limitations or known issues associated with this Authentication Service and Privilege Elevation Service release.

 

For the most up to date list of known issues, please login to the Customer Support Portal at http://www.centrify.com/support and refer to Knowledge Base articles for any known issues with the release.

Centrify DirectControl Agent for *NIX

 

·        Known issues with Multi-Factor Authentication (MFA)

If MFA is enabled but the parameter "adclient.legacyzone.mfa.required.groups" is set to a non-existent group, all AD users will be required for MFA. The workaround is to remove any non-existent groups from the parameter. (Ref: CS-39591b)

·        Known issues with AIX

 

On AIX, upgrading DirectControl agent from 5.0.2 or older versions in disconnected mode may cause unexpected behavior. The centrifydc service may be down after upgrade. It's recommended not to upgrade DirectControl agent in disconnected mode. (Ref: CS-30494a)

 

Some versions of AIX cannot handle username longer than eight characters. As a preventive measure, we have added a new test case in the adcheck command to check if the parameter LOGIN_NAME_MAX is set to 9. If yes, adcheck will show a warning so that users can be aware of it. (Ref: CS-30789a)

 

·        Known issues with Fedora 19 and above (Ref: CS-31549a, CS-31730a)

 

There are several potential issues on Fedora 19 and above:

1)   The adcheck command will fail if the machine does not have Perl installed.

2)   Group Policy will not be fully functional unless Text/ParseWords.pm is installed.

 

·        Known issues with RedHat

When logging into a RedHat system using an Active Directory user that has the same name as a local user, the system will not warn the user of the conflict, which will result in unpredictable login behavior. The workaround is to remove the conflict or login with a different AD user. (Ref: CS-28940a, CS-28941a)

·        Known issues with rsh / rlogin (Ref: IN-90001)

 

-   When using rsh or rlogin to access a computer that has DirectControl agent installed, and where the user is required to change their password, users are prompted to change their password twice. Users may use the same password each time they are prompted, and the password is successfully changed.

 

·        Known issues with compatibility 

 

Using DirectControl 4.x agents with Access Manager 5.x (Ref: IN-90001)

 

-   DirectControl 4.x agents can join classic zones created by Access Manager 5.x. It will ostensibly be able to join a DirectControl 4.x agent to a hierarchical zone as well, but this causes failure later as such behavior is undefined.

 

Default zone not used in DirectControl 5.x (Ref: IN-90001)

 

-   In DirectControl 4.x, and earlier, there was a concept of the default zone. When Access Manager was installed, a special zone could be created as the default zone. If no zone was specified when joining a domain with adjoin, the default zone would be used.

 

-   This concept has been removed from DirectControl 5.0.0 and later as it is no longer relevant with hierarchical zones. In zoned mode, a zone must now always be specified.

 

-   A zone called "default" may be created, and default zones created in earlier versions of Access Manager may be used, but the name must be explicitly used.

 

Smart Card

 

·        Release 18.8 includes an update to Coolkey to support Giesecke & Devrient 144k, Gemalto DLGX4-A 144, and HID Crescendo 144K FIPS cards. However, this has caused known issues that may cause CAC cards to only work sporadically. A workaround for CAC cards is to wait for it to prompt for PIN and Welcome, without removing the card, and then try again. (Ref: CC-58013a)

 

·        There is a Red Hat Linux desktop selection issue found in RHEL 7 with smart card login.  When login with smart card, if both GNOME and KDE desktops are installed, user can only log into GNOME desktop even though "KDE Plasma Workspace" option is selected. (Ref: CS-35125a)

 

·        On RHEL 5.10 and 5.11, if "Smart Card Support" is enabled and a smartcard is inserted on the login screen, a PIN prompt may not show up until you hit the "Enter" key. The workaround is to replace libsoftokn3.so with the old one on RHEL 5.9, which is a shared object file in NSS package. (Ref: CS-35038a)

 

·        On RHEL 5.10 and 5.11, if "Smart Card Support" is enabled and "Card Removal Action" is configured as "Lock", the screen will be locked several seconds after login with smart card. The workaround is to replace libsoftokn3.so with the old one on RHEL 5.9, which is a shared object file in NSS package. (Ref: CS-33871a)

 

·        When a SmartCard user attempts to login on Red Hat 6.0 with a password that has expired, the authentication error message may not mention that authentication has failed due to an expired password. (Ref: CS-28305a)

 

·        On RedHat, any SmartCard user will get a PIN prompt even if he's not zoned, even though the login attempt will ultimately fail. This is a divergence from Mac behavior - On Mac, if a SmartCard user is not zoned, Mac doesn't even prompt the user for PIN. (Ref: CS-33175c)

 

·        If a SmartCard user's Active Directory password expires while in disconnected mode, the user may still be able to log into their machine using their expired password. This is not a usual case, as secure SmartCard AD environments usually do not allow both PIN and Password logins while using a Smart Card. (Ref: CS-28926a)

 

·        To login successfully in disconnected mode (Ref: CS-29111a):

·        For a password user:

§  A password user must log in successfully once in connected mode prior to logging in using disconnected mode. (This is consistent with other DirectControl agent for *NIX behavior)

·        For a SmartCard user:

§  The above is not true of SmartCard login. Given a properly configured RedHat system with valid certificate trust chain and CRL set up, a SmartCard user may successfully login using disconnected mode even without prior successful logins in connected mode.

§  If certificate trust chain is not configured properly on the RedHat system, the SmartCard user's login attempt will fail.

§  If the SmartCard user's login certificate has been revoked, and the RedHat system has a valid CRL that includes this certificate, then the system will reject the user.

 

·        After upgrading from DirectControl version 5.0.4 to version 5.1, a Smartcard user may not be able to login successfully. The workaround is to run the following CLI commands:

 

sudo rm /etc/pam_pkcs11/cacerts/*

sudo rm /etc/pam_pkcs11/crls/*

sudo rm /var/centrify/net/certs/*

 

then run adgpupdate. (Ref: CS-30025c)

 

·        When CRL check is set via Group Policy and attempting to authenticate via Smartcard, authentication may fail. The workaround is to wait until the Group Policy Update interval has occurred and try again or to force an immediate Group Policy update by running the CLI command adgpupdate. (Ref: CS-30090c)

 

·        After upgrading from DirectControl agent Version 5.0.4 to version 5.1.1, a SmartCard user may not be able to authenticate successfully. The workaround is to perform the following CLI command sequence:

 

sctool -d

sctool -e

sudo rm /etc/pam_pkcs11/cacerts/*

sudo rm /etc/pam_pkcs11/crls/*

sudo rm /var/centrify/net/certs/*"

adgpupdate

 

and then re-login using the SmartCard and PIN. (Ref: CS-30353c)

 

·        A name-mapping user can unlock screen with password even though the previous login was with PIN. (Ref: CS-31364b)

 

·        Need to input PIN twice to login using CAC card with PIN on RedHat. It will fail on the first input but succeed on the second one. (Ref: CS-30551c)

 

·        Running "sctool –D" with normal user will provide wrong CRL check result. The work-around is to run it as root. (Ref: CS-31357b)

·        Screen saver shows password not PIN prompt (Ref: CS-31559a)

 

Most smart card users can log on with a smart card and PIN only and cannot authenticate with a username and password. However, it is possible to configure users for both smart card/PIN and username/password authentication. Generally, this set up works seamlessly: the user either enters a username and password at the log on prompt, or inserts a smart card and enters a PIN at the prompt.

However, for multi-user cards, it can be problematic when the screen locks and the card is in the reader. When a user attempts to unlock the screen, the system prompts for a password, not for a PIN, although the PIN is required because the card is in the reader. If the user is not aware that the card is still in the reader and enters his password multiple times, the card will lock once the limit for incorrect entries is reached.

On RHEL 7, an authenticated Active Directory user via smart card cannot login again if the smart card is removed.   This is due to a bug in RHEL 7, https://bugzilla.redhat.com/show_bug.cgi?id=1238342.  This problem does not happen on RHEL6. (Ref: CSSSUP-6914c)

Centrify Report Services

 

·        N/A

5.     Additional Information and Support

 

In addition to the documentation provided with this package and on the web, you can find the answers to common questions and information about any general or platform-specific known limitations as well as tips and suggestions from the Centrify Knowledge Base.

 

The Centrify Resources web site provides access to a wide range of information including analyst report, best practice brief, case study, datasheet, ebook, white papers, etc., that may help you optimize your use of Centrify products. For more information, see the Centrify Resources web site:

www.centrify.com/resources

You can also contact Centrify Support directly with your questions through the Centrify Web site, by email, or by telephone. To contact Centrify Support or to get help with installing or using this software, send email to support@centrify.com or call 1-669-444-5200, option 2. For information about purchasing or evaluating Centrify products, send email to info@centrify.com.