What's New in Imprivata OneSign 23.3
Imprivata OneSign® 23.3 contains the following new features and technology updates.
NOTE:
New Features
Number Matching Authentication
You may configure Imprivata Confirm ID to require users enter a 2-digit code into Imprivata ID when authenticating for Imprivata WebSSO and Remote Access Cloud. Number Matching provides a greater level of protection against MFA fatigue attacks, keeping your digital assets out of the hands of bad actors.
G4 Appliances Support VMware vMotion for OneSign 23.2 and Later
Imprivata G4 (fourth generation) appliances support VMware vMotion for OneSign 23.2, 23.3, and later releases. vMotion support enables the seamless and live migration of G4 appliances (ESX virtual machines) across physical hardware servers for purposes such as traditional server maintenance operations, hardware refreshes, and workload re-balancing.
OneSign 23.3 is Last Release to Support Direct Migrations from G2 to G4 Enterprises
OneSign 23.3 is the last major OneSign release that supports direct migrations from G2 (second generation) to G4 (fourth generation) enterprises. For procedures to migrate from a G2 to a G4 enterprise, see "Migrating to a G4 Enterprise" in the Upgrade Portal. Rollback from a G4 enterprise to a G2 enterprise is not supported.
OneSign and Confirm ID 7.11 and Later Releases Run Only on G4 Appliances
OneSign 7.11, Confirm ID 7.11, and later releases of those products run only on G4 (fourth generation) appliances in a G4 enterprise. If you’re running G3 (third generation) appliances in a G3 enterprise, or G2 (second generation) appliances in a G2 enterprise, and you want to upgrade to 7.11 or later, you must instead migrate to a G4 enterprise. You can install 7.11 or later as part of the migration process. For procedures to migrate from a G3 or G2 enterprise to a G4 enterprise, see "Migrating to a G4 Enterprise" in the Upgrade Portal.
Note that there are significant differences between G3 (or G2) and G4 appliances and sites. For information on G4 appliances, see
Rollback from a G4 enterprise to a G3 or G2 enterprise is not supported.
Technology Updates
Qualifications and Certifications
Microsoft 2020 LDAP Channel Binding and LDAP Signing Updates
While Microsoft has not announced a release date for their planned update to LDAP channel binding and LDAP signing requirements, it is recommended that Imprivata administrators verify that their Imprivata directory (domain) connections are configured for SSL. When the update is applied, any directory connection that is not configured for SSL may fail.
To verify the connection settings, go to the Directories page (Users menu > Directories) and open the required domain. Verify that Use TLS for secure communication is selected.
TLS Support
As part of Imprivata's continuing effort to increase our security posture, beginning with the 7.4 release, Imprivata disables the use of older TLS versions 1.0 and 1.1 for all G3 appliance communications.
For more information on TLS usage, see the "About TLS Communication" topic in the Imprivata Online Help.
Imprivata OneSign API Access
As part of Imprivata's continuing effort to increase our security posture, there are two modes of API access through the Imprivata OneSign ProveID Web API and ProveID Embedded:
-
Full
-
Restricted
In restricted mode, access to Password and UserAppCreds resources are disabled. A ResourceRequest that includes an attribute id of Password or UserAppCreds returns a response with a message stating that access is restricted and status code 403.
The settings to manage API access are on the API access page in the Imprivata Admin Console.
Imprivata Google Chrome Extension
The Imprivata agent continues to install the Chrome extension for SSO, but no longer enables it.
If you plan on installing Imprivata agents on new endpoints or upgrading existing Imprivata agents, you must enable/allow the extension using a Microsoft Active Directory GPO. Per the Chrome Safe Browsing Policy, a GPO is the only supported way to enable extensions silently.
NOTE: For complete details on enabling the Chrome extension, see "Support for Applications that Run in Google Chrome" in Imprivata OneSign help.
Support for ForceAuthN Attribute in OneSign WebSSO Integrations
ForceAuthN would typically be used when designing a SAML-enabled app to integrate with Imprivata OneSign WebSSO. Use the ForceAuthN attribute when a clinician must authenticate during a clinical workflow, while preserving their browser login.
Upgrade Considerations
Imprivata Platform Update - G4 Appliances
An upgrade to 23.3 requires that you install the Imprivata platform update (virtual-applianceG4-IMPRIVATA-2023-3-1.ipm) before upgrading the G4 appliance.
The platform update provides infrastructure, communication, and security improvements which must be in place before you upgrade.
Take note of the following considerations:
-
This platform update is supported on Imprivata OneSign 7.10 and later as part of the upgrade process or as a standalone update. If desired, you can install and distribute this platform update to your appliances without having to upgrade.
Use one of the following methods for uploading:
-
Upload the platform update files from a file server connected to the appliance. This is the preferred method for updating the appliances.
-
If you cannot use a file server, and need to upload the IPM from your local computer, using the Imprivata Appliance Console > Packages tab.
-
The upgrade from 7.8 or 7.9 to 23.3 requires that you must first upload the provided increasePHPmaxPOST-2022-3-1.ipm. This small platform update temporarily increases the maximum PHP file upload size, allowing you to then upload the virtual-applianceG4-IMPRIVATA-2023-3-1.ipm file.
-
The upgrade from 7.10 through 7.12 to 23.3 does not require the increasePHPmaxPOST-2022-3-1.ipm be uploaded first. You can simply upload the virtual-applianceG4-IMPRIVATA-2023-3-1.ipm platform update file
-
For more information about upgrading to 23.3, see the Imprivata Upgrade Help.
Considerations
The following sections describe changes in behavior in
Database Replication Status Icon and Text are Improved for G4 Service Appliances
An icon used to show database replication status in the Status box on the Imprivata Admin Console is improved. For G4 service appliances, that icon is now a gray circle with a white interior. The icon indicates that a G4 service appliance does not have a database and therefore database replication status is not applicable to that appliance. In contrast, the icon of a green circle containing a white check mark still indicates that database replication is occurring normally for a G4 database appliance.
On the Sites page of the Imprivata Admin Console, the former Status column is now relabeled as database Replication Status to improve clarity. For a site having only a G4 service appliance, the database replication status value is now displayed as "Not applicable".
New Appliances on Non-DHCP Networks Get Prepopulated Host and Domain Names
When you set up a new G3 or G4 appliance on a network that does not use DHCP, then in the Appliance Setup Wizard process, under System Information, the Host Name and Domain Name fields get prepopulated with values localhost and localdomain. Previously, in
Secure Walk Away – Imprivata ID Sensitivity Control May Need Adjustment for Nordic BLE Receiver
Imprivata Secure Walk Away added support for a Nordic Bluetooth Low Energy (BLE) receiver in Imprivata OneSign and Imprivata Confirm ID 7.11. The Bluetooth receiver sensitivity may vary for different mobile devices. If your users report that their workstations lock because Secure Walk Away does not detect their mobile devices, adjust the Secure Walk Away – Imprivata ID Sensitivity slider control in the computer policy assigned to those workstations. For more information, see topic
