Main new features

Anchor
Main-new-features Main-new-features

End-to-end ECC support 

In Germany, the Federal office of Information Security (BSI) advises to use a minimum of 3000 bits key length for RSA keys from the beginning of 2023. However, the longer keys have some drawbacks, for example, it will take longer time to generate and use more space on the cards. An alternative is to use Elliptic Curve (ECC) keys instead. 

Previous versions of Identity Manager supported elliptic curve cryptography for some middleware programs and some Certificate Authorities (CAs).  

Identity Manager 5.0.0 supports key archival of ECC keys with Certificate Manager and support of ECC keys with Nexus Personal Desktop Client. This feature will help existing customers benefit from ECC keys without changing their general setup. 

Entra connector 

Microsoft Entra is widely used to hold employee master data. Identity Manager needs to synchronize with employee master data so that it always has the latest information on the employees data set and send the latest information about corresponding cards and certificates. 

Identity Manager currently supports various HR systems and LDAP directories to synchronize. With the new connector, an Identity Manager setup will be possible in an environment where Microsoft Entra holds employee master data. The connection is established via SCIM datapools and the new Entra connector.

For more information, see Set up Microsoft Entra connector.

Responsive self-service portal

Smart ID Self-Service (Smart ID Self-Service) is the interface of Identity Manager that end-users interact with. It is a web portal used by all the persons whose identity is managed and has a large number and range of users.

Here are example use cases that can benefit from the improved responsiveness in the Self-Service portal:

• Access Smart ID Self-Service on mobile phone whenever that is more convenient

• Organizations where users have Chromebooks as their primary device

• A truly responsive design also helps visually impaired people that use large zoom factors.

• The responsive design enables mobile use cases around Physical ID where action is needed on site.

New BPMN engine 

Identity Manager includes a workflow engine where the processes around card and credential’s management are custom built. This makes Identity Manager more flexible. 

As Activiti 5 is no longer supported, the BPMN engine has been switched to Flowable. The new engine improves performance and parallelization and provides new possibilities to be explored, for example, forms editing and process monitoring. Editing processes will be simplified with the new Nexus Process Modeler that can be used as a separate application as well as from inside Identity Manager Admin. 

Flowable is available as an open source version and as a commercial version called “Flowable work”. There is a community ensuring further development of the product. 

Configurations made for Activiti can be run with the new Flowable engine to ensure upgrading. The migration is done automatically, see Upgrade Smart ID Identity Manager from 23.10.9 to 5.0.1.

Bootstrapping validation 

Smart ID Identity Manager is a security application based on public key infrastructure. It uses keys and certificates to encrypt secrets managed within the application, to sign the object history to make it audit proof, and other key related use cases. All these keys and certificates need to be created and moved to the right places - a procedure known as bootstrapping. As it is crucial for the security of the application that secure keys are used, a validation of the bootstrapping has been introduced. Demo-keys are no longer delivered with the software. This increases the effort in setting up demo and test systems but protects productive systems from accidently using publicly known keys.

To help first-time bootstrapping and get instructions for changing compromised keys and certificates later, see Bootstrapping the sign and encrypt engine.

Removed features and changes in delivery

Anchor
Removed-features-and-changes-in-delivery Removed-features-and-changes-in-delivery

 

Support for encodings of USB tokens via Card SDK is discontinued 

The support for encodings of USB tokens via Card SDK is discontinued.

A workaround for the Java bug https://bugs.openjdk.org/browse/JDK-8026326 (implemented in CRED-13615) was removed, as it is incompatible with Java 17 and above and thus prevents moving forward with support for newer Java versions. This bug causes errors in the reader detection once the last remaining reader has been removed or disabled and it, or another reader, is added or connected again during the lifetime of the Java process. In this case the smartcard service is restarted, which Java fails to handle gracefully.

USB tokens integrate the PKI chip and the reader in one device, so they tend to be affected by this issue, unlike PKI encoding on smart cards, where the reader remains connected. PKI encoding of USB tokens can be handled by Smart ID Desktop App instead.

For more information, see Upgrade Smart ID Identity Manager from 23.10.9 to 5.0.1.

Support for some CardOS related encodings has been removed 

Support for OsVersionField and PackageInformationField has been removed from encoding descriptions. This feature was specific to CardOS smart cards. APDU commands can be used to get the same result.

For more information, see Upgrade Smart ID Identity Manager from 23.10.9 to 5.0.1

Deprecation of Service Task "Cert: Update Certificate State from CRL"

The service task "Cert: Update Certificate State from CRL" (delegate expression) ${updateCertificateStateFromCRLTask}is no longer recommended to be used as severe performance problems are likely to happen. Instead, it is recommended to push CRLs from the CA.

For Certificate Manager and Identity Manager the procedure is described here: Push CRL from Certificate Manager to Identity Manager

Configuration files excluded from the Smart ID package 

The configuration files SmartID-xxx-configuration.zip are no longer delivered with the Smart ID package. These configuration files were the basis of the Smart ID Workforce module. They are replaced by the