UCMS 4.17/UP 2.12 Release Notes

Product versions included in this release:

• UCMS v4.14, 4.15, 4.16, and 4.17

• UP v2.9, 2.10, 2.11, and 2.12

UCMS 4.17

New Features

FIPS-Compliant Cryptography

As part of our dedication to ensuring our solution meets FedRAMP authorization requirements, we've upgraded all of our cryptography libraries with their FIPS-compliant versions. You can now configure UCMS to rely exclusively on FIPS compliant cryptography.

Support for Multiple AD Identities Mapped to a Single Authenticator

Axiad now supports users with multiple AD identities that are mapped via user SIDs to a single authenticator, in support of the recently-introduced Microsoft KB5014754 certificate-based authentication changes to Windows domain controllers.

• SIDs Configured via a SCIM or AD User Source: When the SID is configured in your SCIM or AD data source, it will be automatically included in all certificate requests for card slots that are configured in a workflow.

• Alternatively, you can opt to use a custom attribute to insert a custom value via a new Custom SID column on the Certificate Workflow’s Configure Workflow Steps > Certificates page: In this field, you can:

  • leave the field blank: UCMS will automatically retrieve the SID and insert it into the PIV Authentication slot, as described above.

  • enter a custom attribute that is defined in your user source.

    • UCMS reads a custom attribute for the current user (such as {user_custom1}) to retrieve a custom SID.

    • This custom attribute can come from either an Active Directory or a SCIM user source.

    • If the custom attribute is empty, or set with an incorrect value (for example, an invalid format), the device issuance fails.

      You can configure as many custom SIDs as there are certificate slots available, and the device will issue with each authentication certificate that presents the expected SID. This process works with all Axiad-supported PKI providers.

Read more about this feature’s experience here.

UCMS-Installer PowerShell module

For Windows-based deployments, Axiad is introducing a new UCMS-Installer PowerShell module. This module automates and simplifies many steps, and, as a result, we've removed the following files from the UCMS > archive folder:

• bin\encrypt.bat

• bin\install_service.bat

• bin\migration.bat

• bin\oauth.bat

• bin\uninstall_service.bat

• schema\load-db.ps1

• schema\load-db-config.xml

• schema\README.txt

The UCMS-Installer PowerShell module is available from your Customer Success representative.

Support for Offline PIN Reset via a Challenge/Response with IDEMIA 8.2 Cards

Please see the UP release notes below for details on the user experience. From an administrative standpoint, you can set a preferred PIN reset method for your IDEMIA 8.2 cards by creating and configuring a new parameter, Preferred offline unlock on the Parameter Management page in UCMS.

Enhancements

User Groups Are No Longer Exclusive From Each Other in Workflows

Groups that you use in your organization to assign UCMS workflows to users are no longer exclusive. A new priority attribute allows you to decide which workflow should take precedence when multiple ones apply to a given user.

Feature Removal: Device Actions in UCMS

The following device management actions have been removed from the UCMS Operator Portal, and are no longer available:

• Device Scan > Card Security > GP Lock

• Device Scan > Card Security > GP Unlock

• Device Scan > Card Security > Reset

The following device management actions are now handled exclusively via the Unified Portal’s Help Desk and/or MyIdentities pages.

Feature Removal: API v1

As of this release, we no longer support version 1 of the UCMS REST API.

Feature Removal: Legacy Devices and Tools

As of UCMS 4.16, we no longer support the following:

• YubiKey Neo

  • We no longer support the YubiKey Neo device.

  • You can no longer create or manage a YubiKey Neo credential profile.

  • The YubiKey Neo option has been removed from the Add Credential Profile option on the Credential Profile page.

  • The Create Yubikey Neo Credential Profile privilege on the Configuration Management > Role Management > Access Privileges page has been removed.

• JCOP

  • Generic JCOP devices are no longer supported in UCMS.

  • You can no longer create or manage a JCOP credential profile.

  • The JCOP and JCOP3 applet types have been removed from the Add Credential Profile option on the Credential Profile page.

  • The Create JCOP Credential Profile privilege on the Configuration Management > Role Management > Access Privileges page has been removed.

As of UCMS 4.17, we no longer support the following:

• the legacy CMS import tool

Support Deprecation: 3DES Keys in HSMs

As of December 2024, NIST no longer approves the use 3DES keys in any FIPS-compliant environment. We are updating our product to align with these new security guidelines. UCMS will continue to support legacy devices in the field that are using such keys.

Bug Fixes

Known Issues

UP 2.12

New Features

FIPS-Compliant Cryptography

As part of our dedication to ensuring our solution meets FedRAMP authorization requirements, we've upgraded all of our cryptography libraries with their FIPS-compliant versions. You can now configure UCMS to rely exclusively on FIPS compliant cryptography.

Support for Offline PIN Reset via a Challenge/Response with IDEMIA 8.2 cards

If enabled in your organization, when using IDEMIA 8.2 cards, you can use either the PIN Unblocking Key (PUK) functionality and/or reset your PIN via a challenge question and response prompt. Enterprises can set a preferred method for devices that support both mechanisms.

This option is available to all IDEMIA 8.2 cards. If you have an existing, enrolled IDEMIA 8.2 card, the challenge/response prompt will be available for you (if your organization enables it).

User-Friendly Device Names for Your UCMS-Managed Identity Devices

You can now rename all of your own certificate-based identity devices issued in the Unified Portal (including Gemalto and IDEMIA smart cards, YubiKeys, and Virtual Smart Cards) with custom, user-friendly names.

New "LEGIBLE ID" Column in the MyIdentities and Reporting Pages

If your organization issues IDEMIA cards via UCMS, you can use a new column, LEGIBLE ID, to display the card's printed serial number. This makes it easier to compare what's listed in your device list to the physical card itself.

• For existing devices, the ID will not display the first 10 digits of your IDEMIA card (the BAP number and the IC embedded date), as we did not previously store this data. For example, if your existing card number is 123456-7890-1234567890, it displays in the LEGIBLE ID column as XXXXXX-XXXX-1234567890.

• For new devices, we will display all digits of your IDEMIA card, including the BAP number and IC embedded date. For example, if your new card number is 123456-7890-1234567890, it displays in the LEGIBLE ID column as 123456-7890-1234567890.

Bug Fixes

Article History