Release Notes

EmpowerID 2019 has many new features, numerous enhancements, and multiple fixed issues to make the EmpowerID user experience better than ever.

New Features

Privileged Session Manager (PSM) is updated to record and monitor privileged sessions, and to be hosted as a Docker Swarm on local or cloud service locations. You can configure PSM to record session activity when users check out credentials for a managed computer, allowing Access Managers and other administrators to view what users do on the computer during a session, and to terminate a session if necessary. It is also updated to comply with new European Union GDPR laws. For more information, see the following topics:

• Checking out credentials and initiating a Privileged Session Manager (PSM) session (Checking Out Credentials and Initiating an RDP Session)
• Watching and monitoring a live PSM session (Viewing Privileged Session Details)
• Terminating a live PSM session (Terminating a Privileged Session)
• Turning off monitoring and recording to comply with new European Union GDPR laws (Creating Privileged Session Policies)

More functionality is moving to the web application so that you can configure EmpowerID without using the EmpowerID Management Console. The Management Console retains some functionality in 2018, but now you can also perform many new functions in the web application, including:

• Mapping roles and locations (Mapping Locations)
• Setting server roles and server jobs (Configuring Server Roles)
• More system settings for configuring EmpowerID
• Creating account stores (/wiki/spaces/EIAG/pages/453181868)
• Attribute flow rules (Configuring Attribute Flow)

The EmpowerID Reverse Proxy or microservices gateway is a dockerized NGINX module that is a key component of any Zero Trust or microservices security architecture. As a component of the EmpowerID WAM System, the Reverse Proxy stands in front of protected Web applications and Docker containers, restricting access to the resources served by those applications by intercepting all HTTP traffic bound for those applications, evaluating and processing each request using EmpowerID's hybrid RBAC / ABAC engine.

As a WAM component, the EmpowerID reverse proxy provides web environments with seamless access to all of the identity management facilities of EmpowerID. This means that organizations can use the EmpowerID reverse proxy to provide the same level of security for the resources that live on their web servers as they provide for the resources that live in their directories and other such similar resource systems.

The EmpowerID Reverse Proxy controls access to web applications and APIs without requiring the installation of an agent. To configure the reverse Proxy, an OpenID Connect OAuth application record is created in EmpowerID, with an associated SAML connection linked to it for use in defining attribute statements. The Reverse Proxy uses this OAuth connection when making API calls to the EmpowerID REST endpoints to retrieve its configuration and for making real-time ABAC access checks. Web applications protected by the Reverse Proxy are created in EmpowerID as web applications with their protected URLs and paths registered as "Application Subcomponents." RBAC and ABAC policies can be applied to determine who may have access to these subcomponents/URL paths. After creating the appropriate reverse proxy components in the EmpowerID Web interface, you configure the reverse proxy application files with the appropriate information for your environment.

The below diagram shows all the components and configuration files associated with the EmpowerID reverse proxy. Click the image for an expanded view.

EmpowerID now supports assigning and tracking responsible parties for key objects like accounts, groups, computers, management roles, locations, and shared credentials. This responsibility relationship differs from that of a Person owning an account. An account owned by a Person represents that person and serves as their personal account. Responsible parties are assigned to signify who is responsible for an IT object from a security and audit perspective. For more information, see Responsible Parties.

Any EmpowerID RBAC Actor Type can be assigned as the responsible party, but most organizations configure EmpowerID to only allow the assignment of a Person. The field that stores this assignment is called OwnerAssigneeID, and you can find it in each supported object's table.

You can assign responsibility for EmpowerID objects using the Responsible Party property on the Details page for the object, or you can bulk assign responsibility for a number of the same type of objects using an action found on the object type's View Many page. Once assigned, you can transfer responsibility from one party to another. 

When a person is leaving or changing positions, you can transfer all of their responsibilities to another party. You can either do this manually, using the Transfer Responsibilities workflow, or automate the process in a Planned Leaver Event.

The following new request workflows support these new features:

• UpdateOwnerAssignee
• AssignOwnerForAccounts
• AssignOwnerForGroups
• TransferAccountOwner
• AssignOwnerForManagementRoles
• TransferAccountsOwner
• TransferGroupOwner
• AssignOwnerForComputers
• AssignOwnerForResources
• TransferResourceOwner

EmpowerID now supports the concept of a Core identity so that you can log in with different Person identities that are all linked to the same Core ID. Just as a person can have multiple user accounts in different external directories, so a core identity can have more than one persona. You can enable EmpowerID to create core identities when more than one person is discovered during inventory that shares the same name, birth date, or any attributes that you specify in the system settings. A person that is attached to a core identity is presented at login with a selection of personas to log in as, and once logged in, can switch between personas. The new ProvisionCoreIdentityBulk permanent workflow monitors the ProcessAccountInbox request workflow and provisions core identities as necessary. For more information, see Core Identities.

Now you can use vaulted admin credentials in a PowerShell script (Retrieving Credentials in a PowerShell Session)

Two new permanent workflows automate group membership processes to ensure that sensitive groups always have the right members.

• The new ContinouousRecertification permanent workflow constantly monitors membership changes in groups and generates recertification tasks for group owners. This ensures that access changes to sensitive groups comply with security policy.
• The GroupMembershipExpirationNotification permanent workflow monitors group membership expiration dates, and notifies group owners of expired memberships.

Several new permanent workflows help your organization to stay up-to-date on audits and expired items.

• The Unreviewed Recertification Task Notification permanent workflow monitors unreviewed audit tasks, and notifies assigned reviewers of their unreviewed tasks.
• The Create Scheduled Certification Audit permanent workflow creates and runs any scheduled certification audits.
• The Close Revoke Re-certification Unreview Tasks After Due Date permanent workflow closes any revoke tasks that remain unreviewed beyond the recertification due date.
• The Check in Shared Credential permanent workflow monitors shared credential check-outs, and automatically checks them in when the requested time has expired.
• The ScheduledCredentialPasswordReset permanent workflow monitors password reset schedules for shared credentials and resets passwords at the specified times.
• The DeleteTemporaryPeopleCreatedDuringSignup permanent workflow monitors temporary people created during signup and deletes them after 60 minutes.

See the Workflow Library for a full listing of permanent workflows and request workflows.

You can now use HTML to attractively style user agreements (two are included out of the box) to display to users when they sign in. For more information, see Setting Up Password Manager Policies.

When there is an RBAC policy for group enforcement (other than full enforcement), a flag marks any affected group accounts as RBACAssigned. If the group account later loses the policy, the RBACAssigned flag gets set back to false but the group membership remains in place to prevent the accidental removal of valid memberships when someone is testing policies and then removing them.

Since many companies do want to remove the membership once policies are removed, we added a new date field called RbacAssignmentConfirmationDate. This date is only set for group accounts that are flagged as CreatedFromAccountStore and are subsequently flagged as RBACAssigned. The date field is set to seven days after the RBACAssigned flag is set to true, and it represents the time until the RBAC-assigned group account becomes fully managed by EmpowerID.

• If the RBAC policy that flags the group account as RBACAssigned is rolled back before the seven days expires, then the RBACAssigned flag is set to false, the date is cleared, and the group account remains.
• If the RBAC policy that flags the group account as RBACAssigned is rolled back after the confirmation date, then the group account is removed, the same as any other policy assignment.

The OAuth Identity Provider (IdP) login page now provides the same user experience as other login pages. The following changes make for a more user-friendly experience:

• Removed all OAuth authentication cookie references.
• Changed handling of IdP authentication cookies so that logging in twice is not required.
• Updated OAuth browser flows to support external IdP authentication.
• Added IdP tiles such as Facebook, GitHub, Salesforce, et cetera, to appear on the OAuth login page based on the IPDomain settings.

EmpowerID 2018 includes numerous security updates in response to evolving changes in security needs. 

The theme of the EmpowerID web application has been redesigned, and many new pages have been added.

The IT Shop has a new theme.

EmpowerID 2018 has a new ServiceNow Manager page.

All Features and Enhancements

Fixed Issues

Upgrading EmpowerID

EmpowerID freely provides hotfixes to address known issues. We also offer upgrades with new functionality in the form of new builds. When installing a hotfix or a newer version of EmpowerID, you can add the enhancements to your environment without losing preexisting data and configuration models.

When upgrading EmpowerID, you must be logged in as a user with rights to alter the EmpowerID database on the target SQL server.

You can upgrade to the latest build using the steps in the /wiki/spaces/E2D/pages/293306612 (opting NOT to delete the database) and Installing and Licensing EmpowerID topics. The only new prerequisites are the following.

• Install .NET Framework 4.7 on each server.
• Install Microsoft IIS CORS and URL Rewrite modules on each server. (Detailed in the installation topic.)

Product Support

EmpowerID provides support to all customers who have a trial version of an EmpowerID product or who have purchased a commercial version with a valid Software and Maintenance support contract. By purchasing Software Maintenance and Support, you have access to any upgrades that are released within a 12-month period and have email access to our product team to resolve any issues that may arise.

For further information on Software Maintenance and Support, please contact us by email at sales@empowerID.com.

Online Support

Registered users may submit cases online and track their status. If you are a registered user, you may submit and view the status of cases at any time. 

Contacting Support

To contact a support representative, you may send an email to support@empowerID.com  or contact us by phone at +1 (877) 996-4276.

EmpowerID offers support for the most recently released version of the Software Program and one version prior. This means that with the release of EmpowerID 2018, support is offered for EmpowerID 2016 and EmpowerID 2018.