Skip to main content

Changelog

Entries are in timeline order by date, going backwards in time down the page.

10.0.0 - GA 2025-02-12​

Enhancements​

  • [Adapt] Feature Requests

    • [Adapt] Show Logging Only flag value in the Policy details drawer
    • [Adapt] Store the OAuth2 CrowdStrike API key in Adapt for calls
    • [Adapt] Fixed: CrowdStrike IdP Policy evaluation IdP score check is not working as expected
    • [Adapt] Fixed: ZTA policy enhancement fires STORED_API_ZERO_TRUST_ASSESSMENT whenever ZTA score is manually retrieved
    • [Adapt] Fixed: Crowdstrike policies allowed=true when unable to obtain score
    • [Adapt] Fixed: Logging Only Enabled/Disabled status is not tracked in the Audit Trail
    • [Adapt] Fixed: CrowdStrike Signal Handler: Add Bulk API call to cover ZTA machine statuses for user web calls

  • [Adapt] General Improvements

    • [Adapt] Consolidate policy evaluation calls in Keycloak Select Login Method module
    • [Adapt] Policy assignment event should be tagged as ADAPT_POLICY_ASSIGNMENT and should have policyName
    • [Adapt] Add tests for the Login Limits template
    • [Adapt] Create diagrams/documentation notes for Firebase KT
    • [Adapt] Fixed: Policy / Handler search doesn't work with ID, works only with name

  • [Adapt] Risk policy chaining PoC

    • [Adapt] Composite policy chaining

  • [Adapt] UI/UX Updates

    • [Adapt] Decrease width of version selection field
    • [Adapt] Run a new signal search on username change
    • [Adapt] Enable searching in the Rego editor
    • [Adapt] Confirm exit on unsaved changes
    • [Adapt] Prompt for configuration Save upon form change
    • [Adapt] Add a refresh button for Signal Handler metrics
    • [Adapt] Signal Handler metrics: UX feedback points
    • [Adapt] Signal Handler metrics: Info icon with rollover text explaining the use and source of the metric
    • [Adapt] Fixed: Manual evaluation input gets overridden on evaluation request

  • [Affirm] Feature Requests

    • [Affirm] Add resource field to OIDC
    • [Affirm] Add resource field to OIDC in the UI
    • [Affirm] Add an outcome option to redirect on failure
    • [Affirm] Add Consent screen

  • [Affirm] Workflow Friction level for predefined Verification Step templates

    • [Affirm] Create the new Friction enum and add it to the UI
    • [Affirm] Create workflow defaults by Friction

  • [Affirm; Integrations; Platform - Keycloak] Keycloak, Affirm and Integrations-related tasks

    • [Affirm] Add unit tests to AffirmUserService.kt
    • [Affirm] When creating a new workflow, force the user into the full modal

  • [All HYPR] UX/UI component library updates

    • [All HYPR] Generate build of component library

  • [Passwordless for Windows] Security Device Enhancements

    • [Passwordless for Windows] Show smart card device type at registration
    • [Passwordless for Windows] Touch policy for YubiKey (presence verification)
    • [Passwordless for Windows] Configurable security device lockout number
    • [Passwordless for Windows] Fixed: Not getting firmware version from Feitian keys
    • [Passwordless for Windows] Fixed: When Smart Card Pairing Enabled is disabled, we cannot pair an IDEMIA card

  • [Passwordless for Windows] Tech Debt Q1 2025

    • [Passwordless for Windows] Change default so HyprKsp does NOT do CRL and user account checks
    • [Passwordless for Windows] Extend copyright year to 2025
    • [Passwordless for Windows] Fixed: HyprServiceInstallError system environment variable may be set following the Passwordless client installation
    • [Passwordless for Windows] Fixed: Checking wrong error code after DiInstallDriver

  • [SDK for FIDO2 Web Browser] HYPR FIDO2 Web SDK Improvements 10.0

    • [SDK for FIDO2 Web Browser] Consolidate Type imports

  • [Adapt ] Event Handlers Beta

  • [Adapt] Logging facility for Policies

  • [Adapt] Risk and Signal Handler versioning Template [Backend]

  • [Control Center - Integrations] Enterprise Passkey: Third-party passkey provider API for macOS [Alpha]

  • [Mobile App for Android] Current profile improvements: MachineStatus and token refresh

  • [Mobile App for Android] Hyprlinks: sample code reference app

  • [Mobile App for Android] Provide responses for MASA revalidation

  • [Mobile App for iOS] Update EULA text

  • [Passwordless for Windows] Update EULA text on the workstation client

  • [Platform - Keycloak] Keycloak to send authenticated events

Bug Fixes​

  • [Passwordless for macOS] Q2 2025 Security Device Enhancements

    • [Passwordless for macOS] Fixed: Cannot set "securityKeyPinComplexity" in hypr.json
    • [Passwordless for macOS] Fixed: Passwordless doesn't enforce PIN Complexity

  • [Affirm] Integration Bug Fixes

    • [Affirm] Fixed: Control Center UI Verification Flows table Description sort leads to a white screen
    • [Affirm] Fixed: Generic error when updating verification flow that isn't assigned an rpAppId
    • [Affirm] Fixed: After the Consent screen, instead of redirecting to chat, it redirects to the Control Center login page
    • [Control Center - Integrations] Fixed: Azure: All three transport types are may be successfully disabled

  • [Adapt ] The risk policy name is displayed as 'NA' in the Integrations page when the policy is deleted

  • [Login Limits Policy] The user remains blocked even after the User Blocked Duration is configured

  • [Passwordless - Both] QR_Fallback: QR icon is large in size when compared to the line of text

  • [Passwordless for Windows] Fix warning introduced

9.7.2 - GA 2025-02-07​

Enhancements​

  • [Affirm] PoC: Helpdesk Support

  • [Affirm] Helpdesk CC UI Changes

  • [Affirm] Helpdesk endpoint details UI

  • [Affirm] Helpdesk endpoint main table UI

  • [Affirm] Helpdesk IdV UI changes

  • [Affirm] Helpdesk PoC - combine/connect the web UI all together

  • [Affirm] Helpdesk scaffolding code for the new endpoint

  • [Affirm] New feature flag for Help Desk functionality

  • [Affirm; Integrations; Platform] Q1/2025 Keycloak, Affirm and Integrations related tasks

  • [Integrations - Entra] Use the Keycloak url from vault

  • [Integrations - Okta] Don't assign an application when adding a device

  • [Mobile App - Both] Make SMS keyword responses adhere to convention (stop, help, etc.)

Bug Fixes​

[Entra] Federation: After updating the password of a service account, users can no longer authenticate

9.7.1 - GA 2025-01-07​

Enhancements​

  • [Adapt] Additional CrowdStrike functionality and fixes

    • [Adapt] Store OAuth2 CrowdStrike API Key in Adapt for calls
    • [Adapt] Fixed: ZTA policy enhancement: Fire INBOUND_EVENT_HOOK whenever the CrowdStrike ZTA score is manually retrieved
    • [Adapt] Fixed: Crowdstrike IdP Policy: The evaluation IDP score check is not working as expected
    • [Adapt] Fixed: Add Bulk API call to cover CrowdStrike ZTA machine status for user web calls
    • [Adapt] Fixed: CrowdStrike policies allowed=true when unable to obtain score
    • [Adapt] Fixed: CrowdStrike IdP Policy: Policy evaluation failed due to error 'failed to create policy evaluation context'
    • [Adapt] Fixed: CrowdStrike ZTA policy: Previously generated STORED_API_ZERO_TRUST_ASSESSMENT is not being used for policy eval

  • [Affirm] Third party jars/tools production readiness tasks

    • [Affirm] Add SMS reference data
    • [Affirm] Use the latest pinpoint SDK (version 2)
    • [Affirm] Configure rate limits
    • [Affirm] Update IAM policy for accessing end-user messaging API

  • [All HYPR] Observability Tasks

    • [API] Enhance API Tokens Traceability
    • [Control Center] Consistent server request logging
    • [Errors] DBMigration service logs should use the 'Info' log level instead of the 'Error' log level
    • [Events] Define Event information requirements
    • [Events] FIDO_ONLY_AUTH and FIDO_ONLY_REG attempts do not have an associated COMPLETE event
    • [Events] Saving an Event failure should not fail flows
    • [Errors] Fixed: Remove error codes for successful Event logs
    • [Events] Fixed: The deviceId is null in Event logs when other device data is known

  • [All HYPR] Use same traceId for reg process

  • [Mobile App - Android] QR Code handling of additional parameters

    • [Mobile App for Android] Custom field added to qrpayload

  • [Passwordless - Both; API] Workstation thundering herd mitigation

    • [API] Move security key last used date to batching
    • [Control Center; API] Block or throttle selected Control Center calls
    • [Passwordless - Both] Mitigate workstation Audit call flood
    • [Passwordless - Both] Workstation status warm session cache needs optimization

  • [Platform - Keycloak] Protect against Evilnginx first phase

    • [Platform] Confirm that protections against Evilnginx will work in production

Bug Fixes​

  • [Affirm; Control Center - Integrations] Q1/2025 bugs fixed

    • [Affirm] Fixed: Switching approver to HYPR from Manager is not taking still get emails and texts
    • [Affirm] Fixed: The results API returns a query when invalid/nonexistent workflowId is provided
    • [Affirm] Fixed: Code Customizations: ACCEPT and CONTENT_TYPE headers are being appended twice
    • [Affirm] Fixed: A blank page appears because of a React error when the user selects a value from the Type dropdown in the Affirm Approver Management page
    • [Control Center] Fixed: Adding a Control Center admin user shows on both the Registered and Pending lists
    • [Control Center] Fixed: After successful registration on mobile using a passkey, the passkey is not displayed
    • [Control Center - Integrations] Fixed: Okta: Two users with same email; only one is able to register with HYPR

  • [Adapt] Fixed: Signal Handlers: TOR Data Collector handler times out when a signal is triggered

  • [Affirm] Fixed: Add better logging to Affirm for production releases

  • [API] Fixed: /rp/wsapi/securitykey/updatepinreset returns 200 with invalid existingPuk

  • [Control Center - Integrations] Fixed: HYPR Enterprise Passkey: Double user presence (UP) prompt periodically occurs during authentication

  • [Control Center - Integrations] Fixed: HYPR Enterprise Passkey: Unexpected signature counter received

  • [Mobile App for iOS] Fixed: Web-to-workstation QR scan to login fails with 1202006

9.7.0 - GA 2024-12-11​

New Features and Feature Changes​

  • [Adapt] Implement Adapt for Workstation - Beta

  • [Adapt] Policy & Signal Handler UI v9.7 Cleanup

    • [Adapt] Login Limits Policy Unit Test
    • [Adapt] Signal Handlers: Template and tests organization
    • [Adapt] Fixed: Login limits policy allows negative values in the config and the policy evaluation fails
    • [Adapt] Fixed: Signal Handlers: Values flicker when the mouse is hovered on the success or failure percentage tooltip

  • [Adapt] UX Updates II

    • [Adapt] Add version tags to templates
    • [Adapt] Enhance Signal Handler Error Details
    • [Adapt] Add View Raw option for signal search results
    • [Adapt] Add Search by Signal Handler button
    • [Adapt] Saved Event View in Signal Search
    • [Adapt] Add Console Log Pane to Policy Test Page
    • [Adapt] Revert code view change for built-in entities
    • [Adapt] Policy Config Form - Support Textarea field
    • [Adapt] UI - Update Doc Portal
    • [Adapt] Signal Handlers page should show the pipeline - i.e. Sort by Status, Priority & then Last Modified
    • [Adapt] Signal Handler Metrics - UX feedback items
    • [Adapt] Fixed: ‘Policy Assignments Updated’ success message interrupts the Policy assignment
    • [Adapt] Fixed: The exceptions for date selection in the Signal Search page aren't handled properly, which leads to an empty page being displayed

  • [Affirm] Control Center login first time Admin with Affirm

    • [Affirm] Remove AffirmUserService.kt from all sonar exclusions

  • [Affirm] Custom Workflow Enhancements & Management in UI

    • [Affirm] Back End: Create an end point to allow the UI to get all the available workflows
    • [Affirm] Remove Application Setup Tab
    • [Affirm] Front End: Add the verifications flow tab table
    • [Affirm] Update workflow drawer UI
    • [Affirm] Select a workflow step in the drawer should zoom into the step in the modal
    • [Affirm] Workflow Modal: Save and revert should work per tab
    • [Affirm] Remove the first step of the web UI

  • [Affirm; Control Center - Integrations] Q4/2024 Integrations and Affirm bug fixes and unplanned work

    • [Adapt; Events] Add 'locationIpDistance=' and 'locationReverseGeocodeDistance=' to GOOGLE_LOCATION_ADDRESS operation payloads
    • [Affirm] Add logins to logs for Affirm to help get info for debugging and future issues
    • [Affirm] Upgrade/migration path to populate missing values in new Affirm table
    • [Affirm] If only 1 Approver/escalation Approver is listed, do not show a timeout
    • [Affirm] Add close button to verification flow modal
    • [Affirm] Lint & Format affirm cc ui code to be in unison with proper configs.
    • [Control Center] Email templates need to be updated with the new office information
    • [Platform - Keycloak] Authenticator page text changes
    • [Affirm] Fixed: if user is stuck in the upload document we should time out after a set amount of time
    • [Control Center] Fixed: Deleting a Control Center user deletes the user but shows an error in the model and both a success and failure message on Control Center
    • [Affirm] Fixed: Some users are not able to type in the chat and are not able to click on the type here to chat
    • [Affirm] Fixed: API missing "status": and "type": for new table flows
    • [Affirm] Fixed: Approver chat is not loading for requester or approver
    • [Affirm] Fixed: Creating a flow via the API in 9.7 does not allow "OUTCOME_STEP_REDIRECT_URL": "Dynamic
    • [Affirm] Fixed: Cannot create a workflow approver time must be 0 for last approver
    • [Affirm] Fixed: Data too long for column error and 500 internal error
    • [Affirm] Fixed: Lock header and footer in place for the model
    • [Affirm] Fixed: CC Admin flow unable to register device/ 500 on device registration
    • [Affirm] Fixed: Twilio video no longer loading for affirm on Firefox/Edge
    • [Affirm] Fixed: Workflow Inactive/active does nothing flows can be run in either state
    • [Affirm] Fixed: Entering nothing in the input field for text messages verification number goes to site cannot be reached
    • [Affirm] Fixed: Better UX around the please wait screens
    • [Affirm] Fixed: Better wording around the text received by users with the verification code
    • [Affirm] Fixed: Better branded error messages for 403 errors after a link is clicked
    • [Affirm] Fixed: OIDC approver not persisting after save on new table
    • [Affirm] Fixed: Attempting to select type on affirm new table shows under applications when selected
    • [Affirm] Fixed: Better error message around missing type
    • [Affirm] Fixed: 2 approvers are able to join the chat
    • [Affirm] Fixed: Remove assigned approvers if escalate to live chat is inactive - don't allow add escalation approver to be added unless it is active
    • [Affirm] Fixed: With no data present - on advanced customizations we are showing them on the workflow management as active when they are not
    • [Affirm] Fixed: Deleting last workflow causes user not to be able to close the slider and can delete an empty workflow
    • [Affirm] Fixed: Remove the 'this link expires in time' from the approver email.
    • [Affirm] Fixed: Set timeouts for approvers saved at 5 minutes on save are set to 0 minutes
    • [Affirm] Fixed: CC Admin second flow being added to a tenant where a CC admin flow exists for the tenant throws a null pointer
    • [Affirm] Fixed: Approvers missing on the slider view
    • [Affirm] Fixed: Workflow validation for if HYPR approver is required says approver type none
    • [Affirm] Fixed: When turning off escalation approvers when should clean up the existing approvers to not confuse the user
    • [Affirm] Fixed: Change status for rotation /cc/ui/idv/verify/document-upload-video to not be error
    • [Affirm] Fixed: "null" String value as oidcClientConfigId in Approvers
    • [Affirm] Fixed: Error when saving workflow after adding escalate to live chat
    • [Affirm] Fixed: Creating customization and then opening modal, will not re-fetch list, but instead user needs to refresh the page
    • [Control Center] Fixed: User Management: Can't create/delete admin users
    • [Control Center] Fixed: Branding: UI on QR auth and QR fallback pages has HYPR style showing
    • [Control Center] Fixed: Device Manager: Scan the QR code icon in the instructions; the QR is able to be picked up by camera
    • [Control Center] Fixed: Fix the email to match the re-worked design
    • [Control Center - Integrations] Fixed: Okta: Manually sending invite to a fake user leads to a server error
    • [Control Center - Integrations] Fixed: Okta: Two users with same primary email, but different usernames, both get assigned to the Okta app
    • [Control Center - Integrations] Fixed: Okta: Control Center showing blank error after failed attempt to add an Okta integration
    • [Control Center - Integrations] Fixed: Okta: IDP provider is created/not deleted during failed attempts to add the integration
    • [Platform] Fixed: Validation error in Datadog after brute force attempt
    • [Keycloak] Fixed: NullPointerException when running with debug log in the old authenticator
    • [Platform - Keycloak; Mobile App for Android] Fixed: Keycloak UI: Poor UX for Android user-agent to Android device.
    • [Platform - Database] Fixed: Oracle-incompatible database migration

  • [All HYPR] Customer Issues Brought In

    • [All HYPR] Single Registration: Web-to-Workstation: Extend validity of the FIDO session to cover enrolment/complete step on slow environments
    • [All HYPR] Address server CVE
    • [Control Center] Find a way to not have feature enabled for controlCenterAdmin
    • [Mobile App for Android] Current Profile Improvements - Phase 1
    • [Passwordless for Windows] Adjust SSO command line parsing to allow for Chrome breaking our URL
    • [Control Center; Passwordless - Both] Fixed: InternalServerErrorException error returned for settings call
    • [Passwordless for Windows] Fixed: Locale mismatch leads to invalid certificate expiration reported to CC
    • [Passwordless for Windows] Fixed: Unlock fails with "Bad username or password" for a local user account when running in an RDP session

  • [All HYPR] Q4 2024 Authenticate Application Security Items

    • [Platform] Redis: Encrypt ML

  • [All HYPR] Q4 2024 Branding and Customization

    • [Affirm; Control Center] Back End: Adjust branding interceptor (CC/Affirm/DM) to enable disable branding based on the product calling it
    • [Control Center] Front End: Fix responsiveness of cards and forms + handle loading states & error states in a nicer way
    • [Control Center] Back End: Fix existing Device Manager data to use the correct end point
    • [Control Center; API] Front End: Add Typescript support + switch api calls to use RTK for Custom Branding sections
    • [Mobile App - Both] Back End: Add Mobile section to the customization
    • [Mobile App - Both] Back End: Add Mobile section to the customization
    • [Platform - Keycloak] Back End: Bring Logo and Background to Keycloak
    • [Platform - Keycloak] Back End: Adjust Keycloak logic x branding by the enableLogoAndBgForKC flag
    • [Platform - Keycloak] Keycloak branding customization should apply to all dialogs, not just the initial one.

  • [Control Center - Integrations] Entra: EAM Integration - Beta

    • [Control Center - Integrations] Code cleanup around Entra integration
    • [Control Center - Integrations] External Authentication Methods: Integration is enabled despite error message

  • [Control Center - Integrations] Entra: User Management Authenticator Removal

    • [Control Center] UI: Use Generic User Management component in v1 Control Center users
    • [Control Center] Settings: Use Generic User Management component
    • [Control Center - Integrations] User Management: Paired with Azure: Display option to "Remove Workstation" or "Remove Web Domain" from mobile device
    • [Control Center - Integrations] User Management: Paired with HYPR/Enrolled: Display option to "Remove Workstation" or "Remove Web Domain" from mobile device

  • [Control Center - Integrations] HYPR Enterprise Passkey: Tap to Login UX PoC

  • [Control Center - Integrations] Okta: Inline registration

    • [Control Center - Integrations] Okta: Create the integration

  • [Control Center; Platform] UX/UI Auxiliary - v9.7

    • [Platform] HYPR UI Component Library: Upgrade to Storybook 8
    • [Control Center] Workstation Settings: Require User Presence UI

  • [Passwordless - Both] Q4 2024 Passwordless UI Improvements

    • [Passwordless for Windows] Remove Desktop SSO "success" notification

  • [Passwordless - Both] Security Device Enhancements - Q4 2024

    • [Control Center] HYPR IE SmartCard Hook not provided the type of the card
    • [Passwordless for macOS] HYPR IE SmartCard Hook not provide type of the card
    • [Passwordless for macOS] Security Key pre-registration hook before certificate is requested
    • [Passwordless for Windows] Client doesn't enforce PIN complexity
    • [Passwordless for Windows] Fixed: Unable to enter current PIN with special characters if securityKeyPinCharacters is not Any
    • [Passwordless for Windows] Fixed: Deleting a fingerprint from the middle of the list doesn't re-order the rest of the list
    • [Passwordless for Windows] Fixed: Security key registration is successful without entering values in New PIN and Confirm New PIN fields

  • [Passwordless for Windows] Passwordless Tech Debt Q4 2024

    • [Passwordless for Windows] Fix build of PairedDevices tool

  • [Passwordless for Windows] (PUK) Security Device Unlock Code Support

    • [Passwordless for Windows; API] Send "deletePuk" option in /rp/wsapi/smartkey/unenroll API
    • [Passwordless for Windows] Multiple small fixes for Passwordless 9.5.1
    • [Passwordless for Windows] Improve setting new PUK during security key enrollment
    • [Passwordless for Windows] Client doesn't allow Feitian/YubiKey key to be reset when the wrong PUK is entered.
    • [Passwordless for Windows] Server seems to give the wrong PUK or the client isn't accepting the right PUK
    • [Passwordless for Windows] Client doesn't show UI to obtain PUK when we lock PIN through unpair workflow
    • [Passwordless for Windows] Unable to unlock YubiKey with old firmware's using PUK

  • [Platform] Ops Tasks

    • [Platform] Deploy latest 9.5 image for EOG
    • [Platform] Enable Adapt signals for EOG tenants

  • [Platform - Keycloak] Q4 2024 Keycloak module improvements

    • [API] Use POST instead of GET for usernames
    • [Control Center - Integrations; Platform - Keycloak] Update code to use the new keycloak.fqdn address for Keycloak access
    • [Platform - Keycloak] Upgrade to the latest Keycloak 25

  • [SDK for iOS] Mobile SDK Size Reduction - Implementation

    • [SDK for iOS] Remove Cached Audit Event Mechanism

Enhancements​

  • [Adapt] Inbound Event hooks ingestion
  • [Adapt] JSONDecodeError WEBAUTHN event
  • [Adapt] Signal Handlers: Add more functions to the ctx API
  • [Adapt; Documentation] Articles review and improvement/update
  • [Adapt; Platform - Keycloak] Hardening II - v9.7
  • [API] Switch /checksettings request justVerifySerialNumber to justValidateSerialNumber
  • [Control Center] (PUK) Security Device Unlock Code Support
  • [Control Center - Integrations] AD FS Plugin v2: Add support for Desktop SSO/HYPRSpeed
  • [Control Center - Integrations] HYPR Enterprise Passkey: Entra ID FIDO2 Provisioning APIs Security Hardening Integrations - Beta
  • [Mobile App - Both] Transaction Extras in QR code
  • [Mobile App for Android] Single Registration: Call status/registration when needed every time the app starts (instead of relying on Fallback button)
  • [Passwordless for Windows] Figure out PRT Validation

Bug Fixes​

  • [Adapt] Bug Fixes

    • [Adapt] Fixed: Exclude untrusted events
    • [Adapt] Fixed: Evaluation Response Unavailable on Fallback Assignments appears null for old assignments
    • [Adapt] Fixed: The attribute "eventTags" in the /cc/ui/audit/search call has "HYPR CC" or "KC" text appended to existing value
    • [Adapt] Fixed: CrowdStrike event gets stored with eventName as 'null'
    • [Adapt] Fixed: Policy home page > Assign policy: No RP App Evaluation Points to choose from
    • [Adapt] Fixed: Missing/misformatted fields in ADAPT_POLICY_EVAL_USER_BLOCKED events
    • [Adapt] Fixed: Events aren't valid JSON and are failing to route to the Event bus
    • [Adapt; Control Center - Integrations] Fixed: Okta inbound hook handler code has undefined object error

  • [Adapt] Fixed: Signal Handlers: Crowdstrike: HMACTestSecretKey works only for one of the test Events

  • [All HYPR] Fixed: Single Registration: We don't see Recovery PINs for iOS/Android

  • [Control Center] Fixed: Custom Branding: Device Manager redirect URL not saving on Control Center, and not seeing the prompt or redirect link on Device Manager

  • [Events] Fixed: Traceids are not consistent through Enterprise Passkey Event flow

  • [Mobile App for Android] Fixed: Enterprise Passkey: User presence prompt contents are being read incorrectly

  • [Passwordless for Windows] Fixed: Enterprise Passkey: Accessibility: Incorrect element being read on the on Entra pairing success screen

  • [Passwordless for Windows] Fixed: Enterprise Passkey: Accessibility: Name property for the buttons are null in Wi-Fi/BLE selection screen

  • [Passwordless for Windows] Fixed: Intermittent issue with the client UI when we delete YubiKey registration with the API

9.5.3 - Patch 2024-11-18​

Enhancements​

  • [Passwordless for Windows][ Create fully independent messages for PIN unlock
  • [Control Center - Integrations] Okta: Allow confguration of user removal from an Okta application

Bug Fixes​

  • [Affirm] Using customized email leads to an invalid link while inviting user to chat

9.5.2 - Patch 2024-11-01​

New Features and Feature Changes​

  • [Adapt] General Improvements

    • [Adapt] Exclude untrusted Events
    • [Adapt] Add the version bump code to the Risk engine pom
    • Bug Fixes:
      • [Adapt] Fixed: Unable to deploy 9.5.2 Risk engine to STG environment due to auto-bump issue
      • [Adapt] Fixed: Missing/misformatted fields in ADAPT_POLICY_EVAL_USER_BLOCKED Events
      • [Adapt] Fixed: Events aren't valid JSON and are failing to route to the Event bus
      • [Control Center; API; Events] The attribute "eventTags" in /cc/ui/audit/search call has "HYPR CC" or "KC" text appended to existing value

  • [Adapt] Solve JSONDecodeError when parsing Events

    • [Adapt] Fixed: JSONDecodeError WEBAUTHN Event
    • [Adapt] Fixed: JSON Parsing: investigate and solve AttributeError

  • [Platform] Ops Tasks

    • [Platform] Deploy latest 9.5 image for EOG
    • [Platform] Enable Adapt signals for EOG tenants

Enhancements​

  • [Adapt] Push is treated as an allowed authenticator under the Login Limits policy if QR is configured
  • [Control Center] During upgrade, uaftxn expiration loop defenses
  • [Passwordless for Windows; Platform; Keycloak] Desktop SSO: Remove "Logging in just got easier" screen from Keycloak
  • [Passwordless for Windows] De-registration success text can be customized
  • [Passwordless for Windows] Remove Desktop SSO "success" notification
  • [Passwordless for Windows; API] Include Passwordless activity in smartkey/checksettings request payload

Bug Fixes​

  • [Affirm] Fixed: Flows with no configured rpAppId using custom directory source data Events are not making it to the Audit Trail

9.6.0 - GA 2024-10-01​

New Features and Feature Changes​

  • [Adapt] UI (Phase 4)

    • [Adapt] Adapt Unavailable feedback: Display a warning message that for all the users Authentication would be blocked
    • [Adapt] Allow user to change time period of Signal Handler metrics
    • [Adapt] Custom policy secret values instructions are missing
    • [Adapt] Dedicated Signal Search UI
    • [Adapt] Set icons for Signal Handler templates
    • [Adapt] Signal Handler metrics overview
    • [Adapt] Update RP App Policy assignment table

  • [Affirm] Custom Workflow Enhancements and Management in UI

    • [Affirm] Custom Outcome if denied
    • [Affirm] Connect between custom user directory/SMS/Email and the rpApp selection in the UI
    • [Affirm] Connect between the OIDC and the Requester/Approver in the UI

  • [All HYPR] UX/UI Auxiliary I

    • [All HYPR] UI Accessibility Checklist
    • [Control Center] Update Control Center UI Gitlab README

Enhancements​

  • [Adapt] Add Signal Handler tests
  • [Adapt] Crowdstrike Inbound Webhook: Need 2 HMAC keys for both the Signal Handler and test Event to work
  • [Adapt] Risk Reports: Replace policyID column name to policyName
  • [Adapt] Signal Handlers Test tab: rename the ‘Test’ tab and disable the Code tab; but still show the code for 'Builtin' type
  • [Adapt] Signal Handlers: Add templates for Event Enricher
  • [Affirm] Upgrade to the latest OnFIDO
  • [Control Center] Create device registration notification enablement
  • [Control Center] Custom Branding: Adjust Logo and Background section to contain toggles that enable/disable branding by product
  • [Control Center] Device Manager: Unauthorized DELETE call
  • [Control Center] Inline Registration: create Enablement
  • [Control Center] Send an email when a user create/pair new device
  • [Control Center - Integrations] Entra EAM: Username should be pre-populated
  • [Passwordless for macOS] Add extra logging to detect TouchID usage from OS before displaying unlock dialog
  • [Passwordless for Windows] HYPR IE SmartCard Hook not provide type of the card
  • [Passwordless for Windows] Password Prompt Removal for Windows - PoC/Alpha
  • [Platform - Keycloak] Custom migration for existing tenant to move Azure integration to use the new Keycloak SAML flow/authenticators
  • [SDKs for Android and iOS] Mobile SDK Size Reduction

Bug Fixes​

  • [Adapt] Fixed: Risk Reports Events are not sorted by eventTimeInUTC column
  • [Affirm] Fixed: Escalation approver should not have automated approver as an option
  • [Control Center] Fixed: Settings user table alignment on username and email are misaligned, higher than the others
  • [Mobile App for Android] Fixed: Enterprise Passkey: Android stops issuing the /deviceapi/fido2/receive calls on trying to register Security key again after de-registering previous Entra pairing
  • [Mobile App for Android] Fixed: Transaction Flow Fails to Render Activity Screen
  • [Passwordless for macOS] Fixed: Failed to contact Certificate Authority if user is accessing a shared folder
  • [Passwordless for macOS] Fixed: QR Fallback: rpApp name is cut on Passwordless dialog if tenant name is too long
  • [Platform - Keycloak] Fixed: Select your login page ^ covers text on screen while hovering over the HYPR Mobile App

9.5.0 - GA 2024-09-12​

New Features and Feature Changes​

  • [Adapt] Crowdstrike - Beta

    • [Control Center - Integrations] Create Adapt Policy for Crowdstrike
    • [Control Center - Integrations] Create Tests for Crowdstrike Service
    • [Control Center - Integrations; Adapt] Improve Crowdstrike Policies description, policy evaluation messages
    • [Control Center - Integrations; API] Create Service for Crowdstrike API
    • Bug Fixes:
      • [Adapt] CrowdStrike and Okta Signal Handlers: Name update and parsing error in handler code
      • [Adapt] Crowdstrike ZTA policy: Workstation Unlock fails as there is no ZTA score retrieved
      • [Adapt] CrowdStrike ZTA policy doesn't fail if the score threshold difference is '0.5'
      • [Adapt; API] Crowdstrike Policies: CrowdStrike API field is not secret and API calls fail if the field is made as a secret
      • [Platform - Vault; Adapt] Adapt webhook fails because 'hypr.cc.crowdStrikeWebHookKey' gets removed after updating the Control Center image

  • [Adapt] Policy and Signal Handler UI (Phase 3)

    • [Adapt] Policies: Add Support For Managing Policy Assignments in Policy Configuration
    • [Adapt] Policies: Create Test Pane for Built-in Policies
    • [Adapt] Policies: Update Creation Flow
    • [Adapt] Policies: Update Table View
    • [Adapt] Risk policy and Signal Handlers: Add 'Date created' column
    • [Adapt] Signal Handlers: Scroll not visible, View logs button name change, add handler type info
    • [Adapt] Signal Handlers: Test Tab: In the Sample Signal dropdown, the first item in the dropdown should be selected by default
    • [Adapt] Signal Handlers, Policies: Replace 'Event' with 'Signal'
    • [Adapt] Signal Handlers: Add Invocation Metrics
    • [Adapt] Signal Handlers: Add Status Badge to Configuration Page
    • [Adapt] Signal Handlers: Add templates for Action Executor type
    • [Adapt] Signal Handlers: Add Versioning Support
    • [Adapt] Signal Handlers: Rename "Event Handlers" to "Signal Handlers"
    • [Adapt] Signal Handlers: Test data should match the test data from signal handler template
    • [Adapt] Signal Handlers: Test tab 'Send Event' button
    • [Adapt] Signal Handlers: Update Code Pane
    • [Adapt] Signal Handlers: Update Creation Flow
    • [Adapt] Signal Handlers: Update Table View
    • [Adapt] UI Post Product Review Fixes
    • [Adapt] UI Technical debt
    • [Adapt] Update Landing Page
    • [Adapt; API] Signal Handlers: API to support UI changes
    • [Adapt; Documentation] Create articles for Signal Handlers and Risk Policy templates
    • Bug Fixes:
      • [Adapt] Fixed: Data collector Signal Handler gets invoked as per cron schedule but doesn't execute the code
      • [Adapt] Fixed: Signal Handlers: Add documentation for Signal handlers
      • [Adapt] Fixed: Signal Handlers: AWS ARN info is displayed in the logs
      • [Adapt] Fixed: Signal Handlers: BUILT_IN_SAVE_EV_HANDLER doesn't always execute if one of the handler executions fails
      • [Adapt] Fixed: Signal Handlers: Configuration fields are missing
      • [Adapt] Fixed: Signal Handlers: Cron schedule link broken and Control Center logs issue
      • [Adapt] Fixed: Signal Handlers: Error logs are not shown on the UI
      • [Adapt] Fixed: Signal Handlers: Existing Signal Enricher handler is getting executed when it is not expected
      • [Adapt] Fixed: Signal Handlers: New signal handlers gets executed in regular intervals even though there is no cron schedule set
      • [Adapt] Fixed: Signal Handlers: Some of the handlers take longer than 6s and don't get processed
      • [Adapt] Fixed: Signal Handlers: The clear assignments pop-up is not responsive
      • [Adapt] Fixed: Signal Handlers: User unfriendly error message is displayed when there is no data
      • [Adapt] Fixed: UI Code Editing Broken
      • [Adapt; Documentation] Fixed: Welcome screen: Create policy documentation link is broken

  • [Affirm] Outcome: Microsoft Verified ID

    • [Affirm] Add Outcome for Microsoft Verified ID

  • [Affirm] Improvements on the way to GA

    • [Affirm] Add message to Requester to tell them the continue button has become available
    • [Affirm] Add padding to inputs to have better visibility
    • [Affirm] Adjust padding in the phone number verification screen in input field to improve visibility
    • [Affirm] Align behavior of custom user directory source and standard integration user lookup when 4xx or 5xx
    • [Affirm] Change login-id endpoint and FTL template
    • [Affirm] Chat input text message field should be the same height as video/send buttons
    • [Affirm] Chat window is wider than other windows this should match the rest of the screen
    • [Affirm] Check over and make sure the examples for code customizations are correct JS
    • [Affirm] Code customizations, optimize Requester/Approver lookups
    • [Affirm] Display flow id in the flow UI
    • [Affirm] Event for workflow escalation
    • [Affirm] Icon missing on Approver screens
    • [Affirm] Implement chat escalation process for OnFido IDV failure cases in the verification flow
    • [Affirm] Improve error handling in code customization calls
    • [Affirm] Make buttons feel more responsive when clicked
    • [Affirm] OIDC and other advanced settings UI improvement adding ID
    • [Affirm] OnFIDO background is currently blue, change it to white to match the rest of the flow
    • [Affirm] Remove Twilio chat and video dependencies from Photo ID and Liveness
    • [Affirm] Requester timeout on chat
    • [Affirm] Text code message is out of the text block shorten the message.
    • [Affirm] Text sizes and fonts for all screens
    • [Affirm] UX: Change size of model to better match OnFIDO
    • [Affirm] UX: Long Processing
    • [Affirm] UX: No user knowledge that the record button has done anything or is attempting to get the image captured
    • [Affirm] UX: When a new Approver joins the chat there is no feedback to the Requester that the Approver has changed
    • [Affirm; API] Fix Affirm APIs in Arch tests
    • [Affirm; Documentation] Article on error handling for code customizations; custom user directory source (no record found, generic error)
    • [Affirm; Documentation] Broken Links in the Affirm configuration UI
    • [Affirm; Events] Add user role field to Affirm Events
    • Bug Fixes:
      • [Affirm] Fixed: Activity Log type says recovery when initiated by the API
      • [Affirm] Fixed: Client secret is not hidden on OIDC settings
      • [Affirm] Fixed: Custom Branding: Large icons cause buttons to break out of the model
      • [Affirm] Fixed: Data mismatch on Activity Log for Approver when secondary Approver approves
      • [Affirm] Fixed: Duplicated records in idv_user_info table when both Approvers and escalation Approvers contain MANAGER or the same SOMEONE_ELSE email
      • [Affirm] Fixed: Escalation Approvers/Approvers are overlapping each other (no distinguishing between Approver being regular/escalated one in idv_user_info table)
      • [Affirm] Fixed: Buttons in both Requester and Approver flow
      • [Affirm] Fixed: Multiple entries in the Activity Log caused by showing a entry per Approver in the Activity Log
      • [Affirm] Fixed: No Approvers were found on workflow error
      • [Affirm] Fixed: When liveness check fails and you are sent to chat escalation the Approver report card does not show the face capture
      • [Affirm; Documentation; API] Fixed: API doc content-type: application/json is missing in all GET requests in Postman JSON

  • [Affirm] Q4 2024 Integrations and Bug Fixes and Unplanned Work

    • [Affirm] Cost tracking details for OnFIDO
    • [Affirm] Add dynamic Approvers in the create single user flow API
    • Bug Fixes:
      • [Affirm] Fixed: Duplicate workflowId on Approver better error messages and logging
      • [Affirm] Fixed: OIDC for Requester stuck on blank page
      • [Affirm] Fixed: Affirm selfie match going full screen on mobile devices during regression.
      • [Affirm] Fixed: Azure incorrect email error showing incorrect error message
      • [Affirm] Fixed: Adding long strings to the chat
      • [Affirm] Fixed: If time for Approvers is over 10 minutes throw an error on the front end since we now have a 10 minute timeout

  • [Affirm; Events] Reporting (Enhance reporting features or capabilities, including support for collection of metrics); Event Alignment

    • [Affirm; Events] AFFIRM_WORKFLOW_CONFIGURATION_CHANGED Event
    • [Affirm; Events] AFFIRM_WORKFLOW_IDV_FINISH Event
    • [Affirm; Events] AFFIRM_WORKFLOW_IDV_START Event
    • [Affirm; Events] AFFIRM_WORKFLOW_PHONE_NUMBER_ENTERED Event
    • [Affirm; Events] APPROVER ACCEPTED INVITE Event
    • [Affirm; Events] DOCUMENT UPLOAD Event; photo ID liveness
    • [Affirm; Events] OUTCOME TYPE Event
    • [Affirm; Events] PARITY API/UI FLOW EDITING Events
    • [Affirm; Events] USER STARTS FLOW Event
    • [Affirm; Events] VIDEO Event

  • [Affirm; Control Center] Branding and Customization

    • [Affirm] Custom Branding for the Control Center UI
    • [Affirm] Custom Branding: Custom Icon - custom icon should be correctly scaled on affirm flows
    • [Affirm] Custom Branding: Support custom background URL
    • [Control Center] Backend: Device Manager Section
    • [Control Center] UI: Device Manager Section
    • Bug Fixes:
      • [Affirm] Fixed: Custom Branding: Background color missing # on Hex while parsing to Affirm
      • [Affirm] Fixed: Custom Branding: Background color not accepting HEX characters A-F
      • [Affirm] Fixed: Custom Branding: Background needs to be background; not model background
      • [Affirm] Fixed: Custom Branding: Box sizes are not responsive and can cut off links
      • [Affirm] Fixed: Custom Branding: Hexadecimal color character counter warns when a letter is in the value, and fails to save when there is no warning message
      • [Affirm] Fixed: Custom Branding: Preview for company logo not displaying uploaded image
      • [Affirm] Fixed: Custom Branding: Save buttons in Control Center Settings Custom Branding don't save; Image Upload fails
      • [Affirm] Fixed: Custom Branding: Saving causes 400 on image end point without adding an image
      • [Affirm] Fixed: Custom Branding: When saving logo or background Hex in Control Center the Save button spins

  • [All HYPR} Single Registration: Web-to-workstation Enhancements - Offline PINs

    • [Mobile App for Android] Process signingCert in OfflineAccess object for web registration flow
    • Bug Fixes:
      • [Passwordless for macOS] Fixed: Workstation-to-web: Mobile App for Android crashes when unlocking machine after use of Offline PIN
      • [Passwordless for macOS] Fixed: Workstation-to-web: Mobile App for iOS crashes when unlocking machine after use of Offline PIN

  • [All HYPR] Support native camera QR Code scan via dynamic short links - Beta

    • [Control Center] Support Parsing Dynamic Link
    • [Mobile App for Android] Support Parsing Dynamic Link
    • [Mobile App for iOS] Support Parsing Dynamic Link

  • [Control Center - Integrations] Entra External Authentication Methods (EAM) Integration [Beta]

    • [Control Center - Integrations] Entra EAM: Create feature enablement
    • [Control Center - Integrations] Entra EAM: Entra Integration backend; User Management
    • [Control Center - Integrations] Entra EAM: Fix integration UI
    • [Control Center - Integrations] Entra EAM: Integration backend; Entra artifacts
    • [Control Center - Integrations; Documentation] Entra EAM Integration
    • [Control Center - Integrations; Events] Entra EAM: Add EAM value to integrationType field in Event logs
    • [Control Center - Integrations; Platform - Keycloak] Entra EAM: Entra integration backend; Keycloak artifacts

  • [Control Center - Integrations] HYPR Enterprise Passkey: Entra ID FIDO2 Provisioning APIs - Beta

    • [Documentation] Provisioning API flow
    • [Mobile App for Android] Provisioning API UI Updates
    • [Mobile App for iOS] Provisioning API UI Updates
    • [Passwordless for Windows] Provisioining API UI Updates
    • Bug Fixes:
      • [Mobile App for Android] Fixed: Link to Entra Pairing documentation is broken
      • [Mobile App for iOS] Fixed: Link to Entra Pairing documentation is broken
      • [Mobile App for iOS] Fixed: Link to Entra Pairing documentation is broken (again)
      • [Passwordless for Windows] Fixed: Entra Enterprise Passkey pairing prompted for Local/Non-Hybrid AD accounts fails with an error
      • [Passwordless for Windows] Fixed: Entra Enterprise Passkey: Local/Non-Hybrid AD Accounts has 'pairing incomplete/Not fully paired' link, which triggers Entra pairing flow
      • [Passwordless for Windows] Fixed: Entra Enterprise Passkey: Mobile device logo is missing within the mobile device image on the Passkey naming screen
      • [Passwordless for Windows] Fixed: Entra Enterprise Passkey: System restart prompted to complete HID minidriver FIDO key setup

  • [Control Center - Integrations] HYPR Enterprise Passkey: FIDO2 Gateway Fallback - 3

    • [Control Center - Integrations] Add Observability AT Events
    • [Control Center - Integrations] Sync TraceId across Observability Flow
    • [Documentation] FIDO2 Gateway articles
    • [Mobile App for Android] Add Observability AT Events
    • [Mobile App for Android] Add Roaming Capabilities to EPK with Gateway
    • [Mobile App for Android] Sync TraceId across Observability Flow
    • [Mobile App for Android] Update feature logic for transports
    • [Mobile App for Android] Update feature UI for transports
    • [Mobile App for iOS] Add Observability AT Events
    • [Mobile App for iOS] Add Roaming Capabilities to EPK with Gateway
    • [Mobile App for iOS] Sync TraceId across Observability Flow
    • [Mobile App for iOS] Update feature logic for transports
    • [Mobile App for iOS] Update feature UI for transports
    • [Mobile App for iOS] Update FIDO2 Observability Audit Trail Event
    • [Passwordless for Windows] Add Observability AT Events
    • [Passwordless for Windows] Sync TraceId across Observability Flow
    • Bug Fixes:
      • [Mobile App for Android] Fixed: Enterprise Passkey FIDO2 Gateway: Advertise request does not restart on deleting one of the registered Workstation
      • [Mobile App for Android] Fixed: Incorrect traceId in the advertise request on registering second workstation with same rpApp

  • [Mobile App - Both] Single Registration: Conditional Enrollment

    • [Mobile App for Android] Conditional Enrollment: Add enablement and hide the Pending bubble
    • [Mobile App for Android] Conditional Enrollment: Parse QR field and send it back to the server
    • [Mobile App for iOS] Conditional Enrollment: Add enablement and hide the Pending bubble
    • [Mobile App for iOS] Conditional Enrollment: Parse QR field and send it back to the server

  • [Passwordless for Windows] (PUK) Security Device Unlock Code Support

    • [Passwordless for Windows] Create stable serial number for Feitian keys
    • [Passwordless for Windows] Implement PUK support (internal bits)
    • [Documentation] Security Key PUK support in HYPR Passwordless UI

  • [Platform - Keycloak] Q3 2024 Authenticator Modules

    • [Platform - Keycloak] Allow new Azure integration to use the new Keycloak SAML flow/authenticators

Enhancements​

  • [Adapt; Affirm] Hardening/Beta
  • [Adapt; Documentation] Add intro in the Signal Handlers page
  • [Adapt] Control Center Events to consume the PolicyName returned by Risk Engine
  • [Adapt] Multiple Entities in Policy
  • [Adapt] Risk Reports: After a 30-minute timeout, the session doesn't get automatically refreshed
  • [Affirm] Embed Dashboard in Control Center
  • [Affirm] Make idv-card CSS class expandable and adjustable to screen size, so that it fits its content nicely
  • [Affirm] Make OnFIDO screen borders look the same as rest of the Affirm Verification Flow
  • [Affirm] QuickSight Dashboard
  • [Affirm; API] Add Code Customization API descriptions to Affirm API docs
  • [All HYPR] Americans with Disabilities Act Fixes
  • [All HYPR] Remove Dinot font
  • [All HYPR] Single Registration Multi-Domain Enrollment
  • [API] API /info calls should not call Redis
  • [Control Center] Dashboard Enhancements
  • [Control Center] Firebase SDK: Update UI to allow uploading multiple
  • [Control Center] Remove legacy Analytics Dashboard (Google React charts) in all environments
  • [Control Center] User Manager Role access denied to workstations
  • [Control Center - Integrations] HYPR Enterprise Passkey - Generic Control Center Integration - II
  • [Documentation] Entra ID Docs: Replace internal domain with something more generic
  • [Documentation] Firebase Admin SDK setup articles
  • [Documentation] New/removed Analytics Dashboards
  • [Documentation] Substitute tiny URLs for embedded UI links to docs; maybe also to external sources
  • [Documentation] Update Compatibility Matrix article
  • [Mobile App for Android; Documentation] Fix deprecated links
  • [Mobile App for Android; Events] WS_AUTH_COMPLETED logging wrong traceID
  • [Mobile App for Android] Notification icon update
  • [Mobile App for Android] Single Registration: Allow white label flow
  • [Mobile App for iOS] FIDO2 Re-Enable WiFi and BLE
  • [Mobile App for iOS] Remove profiles on Mobile App first launch
  • [Passwordless - Both] Q3 2024 Passwordless UI improvements
  • [Passwordless for macOS] Reduce the time occurring between sending Passwordless to the Trash and uninstalling the product
  • [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.6.3
  • [Passwordless for Windows] YubiKey Bio MPE verbiage improvements
  • [Platform - Database] Startup error after upgrade to 9.1.0
  • [Platform - Keycloak] Add Vault entry for Keycloak k8s service address to remove NAT GW IPs in allowlist
  • [Platform - Keycloak] Improve multi-user messaging
  • [Platform - Keycloak] Perfomance tuning Phase 2
  • [Platform - Keycloak] Upgrade to 24.0.3
  • [SDK for FIDO2] Security Audit

Bug Fixes​

  • [Adapt] Fixed: All the evaluation points are not getting invoked in the authentication flow
  • [Adapt] Fixed: Monitor authentication policy not blocking after FIDO2 failures
  • [Adapt] Fixed: Upon a cold start of a tenant, Create Policy shows blank page
  • [Adapt] Fixed: User is not getting blocked when FIDO2 failure threshold is crossed
  • [Affirm] Fixed: OnFIDO break with retention policy change
  • [Affirm] Fixed: Photo ID liveness takes a second to load but the buttons render immediately
  • [Control Center] Fixed: Access Token: When Affirm is not enabled and a user tries to generate an access token with Affirm scope, no user-friendly log message
  • [Control Center] Fixed: Missing HYPR Logo and color scheme
  • [Control Center] Fixed: Optimized payload missing Asynchronous Registration in RP App features
  • [Control Center - Integrations] Fixed: ADFS Plugin: When authentication is denied, no message is shown to user
  • [Control Center - Integrations] Fixed: Generic OIDC: Correct the reference to BeyondTrust
  • [Control Center - Integrations] Fixed: Okta: Broken UI Link in Okta Integration
  • [Control Center - Integrations] Fixed: Okta: Email field is set to "N/A" under user management in advanced mode
  • [Control Center - Integrations] Fixed: Okta: If two users have the same email, the Enrollment drawer doesn't behave correctly when users clicks 'send email' for either user
  • [Control Center - Integrations] Fixed: Okta: NullPointerException after generating a Magic Link
  • [Events] Fixed: EventRequestObject.kt shows incorrect Event labels for Keycloak brute force Events
  • [Mobile App - Both] Fixed: Single Registration: Workstation-to-web: "Add Linked Workstation" button is longer on iOS than on Android
  • [Mobile App - Both; API] Fixed: Mobile unable to perform the right action(lock/unlock) as /rp/versioned/device/query/ws/status is returning 302
  • [Mobile App for Android] Fixed: FIDO2 Gateway Roaming: Delay observed during login to workstation by scanning the QR on credential provider
  • [Mobile App for Android] Fixed: FIDO2 Gateway: traceID is empty in the mobile gateway request headers
  • [Mobile App for Android] Fixed: Shortcut to unlock workstation crashes the app
  • [Mobile App for Android] Fixed: Singe Registration: Web-to-workstation: When we enable TalkBack, we can't manually trigger a push
  • [Mobile App for Android] Fixed: Single Registration: Web-to-workstation: App is unresponsive when we trigger a push to receive a certificate
  • [Mobile App for Android] Fixed: Single Registration: Web-to-workstation: When deleting web account, we see text hidden
  • [Mobile App for iOS; Passwordless for Windows] Fixed: White label in hypr.json and tenant ID for Device Manager link doesn't start Desktop SSO
  • [Mobile App for iOS] Fixed: Single Registration: Deleting pairings from Device Manager doesn't remove the accounts on the Mobile App
  • [Mobile App for iOS] Fixed: Single Registration: Workstation-to-web: Clicking "Add Linked Workstation" when the certificate is not ready generates an error
  • [Mobile App for iOS] Fixed: Single Registration: Workstation-to-web: We see Offline PINs as an option even though successful online unlock wasn't made
  • [Mobile App for iOS] Fixed: Single Registration: Workstation-to-web: When pairing is deleted from app, we see number of accounts as 1 on list
  • [Passwordless for Windows] Fixed: Intermittent issue: Enterprise Passkey: Azure Provisioning API: FIDO2 security key creation fails with a fault exception
  • [Passwordless for Windows] Fixed: QR Fallback application name is cut on Passwordless if tenant name is too long
  • [Platform - Database] Fixed: Remove "barcode" properties in the document report in the DB
  • [Platform - Keycloak] Fixed: Keycloak 9.5 fails the Datadog health check

9.3.2 - Patch 2024-08-23​

Enhancements​

  • [All HYPR] Remove dinot font
  • [API] Switch check settings request justVerifySerialNumber to justValidateSerialNumber
  • [Mobile App for iOS; SDK for iOS] Customer TrustKit
  • [Passwordless for Windows] Create 9.1.3 and 9.3.2 hotfix releases to pick up YubiKey mini-driver 4.6.3

Bug Fixes​

  • [Platform - Keycloak; Control Center] Fixed: Control Center to Keycloak HttpClient issues

9.3.1 - Patch 2024-08-07​

Enhancements​

  • [Control Center] Custom Branding: No flow to delete custom icon
  • [Control Center - Integrations] HYPR Enterprise Passkey: Entra ID FIDO2 Provisioning APIs - Alpha
  • [Documentation; Events; Errors] Security Key PUK support Events and Error codes
  • [Mobile App for Android] Fix timing issue on startup
  • [Mobile App for Android] Single Registration: Add possibility to add multiple workstations even if one is already present
  • [Mobile App for Android; Documentation] Fix dead links
  • [Passwordless for Windows] Incorporate visual indicator that there's a timed process
  • [Platform - Keycloak] Keycloak is displaying the old favicon; update to current favicon for Mobile App

Bug Fixes​

  • [Affirm] Fixed: Font differences between web and mobile UI
  • [Affirm] Fixed: OnFIDO breaks with retention policy change
  • [Control Center - Integrations] Fixed: Remove client secrets from server's response
  • [Control Center] Fixed: Custom branding boxes should be matched in size for icon and background
  • [Control Center] Fixed: Sanitize logs for Firebase
  • [Mobile App for iOS] Fixed: Single Registration: Web-to-workstation: Two computer bubbles appear in iOS after pairing
  • [Passwordless for Windows; Documentation] Fixed: Link to Entra pairing documentation is broken
  • [Platform - Keycloak; Control Center] Fixed: Audit Trail: Keycloak Events are not getting generated

9.4.0 - GA 2024-07-24​

New Features and Feature Changes​

  • [Adapt; Affirm] Hardening/Beta

    • [Affirm] Test out new Affirm redirect for viability
    • Bug Fixes:
      • [Affirm] Fixed: Affirm module is not added to HYPR authenticator after upgrade to 9.3

  • [Adapt; API] Protection for Signals Endpoint

    • [API] Add JWKS endpoint support for verifying JWT
    • [Adapt; API; Events] Third-party Event ingestion API for Adapt
    • [Adapt; API] OAuth credentials: Test button to check if the JWKS endpoint is a valid endpoint
    • [Adapt; API] OAuth credentials: Test button to check if the JWKS endpoint is a valid endpoint
    • [Control Center; API] Access Token scopes such as Adapt and Affirm should be enabled only if respective features are enabled
    • Bug Fixes:
      • [Control Center; API] Fixed: Access Tokens: Affirm endpoints throw 500 Internal server error with non-affirm related tokens
      • [Control Center; API] Fixed: Access Token Scopes: Few Endpoints can be accessed with wrong permissions
      • [Control Center; API] Fixed: Access Tokens: ADAPT_WRITE_POLICY, HYPR_CC_APPLICATIONS token works for ADAPT_TEST_POLICY

  • [Mobile App for Android] Feature Enablement Performance

    • [Control Center] Feature Enablement performance SSL path
    • [Mobile App for Android] Update Feature Enablement API call to specify features
    • [API] etag not refreshing for settings API call

  • [SDK for FIDO2] Design, Code

    • [SDK for FIDO2] Create centralized repository for source code

  • [SDK for FIDO2] FIDO2 Javascript SDK II Implementation

    • [SDK for FIDO2; Control Center] Update SDK code in Control Center
    • [SDK for FIDO2; Platform - Keycloak] Update SDK code in Keycloak
    • [SDK for FIDO2] Update SDK code in Sample Web App
    • [SDK for FIDO2] Publish to public NPM registry
    • [SDK for FIDO2] Setup Artifactory Deployment
    • [SDK for FIDO2; Documentation] Update Public Documentation

Enhancements​

  • [Adapt] Analytics Dashboards
  • [Adapt] Custom Policy: Secret values should be redacted from the UI and logs just like Event Handlers
  • [Adapt] Signal Handlers: Default 'Test action event' JSON improvements
  • [Affirm ] Control Center Branding and Customization
  • [All HYPR] Q2 Authenticate Application Security Items
  • [API] Returning nodeCount instead of result of publish; device/wfa/status doesn't work on cluster
  • [Control Center] Add Perf Timestamps where missing
  • [Control Center] Identity Assurance Dashboard Alpha (Prod)
  • [Control Center] Add IP address to "New device added" email
  • [Events] Populate Event Tags where they are null for Control Center Events
  • [Passwordless - Both] Adjust Workstation Unlock to include optional Workstation Signal field
  • [Passwordless for macOS] Investigate Improving Login Speed
  • [Passwordless for Windows] Update Enrollment Service to operate in multi-domain forest
  • [Platform] Allow starting hypr.rp.haasMode without Vault

Bug Fixes​

  • [Adapt] Fixed: Policy assignment for Pre/post-integration Evaluation points 'Adapt Unavailable Fallback' value is not getting saved
  • [Adapt] Fixed: Policy assignment: 'Adapt unavailable' selected option is not getting saved properly
  • [Adapt] Fixed: Server is saving duplicate signals with when Send Workstation Signals is enabled
  • [Adapt] Fixed: When Adapt is enabled, 'Pre HYPR Integration' expects the policy to be assigned, or else Desktop SSO fails
  • [Adapt] Fixed: Workstation authentication policy assignment 'Adapt Unavailable Fallback' value is not getting saved
  • [Adapt; Affirm] Fixed: Combined policy 'Affirm Verification Flow ID' description is missing and the default value is - [object Object]
  • [Affirm] Fixed: OnFIDO break with retention policy change
  • [All HYPR] Fixed: Single Registration: Web-to-workstation: Deleting user devices from Control Center doesn't delete the pairing from devices
  • [API] Fixed: DELETE "${SERVER_URL}/cc/api/fido/facet" doesn't return valid JSON response
  • [Control Center] Fixed: Support Access: Email not wrapping on delete on popup modal
  • [Control Center; API] Fixed: Firewall: Swagger is getting blocked with 400 error
  • [Control Center - Integrations] Fixed: Entra ID External Authentication Method PoC
  • [Control Center - Integrations] Fixed: Google Workspace: Can't add integration
  • [Passwordless for Windows] Fixed: HyprLibFido2.dll version number isn't being updated
  • [Passwordless for Windows] Fixed: Link to Entra Pairing documentation is broken

9.3.0 - GA 2024-07-17​

New Features and Feature Changes​

  • [Adapt] Implement Adapt for Workstation - Alpha

    • [Adapt] Passwordless Signals: Server to handle the client signal sent with 'client/authorize/unlock' request
    • Bug Fixes:
      • [Adapt] Fixed: Passwordless Signals: SQL Exceptions are encountered whenever client signals are generated
      • [Adapt] Fixed: Passwordless authentication policy fails even when the client signal has relevant network name
      • [Adapt] Fixed: Consecutive client signals don't make it to Dynamo database
      • [Adapt] Fixed: Workstation authentication PRE_WORKSTATION_UNLOCK evaluation point doesn't get invoked before the FIDO request
      • [Adapt] Fixed: macOS signals are not getting saved in Dynamo database
      • [Adapt] Fixed: Workstation authentication POST_FIDO_AUTH evaluation point failure causes failed unlock
      • [Adapt] Fixed: Workstation authentication PRE_FIDO_AUTH evaluation point is not invoked
      • [Adapt] Fixed: Workstation authentication policy is getting evaluated twice for the POST_WORKSTATION_UNLOCK evaluation point
      • [Adapt] Fixed: Workstation authentication policy does not match the exact network name and allows unlock to pass

  • [Adapt] Leverage Affirm for re-verification POV1

    • [Adapt] Make Adapt + Affirm integration policy as a template
    • [Adapt] Policy with template 'Affirm/Adapt Integration' throws error on configuration page
    • [Platform - KeyCloak] UX for Adapt + Affirm integration

  • [Adapt] Q2 Authenticate Signals Updates

    • [Passwordless for macOS] Include system and CrowdStrike ID information in device signal
    • [Passwordless for macOS] Signals: During unlock flow, send system, network, and location info
    • Bug Fixes:
      • [API; Passwordless - Both] Fixed: Client signals are sent after rp/wsapi/client/authorization/complete instead of /rp/wsapi/client/authorize/unlock
      • [Passwordless - Both] Fixed: Network information is of String datatype instead of JSON object

  • [Adapt] Risk Policy Improvements I - Alpha

    • [Adapt] UI/UX Feedback Part 2
    • [Adapt] Custom policy page UX feedback Phase 2
    • Bug Fixes
      • [Adapt] Fixed: Policy config page: Duplicates: /cc/ui/application and /cc/ui/appconfig/adapt

  • [Adapt] Risk Policy Visual Reporting Tool

    • [Adapt] Risk Reports: Make Event date and timestamp match with the actual timestamp
    • [Adapt] Risk Reports: Sort Policy evaluations Events table using eventTimeInUTC column
    • [Adapt] Risk Reports: Policy evaluation should match the Audit Trail message
    • Bug Fixes:
      • [Adapt] Fixed: Risk Reports: Minor UI issues
      • [Adapt] Fixed: Risk Reports: Tenant data for adaptreleaseint is not available for reports
      • [Adapt] Fixed: Risk Reports: The latest Policy Evaluation Data is not visible in the report; i.e., auto-refresh is not happening
      • [Adapt] Fixed: Risk Reports: Workstation authentication evaluation points are getting classified as Unknown

  • [Affirm] Control Center Branding and Customization for Affirm

    • [Affirm] White labels, logo, and background
    • [Affirm] Hide the new UI while we are building it
    • [Affirm] Company Identity section
    • [Affirm] Logo and Background section
    • [Affirm] Backend Logo and Background section

  • [Affirm] Enhancements

    • [Affirm] Ability to add multiple Approvers with progressive logic
    • [Affirm] Ability to add multiple Approvers with progressive logic
    • [Affirm] Add extension for Send Email; Customization Tab
    • [Affirm] Add extension for SMS; Customization Tab
    • [Affirm] Add Polyglot JS extension for User Lookup
    • [Affirm] Add Polyglot JS extension for User Lookup
    • [Affirm] Affirm flow status on cc = disabled, User can still complete affirm flow
    • [Affirm] Approver attestation comment modal redesign
    • [Affirm] Approver attestation screen redesign
    • [Affirm] Approver final approval status screen redesign
    • [Affirm] Approver pre-chat summary screen redesign
    • [Affirm] Approver summary screen redesign
    • [Affirm] Authenticate Approver
    • [Affirm] Authenticate Approver configuration changes
    • [Affirm] Chat screen redesign
    • [Affirm] Enable application screen redesign
    • [Affirm] Extension (SMS/Email) backend/API support
    • [Affirm] Failure cases not beng handled gracefully by document-upload
    • [Affirm] Fix web UI to be more consistent based on an agreed design
    • [Affirm] Granular scopes (read and read/write) for CodeCustomizationController
    • [Affirm] If reference image exists, skip document upload in Photo ID and Liveness
    • [Affirm] Invalid link screen redesign
    • [Affirm] Make Activity Log match the steps we have
    • [Affirm] New users should be taken to Onboarding flow while existing users should be taken to the index page (current behavior)
    • [Affirm] Password reset flow for okta
    • [Affirm] Upgrade screen redesign
    • [Affirm; Documentation] Affirm Ccontrol Center UI documentation
    • [Affirm; Documentation] Affirm Web UI documentation
    • [Affirm; Documentation; API] Affirm public API documentation
    • Bug Fixes:
      • [Affirm] Fixed: After Approver leaves video call to approve the video remains but is frozen
      • [Affirm] Fixed: Faces do not match redo/retry button does not render correctly
      • [Affirm] Fixed: If Requester is in video before Approver the Approver cannot see the Requester in the video
      • [Affirm] Fixed: Name comparison status not showing results if results is consider

  • [Affirm] Improvements

    • [Affirm] PKCE client secret issue
    • [Affirm] Redirect URL can be dynamic in outcome type
    • [Affirm] Rename escalateAfterMinutes for Approver field to reduce confusion with new escalate flow
    • [Affirm] Update documentation for Okta Password Reset
    • Bug Fixes:
      • [Affirm] Fixed: Affirm not pulling phone number from Azure correctly on Approver
      • [Affirm] Fixed: Error message causes button to escape highlighted box
      • [Affirm] Fixed: Three texts and three emails during Affirm flow
      • [Affirm] Fixed: Brute force detection on SMS needs better messaging to user

  • [All HYPR] Q2 Application Security Items

    • [Control Center] Prevent rpUser update
    • [API] Restrict user role access
    • [Mobile App for iOS] Verify RP's response before attempting registration

  • [All HYPR] Single Registration: Workstation-to-web re-register/deregister cases

    • [All HYPR] Single Registration: Workstation-to-web: User has to delete HYPR Mobile App for iOS during re-registration to see the web account
    • [All HYPR] Single Registration: Workstation-to-web: Removal of pairing from Device Manager doesn't reflect on the Mobile App
    • [All HYPR] Single Registration: Workstation-to-web: Deletion of user from Control Center doesn't remove pairings from Mobile
    • [All HYPR] Single Registration: Workstation-to-web: User has to delete the HYPR Mobile App for Android during re-registration to see the web account

  • [All HYPR] Single Registration: Web-to-workstation: Deregistration/Re-enroll

    • [All HYPR] Single Registration: Deregistration of one pairing should remove all associated pairing entries
    • [Mobile App for iOS] Implement Single Registration on iOS Mobile app
    • [Mobile App for Android] Single Registration: Web-to-workstation: Remove VDI when deregistering a workstation, to remove certificate from device
    • Bug Fixes:
      • [All HYPR] Single Registration: Web-to-workstation: Deletion of web account doesn't always delete corresponding computer bubble on iOS

  • [API] (PUK) Security device unlock code support

    • [Control Center] Server side for PIN PUK support

  • [Control Center] FIDO2: FacetID Management, Validation, Compatibility

    • [Mobile App for iOS] Existing registrations cannot authenticate if FIDO Allowlist Facets is enabled afterward
    • [Mobile App for Android] Existing registrations cannot authenticate if FIDO Allowlist Facets is enabled afterward

  • [Control Center] Fingerprint JS hosted

    • [Control Center] Host Fingerprinting JS script
    • [Passwordless - Both] Pass traceId into Desktop SSO link for Passwordless
    • Bug Fixes:
      • [Control Center] Fixed: Two traceIds are created for authentication

  • [Control Center - Integrations] HYPR Enterprise Passkey: FIDO2 Gateway Fallback - 2

    • [Control Center - Integrations] Backend: Expose BLE and WiFi transport options for Enterprise Passkey configuration
    • [Control Center - Integrations] UX: Expose BLE and WiFi transport options for Enterprise Passkey configuration

  • [Control Center - Integrations; API] HYPR Enterprise Passkey: Entra ID FIDO2 Provisioning APIs - Alpha

    • [Control Center - Integrations; API] Entra Provisioning API toggle in Control Center
    • [Control Center - Integrations; API] Entra: Create the Provisioning API
    • [Control Center - Integrations; API] Entra: Create endpoint for the Provisioning API

  • [Control Center - Integrations; Mobile App for Android] HYPR Enterprise Passkey: FIDO2 Gateway Fallback - Beta

    • [Control Center] FIDO2 Gateway Advertise is False in background
    • [Control Center - Integrations] Azure: Domain-joined environment: Delete workstation and then credential, and the user stays in paired with Azure
    • [Passwordless for Windows] FIDO2 Gateway CTAP error responses are not being relayed to the USB HID driver
    • [Mobile App for Android] Error information overlay displays on tapping over the successful authentication entries in login history screen
    • [Mobile App for Android] Enterprise Passkey: Unable to unlock workstation using passkey if app is backgrounded on receiving the User Presence prompt
    • [Mobile App for Android] Enterprise passkey: Error not displayed on completing authentication on the Mobile App that was resumed from background which had the User Presence prompt
    • [Mobile App for Android] FIDO2 Gateway: When the workstation is unreachable, Android sends two advertise requests within 4s, repeating every 30s
    • [Mobile App for Android] Login History screen displays more than 50 entries

  • [Control Center] Customer Tenant Access Approval/Support Access Bug Fixes

    • [Control Center] Fixed: Support Access:Able to save on no action example custom date you can switch to custom date and save no change but save action is shown
    • [Control Center] Fixed: Support Access:Date picker while flipping month causes 1st of month to be selected on future months/current month selects today's date
    • [Control Center] Fixed: Support Access: Canceling swap of custom date vs. always access shows saved state banner
    • [Control Center] Fixed: Support Access: Email list no wrapping on screen causes scroll bar
    • [Control Center] Fixed: Support Access: Audit Trail not showing correct numbers showing 1-5 instead of the number of entries
    • [Control Center] Fixed: Support Access: Audit Trail does not refresh on toggle off/on

  • [Passwordless for Windows] Q3 2024 Security Device Enhancements

    • [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.6.1
    • Bug Fixes:
      • [Passwordless for Windows] Fixed: "YubiKey PUK Lock Enabled" feature is broken
      • [Passwordless for Windows] Fixed: Cannot log in with YubiKey Bio if Security Key PIN Minimum Length is set to 7 and current PIN is 7 on Windows 11
      • [Passwordless for Windows] Fixed: Fingerprint registration UI failed to appear resulting in error during YubiKey Bio MPE pairing, though registration was successful

Enhancements​

  • [Adapt] Add new Workstation Unlock Evaluation Points
  • [Adapt] Add Polyglot JS User Lookup extension Test tab
  • [Adapt] Datadog logs flooding due to Event Handler-generated Events parsing issue
  • [Adapt] Event Handlers Alpha
  • [Adapt] Monitoring and alerting
  • [Adapt; Control Center - Integrations] Adapt is breaking the Okta integration
  • [Adapt; Documentation] Create and document a beginner policy
  • [Affirm] Enable sonar on Affirm code
  • [API] Returning nodeCount instead of result of publish; device/wfa/status doesn't work on cluster
  • [API] Take advantage of justVerifySerialNumber in checksettings payload
  • [Control Center] Asynchronous Registration: Push consent shouldn't be mandatory during registration
  • [Control Center] FIDO2/Login Settings
  • [Control Center] Finally removed the apostrophe/comma in the New Application dialogs
  • [Control Center] Server is not picking the proxy from the environment variable
  • [Control Center - Integrations] ADFS deeplinks issues
  • [Control Center - Integrations] Create maintenance job to add aliases to Okta Integration users
  • [Control Center - Integrations] Sanitize logs
  • [Control Center; Documentation] Update Control Center links to new Documentation portal
  • [Documentation] Entra ID Documents: Replace internal domain with something more generic
  • [Documentation] Generic OIDC articles
  • [Documentation] OAuth token usage
  • [Documentation; API] MDS API endpoints Part I
  • [Documentation; API] Security Key PUK support APIs
  • [Documentation; Errors] Error Code Cleanup
  • [Events] QR Authentication timeout, QR Authnentication scan are not generating Events
  • [HYPR Mobile App - Both] QR Authentication skip confirmation prompt
  • [Mobile App for Android] Android appeal in the Play Store
  • [Mobile App for iOS; SDK for iOS] Automation: Request to add ID for Transaction Amount and Text displayed
  • [Mobile App for iOS] Enterprise Passkey: Fix advertise called during FaceID
  • [Mobile App for iOS] Improve HYPR Mobile App speed
  • [Mobile App for iOS] Request for element Locator in error message screen
  • [Passwordless for Windows] Log every file submitted to DigiCert code signing service
  • [Passwordless for Windows] Optimize code signing during CI/CD builds
  • [Passwordless for Windows] Update ATR's for Feitian security keys
  • [Passwordless for Windows] Use same names for Feitian keys that Passwordless 8.X used
  • [Platform] Fix 404 Page
  • [Platform - Database; Events] Add Primary Key Index to idv_audit_event table
  • [Platform - Firebase] Firebase SDK: Multiple projects with OAuth config
  • [Platform - Keycloak] Custom migration for existing tenant to move Ping DaVinci and BeyondTrust integrations to use the new Keycloak OIDC flow/authenticators
  • [Platform - Keycloak] Match Keycloak UI to Control Center UI so the login options are the same
  • [Platform - Keycloak] Remove misleading brute force logs when error occurs

Bug Fixes​

  • [Adapt] Fixed: HYPRSpeed is missing in Login limits template
  • [Adapt] Fixed: Policy management Event Search Window issues
  • [Adapt] Fixed: Push attack prevention policy: QR code is not getting displayed; i.e., Mobile option is going away and FIDO2 is displayed
  • [Adapt] Fixed: User forced to click "Configure Policy" after creating policy
  • [Affirm] Fixed: ApproverRequestResultsAction: Get reference image from the database, not only from the cache
  • [API] Fixed: Magic link call /cc/ui/rpUser/self is intermittently returning 404
  • [Control Center] Fixed: Device Manager template capturing
  • [Control Center] Fixed: QR Fallback: Control Center users cannot use QR Fallback to login
  • [Control Center] Fixed: SVG Display in UI management screen
  • [Control Center] Fixed: User Management page has extra padding above the 'Web Domains' table
  • [Control Center - Integrations] Fixed: Enrollment drawer doesn't show two users with same primary email address
  • [Control Center - Integrations; API] Fixed: Okta: On launching Device Manager from the Okta dashboard, 404 errors occur with the /cc/ui/rpUser/self endpoint
  • [Control Center; API] Fixed: Server expecting machineId populated in Audit API for FIDO-Only registration/authentication flows
  • [Control Center; Documentation] Fixed: Links to new Documentation portal
  • [Mobile App for Android] Fixed: All workstation registrations are being removed on de-registering one workstation pairing
  • [Mobile App for Android] Fixed: Single Registration: Workstation-to-web: Removal of pairing from Device Manager doesn't reflect on Mobile App
  • [Mobile App for iOS] Fixed: Device cannot authenticate if FIDO Allowlist Facets is enabled before registration
  • [Mobile App for iOS] Fixed: Single Registration: Workstation-to-web: Deletion of Computer Bubble doesn't delete Web Account
  • [Passwordless for macOS] Fixed: Signal reporting can answer with code 204
  • [Passwordless for macOS] Fixed: Single Registration: Web-to-workstation: Web account's Computer Bubble keeps getting hidden
  • [Passwordless for macOS] Fixed: Uninstalling client doesn't restore default unlock screen
  • [Passwordless for macOS; Mobile App for Android] Fixed: Single Registration: Web-to-workstation: All accounts on Android are deleted when user in web rpapp gets deleted on Control Center
  • [Passwordless for Windows] Fixed: CSR generation times out during IDEMIA smart card registration
  • [Passwordless for Windows] Fixed: WiFi and BLE icons on the "Choose Connection" screen are clipped
  • [Platform - Database] Fixed: rp_user_alias table not cleaned up after delete
  • [Platform - Keycloak] Fixed: Authentication failing with error 'Unexpected error when handling authentication request to identity provider'

8.7.2 - Patch 2024-06-13​

Enhancements​

[API] Implement token refresh retry on settings endpoint

8.4.2 - Patch 2024-06-13​

Enhancements​

  • [Mobile App for Android; SDK for Android] Android support in 8.4.2

9.1.2 - Patch 2024-05-29​

New Features and Feature Changes​

  • [Passwordless for Windows] Q3 2024 Security Device Enhancements
    • [Passwordless for Windows] Implement UI for FIDO2 fingerprint management
    • [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.6.1
    • Bugs Fixed:
      • [Passwordless for Windows] "YubiKey PUK Lock Enabled" feature is broken

Enhancements​

  • [All HYPR] Americans with Disabilities Act (ADA) Fixes Pass 4
  • [API] Returning nodeCount instead of result of publish using device/wfa/status doesn't work on a cluster
  • [Control Center] FacetID Management, Validation, Compatibility
  • [Control Center] FacetID UI Accessibility Changes
  • [Control Center - Integrations] Okta Extension: Customer use case
  • [Control Center - Integrations] Okta Extension: Issues with customer upgrade
  • [Control Center - Integrations] Okta Extension: Use oktapreview when looking for client
  • [Mobile App for Android] Customer permission issue
  • [Passwordless for Windows] Successful pairing screen timeout
  • [Passwordless for Windows] Update ATR's for Feitian security keys
  • [Passwordless for Windows] Use same names for Feitian keys that Passwordless 8.X used

Bug Fixes​

  • [Affirm] Fixed: Mobile IdV flow shows blank spinning screen after selecting document type to upload
  • [Control Center - Integrations] Fixed: Multiple problems with security key removal dialog
  • [Control Center - Integrations] Fixed: Security Key removal does not pop up in 9.1+
  • [Control Center] Fixed: Errors thrown with creation and deletion of duplicate facetIDs (UI)
  • [Mobile App for Android; SDK for Android] Fixed: App crash for Location permission with Signals enabled

9.1.1 - Patch 2024-05-01​

New Features and Feature Changes​

  • [Affirm] Enhancements

    • [Affirm] Rename AFFIRM Event field 'costsTracking | isSuccessful' to enable efficient parsing
    • [Affirm] Email Case Sensitivity
    • [Affirm] Document-upload not handling failure cases gracefully
    • [Affirm] When the IdV flow is Disabled, the Requester can still complete the Affirm flow

  • [Control Center] FIDO2: FacetID Management, Validation, Compatibility

    • [Control Center] FIDO2: Add 'Delete' button for trusted facets
    • [Mobile App for iOS] Existing registrations cannot authenticate if FIDO Allowlisted Facets is enabled afterward
    • [Mobile App for Android] Existing registrations cannot authenticate if FIDO Allowlisted Facets is enabled afterward

Enhancements​

  • [Adapt] Workstation authentication policy UI changes
  • [Adapt; Control Center - Integrations] Adapt is breaking the Okta Integration
  • [All HYPR] 'Azure' still appears in several places in the dialog options; change to 'Entra' or 'Microsoft Entra ID'
  • [All HYPR] Single Registration (Both) chsch sso issue
  • [API] Take advantage of justVerifySerialNumber in checksettings payload
  • [Mobile App for iOS] Enterprise Passkey: Fix advertise called during FaceID
  • [Mobile App for iOS] FIDO2 Disable WiFi and BLE
  • [Passwordless for Windows] Add support for YubiKey 5.7.0 firmware
  • [Passwordless for Windows] Allow security key registration to set alphanumeric PINs
  • [Platform - Keycloak] Bring jQuery changes to the Keycloak registrator

Bug Fixes​

  • [Adapt] Fixed: Using the new Login Limits policy template, the user is getting blocked before the 'number of failed events' condition is met
  • [Control Center] Fixed: Device Manager registration fails on Safari browser
  • [Control Center - Integrations] Fixed: Azure domain-joined: Delete credential and then workstation; uer stays in "Paired with HYPR' in the Azure portal
  • [Control Center - Integrations] Fixed: User Management: Pending tab message still uses 'WFA' and should use 'Passwordless'
  • [Mobile App for Android] Fixed: Enterprise Passkey: On deregistering the linked security key for a hybrid account, the Workstation pairing is also being removed
  • [Mobile App for Android] Fixed: Passwordless Unlock: Location flickers and Unlock fails

9.2.0 - GA 2024-04-11​

New Features and Feature Changes​

  • [Adapt] Data retention Events TTL

    • [Adapt] Set retention TTL to 5 years

  • [Adapt] Risk Policy Improvements I Alpha

    • [Adapt] Fetch individual policy when rendering policy configuration
    • [Adapt] Home page; Create Policy flow; built-in policy pages UX feedback
    • [Adapt] Custom policy pages UX feedback

  • [Adapt; API] Protection for signal endpoint

    • [Adapt; API] API security for the signal service
    • [Adapt; Control Center; API] UI updates for OAuth API tokens
    • [Control Center; API] OAuth API token: Token not getting created when OIDC related permissions are selected
    • [Control Center; API] OAuth credentials: Creating a token with 999999s TTL throws error
    • [Control Center; API] OAuth Credentials: Token TTL is not correctly reflected in the UI
    • [Control Center; API] OAuth Credentials: Able to create a token with blank 'Use JWKS endpoint'

  • [Affirm] Enhancements

    • [Affirm] Front end validations around redirect URL
    • [Affirm] Update copy for Photo ID and Liveness
    • [Affirm] Warning message cleanup UI for invalid configurations
    • [Affirm] Public API - Design
    • [Affirm] Activity Log Name Check field implementation
    • [Affirm] Improve look of the email step
    • [Affirm] Improve look of the phone step
    • [Affirm] Improve look of the location step
    • [Affirm] Improve look of the start step
    • [Affirm] Improve look of the final wrapping up step for Requester
    • Bug Fixes:
      • [Affirm] Fixed: Approver does not receives phone message with Requester detail and link to approve
      • [Affirm] Fixed: 500 on Approver clicking continue in Approver chat
      • [Affirm] Fixed: Phone number match not throwing error unless comparing last 3 digits
      • [Affirm] Fixed: Upon clicking Redo, "you'll" switches to "you'll"
      • [Affirm] Fixed: Camera is enabled but microphone is not causing extra click for user
      • [Affirm] Fixed: Background shifts when entering OnFIDO part of the flow
      • [Affirm] Fixed: Button sizes and style to match previous steps in Affirm flow
      • [Affirm] Fixed: Error message . vs . on Affirm email page
      • [Affirm] Fixed: Chat of Approver and Requester appears are different
      • [Affirm] Fixed: 500 on going directly to URL
      • [Affirm] Fixed: UI is not reactive to screen size
      • [Affirm] Fixed: Background of application connection default new login method does not cover the entire name for the drop-down
      • [Affirm] Fixed: Session timeout on cc/ui/idv leads to 'Access Denied' on refresh; when 'Log In' is clicked again opens a Control Center login instead of an Affirm landing page

  • [Control Center] Audit Trail Enhancement

    • [Control Center] Audit Trail: Updating machineid, eventtags and deviceType validation and adding new TC in validation

  • [Control Center] Technical Debt

    • [Control Center] Dropdown’s option is not visible on mouse-hover
    • [Control Center] Audit trail selected date doesn't get displayed
    • [Control Center] DEV env CSRF token fix
    • [Control Center] React Google chart using deprecated version

  • [Control Center - Integrations] Generic OIDC Integration

    • [Control Center - Integrations] Generic OIDC: Feature enablement
    • [Control Center - Integrations] Generic OIDC: Create tile and Beta UI
    • [Control Center - Integrations] Generic OIDC: Implement Integration
    • [Passwordless for Windows] Uninstall doesn't deregister paired devices

  • [Control Center - Integrations] HYPR Enterprise Passkey: FIDO2 Gateway Fallback Part 2 - Beta

    • [Passwordless for Windows] Client should reflect correct Enterprise Passkey status when brought into focus
    • [Control Center] Custom Device Manager templates to aid customer migrations

  • [Mobile App - Both] Single Registration: Web-to-workstation Deregistration/Re-enroll Bug Fixes

    • [Mobile App for Android] Fixed: Single Registration: Web-to-workstation: Displays bubble with the computer icon instead of a QR code after obtaining certificate
    • [Mobile App for iOS] Fixed: Workstation bubble naming has machine name instead of username

  • [Passwordless for Windows] Missing removed registrations

    • [Passwordless for Windows] Uninstalling the client doesn't deregister paired security keys

  • [Platform - Keycloak; Events; SDK - All] Keycloak Observability

    • [Platform - Keycloak; Events] Propagate Keycloak Events to Control Center
    • [Platform - Keycloak; Events] Enable Keycloak login Event for new integrations
    • [Platform - Keycloak; Events] Send Keycloak modules login Events to Control Center
    • [Platform - Keycloak; Events] Send Keycloak authentication/registration login Events to Control Center
    • [Platform - Keycloak; Events] Tracing and Event improvements - traceId
    • [Platform - Keycloak; Control Center - Integrations; Events] Create a custom migration to enable Keycloak login Events for all integrations
    • [Platform - Keycloak; Events] Sending Events from Keycloak throws exceptions
    • [SDK - All] SDK method to log successful Events
    • [SDK for Java] Make sure all Java SDK calls use the traceId from the session

Enhancements​

  • [All HYPR] CVE-2023-52428
  • [All HYPR] CVE-2024-22259(8.100000381469727)
  • [All HYPR] Single Registration (Both) chsch sso issue
  • [Control Center - Integrations] ADFS Plugin v2: Replace external IIS Web Server needed for the HYPR ADFS Plugin to a URL served via ADFS
  • [Control Center - Integrations] Entra ID: Create enablement for the APIs
  • [Control Center - Integrations] Extension web hooks
  • [Control Center; Adapt] Remove Login Limits local template from Control Center, point strictly to PolicyTemplates Risk Engine API in code
  • [Control Center] Add POV banner
  • [Control Center] ccdocs target is failing
  • [Control Center] Drop zipkin reporting
  • [Control Center] Update .jar dependencies
  • [Passwordless for macOS] Don't use System Events to start HYPR after the first reboot
  • [Passwordless for Windows] Add support for YubiKey 5.7.0 firmware
  • [Passwordless for Windows] Allow security key registration to set alphanumeric PINs
  • [Passwordless for Windows] Force Windows to refresh icons after client installation
  • [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.6.0
  • [Platform - Keycloak] Create SAML integration APIs
  • [Platform - Keycloak] Custom migration for existing tenant to move Okta integration to use the new Keycloak OIDC flow/authenticators
  • [Platform] Upgrade owasp-dependency
  • [Platform] Upgrade Spring to 3.2

Bug Fixes​

  • [Adapt] Fixed: Assign policy returns 200 with invalid policy ID and invalid rpApp
  • [Adapt] Fixed: Keycloak authentication defaulting to Push when both Mobile App and FIDO2 are registered
  • [Adapt] Fixed: Signals do not report local network information
  • [Affirm] Fixed: UI import issues
  • [Control Center] Fixed: Single Registratio: Workstation-to-web: No email associated with user doesn't create a web account with UPN
  • [Mobile App -Both] Fixed: Authentication message differs on Android and iOS
  • [Mobile App for Android] Fixed: Single Registration: Workstation-to-web: Hide the "Add Linked Workstation" button
  • [Mobile App for iOS] Fixed: Signals have duplicate values in many attributes
  • [Passwordless for macOS] Fixed: Ensure TokenDriver is available for the current user when the workstation is locked
  • [Passwordless for macOS] Fixed: Server crashes trying to read user info
  • [Passwordless for macOS] Fixed: Shows Android icon instead of iPhone icon when paired
  • [Platform - Keycloak] Fixed: QR authentication synchronous form submission blocks UI Automation

9.1.0 - GA 2024-04-10​

New Features and Feature Changes​

  • [Adapt] Event Handlers Alpha

    • [Adapt] Event Handlers: Context functions
    • [Adapt] Event Handlers: Rename: Front end

  • [Adapt] Risk Policy: Custom Code Configuration w/Dynamic UI [Beta]

    • [Adapt] Add AI assist button
    • [Adapt] Further separate built-in and custom policies
    • [Adapt] Provide more context for versioning
    • [Adapt] Relocate documentation
    • [Adapt] Custom policies UI
    • [Adapt; API] Custom policies CRUD API

  • [Adapt] Risk Policy Improvements I Alpha

    • [Adapt] Risk Engine: Pass Events into Event attribute for test evaluations
    • Bug Fixes:
      • [Adapt] Custom policy UI: 'My policy template' policy evaluation throws exception

  • [Adapt] Risk Policy: Visual Reporting Tool

    • [Adapt] Policy evaluation results report
    • [Adapt] Risk Report Highlights

  • [Affirm] Bug Fixes

    • [Affirm] Control Center Activity Log page selector is not selectable and is blocked by the artifacts being populated in the table
    • [Affirm] If all settings are off you get the basic error on IDV page
    • [Affirm] No verification flow default selected if no application is set up for Affirm

  • [Affirm] Enhancements

    • [Affirm] Make Document photo and video selfie step more user friendly (reference IdV steps)
    • [Affirm; API] Public API Implementation
    • Bug Fixes:
      • [Affirm] Configuration error TAP is allowed for Okta
      • [Affirm] Name check in Activity Log showing CLEAR even when not used in the flow

  • [Affirm] GA

    • [Affirm] Add Affirm entry point on Keycloak authenticator
    • [Affirm] Add Affirm entry point on Keycloak Modules
    • [Affirm] Allow for auto-credentialing (no manager approval)
    • [Affirm] BE add name extraction and cross-referencing with IdP
    • [Affirm] BE Support for username as an initial identifier
    • [Affirm] BE Support more flexible configuration options
    • [Affirm] Control Center add name extraction and cross-referencing with IdP
    • [Affirm] Control Center Allow for auto-credentialing (no manager approval)
    • [Affirm] Control Center Support for username as an initial identifier
    • [Affirm] Control Center Support more flexible configuration options
    • [Affirm] IdV Support for username as an initial identifier
    • [Affirm] Activity Log: Document Verification result field implementation
    • [Affirm] Activity Log: Image File Name field implementation
    • [Affirm] Activity Log: Reduce amount of queries for fetching Activity Log details
    • [Affirm] Activity Log: Registration field implementation
    • [Affirm] Add document load step to the Twilio flow; remove it from the chat window
    • [Affirm] Add facial rekognition and SMS permissions to tenant IAM user
    • [Affirm] Add new item to generated chat for continue for Requester chat
    • [Affirm] Add picture taken step to the Twilio flow; remove it from the chat window
    • [Affirm] Attacker can brute force phone number without any limitation at all
    • [Affirm] Base settings/modified settings in Control Center front end HYPR Affirm component; refactor/consolidate so that there are fewer duplications in both default/modified settings representative objects
    • [Affirm] Control Center UI changes to match the public API
    • [Affirm] Check that Azure Users are active in data source before continuing Affirm flow
    • [Affirm] Clean the Twilio chat step
    • [Affirm] Create a simple error page for errors
    • [Affirm] Face ID verification can be bypassed using any random blurry image
    • [Affirm] Finish the implementation for Approver assignment
    • [Affirm] Go over copy on the following messages
    • [Affirm] Simplify Affirm Events
    • [Affirm; Control Center - Integrations] Okta: Check that User is active in Data Source before continuing Affirm flow
    • [Documentation] Technical Edits for HYPR Affirm
    • [All HYPR] CVE-2023-26159
    • Bug Fixes:
      • [Affirm] Fixed: 500 error after multiple SMS requests
      • [Affirm] Fixed: 500 error on Requester side if no Approver action is found
      • [Affirm] Fixed: 500 on Approver flow
      • [Affirm] Fixed: Activity Log details page shows recovery correctly while the index page shows it as onboarding
      • [Affirm] Fixed: Activity Log more details showing passport as document type but driver's license was used
      • [Affirm] Fixed: Misleading error message appears when Requester's Mobile Number is not added in IDP
      • [Affirm] Fixed: Attestation toggle needs to work with the current flow
      • [Affirm] Fixed: Auto approval not showing as approved and instead showing N/A
      • [Affirm] Fixed: Back button here leads to an error state remove
      • [Affirm] Fixed: Back button on video chat leads to a confirm form resubmission page
      • [Affirm] Fixed: Clean up current state of Affirm if it is turned off
      • [Affirm] Fixed: Duplicate entries on approval in Activity Log
      • [Affirm] Fixed: Duplicate entry on rejection in Activity Log
      • [Affirm] Fixed: Global toggle not showing model for Affirm enablement off
      • [Affirm] Fixed: Going to IDV page while disabled leads to 500
      • [Affirm] Fixed: HYPR auto Approver/Approver is blank
      • [Affirm] Fixed: If Approver approves Requester before they complete the chat verification the Requester cannot continue
      • [Affirm] Fixed: If session expires when you return to the page you get a 500
      • [Affirm] Fixed: If user does not have the country code for mobile phone in their IDP you fail the phone number check
      • [Affirm] Fixed: If you click the link on the email after you activate the link on your phone you get a 500
      • [Affirm] Fixed: Images failing to send on the front end after upload by Requester
      • [Affirm] Fixed: IP address in Activity Log PII
      • [Affirm] Fixed: More PII in the Datadog logs
      • [Affirm] Fixed: On second pass the geo location fails
      • [Affirm] Fixed: On second pass the user needs to select new phone or lost device and enter email twice
      • [Affirm] Fixed: OnFIDO Document Verification X button not returning to correct location
      • [Affirm] Fixed: Remove the upgrade model while the FF is off
      • [Affirm] Fixed: Requestor vs Requester in UI
      • [Affirm] Fixed: Second Approver link sent in same session redirects to main Affirm page
      • [Affirm] Fixed: Someone else Approver sending emails to Okta email address for manager
      • [Affirm] Fixed: Update copy on email for verification request
      • [Affirm] Fixed: Upgrade now link on banner does nothing
      • [Affirm] Fixed: Video doesn't display chat as expected
      • [Affirm] Fixed: When integration is deleted Affirm does not get cleaned up

  • [All HYPR] Enterprise Passkey: FIDO2 Gateway Fallback Bug Fixes

    • [Mobile App - Both] Fixed: Enterprise Passkey: FIDO2 Gateway: Authentication does not fallback to FIDO2 Gateway transport when BLE is disabled on the Mobile device
    • [Mobile App - Both] Fixed: Enterprise Passkey: FIDO2 Gateway transport is not available on enabling the feature on Control Center after a Control Center upgrade
    • [Passwordless for Windows] Fixed: FIDO2 Gateway: Unable to register Enterprise Passkey using FIDO2 Gateway on Windows 11

  • [All HYPR] Single Registration: Workstation-to-web: rpApp model Alpha

    • [Mobile App for iOS] Implementation
    • [Passwordless - Both] Single Registration: Workstation-to-web: Certificate issue: chsh case
    • [Passwordless - Both] Single Registration: Workstation-to-web: Multiple rpAppId

  • [Control Center - Extensions] Security Key pre-registration hook [Part II]

    • [Passwordless for Windows] Passwordless Security Key pre-registration hook before certificate is requested

  • [Control Center - Integrations] HYPR Enterprise Passkey - FIDO2 Gateway Fallback - 1

    • [Control Center - Integrations] FIDO2 Gateway PoC
    • [Mobile App for Android] FIDO2 Gateway Implementation
    • [Mobile App for Android] fido2gateway moving /advertise to longpool
    • [Mobile App for iOS] fido2gateway moving /advertise to longpool
    • [Passwordless for Windows] FIDO2 Gateway Implementation
    • Bug Fixes:
      • [Mobile App for Android] Fixed: Wrong machineUserName on Azure FIDO2 Pairing Events (FIDO2_DEVICE_REG + FIDO2_DEVICE_REG_COMPLETE)

  • [Control Center - Integrations] HYPR Enterprise Passkey - Generic Control Center Integration

    • [Control Center - Integrations; API] Add Enterprise Passkey data to the mobile endpoint
    • [Control Center - Integrations; API] Add new API for Enterprise Passkey settings
    • [Control Center - Integrations] Add Enterprise Passkey settings to Advanced / FIDO2 Settings tab
    • [Control Center - Integrations] Add Enterprise Passkey settings to Standard Integration / Login Settings tab
    • [Control Center - Integrations] Add Enterprise Passkey settings to Standard Workstation / Workstation Settings tab
    • [Control Center - Integrations] Add username to rp_enrolled_credentials_data primary key
    • [Control Center - Integrations] Change setup of Azure Native integration to use Generic Enterprise Passkey settings
    • [Control Center - Integrations] Create FF FIDO2_GATEWAY
    • [Control Center - Integrations] Enable FIDO2_DEVICE_REG_COMPLETE and FIDO2_DEVICE_DEREG logic for generic
    • [Control Center - Integrations] Generic Enterprise Passkey: Add recovery PIN option to device details
    • [Control Center - Integrations] Generic Enterprise Passkey: Use Generic User Management component in V1 user management
    • [Control Center - Integrations] Generic Enterprise Passkey: Use Generic User Management component in Workstation user management
    • [Control Center - Integrations] Migrate Azure Native restricted domains to Generic Enterprise Passkey settings
    • Bug Fixes:
      • [Control Center - Integrations] After re-pairing workstation, user is present in two groups in Azure portal
      • [Control Center - Integrations] Generic Enterprise Passkey: Performing FIDO2 pairing with Ping Adapter overwrites the email in User Management
      • [Control Center - Integrations] User information not fully removed from Keycloak after user deletion

  • [Control Center - Integrations] Logo / Brand Updates

    • [Control Center] Device Manager 2.0: Icon changes for 9.1

  • [Control Center - Integrations] Update All Branding

    • [Control Center - Integrations] ADFS Plugin: HYPR Branding Implementation
    • [Mobile App for Android] HYPR Brand Implementation (HYPR, SDK, Reference, FCA, Maven, Play Store)
    • [Mobile App for iOS] HYPR Brand Implementation (HYPR, SDK, Reference, FCA, Swift Package, App Store)
    • [Passwordless for macOS] HYPR Brand Implementation
    • [Passwordless for Windows] HYPR Branding Update

  • [Documentation] New Documentation Portal

    • [Documentation] Doc site external deploy - 9.1

  • [Events] Improve external authentication Event tracking

    • [Events; Passwordless for macOS] Log macOS login with TouchID as an EXTERNAL_AUTH_COMPLETE Event
    • [Passwordless for Windows] Generate EXTERNAL_AUTH_COMPLETE even if user has no paired devices

  • [Mobile App - Both] Q1 2024 Mobile App Tech Debt

    • [Mobile App for Android] Stop support for FCA, Dev App, and All ADP
    • [Mobile App for iOS] Create List of Device IDs for Apple Developer Program
    • [Mobile App for iOS] Deprecate ADP TaADP
    • [Mobile App for iOS] Deprecate HYPR Firebase Notification Adapter
    • [Mobile App for iOS] Remove Dev version of HyprApp
    • [Mobile App for iOS] Stop Support for FCA and all ADP

  • [Mobile App - Both] QR Scanning Widget

    • [Mobile App for Android] QR to unlock Widget
    • [Mobile App for iOS] QR to unlock Widget

  • [Passwordless for Windows] Basic Branding Customization for Windows

    • [Passwordless for Windows] Apply customized branding during Passwordless upgrades
    • [Passwordless for Windows] Basic Branding Customization
    • Bug Fixes:
      • [Passwordless for Windows] Preserve "old style" UI customizations

  • [Passwordless for Windows] Q3 2024 UI improvements

    • [Passwordless for Windows] Enter key should "click" the primary button
    • [Passwordless for Windows] Force Windows to refresh icons after Passwordless installation
    • [Passwordless for Windows] Make sure an appropriate control has focus

  • [Passwordless for Windows] Support for YubiKey Bio MPE Security Keys (Inline Fingerprint Registration)

    • [Passwordless for Windows] FIDO2 fingerprint registration during PIV pairing
    • [Passwordless for Windows] Copy text fingerprint enrollment messages
    • [Passwordless for Windows] Extend SMARTKEY_AUTH_COMPLETE Audit Trail Event to indicate PIN or Fingerprint
    • [Passwordless for Windows] Implement code to enroll fingerprints on YubiKey BIO MPE [1/2]
    • [Passwordless for Windows] Implement code to enroll fingerprints on YubiKey BIO MPE [2/2]
    • [Passwordless for Windows] Implement UI for FIDO2 fingerprint registration during PIV pairing [1/2]
    • [Passwordless for Windows] Remove timeout during start of fingerprint enrollment process
    • [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.5.3
    • [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.6.0
    • [Passwordless for Windows] Update post registration message for YubiKey Bio MPE devices

  • [Platform - Certificates] Certificate Services (Certificates Tracking)

    • [Platform - Certificates; API] Make certificate information available for Bulk Export
    • [Platform - Certificates] Add certificate serial numbers and expiration to device logs

  • [Platform - Keycloak] Authenticator Refactoring Phase 2

    • [Platform - Keycloak] Bring Azure module to be up-to-date
    • [Platform - Keycloak] Generalize Adapt code so we can use it in the new modules
    • [Platform - Keycloak] 9.1 Upgrade to the latest Keycloak server

Enhancements​

  • [Adapt; Control Center - Integrations] Adapt is breaking the Okta integration
  • [Adapt; Mobile App for Android] Remove the separate signal request during authentication as the signal payload is already sent with fido/get
  • [Adapt] Build out extension logic for workstation evaluation points
  • [Adapt] Create a workstation policy for network names (DEMO); Beta
  • [Adapt] Policy: Invoke Adapt for policy evaluation during workstation authentication
  • [Adapt] Risk engine should search the Events based on the policy and not hardcode to 7L
  • [Adapt] Risk Policy: Action Events
  • [Affirm] Make BasicApproverInfo and BasicManagerInfo one structure
  • [All HYPR] Americans with Disabilities Act (ADA) Fixes Pass 3
  • [All HYPR] Single Registration: Workstation-to-web: Multiple rpAppId setup; fix logging into ws
  • [All HYPR] Single Registration: setup
  • [Control Center] Add forwarding functionality for the IP allowlist
  • [Control Center] Custom Device manager templates/updates for customer
  • [Control Center] Enable facetid checking for FIDO UAF; add ability to delete facet IDs
  • [Control Center] Pass Time Filters into Audit Trail Requests in UI
  • [Control Center] Remove login option change UI
  • [Control Center] Switch background-image to background-gradient
  • [Control Center - Extensions] Add extension webhooks
  • [Control Center - Extensions] Add service account restiction
  • [Control Center - Extensions; API] Incorporate extension calls inside workstation Unlock APIs
  • [Control Center - Integrations] Okta: UPN in Integrations
  • [Documentation] Documentation modifications for breaking upgrades
  • [Documentation] Entra ID Documentation: Replace internal domain with something more generic
  • [Mobile App for Android] Remove Sensory
  • [Mobile App for Android] Update UI/color when possible
  • [Mobile App for iOS] Implement SDK Deprecations in consuming apps
  • [Mobile App for iOS] Provide custom iOS build
  • [Mobile App for iOS] Remove Sensory
  • [Mobile App for iOS] Update App privacy info manifest
  • [Mobile App for iOS] Update UI/color when possible
  • [Mobile App for iOS] Wording changes to accommodate Azure -> Entra
  • [Passwordless - Both] Remove pinned shortcut after uninstallation
  • [Passwordless for macOS] Implement workaround for Sonoma screensaver
  • [Passwordless for macOS] Packaging for Intune deployment
  • [Passwordless for macOS] Replace fa-devices.js with devices.js and remove login options prompt
  • [Passwordless for Windows] Advanced Branding Customization
  • [Passwordless for Windows] IDEMIA PIV/FIDO2 Badge Support
  • [Passwordless for Windows] Provide Passwordless build without obfuscation
  • [Passwordless for Windows] Support for YubiKey Bio MPE Security Keys
  • [Passwordless for Windows] Verify signing on package update
  • [Platform] Breaking upgrades to the server
  • [Platform - Database] Extend length of raw data
  • [Platform - FIDO2] Update Fido2Authenticator Lib with MASA fix
  • [Platform - Keycloak] Optimize feature enablement fetching
  • [Platform - Logging] fidogateway: Log decoded rawdata
  • [SDK for iOS] Make HYPRiOSReferenceApp consume XCFrameworks on master builds

Bug Fixes​

  • [Adapt] Fixed: Login Limits fails push notification with error 'message attr missing in policy response'
  • [Adapt] Fixed: Push bomb prevention switches to QR authentication; PRE_WEB_AUTH evaluation point fails if QR authentication fails
  • [Adapt] Fixed: Settings: Table border is distorted due to the new column 'Adapt unavailable'
  • [Adapt] Fixed: Signals: CrowdStrikeAID information is missing in the resulting Signal report because of character casing used in Passwordless
  • [Adapt] Fixed: Unable to register device due to 'Failed to load extensionId: AdaptExtId' error
  • [Adapt] Fixed: Workstation Authentication policy 'network' field is missing and the option is present in the high-level drop-down
  • [Adapt; Mobile App for Android] Fixed: Android Signal is sent with authentication/requests 'REQUEST_SENT' status instead of 'COMPLETE' status
  • [Adapt; Mobile App for iOS] Fixed: Signals - app minimization generates 3 signal requests for each registration
  • [Adapt; Platform - Keycloak] Fixed: Keycloak's 'Authentication Upgraded Message' sometimes doesn’t get displayed
  • [Affirm] Fixed: 500 on attempting to relogin into Control Center after completing affirm flow
  • [Affirm] Fixed: Backward compatibility issue: Removal of Manager role in favor of Approver
  • [Affirm] Fixed: Cannot fetch Approver when its set to Manager and not Someone Else
  • [Affirm] Fixed: Data fields with null values populating with text string "null"
  • [API] Fixed: Adjust Broken FIDO2 Update User API URL
  • [Control Center] Fixed: Audit Trail says that registration of paired IDEMIA card is unknown
  • [Contorl Center] Fixed: Device Manager 2.0: Fails to update Device Name
  • [Control Center] Fixed: Device Manager 2.0: Failure to delete device with invalid date
  • [Control Center] Fixed: Device Manager 2.0 Onboarding: Welcome email for non-ControlCenterAdmin apps leads to standard Device Manager index page and not the Onboarding page
  • [Control Center] Fix Event listener assignment on login page
  • [Control Center] Fixed: Many instances of PersistenceException error
  • [Control Center] Fixed: RBAC (Haas): User is unable to redirect to Okta
  • [Control Center - Extensions] Fixed: Associate Extensions: WebHooksExtId option is not visible clearly
  • [Control Center - Extensions] Fixed: Webhooks: Authentication hook throws 'Failed to execute extension' error
  • [Control Center - Integrations] Fixed: Okta: Integration is not cleaned up when deleting Okta user whose username != email
  • [Control Center - Integrations] Fixed: Okta: Query for application fails
  • [Control Center - Integrations] Fixed: Okta: Remove integrations data from response
  • [Control Center - Integrations] Fixed: OneLogin: Cannot copy "Client Secret for OneLogin Trusted IdP"
  • [Control Center - Integrations] Fixed: RADIUS doesn't work with 9.1
  • [Control Center - Intgerations; Passwordless - Both] Fixed: Issue with Desktop SSO, Okta, and Aliases
  • [Mobile App - Both] Fixed: Enterprise Passkey: Mobile App crashes on authenticating after receiving the user presence prompt via WiFi
  • [Mobile App - Both; Events] Fixed: Fix Events during pairing via Device Manager in the Mobile App
  • [Mobile App for Android] Fixed: Device-specific: App crashes upon launching after install
  • [Mobile App for Android] Fixed: Scanner does not open and the QR icon is not displayed if the app is in the background and we tap “Start QR Scanner” via shortcuts
  • [Mobile App for iOS] Fixed: Mobile App foreground is not generating signals anymore
  • [Mobile App for iOS] Fixed: Screen Widget - Dark mode doesn't show the machine name
  • [Mobile App for iOS] Fixed: Workstation unlock crashes the app if location is not enabled
  • [Passwordless for macOS] Fixed: read qrCodeUrl configuration from hypr.json
  • [Passwordless for macOS] Fixed: TrustKit crashes on unsupported algorithm
  • [Passwordless for Windows] Fixed: Can't upgrade BofA special Passwordless 8.5.2 to Passwordless 9.1.0
  • [Passwordless for Windows] Fixed: Custom Branding: No spacing between "View More Instructions" button and Contact Support link
  • [Passwordless for Windows] Fixed: Multiple Audit Trail Events queued due to an exception caused by empty RpAppID during Passwordless service startup
  • [Passwordless for Windows] Fixed: Signal does not sent "no location avail" if Location is Disabled
  • [Passwordless for Windows] Fixed: UI in Enterprise passkey flow has extra line space between each line
  • [Passwordless for Windows] Fixed: Unable to complete login to Remote workstation using registered device
  • [Passwordless for Windows] Fixed: Passwordless should trim leading/trailing whitespace from registry values
  • [Platform - Keycloak] Fixed: Modules refactor - Push bomb prevention - QR code is not getting displayed
  • [Platform - Migration] Fixed: Migration from 8.7 to 9.1 fails with error
  • [SDK for Java/Android/iOS] Fixed: Authentication fails with Error 114060 error

8.7.1 - Patch 2024-01-24​

New Features and Feature Changes​

  • [All HYPR] American with Disabilities Act (ADA) Fixes

    • [All HYPR] American with Disabilities Act (ADA) High Priority Items
    • [All HYPR] American with Disabilities Act (ADA) High Priority Items Pass 2

  • [Control Center - Integrations] Azure: HYPR Enterprise Passkey: Support for different usernames and multiple credentials

    • [Control Center - Integrations] Azure: User not moved back to 'Paired with HYPR' group after deleting the FIDO2 credentials from the Mobile App
    • [Passwordless for Windows] Passwordless Client fails to validate pass\pin on local account pairing

Enhancements​

  • [Adapt] Change the ‘WhiteList’ terminology ‘AllowList’ to be more politically correct
  • [Adapt] Extension and Evaluation points Documentation ticket
  • [Adapt] PolicyEvaluationService.evaluatePolicy - Fix the evalDataStartDate and evalDataEndDate values in the log
  • [Adapt] Remove 'Disable Adapt' toggle from Keycloak
  • [Adapt] Rename the policy evaluation point
  • [Adapt; Documentation] Documentation ticket
  • [All HYPR] CVE Fixes
  • [API] FIDO2: Should be able to update displayName
  • [API] Add username validation in fido/get
  • [Control Center] Allow Non-ASCII characters through Control Center firewall in request headers
  • [Control Center] Remove dynamic content in error parameter
  • [Control Center] Security key pre-registration hook before certificate is requested
  • [Passwordless for Windows] Allow more than five paired devices
  • [Platform - Keycloak] Adjust 'Use a dynamic link for web login on mobile devices' toggle logic to account for Adapt flow

Bug Fixes​

  • [Adapt; Mobile App for Android] Fixed: Signals: Mobile App asks for location and phone call permission 'after' the registration is complete
  • [Adapt; Mobile App for Android] Fixed: Signals: machineId is used as 'machineUserName' instead of 'username'
  • [Adapt] Fixed: Event ADAPT_POLICY_ASSIGNMENT_REMOVED doesn't have policy ID info
  • [Adapt] Fixed: Keycloak doesn't display user friendly message when user is Blocked
  • [Adapt] Fixed: Login Settings: HYPR Adapt Settings section - 'Adapt Unavailable Fallback' column is not displayed
  • [Adapt] Fixed: Sending continuous signals for each profile
  • [Adapt] Fixed: Technical Edits
  • [Adapt] Fixed: Unable to assign policy to an rpApp using its own Access token
  • [Control Center] Fixed: Device Manager 2.0 Onboarding: Can't enroll two passkeys or two mobile devices back-to-back
  • [Control Center] Fixed: Device Manager: User is not able to complete authentication and UI shows "Your account has been temporarily blocked"
  • [Control Center] Fixed: Web Login Onboarding tour QR code refresh fails
  • [Control Center - Integrations] Fixed: Azure: Server needs to remove FIDO2 credential on FIDO2_DEVICE_DEREG not workstation delete ???
  • [Control Center - Integrations] Fixed: Enterprise Passkey: Grey workstation bubble displayed when same user is paired from a different workstation and a security key already exists
  • [Control Center - Integrations] Fixed: Enterprise Passkey: Issue with Windows 11 and BLE and iOS
  • [Control Center - Integrations] Fixed: Okta: Migration error when name != 'HYPR Authenticator'
  • [Control Center - Integrations] Fixed: Okta v1->v2 migration: Artifacts in Okta not deleted/Error when deleting users after migration/Side effect around existing users
  • [Control Center - Integrations; Mobile App for Android] Fixed: Enterprise passkey: Workstation bubble on Mobile App gets replaced on pairing two different workstations logged in with same Azure account
  • [Mobile App - Both] Fixed: Customer problem registering a device
  • [Mobile App for Android] Fixed: 404 error when Android OS 13 device trying to authenticate with QR via native camera scanner unless supported web addresses is enabled
  • [Passwordless for macOS] Fixed: PKG Scripts lead to root privilege escalation
  • [Passwordless for macOS] Fixed: Requesting certificate from AD fails with Kerberos error rpc_s_auth_not_us
  • [Platform - Keycloak] Fixed: Keycloak JSON logging
  • [Platform - Keycloak; Adapt] Fixed: Empty Adapt rpapp config parse error in Keycloak

9.0.0 - GA 2024-01-17​

New Features and Feature Changes​

  • [Adapt] Apply Workstation proximity Policy DURING computer unlock

    • [Adapt] Ingest workstation signals
    • [API] Add signals API for workstations

  • [Adapt] Event Handlers: Alpha

    • [Adapt] Event Handlers: Code and Test JSON Event: Implement linter to handle syntax errors
    • [Adapt] Event Handlers: Configuration and Test tab UI enhancements
    • [Adapt] Event Handlers: Configuration tab - remove cron scheduler for ‘data enricher’ and ‘action executor’ type
    • [Adapt] Event Handlers: Configuration tab - secured values like passwords, keys should not be shown as plain-text
    • [Adapt] Event Handlers: Introduce 'logLevel' and add machineUserName in the test Event request body
    • [Adapt] Event Handlers: Add support for DEFINING action executor
    • [Adapt] Event Handlers: Add support for DEFINING pull data collectors
    • [Adapt] Event Handlers: Add support for EXECUTING action executors
    • [Adapt] Event Handlers: Add support for SCHEDULING pull data collectors
    • [Control Center] UI: Add support for Event Handlers
    • Bug Fixes:
      • [Adapt] Fixed: Event Handlers: ctx.httpPost() or ctx.saveEvent() is executing twice
      • [Adapt] Fixed: Event Handlers: Data collector keeps executing even when it is disabled
      • [Adapt] Fixed: Event Handlers: Each line of Handler code is logged as a separate log
      • [Adapt] Fixed: Event Handlers: Event enricher - Able to overwrite the existing columns such as machineUserName, eventName, sessionId, etc
      • [Adapt] Fixed: Event Handlers: Event saved from the Handler Code doesn't show up with search Events
      • [Adapt] Fixed: Event Handlers: Tests Events have missing Tenantld value
      • [Adapt] Fixed: NullPointerException in getAllServerPolicyAssignments()

  • [Adapt] Signal data from Workstation

    • [Adapt] Signals: Workstation data II
    • [Adapt] Signals: Workstation send additional signals data

  • [Affirm] Affirm Identity Verification Minimum Viable Product (MVP)

    • [Affirm] OnFIDO MVP Integration
    • [Affirm] Activity Log
    • [Affirm] Activity Log details
    • [Affirm] Activity Log table
    • [Affirm] Application Settings: Application connection section with calls to the APIs
    • [Affirm] Application Settings: Onboarding/recovery workflow settings section; Employee Location and Identity settings sections
    • [Affirm] Application Setup tab
    • [Affirm] Application Setup tab
    • [Affirm] Approver Assignment tab
    • [Affirm] Approver Assignment tab
    • [Affirm] Audit trail tab
    • [Affirm] Audit trail tab
    • [Affirm] Control Center UI changes
    • [Affirm] Changes in the report card
    • [Affirm] Continue button on the chat/movie should be greyed out
    • [Affirm] Costs tracking auditing additional details substructures + error auditing additional details substructures for various costs-generating third party services for Affirm
    • [Affirm] Fix Control Center verification flow tab
    • [Affirm] Fix Control Center verification model
    • [Affirm] Onboard / recover flow chooser
    • [Affirm] Phone step
    • [Affirm] Phone step
    • [Affirm] Rate Limiting and Blocking
    • [Affirm] Referencing and saving image is broken
    • [Affirm] Remove PII from logs
    • [Affirm] Replace copy with generic copy; fix wording
    • [Affirm] Settings: Create empty tabs view for further UI work; Application Settings/Audit Log/Activity Log
    • [Affirm] Space in the SMS code fails
    • [Affirm] TAP not done yet
    • [Affirm] Use OnFIDO production credentials
    • [Affirm] UX improvements: URLs pointing to specific places in the UI
    • [Affirm] Verification Flow tab
    • [Affirm] Verification Flow tab
    • [Affirm; API] Application Connection API: Assigning/Unassigning/Enabling/Disabling
    • [Affirm; API] Onboarding/Recovery workflow settings API; Approver/Approvers/Employee Location/Identity
    • [Control Center] Remove legacy field and database toggleableByAdmin column from FeatureFlag entity and rp_feature_flags table for 9.0 release
    • [Control Center] Introduce Affirm paid-tier plan feature enablement
    • [Control Center; API] rp/api/versioned/features/toggle/{featureName} Add guard if-statement code for HYPR service account only (API endpoint) and add it only for on-cloud tenants V2 in Control Center backend server code
    • Bug Fixes:
      • [Affirm] Fixed: additionalDetails needs to be .toString
      • [Affirm] Fixed: When first assigning an application, the verification flow settings require a page refresh to properly update
      • [Affirm] Fixed: If Okta application is assigned and you attempt to switch to Azure, Okta remains the application
      • [Affirm] Fixed: If you get an error generating TAP code you should display an error to the user
      • [Affirm] Fixed: Missing costs tracking method call in RequesterJoinsChatAction
      • [Affirm] Fixed: On a second pass of the same user, if they have a picture on file you can just go to video however you still need to do the document upload to continue

  • [All HYPR] Consuming Device Signals, Control Center Integration, Login Limits and Initial Keycloak Integration

    • [Adapt; Mobile App - Both] Send latest signal with the authentication request
    • [Control Center] Event logging performance in v2

  • [All HYPR] Single Registration: Web-to-workstation: Deregistration/Re-enroll

    • [All HYPR] Single Registration: Web-to-workstation: removing devices
    • [All HYPR] Single Registration: Web-to-workstation: trigger push notification on migrated registrations
    • [Mobile App for Android] Implement single registration on the Android app side

  • [Control Center] Deprecate and remove Control Center licensing

    • [Control Center] Drop licensing in 9.0
    • [Control Center] Drop licensing in HYPR-as-a-Service (HaaS)

  • [Control Center - Integrations] Okta: Universal Principal Name (UPN) in Integrations

    • [Control Center - Integrations] Add email column to pending users tab UI
    • [Control Center - Integrations] Add username column to Enroll User Directory List UI

  • [Control Center - Integrations] UX Updates to accommodate Azure -> Entra Branding Changes

    • [Control Center - Integrations] Azure integration branding
    • [Mobile App for Android] Wording changes to accommodate Azure -> Entra
    • [Passwordless for Windows] Wording changes to accommodate Azure -> Entra

  • [Documentation] New Documentation Portal

    • [Documentation] Content readiness - 9.0
    • [Documentation] Style guide - 9.0

  • [Mobile App for Android] Q1 2024 Tech Debt

    • [Mobile App for Android] Enhance PIN protection
    • [SDK for Android] Update to latest Dexguard version
    • [SDK for Android] Update to latest iXGuard

  • [Passwordless - Both] Security Keys Default/Insecure PIN Check

    • [Passwordless for macOS] Block Default/Insecure Security Key PIN
    • [Passwordless for Windows] Block Default Security Key PIN

  • [Passwordless for Windows] Support for YubiKey Bio Security Keys

    • [Passwordless for Windows] Finish UI; Revamp Security Key and Smart Card support (Part 6)
    • [Passwordless for Windows] Update bundled YubiKey mini-driver to version 4.5.2.243

  • [Platform - Keycloak; Control Center] Keycloak Authenticator Refactoring Phase 2

    • [Control Center] Create feature for 'remember me' in Control Center
    • [Platform - Keycloak] Custom migration for existing tenant to move OneLogin integration to use the new Keycloak OIDC flow/authenticators
    • [Platform - Keycloak] Desktop SSO support
    • [Platform - Keycloak] Fix new Okta integration to use the new Keycloak OIDC flow/authenticators
    • [Platform - Keycloak] Fix new Ping DV and BT integrations to use the new Keycloak OIDC flow/authenticators
    • [Platform - Keycloak] Use 'remember me' and bypass username feature from Control Center in Keycloak

Enhancements​

  • [Adapt] Create Empty Risk Reports page
  • [Adapt] Policy Evaluation request log - Need evaluationPoint, username, lambdaRequestID details
  • [Adapt] Remove 'Disable Adapt' feature from Keycloak
  • [Adapt] Risk Engine: Log the Events used for policy evaluation in CloudWatch
  • [Adapt] Unable to assign policy to evaluation point in Control Center UI
  • [Affirm] Minimum Viable Product (MVP)
  • [All HYPR] Americans with Disabilities Act (ADA) Fixes
  • [All HYPR] CVE Fixes
  • [All HYPR] Single Registration: Web-to-workstation: authenticators validation on setting rpAppIdWs on web rpAppId
  • [All HYPR] Update product to remove reference to "HYPR Zero" and "Free"
  • [Control Center] FIDO: FIDO Alliance Missed Step Error
  • [Control Center] Global jQuery upgrade and consolidation
  • [Control Center] Health check should confirm DB and cache are writable in addition to readable
  • [Control Center] Refactor IDP User Management component for reuse in other places
  • [Control Center - Integrations] Fix all integration beta banners to include the new HYPR look and feel
  • [Errors] ErrorCode file contains two 1206045 errors; one should be 1206035
  • [Mobile App - Both] Fixed Events during pairing via Device Manager
  • [Mobile App for Android; SDK for Android] Dependency Bump
  • [Mobile App for Android] Remove support for Android 6 and 7
  • [Mobile App for Android] Upgrade target version to 34
  • [Passwordless - Both] Security Key pre-registration hook - [Part I]
  • [Passwordless - Both] Security Keys "Management Key" Handling
  • [Passwordless - Both] Security Keys Default/Insecure PIN Check
  • [Passwordless for macOS] Align "Contact Support" messages between macOS/Windows
  • [Passwordless for macOS] Desktop SSO "success" HYPR Passwordless message should close itself after timeout
  • [Passwordless for macOS] Remove workaround for Fast User Switch
  • [Passwordless for macOS] Update list of macOS models
  • [Passwordless for macOS] Upgrade notarization to use notarytool instead of altool
  • [Passwordless for Windows] Reduce idle CPU usage by HyprOneService
  • [Passwordless for Windows] Upgrade NuGet dependencies
  • [Platform - Keycloak] Adjust 'Use a dynamic link for web login on mobile devices' toggle logic to account for Adapt flow

Bug Fixes​

  • [Adapt] Fixed: Events search API throws 500 status code when startDate is greater than endDate
  • [Adapt] Fixed: For FIDO2 authentication, POST_FIDO2_AUTH and POST_WEB_AUTH is not getting evaluated
  • [Adapt] Fixed: Integration Test - AdaptEvHandlerTest.saveEventHandler() fails with cronSchedule
  • [Adapt] Fixed: iOS Signal - Wifi bssid and rssi are null and batteryPercentage is wrong. Only the device connected Wifi is displayed
  • [Adapt] Fixed: iOS Signal testing - During registration, 'Motion and Fitness Activity' permission is displayed twice
  • [Adapt] Fixed: Policy assignment - 'Adapt Unavailable Fallback' value is not getting saved
  • [Adapt] Fixed: Risk engine - evalEventCount is not matching with the actual Event count
  • [Adapt] Fixed: Sending continuous signals for each profile
  • [Adapt] Fixed: Unable to assign policy to an rpApp using its own Access token
  • [Adapt] Fixed: WEBSITE_AUTH doesn't have 'eventTags' column populated due to which it doesn't get propagated to Dynamo DB
  • [Control Center] Fixed: Error message is not clear when setting invalid value to “rpAppId of the workstation application"
  • [Control Center] Fixed: QR Fallback is disabled when 'QR Auth' feature is enabled
  • [Control Center] Fixed: QR Fallback is not enabled for controlCenterAdmin rpApp by default
  • [Control Center - Integrations] Fixed: Keycloak checks for non-existent feature for QR login
  • [Control Center - Integrations] Fixed: multipleAuthn SAML attribute is not present when user authenticates with passkey
  • [Mobile App for iOS] Fixed: User fails to complete Authentication process
  • [Passwordless - Both] Fixed: Error -1 when we use the wrong PIN with YubiKey Bio MPE
  • [Passwordless - Both] Fixed: Error during removing machine certificates
  • [Passwordless for macOS] Fixed: PKG Scripts Lead to Root Privilege Escalation
  • [Passwordless for macOS] Fixed: Doesn't throw error in rp/wsapi/settings with invalid SSL PIN
  • [Passwordless for Windows] Fixed: Can't retrieve management key with older YubiKey firmware
  • [Passwordless for Windows] Fixed: Error string is cut off or shortened
  • [Passwordless for Windows] Fixed: Extra whitespace in UI when unpairing YubiKey Bio MPE
  • [Passwordless for Windows] Fixed: File versioning and signature problems
  • [Passwordless for Windows] Fixed: File Write by Diagnostics Console Leads to Boot Loop
  • [Passwordless for Windows] Fixed: Generic error message with error code is displayed on entering the current PIN with 5 digits and less in update security key PIN flow
  • [Passwordless for Windows] Fixed: QR code screen in HYPR Passwordless spells HYPR incorrectly
  • [Passwordless for Windows] Fixed: Shortcuts not removed during uninstall with custom app name
  • [Passwordless for Windows] Fixed: Some options in "protected" registry key may be lost during upgrade
  • [Passwordless for Windows] Fixed: Two extra lines displayed next to the error message for Confirm PIN field in the biometric key/smart card unpair flow
  • [SDK for Java] Fixed: Registration fails with 'Exception in thread "main" java.lang.UnsupportedClassVersionError' error in latest 'java-client-9.1.0-SNAPSHOT.jar'

8.7.0 - GA 2023-12-13​

New Features and Feature Changes​

  • [Adapt] Apply policies during WS login

    • [Control Center] Feature enablement for sending continuous device signals
    • [Mobile App for Android] Send device signals upon the app entering the foreground
    • [Mobile App for iOS] Send device signals upon the app entering the foreground
    • [Mobile App for iOS] User-friendly error dialog for Passwordless Unlock blocked

  • [Adapt] Configure Login Limits

    • [Adapt] Create Policy Configuration UI in Control Center
    • [Adapt] Create Policy Configuration UI for Login Limits
    • [Adapt] Add feature for HYPR Login Limits
    • [Adapt] Updated verbiage for HYPR Adapt Phase 1

  • [Adapt] Consuming Device Signals, Control Center Integration, Login Limits and Initial Keycloak Integration

    • [Adapt] Create policy UI
    • [Adapt] Send latest browser signal with the authentication request
    • [Adapt] Upgrade cloud watch lambda function to handle JSON logs
    • [Adapt; API] Expose policy API for the UI
    • [Adapt; API] Separate policy test endpoint
    • [Adapt; Events] Read/Write Events by deviceId handle
    • [Adapt; Events] Route Events to the dataLake
    • [Adapt; Mobile App for Android] Send location signals from the Mobile App during the Workstation Unlock
    • [Adapt; Mobile App for iOS] Send location signals from the Mobile App during the Workstation Unlock
    • [API] Enhance APIs to take in new WEB signals
    • [API] Enhance Control Center APIs to take in new mobile signals
    • [Control Center] Add both JSON and KV logging
    • [Control Center; API] Remove TenantUUID references in all Control Center API calls
    • [Mobile App for Android] User-friendly error dialog for Passwordless Unlock blocked

  • [Adapt] Create and Manage Risk Policies

    • [Adapt] Add Risk Policy Assignment UI to Login Settings in V1
    • [Adapt] Add Risk Policy Assignment UI to Login Settings in V2
    • [Adapt] Build out new Control Center controller for Policy CRUD API calls
    • [Adapt] Create a New Policy popup
    • [Adapt] Create an empty policies screen
    • [Adapt] Create policy content structure for create/update calls
    • [Adapt] Create UI elements for main authentication Policy page
    • [Adapt] Update Risk Policies Empty State UI

  • [Adapt] Login Limits - Block User

    • [Adapt] Create new UI screen for Authentication Blocked error
    • [Adapt; API] Build out Policy Control Center controller to include evaluation API call to AWS
    • [Adapt; Errors] Create error message, error codes and audits for Authentication Blocked via Risk Service
    • [Platform - Keycloak] Add error messages and code for Control Center 'Authentication Blocked' responses

  • [Adapt] Passwordless client updates

    • [Passwordless for macOS] Send data via WSAPI Signals endpoint during Unlock
    • [Control Center] Add Signals frequency to ServerConfig object in Settings
    • [Control Center] Store Signals data in the database

  • [All HYPR] HYPR Enterprise Passkey - BLE and WiFi (Roaming)

    • [Mobile App for iOS] Bluetooth Screen Changes
    • [Mobile App for Android] Add Roaming Capabilities
    • [Mobile App for Android] Bluetooth Screen Changes
    • [Mobile App for Android] (Enterprise Passkey BLE) Support Offline mode
    • [Mobile App for iOS] Implement BLE Offline Banner
    • [Mobile App for iOS] Add Roaming Capabilities
    • [Passwordless for Windows] Display QR Code on credential provider on Azure Joined
    • [SDK for FIDO2] Add Roaming Capabilities
    • Bug Fixes:
      • [Passwordless for Windows] Windows not receiving UDP broadcast when mobile application closed

  • [All HYPR] SSL/TLS Pinning enhancements for Mobile/Desktop

    • [API] rp/wsapi/settings and rp/deviceapi/settings return 400 when invalid parameters are sent
    • Bug Fixes:
      • [Passwordless - Both] Empty/fatal 401 response to expired endpoint API tokens has been fixed

  • [Control Center - Integrations] Beyond Trust Integration

    • [Control Center - Integrations] Beyond Trust: New tile in Integrations
    • [Control Center - Integrations] Beyond Trust: Beta UI banner
    • [Control Center - Integrations] Beyond Trust: Generalized the OIDC integration
    • [Control Center - Integrations] Beyond Trust: Feature enablement
    • [Control Center - Integrations] Beyond Trust: Administration console

  • [Control Center - Integrations] HYPR Enterprise Passkey Enhancements Part II

    • [Control Center - Integrations] Azure Enterprise Passkey: Changes to support 3rd-party FIDO2 registration
    • [Control Center - Integrations] Azure Enterprise Passkey: Delete the correct group data when we delete a user and a device for local user
    • [Control Center - Integrations] Azure Enterprise Passkey: Skip group population when username is not an email for support of local user
    • [Control Center - Integrations] New user management columns
    • Bug Fixes:
      • [Control Center] The machineUserPrincipalName property is now displayed on the device details screen

  • [Control Center - Integrations; Mobile App - Both; SDKs for Android and iOS] HYPR Enterprise Passkey for Entra/Azure: Support for different usernames and multiple credentials

    • [Mobile App for Android] Update mobile device to accommodate "Different FIDO2 Username" solution
    • [Mobile App for Android] Accessibility Sweep for Enterprise Passkeys
    • [Mobile App for Android] Add credential information to Debug Information Screen
    • [Mobile App for Android] Display banner on MY COMPUTERS if no FIDO2 keys are paired
    • [Mobile App for Android] History tracked on credential Basis
    • [Mobile App for Android] Update FIDO2 prompts to be more generic
    • [Mobile App for Android] UX: Azure domain-joined: Create new bubble type on "MY COMPUTERS" when QR Code is scanned
    • [Mobile App for Android] UX: Update "MY SECURITY KEY" behavior
    • [Mobile App for iOS] Multi-user UI
    • [Mobile App for iOS] Add credential information to Debug Information Screen
    • [Mobile App for iOS] Audit Trail Sweep for Enterprise Passkeys
    • [Mobile App for iOS] Display banner on MY COMPUTERS if no FIDO2 keys are paired
    • [Mobile App for iOS] History tracked on credential basis
    • [Mobile App for iOS] UX: Azure domain-joined: Create new bubble type on "MY COMPUTERS" when QR Code is scanned

  • [Control Center; Mobile App - Both; SDKs for Android and iOS] Single Registration: Existing users can be added to Single Registration without having to de-register and re-register

    • [Control Center] Single Registration with associated workstation RPApp - Part 1
    • [Control Center - Integrations] Migration implementation and integration + Control Center UI changes
    • [Mobile App for Android] Migration implementation and integration
    • [Mobile App for Android] Single Registration with associated workstation RPApp - Part 1
    • [Mobile App for iOS] Migration implementation and integration
    • [Passwordless for macOS] Add fields to QR code
    • [Passwordless for Windows] Add fields to QR code

  • [Passwordless for Windows] Security Key and Smart Card support

    • [Passwordless for Windows] Revamp Security Key and Smart Card support (Part 4)
    • [Passwordless for Windows] Revamp Security Key and Smart Card support (Part 5)

  • [Platform - Keycloak] Improvements to Keycloak integration: select login authenticator; remember me

    • [Platform - Keycloak] Handle remember me functionality
    • Bug Fixes:
      • [Platform - Keycloak] Fix page blinking on cancel for QR / Push

  • [SDKs for Android, Flutter, iOS] Mobile cross-platform SDK wrapper

    • [SDK for iOS] Create the HYPRWrapper for iOS native
    • [SDK for Android] Create the HYPRWrapper with common interface for Android sdk
    • [SDK for Flutter] Add the possibility for registration with QR code

Enhancements​

  • [Adapt] Update Risk Policies table to handle custom policies
  • [Adapt; API] Add API for manually unblocking a user by admins
  • [API] Add machineUserNames field to iOS signals call
  • [API] Add machineUserNames field to the Android signals call
  • [Control Center] Alias lookup now considers the RP application when generating results
  • [Control Center] Device signals include browser info (CIAM device recognition)
  • [Control Center] FIDO2 Metadata files are now generated for passkeys providers
  • [Control Center] Health and Logs page in Control Center has been removed in favor of Event Hooks and Analytics
  • [Events] Missing fields in asynchronously saved Events
  • [Passwordless for Windows] Default security key PINs are now blocked
  • [Passwordless for Windows] Revamp Security Key and Smart Card support (Part 3)
  • [SDK for Android] add logs for zendesk 7752
  • [SDK for Android] Prompt messages for new permissions
  • [SDK for iOS] Device registration now collects the specific device model

Bug Fixes​

  • [Control Center] Fixed: FIDO-only flow Fallback Authentication does not apply when the feature is enabled
  • [Control Center - Integrations] Fixed: Azure: Error when service account password have quotes in it
  • [Control Center - Integrations] Fixed: Extension attributes have been corrected to load properly on startup
  • [Control Center - Integrations] Fixed: Okta: Can't delete username with + signs from Keycloak
  • [Control Center - Integrations] Fixed: Okta: Fixed issues with deleting users from Okta
  • [Mobile App for Android] Fixed: Corrected a 404 error with dyamic links when Android OS 13 / OS 11 Pixel devices attempted authentication with QR using the camera
  • [Mobile App for iOS] Fixed: FIDO registration Events not previously being recorded are now logged in the Audit Trail
  • [Passwordless - Both] Fixed: The Java random number generator causing timeouts during QR code scanning has been fixed
  • [Passwordless - Both] Fixed: When pairing with HYPR, the "Security Key" option no longer displays if it is not meant to
  • [Passwordless for macOS] Fixed: Machine name and username display correctly in the password dialog on macOS Ventura
  • [Passwordless for macOS] Fixed: With passwordless enforcement enabled, password labeling has been corrected to reflect the available options
  • [Passwordless for Windows] Fixed: HYBRID Entra/Azure machines now hide the Security Key option when the certificate template is not defined
  • [Platform - Keycloak] Fixed: Desktop SSO alias gets removed from Keycloak upon user deletion; previously in some cases it did not
  • [SDK for Android] Fixed: After deregistration, the authenticationCounter resets properly for the next authentication attempt

8.5.2 - Patch 2023-11-09​

Enhancements​

  • [All HYPR] CVE Fixes
  • [All HYPR] Fix CVE-2023-22102
  • [All HYPR] Single Registration: Workstation-to-web: Issues with multiple certificates in loginCert chain
  • [Control Center] Relax user validation slightly for FIDO2
  • [Passwordless for Windows] UI customization for customer

Bug Fixes​

  • [Control Center] Fixed: Device Manager error listing devices for user
  • [Events] Fixed: Missing fields in asynchronously saved Events

8.6.0 - GA 2023-10-25​

New Features and Feature Changes​

  • [Adapt] Create and Manage Risk Policies

    • [Adapt; API] (Frontend) Build out create policy POST API calls for front-end, tie to UI
    • [Adapt; API] (Frontend) Build out authentication Policy GET/DELETE calls; tied to UI elements

  • [Adapt; Workforce Access Client - Both] Q4 Updates

    • [API] Create /wsapi Signals Endpoint
    • [Control Center] Signals now are recorded in Audit Trail Events

    [All HYPR] Consuming Device Signals, Control Center Integration, Login Limits and Initial Keycloak Integration

    • [Adapt; API ] Add Timeout to Adapt Evaluation API
    • [Mobile App for Android; SDK for Android] Send location signals from the Mobile App during Workstation Unlock
    • [Mobile App for iOS; SDK for iOS] Send location signals from the Mobile App during Workstation Unlock

  • [Control Center; API] FIDO2 Transports in HYPR API Responses

    • [API] FIDO2: The default value for the transports attribute in the /fido2/assertion/options Response Body has been changed to an empty set; and the transports attribute is now a string data type
    • [Control Center - FIDO2] The transports attribute in /fido2/assertion/options is now a string data type

  • [Control Center - Integrations] Azure: HYPR Enterprise Passkey: Support for Different Usernames and Multiple Credentials

    • [Mobile App - Both; Passwordless - Both] HYPR now accounts for multiple devices or workstations for a single user
    • [Mobile App - Both; Passwordless - Both] Part2 - FIDO2 Username different than the HYPR QR Code pairing Username

  • [Control Center - Integrations; Platform - Keycloak] Authenticator Refactoring; OneLogin new Integration

    • [Platform - Keycloak] Back End: Desktop SSO module
    • [Platform - Keycloak] Adjust QR code authenticator for OneLogin

  • [Passwordless - Both] Desktop SSO Enhancements

    • [Passwordless - Both] Desktop SSO status endpoint should return username that was requested by the web
    • [Passwordless - Both] Desktop SSO support for Web username aliases

Enhancements​

  • [Adapt] Update policy UI to new branding
  • [Adapt; API] Confirm the PUT calls in Adapt policy UI are functional
  • [All HYPR] CVE Fixes for 8.6.0
  • [API] Separate /login and /recover endpoints
  • [Control Center - Integrations; Platform - Keycloak] ADFS Plugin V2: Add final Keycloak pieces to support dynamic links
  • [Control Center; Adapt] Add Adapt Policies enablement to UI
  • [Mobile App - Both] Add additional device information to the logs
  • [Mobile App for Android; SDK for Android] Update androidx security library to alpha-06
  • [Mobile App for iOS] Fixed: Certificate Renewal Failures in Prod
  • [Passwordless for Windows] Support for YubiKey Bio Security Keys

Bug Fixes​

  • [Adapt] Fixed: 500 error when trying to update existing policy
  • [API] Fixed: Logging response is adding double-double quotes that is throwing off CSV positioning upon log ingestion
  • [Control Center - Integrations] Fixed: Improve SAML Messages security
  • [Control Center - Integrations] Fixed: Okta: Alias support should not be case-sensitive
  • [Control Center] Fixed: FIDO2: Authentication fails for unknown AAGUID
  • [Control Center] Fixed: Deleting an rpapp does not cascade correctly for UAFTransaction
  • [Control Center] Fixed: Server returns incorrect error codes (400/500) in response when the properties are tampered in the install token exchange request
  • [Passwordless for macOS] Fixed: Consolidate Audit Trail Event names into a single source file for better accounting
  • [Passwordless for macOS] Fixed: Devices disappear from paired devices
  • [Passwordless for macOS] Fixed: MacOS Sonoma cannot register new devices
  • [Passwordless for macOS] Fixed: Sonoma: Text missing on the client when trying to unpair a device
  • [Passwordless for macOS] Fixed: Unable to unlock using HYPR after upgrade from 8.4 to 8.5
  • [Passwordless for macOS] Fixed: Workforce Access UI on macOS 14 Sonoma renders UI in a different way
  • [Passwordless for Windows] Fixed: Add quotes to the Bonjour service path
  • [Platform - Keycloak] Fixed: Keycloak not creating cookies for username
  • [Platform] Fixed: Liquibase changelog database is not cluster-friendly
  • [SDK for FIDO2] Fixed: iOS does not resume FIDO2 BLE advertising when the Mobile App is closed and reopened

8.5.1 - Patch 2023-10-18​

New Features and Feature Changes​

  • [Control Center - Integrations] Azure HYPR Enterprise Passkey Enhancements Part II

    • [Control Center - Integrations] Enterprise Passkey: Delete one and only one device from Control Center
    • [Control Center - Integrations] Enterprise Passkey: Delete one and only one device from Mobile
    • [Control Center - Integrations] Enterprise Passkey: Delete device from Control Center when we have 2 device paired with the same Passwordless Client
    • [Control Center - Integrations] Enterprise Passkey User Management: Display user in Pending table if they remove their device, regardless of if we send email
    • [Control Center - Integrations] Enterprise Passkey: Delete "Pair with HYPR" workstation from mobile device does not delete from server
    • Bug Fixes:
      • [Control Center] User Management: Single user with multiple devices appears as separate entries

  • [Control Center - Integrations] HYPR Enterprise Passkey - BLE and WiFi Enhancements (Roaming) Bug Fixes

    • [Passwordless for Windows] Fixed: Bonjour service does not start automatically after upgrading Passwordless Client
    • [Passwordless for Windows] Fixed: Windows not receiving UDP broadcast when HYPR Mobile App is closed

Enhancements​

  • [Adapt] Office code changes needed
  • [Control Center] Alias lookup needs an option to include rpappid
  • [Mobile App for iOS; Events] Valid Audit Events for FIDO2 registration: add message to Events
  • [Passwordless for macOS] Remove password unlock on macOS
  • [Platform] Add support for "hypr.fido2.mds.enable" vault parameter in v2

Bug Fixes​

  • [Control Center] Fixed: FIDO2: Authentication fails for unknown AAGUID
  • [Control Center - Integrations] Fixed: Azure: No icon displayed after deleting user from "Paired with HYPR" or "Paired with Azure"
  • [Control Center - Integrations] Fixed: Okta: Always create short name alias when an email is registered
  • [Control Center - Integrations] Fixed: Okta: No icon next to username after deleting device from Magic Link
  • [Mobile App for iOS] Fixed: Fix certificate renewal failures in Prod
  • [Passwordless for macOS] Fixed: Devices disappear from paired devices
  • [Passwordless for macOS] Fixed: macOS Sonoma cannot register new devices
  • [Passwordless for macOS] Fixed: Passwordless Client UI on macOS 14 Sonoma renders UI in a different way
  • [Passwordless for macOS] Fixed: Sonoma: Text missing on Passwordless Client when trying to unpair a device
  • [Passwordless for macOS] Fixed: Unable to unlock using HYPR after upgrade from 8.4 to 8.5
  • [Platform] Fixed: Gray screen issues in embedded browsers
  • [Platform - Keycloak] Fixed: Network cache TTL is not working
  • [Platform - Keycloak] Fixed: Setting a custom theme does not work in 21.1.2
  • [SDK for FIDO2] Fixed: iOS does not resume FIDO2 BLE advertising when HYPR Mobile App is closed and reopened

8.5.0 - GA 2023-09-27​

New Features and Feature Changes​

  • [Control Center] Device Manager 2.0

    • [Control Center] Device Manager 2.0 Alerts UI Improvements
    • [Control Center] Device Manager 2.0 Buttons UI Improvements - [2d part]
    • [Control Center] Device Manager 2.0 Devices List Improvements
    • [Control Center] Device Manager 2.0 Devices UI Improvements - [2d part]
    • [Control Center] Device Manager 2.0 Errors UI Improvements
    • [Control Center] Device Manager 2.0 Header UI Improvements - [2d part]
    • [Control Center] Device Manager 2.0 Hypr-ui-component-library improvements
    • [Control Center] Device Manager 2.0 Modals UI Improvements - [2d part]
    • [Control Center] Device Manager 2.0 Punch list - [2nd part]
    • [Control Center] Device Manager 2.0 Registration UI Improvements - [2d part]
    • [Control Center] Device Manager 2.0 Alerts UI Improvements - [2d part]

  • [Control Center; Passwordless - Both] Improve Workstation Installation token security controls

    • [Control Center] Improve Workstation Installation token security controls
    • [Passwordless for macOS] Improve workstation token security controls
    • [Passwordless for Windows] Improve workstation token security controls

  • [All HYPR] Desktop SSO Enhancements

    • [API] Desktop SSO status endpoint should return username that was requested by the web
    • [Control Center] Send whitelabel URL In Settings
    • [Mobile App for Android] Process whitelabel URL In Settings and add to Desktop SSO
    • [Mobile App for iOS] Process whitelabel URL In Settings and add to Desktop SSO
    • [Passwordless for macOS] Match whitelabel URL or RpServerURL in SSO
    • [Passwordless for Windows] Use new settings API to get list of alternate RP server URLs

  • [Control Center - Integrations] HYPR Enterprise Passkey for Azure - Hybrid Domain-joined Support

    • [Control Center] Accommodate both X.509 certificate and FIDO2 binding
    • [Control Center] Receive machineUserPrincipalName, machineUserEmail and machineUserDisplayName on QR Code Scan
    • [Control Center - Integrations; API] /rp/deviceapi/device/authorize/ws/unlock - remove query did not return a unique result: 2 when paired with Azure
    • [Mobile App for Android] Accommodate both machineUsername and machineUserPrincipalName
    • [Mobile App for Android] Update app to support both X.509 certificate and FIDO2 binding on a single QR Code scan
    • [Mobile App for iOS] Accommodate both machineUsername and machineUserPrincipalName
    • [Mobile App for iOS] Update app to support both X.509 certificate and FIDO2 binding on a single QR Code scan
    • [Passwordless for Windows] Accommodate both X.509 and FIDO2 binding
    • [Passwordless for Windows] Send additional user identity properties during registration
    • [Passwordless for Windows] Update UX to accommodate device pairing when both FIDO2 and X.509 are available
    • Bug Fixes:
      • [Control Center - Integrations] Azure Native - User not deleted from 'Paired with Azure' when delete initiated from Android device
      • [Control Center - Integrations] HYPR Enterprise Passkey: Hybrid - On the Workstation Lock Screen, there is no field to enter Offline PIN/Recovery PIN
      • [Control Center - Integrations; HYPR Mobile App for iOS] CredentialID in Enterprise Passkey Audit Trail Events does not match with one returned by graph API
      • [Control Center - Integrations; HYPR Mobile App for iOS] FIDO2: Multiple errors and exceptions are observed in Datadog on pairing with Azure
      • [Control Center - Integrations; HYPR Mobile App for iOS] Valid Audit Trail Events for FIDO2 registration are not being tracked
      • [Mobile App for iOS] FIDO2 prompt to log back in doesn't go away even after accepting
      • [Mobile App for iOS] UI: 'machineUserName' is displayed under "My Security Keys' instead of 'machineUserPrincipalName'
      • [Mobile App for iOS] Valid Audit Trail Events for FIDO2 registration are not being tracked
      • [SDK for FIDO2] iOS advertising wrong IP address through DNS Service Discovery

  • [Control Center - Integrations] HYPR Enterprise Passkey - Bluetooth \ BLE Support (Windows)

    • [Mobile App for Android] Work required on HYPR mobile application to accommodate BLE/Bluetooth pairing
    • [Passwordless for Windows] Client updates to show BLE as an option
    • [Passwordless for Windows] Implement Bluetooth/BLE Support for Enterprise Passkey for Azure
    • Bug Fixes:
      • [SDK for FIDO2] After Pairing with Azure, unable to log into Windows OS via BLE

  • [Platform - Keycloak] Upgrade - Quarkus

    • [Platform - Keycloak] Keycloak 21.1.2 is out we should use it as our image

  • [Passwordless - Both; Mobile App - Both; API] SSL/TLS Pinning enhancements for Mobile/Desktop

    • [Passwordless for Windows] Use new settings API to get updated SSL pinning hash from Control Center
    • Bug Fixes:
      • [API] 'rp/deviceapi/settings' returns 403 when request contains more than 1 rpApp

[Control Center - Integrations] Azure HYPR Enterprise Passkey Enhancements

  • [Control Center] Add and persist FIDO2 username from the Event to rp_enrolled_credentials_data

  • [Control Center] Add FIDO2 username to the UI

  • [Control Center] Delete enrolledCredentialId from rp_user_device_machine_map

  • [Control Center] Remove rp_registered_user.status column

  • [Control Center - Integrations] Display icon if FIDO2 pairing no longer exists on Azure

  • [Control Center - Integrations] Integrations error can introduce infinite loop of audit calls

  • [Control Center - Integrations] User Management - Display icon if FIDO2 pairing no longer exists on Azure

  • Bug Fixes:

    • [Control Center - Integrations] Azure "Go To Setup" Guide links are not accurate
    • [Control Center - Integrations] Delete user that is "Paired with Azure" does not delete the FIDO2 credential from Azure
    • [Control Center; Platform - Keycloak] User Management - Keycloak needs to leverage machineUserPrincipalName not machineUserName in order to support removal of WHfB

  • [Control Center - Integrations; Platform - Keycloak]Keycloak Authenticator Refactoring - One Login new integration

    • [Control Center] Update all authenticators to allow ALTERNATIVE flow with graceful termination/retry ability
    • [Platform - Keycloak] Manual flow to prove that the new Azure and Push authenticators work
    • [Platform - Keycloak] Manual flow to prove that the new Azure, Push and FIDO2 authenticators work
    • [Platform - Keycloak] FIDO2 login module
    • [Platform - Keycloak] Push login module
    • [Platform - Keycloak] QR fallback module
    • [Platform - Keycloak] QR login module

Enhancements​

  • [All HYPR] Remove Sensory Face and Voice frameworks from the project
  • [API] Cleanup APIs for multi-iDP support
  • [Control Center] Add authenticatorDisplayName field to FIDO2RegisteredUser
  • [Control Center] Add Policy ID to Event structure
  • [Control Center] Adding Policy Evaluation logging and Audit Trail Event
  • [Control Center] FIDO2: Origin verification
  • [Control Center] FIDO2: Update core model to reflect required fields
  • [Control Center] Update processing of FIDO2 data to be in addtionalDetails
  • [Control Center - Integrations; Mobile App for iOS] FIDO2 Mobile Authenticator - Audit Events : 'credentialID', 'FIDO2Username', 'rpID' are missing in the 'additionalDetails' section in Datadog logs
  • [Control Center - Integrations] ADFS Plugin v2: Integrate HTML authentication pieces with ADFS backend
  • [Control Center - Integrations] Client-side Okta credential validation
  • [Control Center - Integrations] Event Hooks: OAuth authentication parameters have invalid schemas
  • [Control Center - Integrations] OneLogin: Allow to read users without email but don't allow to register them
  • [Mobile App for Android] Abilityt to parse a QR code with deeplink embedded directly from Mobile App scan
  • [Mobile App for Android] Enhance PIN protection
  • [Mobile App for Android] Update FIDO2 Data to be in addtionalDetails
  • [Mobile App for iOS] Allow the SDK consumers to add their own rules to the new PIN UI
  • [Mobile App for iOS] Being able to parse a QR code with deeplink embedded directly from HYPR Mobile App scan
  • [Partner Development] FIDO Alliance special login UI
  • [Passwordless for Windows] Allow in-place upgrades to new builds of the same HYPR Passwordless product version
  • [Passwordless for Windows] Move websocket ping/pong logging to TRACE level
  • [Platform] Update ui-component-library with deploy/publish instructions in README
  • [Platform] Wire up AWS cluster config endpoint awareness to lettuce
  • [SDK - Extensions] Add proxy support to the HYPR PAM module

Bug Fixes​

  • [API] Fixed: Perform session validation on devices list
  • [Control Center] Fixed: Authentication and text do not show correct values in the UI
  • [Control Center] Fixed: Can't trashcan last device on user management table
  • [Control Center] Fixed: Device Manager v2 breaks rendering on the legacy Device Manager page
  • [Control Center - Integrations] Fixed: Azure: User is not removed from Keycloak when deleted from Control Center
  • [Control Center - Integrations] Fixed: Azure Native: User is added to 'Paired with HYPR' AND 'Paired with Azure' after pairing device with HYPR Passwordless
  • [Control Center - Integrations] Fixed: Cannot add a second device to an integration
  • [Control Center - Integrations] Fixed: Okta username with plus sign cannot register
  • [Control Center - Integrations] Fixed: RADIUS: Update lack of valid local configuration to FATAL start and log accordingly
  • [Control Center - Integrations] Fixed: Users cannot access devices in DM when accessed via Okta portal
  • [Control Center - Integrations] Fixed: Users do not appear in 'Paired with HYPR' table if a user already exists in the 'Paired with Azure' group
  • [Control Center - Integrations] Fixed: Web domain is not displayed on Paired with Azure list in Control Center
  • [Mobile App - Both] Fixed: Authentication cancels when Policy set to PIN + Native authenticator and PIN complexity FF is set to true
  • [Mobile App for Android] Fixed: Issue refreshing token QR authentication coming from the camera app
  • [Mobile App for iOS] Fixed: Unable to parse a QR code with deeplink embedded directly from HYPR Mobile App scan with fresh install app unless subsequent registration flow
  • [Passwordless for Windows] Fixed: AccessViolationException in Native.YubiGetModel()
  • [Passwordless for Windows] Fixed: HYPR Passwordless may not be able to enroll YubiKey if Windows Hello for Business is enabled
  • [Platform] Fixed: DurableSchemaRegistry size breaks the build
  • [Platform - Keycloak] Fixed: Keycloak not creating cookies for username
  • [Platform - Keycloak] Fixed: Keycloak sends wrong (unused options) request

8.4.1 - Patch 2023-09-27​

Bug Fixes​

  • [Mobile App for Android] Fixed: QR authentication: Issue refreshing the token coming from the Camera app

8.5.2 - Patch 2023-09-21​

Enhancements​

  • [Partner Development] FIDO Alliance special login UI

8.4.17 - Patch 2023-09-13​

Enhancements​

  • [Platform] Liquibase changelog database is not cluster-friendly

8.4.0 - GA 2023-08-09​

New Features and Feature Changes​

  • [API] Bulk Export API

    • [API] Bulk export API/throttling implementation

  • [Workforce Access Client - Both] Backoff and Install Token Issues

    • [Control Center] Check workstation rpAppId when exchanging the installation token
    • [Workforce Access Client - Both] Loosen secure API tokens for Workforce Access Client tokens
    • [Workforce Access Client for Windows] Improve network error handling
    • [Workforce Access Client for macOS] Implement backoff algorithm for network connection retries

  • [Control Center; Platform - Keycloak] Passkey UI Updates

    • [Control Center] Device Manager UI Updates for Passkey Support
    • [Control Center] Login UI Updates for Passkey Support
    • [Platform - Keycloak] Onboarding Experience for New Passkey UI
    • [Platform - Keycloak] UI Updates for Passkey Support
    • [Platform - Keycloak] Update UI for Passkey Experience

  • HYPR Enterprise Passkey for Azure - Hybrid Domain-joined Support

    • [Control Center - Integrations] Update API that the Workforce Access client calls to account for mobile device level full/partial flags
    • [Control Center - Integrations] Update code to receive FIDO2 username in Enterprise Passkey Audit Trail Events
    • [Control Center - Integrations] Update code to receive RPId in Enterprise Passkey Audit Trail Events
    • [Mobile App for Android] Send FIDO2 username in Enterprise Passkey Audit Trail Events
    • [Mobile App for Android] Send RPId in Enterprise Passkey Audit Trail Events
    • [Mobile App for iOS] Send FIDO2 username in Enterprise Passkey Audit Trail Events
    • [Mobile App for iOS] Send RPId in Enterprise Passkey Audit Trail Events
    • [Workforce Access Client for Windows] Update Workforce Access Client UX after QRcCode scan to accommodate Enterprise Passkey pairing
    • Bug Fixes:
      • [Mobile App for Android] Fixed: Send [Base64URL + MSFT encoding] CredentialId in Enterprise Passkey Audit Trail Events
      • [Mobile App for iOS] Fixed: Send [Base64URL + MSFT encoding] CredentialId in Enterprise Passkey Audit Trail Events

  • SSL/TLS Pinning enhancements for Mobile/Desktop

    • [Control Center] SSL Pinning Updates Implementation
    • [Mobile App for Android] SSL Integration Testing
    • [Mobile App for Android] SSL Pinning Updates Implementation
    • [Mobile App for iOS] SSL Integration Testing
    • [Mobile App for iOS] SSL Pinning Updates Implementation

  • [Control Center - Integrations] Azure: HYPR Enterprise Passkey Enhancements

    • [Control Center - Integrations] Azure User Management: Display icon in Pending if devices no longer exist
    • [Control Center - Integrations] Azure User Management: Show RP ID when Azure FIDO2 registration takes place
    • [Control Center - Integrations] Azure User Management: Update DB with RP ID when Azure FIDO2 registration takes place
    • [Control Center - Integrations] Azure User Management: Update the database with FIDO2 username when Azure FIDO2 registration takes place
    • [Control Center - Integrations] Azure: "Paired with HYPR" should display the same table info as "Paired with Azure"
    • [Control Center - Integrations] Azure: Change domains to web domains
    • [Control Center - Integrations] Azure: Create new table for Azure FIDO2 extra details
    • [Control Center - Integrations] Azure: Fix queries to use enrolledCredentialId from rp_enrolled_credentials_data
    • [Control Center - Integrations] Azure: Include enrolledCredentialId and domainName in User Management queries
    • [Control Center - Integrations] Azure: Last active time should be available for mobile devices
    • [Control Center - Integrations] Azure: Move enrolledCredentialId from rp_user_device_machine_map to rp_enrolled_credentials_data
    • [Control Center - Integrations] Azure: Remove dependency on rp_registered_user.status in the different queries

  • [Control Center; Mobile App for iOS] Option to Disassociate Passcode from Registration

    • [Control Center; Mobile App for iOS] Enablement for Non-passcode Registration
    • [Control Center] Enablement for Non-passcode Registration

  • [Mobile App - Both] Confirm Close on Authentication Request

    • [Mobile App - Both] Updated UI on Transaction Summary Screen

Enhancements​

  • [All HYPR] 05-02-2023 CVE Fixes
  • [All HYPR] CVE-2023-20883
  • [All HYPR] QR Fallback: Improved browser UX
  • [API] Endpoint Throttling
  • [Control Center] Create migration script to enable fallback authenticator by default
  • [Control Center] Enforce attestation policy
  • [Control Center] FIDO2 Deterministic user.id
  • [Control Center] FIDO2: Origin verification
  • [Control Center] Split FIDO2 configuration into Settings and Policies
  • [Control Center - Integrations] Add more debug logging to RADIUS server to debug proxy issue
  • [Control Center - Integrations] ADFS Plugin v2: Integrate HTML registration pieces with ADFS backend
  • [Control Center - Integrations] Okta: Add username as an alias in HYPR
  • [Control Center - Integrations] Single Registration integration test
  • [Control Center; API] Control Center policy API bugfix and PATCH API extension
  • [Control Center; Errors] Add the kLAErrorAuthenticationFailed error to the list of the errors resulting in the cancelation of the registration on server
  • [Mobile App for Android] Allow the SDK consumers to add their own rules to the new PIN UI
  • [Mobile App for Android] Enhance PIN protection
  • [Mobile App for iOS] Sign the TrustKit library after it gets decoupled for the XCFramework creation
  • [Mobile App for iOS] Switch active profile based on the machine, when trying to deregister a machine, which doesn't belong to the current active profile
  • [Mobile App for iOS] Update API token retry logic on QR authentication
  • [Mobile App for iOS] Upgrade iXGuard on the build machine to the latest to support iOS 17
  • [Platform - Keycloak] Azure login module
  • [Platform - Keycloak] Basic Keycloak Upgrade
  • [Platform - Keycloak; Control Center; Events] Send Brute Force Detection Keycloak Logs / Events to Control Center
  • [Platform - Keycloak] Fix/Allow setting a custom theme
  • [Platform - Keycloak] Keycloak not creating cookies for username
  • [Platform - Keycloak; Control Center - Integrations] Okta Extension: Delete the Keycloak user when we delete the Control Center user
  • [SDK for Java] Fix Java SDK test suite failures
  • [Workforce Access Client for macOS] Passwordless Enforcement
  • [Workforce Access Client for Windows] Azure wording update (Feedback from MSFT)
  • [Workforce Access Client for Windows] Enrollment Service can't use /rp/wsapi endpoints
  • [Workforce Access Client for Windows] Move websocket ping/pong logging to TRACE level
  • [Workforce Access Client for Windows] Remove roaming dependency for making Passwordless User the default tile
  • [Workforce Access Client for Windows] Stop building Workforce Access client for 32-bit X86

Bug Fixes​

  • [All HYPR] Fixed: Single Registration: Workstation-to-web: Domain user universal principal name (UPN) is used instead of email
  • [Control Center] Fixed: Magic link is not expired when using firebaseDynamicLinkForHyprApp link
  • [Control Center - Integrations] Fixed: 500 on integrations; no element of the collection was transformed to a non-null value
  • [Control Center - Integrations] Fixed: Azure login can fail due to race condition
  • [Control Center - Integrations] Fixed: Deleting a pairing from HYPR Mobile App doesn't delete from "Paired with Azure" in Control Center
  • [Control Center - Integrations] Fixed: Multiple IdP Support: Invalid state of RADIUS integration when multiple RADIUS integrations are present
  • [Control Center - Integrations; Events] Fixed: Some Events are still missing integrationType and integrationProvider
  • [Events] Fixed: Audit Trail Events are not generated when enabling/disabling FIDO2 Settings
  • [Events] Fixed: The Audit Trail Event message does not specify the Admin when toggle status updated by a Control Center user
  • [Mobile App - Both] Fixed: Subsequent Authentication/request is called but not displayed on the authentication screen for the user after first attempt (Tap to Login fails)
  • [Mobile App for Android] Fixed: Wrong sessionId in Audit Events during failure scenarios
  • [Platform - Keycloak] Fixed: Keycloak running in an embedded browser gets the QR code cut off
  • [Platform - Keycloak] Fixed: Keycloak sends wrong (unused options) request
  • [Platform - Keycloak] Fixed: One time Onboarding Keycloak message is scrollable and not seen unless user explicitly knows
  • [Platform - Keycloak; Control Center - Integrations] Fixed: After updating integration, QR authentication settings in tenants and Keycloak are no longer aligned
  • [Workforce Access Client for macOS] Fixed: Login succeeds on paired device but fails on workstation
  • [Workforce Access Client for Windows] Fixed: Auto upgrade from Workforce Access 8.1.0 to 8.2.2 did not reboot, but it needs to
  • [Workforce Access Client for Windows] Fixed: Uninstalling Workforce Access 8.2.0 pops up warning about Bonjour service

8.3.0 / 8.2.0 - Patch 2023-08-02​

Enhancements​

  • [Control Center - Integrations] Okta: Add username as an alias in HYPR

8.3.1 - Patch 2023-07-28​

Enhancements​

  • [All HYPR] Accessibility UI Fixes for Customer
  • [Control Center] FIDO2: Origin verification
  • [Control Center] V2 tenant authentication fails due to Invalid Firebase key
  • [Platform - Keycloak; Events] Send brute force detection Keycloak logs / Events to Control Center

8.4.0 / 7.10.4 - Patch 2023-07-26​

Bug Fixes​

  • [Mobile App for Android] User not receiving push notifications and checkForPendingOOB failing to work

8.3.0 - GA 2023-07-12​

New Features and Feature Changes​

  • [All HYPR] Fallback Authentication

    • [Control Center] Audit Trail Updates for Fallback Authentication
    • [Control Center] Enable Fallback Authentication in rpApp
    • [Mobile App for Android] Audit Trail Updates for Fallback Authentication
    • [Mobile App for Android] Fallback Authentication Flow
    • [Mobile App for iOS] Add failed authenticators info to the fallback authentication Audit Trail Event
    • [Mobile App for iOS] Audit Trail Updates for Fallback Authentication
    • [Mobile App for iOS] Fallback Authentication Flow

  • [All HYPR] FIDO2 Mobile Authenticator - GA

    • [Control Center] Update code to receive CredentialId in Enterprise Passkey Audit Trail Events
    • [Mobile App for Android] On FIDO2 Registration, verify RP ID permitted
    • [Mobile App for Android] Send CredentialId in Enterprise Passkey Audit Trail Events
    • [Mobile App for iOS] On FIDO2 Registration, verify RP ID permitted
    • [Mobile App for iOS] Send CredentialId in Enterprise Passkey Audit Trail Events
    • [Mobile App for iOS] Send to Support: Logs to include information which can help troubleshoot WIFI issues
    • [SDK for FIDO2] Send to Support: Logs to include information which can help troubleshoot WIFI issues
    • Bug Fixes:
      • [Mobile App for Android] Fixed: Send [Base64URL] CredentialId in Enterprise Passkey Audit Trail Events
      • [Mobile App for iOS] Fixed: FIDO2: "Username" is missing in the login confirmation screen
      • [SDK for FIDO2; SDK for iOS] Fixed: Credential is missing id and username in UP and UV

  • [All HYPR] Multiple IdP Environments

    • [API] Back End: Fix API calls IdpConfigController
    • [API] Back End: Fix API calls IdpUsersController
    • [API] Use the fixed API calls and pass rpAppId
    • [Control Center - Integrations] Add tests to avoid creating duplicate integration
    • [Control Center - Integrations] Allow multiple applications of the same SSO provider to be created
    • [Platform] Back End: Add rpAppId to haas-modules GsuiteRedirectRequestDTO
    • Bug Fixes:
      • [Control Center - Integrations] Fixed: Delete integration deletes all of the same type

  • [All HYPR] Passkey Enforcement

    • [Control Center] Device Manager: Enforce passkey settings at registration
    • [Control Center] Update the Device Name on Device Manager when a multi-device passkey is registered
    • [Control Center] Updated FIDO2 configuration
    • [Control Center; Platform - Keycloak] Update passkey verbiage
    • [Control Center; API] Enable/disable passkeys
    • [Platform - Keycloak] UI: Enforce passkey settings at authenticator selection
    • [Platform - Keycloak; API; Errors] Enforce passkey settings at authenticator selection

  • [All HYPR] Single Registration: Workstation-to-web Flow/Migration

    • [All HYPR] Single Registration: Internal Pentest
    • [All HYPR] Single Registration: Workstation-to-web: Handling multiple workstations for one device or multuiple evices for one workstation
    • [Control Center] Single Registration: Implementation of Workstation-to-web Part 2
    • [Control Center] Single Registration: Security Review web username validation
    • [Mobile App for Android] Single Registration: Implementation Workstation-to-web
    • [Mobile App for iOS] Single Registration: Implementation Workstation-to-web
    • [Workforce Access Client for macOS] Send email along with domain username during registration flow
    • [Workforce Access Client for Windows] Send email along with domain username during registration flow

  • [API] Add API token to QR login endpoint

    • [Mobile App for iOS; API] Include rpAppId in QR code / dynamic link to use API token

  • [Control Center] FIDO2 Policies

    • [Control Center] FIDO2 policies core logic
    • [API] FIDO2 policies API

  • [Control Center; Events; Errors] QR Login Productization

    • [Control Center] Set QR login as the default for the ControlCenterAdmin rpApp
    • [Control Center] Set QR Login Feature On by default
    • [Control Center] Support transaction confirmation for QR code
    • [Control Center; Platform - Keycloak] Set Keycloak configuration for QR Login in Control Center UI

  • [Control Center - Integrations] Azure: FIDO2 Mobile Authenticator GA

    • [API] Update mobile endpoint with integration details
    • [Control Center] IDP config changes are not being sent right away after being made
    • [Control Center] UX: Login Settings update restricted domains behavior
    • [Control Center - Integrations] Add Integration: Update Azure icon to reflect latest branding
    • [Control Center - Integrations] Back End: User Management for "Pending" Users; enhancements to enrollment
    • [Control Center - Integrations] Front End: Delete User Device
    • [Control Center - Integrations] Finish the Azure groups and device delete stories
    • [Control Center - Integrations] User Enrollment: Paired with Azure Update Azure when Control Center Admin deletes user or device
    • [Control Center - Integrations] User Enrollment: Paired with Azure Update Azure when user "trashcans" via mobile device
    • [Control Center - Integrations] User Enrollment: Paired with Azure Update Azure when user "trashcans" via workstation client
    • [Control Center - Integrations] User Enrollment: Paired with HYPR Update Azure when Control Center Admin deletes user or device
    • [Control Center - Integrations] User Enrollment: Paired with HYPR Update Azure when user "Pairs With HYPR" (Pending)
    • [Control Center - Integrations] User Enrollment: Paired with HYPR Update Azure when user "Pairs With HYPR" via mobile device
    • [Control Center - Integrations] User Enrollment: Paired with HYPR Update Azure when user "trashcans" via mobile device
    • [Control Center - Integrations] User Enrollment: Paired with HYPR Update Azure when user "trashcans" via workstation client
    • [Control Center - Integrations] User Management for "Paired with HYPR" users
    • [Control Center - Integrations] User Management: Update DB with credential id when Azure FIDO2 Registration takes place
    • [Control Center - Integrations] UX: Add new FIDO2 enrollment email template
    • [Control Center - Integrations] UX: Adding "Pending" Tab and Enroll Users
    • [Control Center - Integrations] UX: User Management for "Paired with Azure" users (new table)
    • [Control Center - Integrations] UX: User Management for "Pending" Users
    • Bug Fixes:
      • [Control Center] Fixed: IDP config changes are not being sent right away after being made
      • [Control Center - Integrations] Fixed: Azure: Trash can delete on mobile device does not remove user from correct Azure group
      • [Control Center - Integrations] Fixed: Azure: User deleted from Pending table in Azure integration is not removed from eligible for pairing group on Azure
      • [Control Center - Integrations] Fixed: Azure: User not added to "HYPR Group (Client Paired With Azure)" when successfully paired with Azure
      • [Control Center - Integrations] Fixed: Azure: User not added to "HYPR Group (Eligible for Pairing)" when sent Enrollment email
      • [Control Center - Integrations] Fixed: Azure: When a Control Center admin deletes a users device they are removed from the Eligible for pairing user group on Azure
      • [Control Center - Integrations] Fixed: Back End: Delete the last User's Device doesn't delete a User and doesn't return it into "Pending" state
      • [Control Center - Integrations; Mobile App - Both] Fixed: Cannot "Pair with HYPR"; QR Code scan fails with 1202600

  • [Control Center - Integrations] Event Hooks Refactor Into Unique SIEMs

    • [Control Center - Integrations] Event Hook: Add enablement for Custom
    • [Control Center - Integrations] Event Hook: Add Splunk Cloud Provider field
    • [Control Center - Integrations] Event Hook: Clean up Event Hooks from the UI
    • [Control Center - Integrations] Event Hook: Create Beta UI for Custom
    • [Control Center - Integrations] Event Hook: Create Custom integration tile
    • [Control Center - Integrations] Event Hook: Custom Event Hook UI
    • [Control Center - Integrations] Event Hook: Prevent 500 errors
    • [Control Center - Integrations] Event Hook: Refactor the backend

  • [Mobile App for iOS] Firebase Token Force Refresh

    • [Mobile App for iOS] Request and send new token when value is nil

  • [Platform] Server/Ops Updates

    • [Platform] Slimmed down Control Center container for on-premises customers
    • [Platform - Firebase] Firebase SDK upgrade: Convert push functionality to SDK calls
    • [Platform - Firebase] Firebase SDK upgrade: Write integration tests covering SDK flow

  • [Platform] Support for multi-region installations - Phase I

    • [Platform] Add conflict avoidance/resolution columns; update existing usage; add Event origin
    • [Platform] Dataprop change capture and propagation for update statements
    • [Platform] Dataprop changelog and group membership
    • [Platform] Handle muti-region out-of-band (OOB) authentication
    • [Platform] Handle muti-region workstation authentication
    • [Platform] Implement network policies for cell clusters
    • [Platform] Review dataprop changelog and group membership

  • [SDKs for Android and iOS] Mobile Reference App Expansion

    • [SDK for Android] AAID Chooser Screen
    • [SDK for Android] Progress Spinner Overrides
    • [SDK for iOS] AAID Chooser Screen
    • [SDK for iOS] Authentication/Transaction Accept screens
    • [SDK for iOS] Push Overrides

  • [Workforce Access Client - Both] Backoff and Installation Token Issues

    • [Control Center] Check workstation rpAppId when exchanging install token
    • [Workforce Access Client - Both; API] Loosen secure API tokens for Workstation Installation tokens
    • [Workforce Access Client for macOS] Send rpAppId when exchanging install token
    • [Workforce Access Client for Windows] Send rpAppId when exchanging install token

  • [Workforce Access Client for Windows] FIDO2 Mobile Authenticator GA

    • [Control Center - Integrations] Azure: Provide updates required for client UX for HYPR pairing (Azure domain-joined) - I
    • [Control Center - Integrations; API] Update device query endpoint
    • [Workforce Access Client for Windows] Complete Merge: Update client UX for HYPR pairing (Azure domain-joined)
    • [Workforce Access Client for Windows] Update client UX for HYPR pairing (Azure domain-joined) - II
    • Bug Fixes
      • [Workforce Access Client for Windows] Fixed: FIDO2: Spelling errors observed on the pairing screens

Enhancements​

  • [Control Center] Create migration script to enable fallback authenticator feature by default
  • [Control Center] FIDO2 Settings: Origin verification
  • [Control Center] QR Fallback issues encountered during internal testing
  • [Control Center] Update FIDO2 metadata periodically
  • [Control Center] Update verbiage for the Require User Presence description
  • [Control Center; API] Update existing API with rpAppId for QR authentication
  • [Control Center - Integrations] Create a facade service with caching to handle integrations
  • [Mobile App for Android] If the HYPR Mobile App is backgrounded during registration, it cancels and throws an error
  • [Mobile App for Android] Issue with Chrome 112 using deeplinks
  • [Mobile App for Android] No paired devices showing after long phone idle state
  • [Mobile App for Android] Single Registration: Remove checks for domain-joined machine
  • [Mobile App for Android] Use the rpAppId for QR authentication when it is available
  • [Mobile App for iOS] Allow HYPR Mobile App to bypass the Firebase dynamic link validity check
  • [Platform - Keycloak] Keycloak is not creating cookies for the username
  • [Platform - Keycloak] Merge customer inline changes into master
  • [Platform] Spring CVE Fixes
  • [SDK for Android] Add text to identify "Limited APK" along with the version text
  • [Workforce Access Client for macOS] Extend logging for the keychain failure to help diagnose intermittent authentication failures
  • [Workforce Access Client for macOS] Passwordless Enforcement
  • [Workforce Access Client for macOS] Send Audit messages for security key registration and authentication
  • [Workforce Access Client for Windows] Accept any type of Windows credential for user presence validation
  • [Workforce Access Client for Windows] Investigate multi-user SSO fail
  • [Workforce Access Client for Windows] Remove Microsoft C/C++ Runtime from the client installer

Bug Fixes​

  • [All HYPR] Fixed: Asynchronous registration fails when default QR login settings is enabled and Push configuration disabled vs registration succeeds
  • [Control Center] Fixed: Implement ownership validation for Lock requests
  • [Control Center] Fixed: User can type in a username into HYPR Control Center login, and then login with a passkey that has a different username
  • [Control Center - Integrations; Events] Fixed: Events missing IntegrationType and IntegrationProvider
  • [Control Center - Integrations] Fixed: Azure Native Login: Exception while trying to pair a device with Azure
  • [Control Center - Integrations] Fixed: Azure: Adding a space at the end of a username prompt us to enter password for already registered users
  • [Control Center - Integrations] Fixed: Azure: Can't update integration
  • [Control Center - Integrations] Fixed: Azure: Cannot save restricted domains when we have two Azure integrations in place
  • [Control Center - Integrations] Fixed: Azure: Groups don't get deleted when add integration fails due to insufficient privileges around creating a conditional access policy
  • [Control Center - Integrations] Fixed: Azure: Incorrect handling of missing field in Azure custom JSON data in 8.3 and above
  • [Control Center - Integrations] Fixed: Google Workspace: Cannot not add integration on 8.3
  • [Control Center - Integrations] Fixed: Integration Config cache populates duplicate integrations
  • [Control Center - Integrations] Fixed: Okta: It is possible to Add integration as Control Center admin user
  • [Control Center - Integrations] Fixed: Okta: Server error after adding integration
  • [Control Center - Integrations] Fixed: User Enrollment: User remains in enrolled list, if last deleted device is a security key or computer
  • [Mobile App - Both] Fixed: Mobile device not sending deviceId during 2nd registration
  • [Mobile App for Android] Fixed: App crashes on tapping "Login" button during Device Manager authentication
  • [Mobile App for iOS] Fixed: App crashes during FIDO2 authentication
  • [Mobile App for iOS] Fixed: App crashes when cancel Chooser/ registration that is timed out
  • [Platform - Keycloak] Fixed: "Insert your security key..." message displays when user selects 'smartphone' for Keycloak+Okta login
  • [Platform] Fixed: NullPointerException when FIDO2 Event fails
  • [Platform] Fixed: Multi-pod deployment issues for the IDP cache
  • [SDK for iOS] Fixed: Investigate and fix a crash when more than one cancelation is called for the same registration operation by the SDK consumer
  • [Workforce Access Client for macOS; Mobile App - Both] Fixed: HYPR App Tap to Login fails if an enrolled security key is plugged in
  • [Workforce Access Client for Windows] Fixed: "Contact Support" doesn't report latest error code and/or message in email
  • [Workforce Access Client for Windows] Fixed: "Contact Support" generates empty error fields in the email when there's no error; also "occurred" is misspelled
  • [Workforce Access Client for Windows] Fixed: Client may not be able to enroll YubiKey if Windows Hello for Business is enabled
  • [Workforce Access Client for Windows] Fixed: HyprCredProvider needs MSVC runtime DLL's that aren't included with Windows
  • [Workforce Access Client for Windows] Fixed: Incorrect log message
  • [Workforce Access Client for Windows] Fixed: Only send AzureAD user name to RP for FIDO2 pairing
  • [Workforce Access Client for Windows] Fixed: Registration with user presence enabled, fails on first incorrect password entry
  • [Workforce Access Client for Windows] Fixed: Single Registration: Workstation-to-web: Re-pairing with the Workforce Access Client after deleting users from Control Center doesn't work
  • [Workforce Access Client for Windows] Fixed: Single Registration: Workstation-to-web: UPN of domain user gets used instead of email
  • [Workforce Access Client for Windows] Fixed: UX for HYPR Pairing (Azure Domain Joined) is still not updated UI reflecting pairing completed

8.2.8 - Patch 2023-07-03​

Enhancements​

  • [Control Center] Check the workstation rpAppId when exchanging the installation token
  • [Workforce Access Client - Both; API] Loosen secure API tokens for Workstation Installation tokens

8.2.2 - Patch 2023-06-02​

Enhancements​

  • [Control Center - Integrations] Only send Azure AD username to the RP Application for FIDO2 pairing

8.1.25 - Patch 2023-06-02​

Enhancements​

  • [Workforce Access Client - Both; API] Loosen secure API tokens for Workforce Access Installation tokens

8.2.1 - Patch 2023-05-15​

Enhancements​

  • [Workforce Access Client for macOS] Passwordless Enforcement

Bug Fixes​

  • [Events] Fixed: Issue with HYPR Event noise

8.2.0 - GA 2023-05-10​

New Features and Feature Changes​

  • [All HYPR] Server/Ops Updates

    • [Platform - Firebase] Firebase SDK Upgrade: New UI for adding SDK configuration
    • [Platform - Firebase] Firebase SDK Upgrade: Lift v2 code; extend functionality; enable v1 path

  • [Control Center; Workforce Access Client for Windows] Automatic updates to v2 migrated customers

    • [Workforce Access Client for Windows] Remove HYPR-as-a-service check in clients for Auto-upgrade feature

  • [Control Center - Integrations] Azure: FIDO2 Mobile Authenticator - Early Access - Bug Fixes

    • [Control Center - Integrations] Fixed: 'Add Integration' HYPR authentication policy requests a PIN when pairing a QR code
    • [Control Center - Integrations] Fixed: Azure: User added to wrong Azure group when "Paired with HYPR"
    • [Control Center - Integrations; API] Fixed: Azure API response for enable/disable doesn't populate the capability field

  • [Control Center - Integrations] Azure: FIDO2 Mobile Authenticator GA

    • [Control Center - Integrations] Azure User Enrollment: Update Azure when user "Paired with Azure" via mobile device
    • [Control Center - Integrations] Update 'Add Integration' description to reflect Enterprise Passkey naming convention
    • [Control Center - Integrations] User Management: HYPR DB needs to store FIDO2 credential ID on registration

  • [Control Center - Integrations] Event Hooks Refactor Into Unique SIEMs

    • Control Center - Integrations] Event Hooks: Change integration UI SIEMs to Event Hooks
    • Control Center - Integrations] Event Hooks: Add Feature enablement for Splunk and DataDog Event Management integration
    • Control Center - Integrations] Event Hooks: Create integration UI for Splunk and Datadog
    • Control Center - Integrations] Event Hooks: Create Beta UI for Splunk and DataDog
    • Control Center - Integrations] Event Hooks: Event Mgmt Event Hook Table and tab
    • Control Center - Integrations] Event Hooks: Event Mgmt: Delete Event Hook
    • Control Center - Integrations] Event Hooks: Event Mgmt: Update integrations for Splunk, DataDog
    • Control Center - Integrations; API] API to list Event Hooks by integration type

  • [Mobile App - Both] Invalidate registration following new device biometric

    • [Mobile App for iOS] Implement invalidation of biometrics

  • [Workforce Access Client for Windows] Security Keys certificate renewal manual trigger

    • [Workforce Access Client for Windows] Allow user to manually force certificate renewal

  • [Workforce Access Client for Windows] WebAuthn: Passkey Detection

    • [Control Center] FIDO2: Make AssertionResultService work with discoverable credentials
    • [Control Center] FIDO2: Attestation Level 3 validation

Enhancements​

  • [API; Errors] Separate the user cancel errors from the failures leading to the call of the sever cancel APIs
  • [Control Center] Passkey Enforcement: Update empty AAGUID device name
  • [Control Center - Integrations] Removing validation for keyAgreementPublicKey and keyAgreementPublicKeyAUTH when FIDO2 Mobile Authenticatoris enabled
  • [Control Center - Integrations] ADFS Plugin V2: HTML Templates
  • [Control Center - Integrations] Removing validation for signingCert when FIDO2 Mobile Authenticator is enabled
  • [Mobile App for Android] Issue with message showing up when not needed on Android
  • [Mobile App for Android] Request and Send New Token when Value is NIL
  • [Mobile App for iOS] Adding feature enablement for iOS invalidation upon a new biometric registration
  • [Mobile App for iOS] Allow user to pick destination for log submission
  • [Mobile App for iOS] Implement potential application slowness fix reported in Zendesk
  • [Mobile App for iOS] Updated authentication flow for in-app QR scan
  • [Platform - AWS] AWS WAF rule breaks img upload test
  • [Platform - Firebase] Firebase SDK Upgrade: Liquibase Java migration script
  • [Platform - Keycloak] Keycloak not creating cookies for username
  • [Platform - Keycloak] POC for one simple use case
  • [Workforce Access Client for Windows] Customization of "Contact Support" behavior - Customer request
  • [Workforce Access Client for Windows] Desktop SSO "success" notification popup should close itself after a timeout
  • [Workforce Access Client for Windows] Enable Workforce Access Client for RDP remote sessions
  • [Workforce Access Client for Windows] Log information from user login certificate

Bug Fixes​

  • [Control Center - Integration] Fixed: Ping DaVinci: Redirect URL list accepts periods instead of commas to separate URLs
  • [Control Center - Integration] Fixed: User enrollment drawer: Can't send invite to personal email
  • [Control Center - Integrations' Mobile App for iOS] Fixed: Unable to complete Azure pairing with iOS
  • [Control Center] Fixed: Wrong push notifcation copy when certificate has been processed
  • [Mobile App for Android] Fixed: ArrayIndexOutOfBoundsException on permission check; notification permission checker fixed
  • [Mobile App for Android] Fixed: Crash on A53 during enrolment
  • [Mobile App for Android] Fixed: Deletion process is corrupted and causes unwanted unpairing of Workstation and Web accounts when the server has a pending authentication request
  • [Mobile App for Android] Fixed: QR Fallback activation code entry 'Submit' button is inactive
  • [Mobile App for iOS] Fixed: Email picker destination not available when log submission is disabled and multiple accounts paired
  • [Platform - Keycloak] Fixed: Keycloak authentication with 'UV=required' succeeds in Safari when the security key is not protected with a PIN
  • [Workforce Access Client - Both] Fixed: Incorrect WORKSTATION_CERTIFICATE_REQUESTED Event in the flow
  • [Workforce Access Client for macOS] Fixed: Client crashes when requesting certificate from AD
  • [Workforce Access Client for macOS] Fixed: Registration fails when Cert based authentication and User presence is disabled
  • [Workforce Access Client for Windows] Fixed: FIDO2 pairing disappears
  • [Workforce Accesss Client for macOS] Fixed: QR Fallback: macOS doesn't show proper error screen when the feature is disabled

8.1.0 - GA 2023-03-29​

New Features and Feature Changes​

  • [All HYPR] Custom FIDO2 WebAuthn Parameters

    • [API] Enforce WebAuthn parameters in end-user flows
    • [Control Center] Updated Device Manager flow based on custom WebAuthn parameters
    • [Control Center] New FIDO2 WebAuthn settings
    • [Platform - Keycloak] Updated flow based on custom WebAuthn parameters

  • [All HYPR] Fallback for QR Scan (Web)

    • [API] Adjust QR Fallback payload to specify 'qrFallbackMobileURL'
    • [Control Center; API] New endpoint to retrieve QR code payload
    • [Control Center; Events] Add Audit Events for QR Fallback
    • [Control Center] Configure QR Fallback options
    • [Control Center] Remove "Begin Pairing" and auto-refresh QR code in Device Manager
    • [Control Center] Update QR fallback server setting to True by default
    • [Control Center] Update QR Payload Response to Include Short URL
    • [Device Manager] Display QR Fallback Information for Web Registration
    • [Mobile App for Android] Add Manual Camera Access Text to Fallback Screen
    • [Mobile App for Android] Adjust QR Fallback Payload to Specify 'qrFallbackMobileURL'
    • [Mobile App for Android] Authenticate using device with QR Fallback
    • [Mobile App for Android] No Camera Access Fallback QR Flow
    • [Mobile App for iOS] Adjust QR Fallback Payload to Specify 'qrFallbackMobileURL'
    • [Mobile App for iOS] Register Device with QR Fallback
    • [Mobile App for iOS] Authenticate using Device with QR Fallback
    • [Mobile App for iOS] No Camera Access Fallback QR Flow
    • [Platform - Keycloak] Desktop: display QR Fallback information for web authentication
    • [Platform - Keycloak] Extend QR Fallback to Keycloak HYPR registrator
    • [Platform - Keycloak] Mobile: Display Dynamic Link fallback information for authentication
    • [SDK for Java] Adjust current QR functions to incorporate fallback functionality
    • [SDK for Java] Adjust Java SDK for respective QR Fallback response and request

  • [All HYPR] Security Improvements

    • [API] Safeguard against missed input validation
    • [Errors] Reduce details in error msgs
    • [Errors] Reduce details in error msgs
    • [Sample Web App] Fixed: Unauthenticated access to various APIs

  • [Control Center] FIDO2/WebAuthn: Passkey Detection

    • [Control Center] FIDO2: Extend model with Credential Backup State
    • [Control Center] FIDO2: Implement Credential Properties extension
    • [Control Center] FIDO2: Persist transport value on registration

  • [Control Center - Integrations] Azure: FIDO2 Mobile Authenticator - Early Access

    • [Control Center] Back End: Delete User Device
    • [Control Center] Back End: Native Azure Login Experience Go Live should not federate a domain
    • [Control Center] Back End: Move user from one status to another
    • [Control Center] UX: Hide "Enroll Users" and "Pending"
    • [Control Center; API] Back End: Azure backend API changes to user Enrollment
    • [Control Center; API] Back End: User Management API changes
    • [Control Center - Integrations] Back End: Add support in the Workforce Access Client Download (via Onboarding) to support new hypr.json config values
    • [Control Center - Integrations] Back End: Feature should be enabled
    • [Control Center - Integrations] Back End: Create new Status column in rp_registered_user
    • [Control Center - Integrations] Back End: Azure changes to Add Integration
    • [Control Center - Integrations] UX: Integration changes to status Enable/Disable
    • [Control Center - Integrations] Back End: Native Azure Login Experience Login Settings tab: restrict domains
    • [Control Center - Integrations; API] Back End: Create get integration configuration API
    • [Control Center - Integrations; Events] Back End: Enable FIDO2 Mobile Authenticator Events
    • [Control Center - Integrations; Events] Back End: FIDO2 Mobile Events for Deregistration and Reset
    • [Control Center - Integrations; Events] Back End: Fix Event integration type
    • Bug Fixes:
      • [Control Center - Integrations] Fixed: Azure: rp_registered_user status not updated after pairing device to the Workforce Access client
      • [Control Center - Integrations] Fixed: Azure: rp_registered_user status column gets updated from PARTIAL to FULL based on incorrect Event
      • [Control Center - Integrations] Fixed: Azure: user status not in the response when calling getUser on the registered user
      • [Workforce Access Client] Fixed: Downloaded client hypr.json contains install token scoped to default workstation rpApp
      • [Workforce Access Client] Fixed: User unable to successfully Pair with HYPR when QR Code scan; Keycloak data missing

  • [Control Center - Integrations] FIDO2 Mobile Authenticator Bug Fixes

    • [Mobile App for Android] Fixed: My Security Key not displaying login history
    • [Mobile App for Android] Fixed: FIDO2 authentication User Presence denial shows a registration failure message

  • [Control Center - Integrations] User Enrollment Drawer Enhancements

    • [Control Center - Integrations] User Management: When Pending/Enrolled, show an option for 'personal email' or 'sync email'
    • [Control Center - Integrations] UX Updates To "Pending Go-Live" Page
    • [Control Center - Integrations] Add "Send Manually" Tab
    • [Control Center - Integrations] Add personal email capabilities

  • [Control Center - Integrations] Web Hooks Refactor Into Unique SIEMs

    • [Control Center - Integrations] Event Hooks: Fix Splunk .SVG file in the integration tile
    • [Control Center - Integrations] Event Hooks: Create DataDog integration tile

  • [Control Center - Integrations; Mobile App for iOS] Include RADIUS Client Name in authentication confirmation

    • [Control Center] Add Note in Control Center about Friendly Name in authentication confirmation

    • [Control Center - Integrations; Mobile App for iOS] Display RADIUS Client Name in authentication request

    • [Control Center - Integrations; SDKs for Android, FIDO2, iOS; Workforce Access Client for Windows] FIDO2 Mobile Authenticator - Early Access

    • [Control Center] Implement FIDO2 Workforce Access Client pairing changes

    • [Mobile App for Android] Send FIDO2 Mobile Authenticator Events

    • [Mobile App for Android] QR Code Scan for HYPR Pairing (Device Binding)

    • [Mobile App for Android] Display User ID (email) after successfully pairing with HYPR

    • [Mobile App for Android] Check server configuration prior to Azure pairing/authentication

    • [Mobile App for Android] Update User ID (email) after successfully pairing with Azure

    • [Mobile App for Android] New registration type option "My Security Keys"

    • [Mobile App for Android] FIDO2 Integration updates

    • [Mobile App for iOS] Send FIDO2 Mobile Authenticator Events

    • [Mobile App for iOS] QR Code Scan for HYPR Pairing (Device Binding)

    • [Mobile App for iOS] Display User ID (email) after successfully pairing with HYPR

    • [Mobile App for iOS] Check server configuration prior to Azure pairing/authentication

    • [Mobile App for iOS] New registration type option "My Security Keys"

    • [Mobile App for iOS] FIDO2 Integration updates

    • [SDK for FIDO2] FIDO2 IntegrationuUpdates

    • [Workforce Access Client for Windows] Complete merge of Windows FIDO2 integration into the Workforce Access Client repo

    • [Workforce Access Client for Windows; Mobile App for Android]

    • Bug Fixes:

      • [Workforce Access Client for Windows] Fixed: FIDO2 - Unlock Azure account fails
      • [Mobile App for iOS] Fixed: FIDO2: Unable to complete Azure pairing

  • [Workforce Access Client for macOS] Security Keys Support for macOS

    • [Workforce Access Client for macOS] Fixed: Error messages are not displayed for security key PIN field validations
    • [Workforce Access Client for macOS] Unpair Security Key shows "This will unpair your smartphone" message
    • [Workforce Access Client for macOS] Integrate Yubico libraries
    • [Workforce Access Client for macOS] Update UI for security keys

  • [Workforce Access Client for Windows] FIDO2 Mobile Authenticator Workstation Unlock - Early Access

    • [Control Center; Events] Events for QR Code Pairing

  • [Workforce Access Client for Windows] Non-Exportable Private Keys / Certificate Template for Security Keys

    • [Workforce Access Client for Windows] Generate a private key on YubiKey
    • [Workforce Access Client for Windows] Option for a certificate template with a non-exportable private key

  • [Workforce Access Client for Windows] QR Fallback Bug Fixes

    • [Workforce Access Client for Windows] Fixed: QR Fallback: Windows doesn't show proper error screen when the feature is disabled
    • [Workforce Access Client for Windows] Fixed: QR Fallback: Server doesn't return a proper error code when when the feature is disabled
    • [Workforce Access Client for Windows] Fixed: QR Fallback: Registration fails on the latest 8.1 build
    • [Workforce Access Client for Windows] Fixed: QR Fallback: "Pair Manually" link does not work after clicking on Begin Pairing button
    • [Workforce Access Client for Windows] Fixed: QR Fallback: Clicking on “Back to QR scan” has no response and doesn’t navigate back to QR scan screen
    • [Workforce Access Client for Windows] Fixed: QR Fallback: If this feature is disabled, the standard QR registration flow fails until service is restarted
    • [Workforce Access Client for Windows] Fixed: QR Fallback: Information for Roaming Authentication

Enhancements​

  • [All HYPR] Global user: Java user model changes I; migrating to a new data structure
  • [Control Center] Add "Desktop SSO" capability to "Login Settings"
  • [Control Center] Error in client config causes a spike in hosted tenant error logs
  • [Control Center] FIDO2: Record transport on WebAuthn operations
  • [Control Center] Invalidate session when modifying user roles
  • [Control Center] Remove deprecated feature
  • [Control Center] Remove obsolete "Domain Joined Users" option in Control Center configuration
  • [Control Center; API] Add API token to QR login endpoint
  • [Control Center; Events] Audit Trail Fields with unknown values in Event logs should always be set to a blank/empty string
  • [Control Center - Integrations] FIDO2 Mobile Authenticator - Limit discovery to only registered devices
  • [Control Center - Integrations] Fix links to documentation in our integrations
  • [Control Center - Integrations] RADIUS Configuration
  • [Control Center - Integrations] RADIUS Server Management
  • [Control Center - Integrations] Removing validation for keyAgreementPublicKey and keyAgreementPublicKeyAUTH when FIDO2 Mobile Authenticator is enabled
  • [Control Center - Integrations] Removing validation for loginCert when FIDO2 Mobile Authenticator is enabled
  • [Control Center - Integrations] Removing validation for signingCert when FIDO2 Mobile Authenticator is enabled
  • [Control Center - Integrations] Update mouse-over on "Current Integrations" -> "Options" to say "Login Settings"
  • [Mobile App - Both] Support button label
  • [Mobile App for Android; SDK for Android] Notifications on Android 13 and target 33
  • [Platform - CVE Fixes] CVE-2022-3064, CVE-2022-45143
  • [Platform - CVE Fixes] CVE-2023-1370: Fix for json-smart lib and nimbus-jose-jwt lib
  • [Platform - Keycloak] Cookies are not being created for the username
  • [Platform - Keycloak] Create Enable Keycloak Modules feature
  • [Platform - Redis] Clear error handling for Enterprise Redis
  • [Platform] Support for multi-region installations
  • [Sample Web App] Allow options for initial registration
  • [Sample Web App] Update public docs
  • [SDK for Android] Allow background to cancel registration
  • [SDK for Android] Manual Registration (QR Fallback) button visibility config
  • [Workforce Access Client for macOS] Mitigate privilege escalation in HyprOneService
  • [Workforce Access Client for macOS] Support for macOS Ventura
  • [Workforce Access Client for Windows] Import latest ykpiv code from Yubico

Bug Fixes​

  • [Control Center] Fixed: Audit messages from workstation are being mangled
  • [Control Center] Fixed: FIDO2 Settings UI updates
  • [Control Center] Fixed: Not possible to login to Control Center with a FIDO2 device
  • [Events] Fixed: Remove value from ExtensionConfigAttribute.toString() for sensitive or redacted attributes
  • [Control Center - Integrations] Fixed: Azure: Domain gets federated on error
  • [Control Center - Integrations] Fixed: Google Workspace: Can't create integration with name that includes spaces
  • [Control Center - Integrations] Fixed: Google Workspace: SSO info not cleared from Google Workspace upon deleting integration
  • [Control Center - Integrations] Fixed: OneLogin: User loses HYPR roll when integration gets disabled, if they were added when integration was live
  • [Control Center - Integrations] Fixed: Ping DaVinci: Fix link/text for Support documentation
  • [Control Center - Integrations] Fixed: Ping DaVinci: Protocol itself needs validation
  • [Control Center - Integrations] Fixed: QR authentication fails after updating integration
  • [Control Center - Integrations; Events] Fixed: Some Events are missing integrationType and integrationProvider information
  • [Mobile App - Both] Fixed: Browser log in into Device Manager succeeds on but the browser never accesses Device Manager
  • [Mobile App for Android] Fixed: Android app must set device ID for FIDO2 authenticator
  • [Mobile App for Android] Fixed: ArrayIndexOutOfBoundsException on permission check; notification permission checker fixed
  • [Mobile App for Android] Fixed: Offline PIN fails to display after successful authentication for the paired workstation
  • [Mobile App for iOS] Fixed: rpApp displays instead of RADIUS Client Name in Authentication Request
  • [Platform - Keycloak] Fixed: Bug in keycloak does not remember user from previous authentication
  • [Platform - Keycloak] Fixed: Realm name limitation is 36 characters; we need to verify that that we build it correctly
  • [Platform - Keycloak] Fixed: UI issue on the Web browser and Mobile browser login pages
  • [Sample Web App] Fixed: Implement CSRF protections
  • [Sample Web App] Fixed: Unable to login with appless QR code after logging out of the sample app
  • [Sample Web App] Fixed: Update jQuery version
  • [Workforce Access Client for macOS] Fixed: Login dialog doesn't disappear when using TouchID
  • [Workforce Access Client for Windows] Fixed: FIDO2 pairing disappears
  • [Workforce Access Client for Windows] Fixed: Import latest ykpiv code from Yubico
  • [Workforce Access Client for Windows] Fixed: Windows Update breaks the user presence check during registration