AD Bridge 26.2 release notes

🆕 New features

Support for the mod_auth_gssapi Apache module

The Apache integration workflow now aligns with the publicly available mod_auth_gssapi module, validated on RHEL 9 and Ubuntu 24.04. Integration guidance is updated to match.

Windows installer components use .NET 10

BeyondTrust Bridge and Windows installer components now run on .NET 10, keeping AD Bridge on a supported runtime as earlier .NET versions approach end of life.

RC4 removed from authentication and domain join protocols

AD Bridge no longer uses RC4 in authentication and domain join protocols, in preparation for Microsoft's deprecation of RC4 in Active Directory.

The change spans Kerberos configuration and encryption-type handling, along with protocol-level updates to SAMR, Netlogon, Schannel, WKSSVC, machine password changes, and NTLM message protection. Together, these reduce reliance on legacy cryptography and improve your security posture.

✨ Enhancements

SELinux policy for Amazon Linux 2023

AD Bridge now includes an SELinux policy for Amazon Linux 2023.

Amazon Linux 2023 ships with SELinux enabled by default. Previously, you had to set SELinux to permissive mode and manually create a policy before AD Bridge could install and operate. The installer now imports the SELinux policy module automatically, so AD Bridge installs and runs in enforcing mode without manual intervention.

RC4 encryption types removed from krb5.conf

AD Bridge no longer includes RC4-HMAC in the preferred encryption types in krb5.conf. This applies to new domain joins and to upgrades.

Supported encryption types are now AES256-CTS, AES128-CTS, CAMELLIA128-CTS, and CAMELLIA256-CTS.

RC4 is a weak algorithm, and this change aligns with Microsoft's deprecation of RC4 in Active Directory.

Elasticsearch suffix option replaces the date-stamped index name

When you configure the Elasticsearch event forwarding suffix in Database Utilities, the suffix value now replaces the date-stamped index name instead of being appended before the date.

This enables alias-based index lifecycle management. You can configure a static suffix, such as current, to write all events to a fixed index name such as adb-eventlog-current, allowing Elasticsearch alias rotation without disrupting event ingestion or existing queries.

ℹ️
The default date-stamped index behavior is unchanged for deployments that do not use a suffix.

Refresh button in the BeyondTrust Bridge console

The BeyondTrust Bridge console now includes a Refresh button on every page. Previously, you had to navigate away from a page and back to see updated data. Refresh reloads the current page data on demand without losing your place in the console.

SELinux policy and platform support for SLES 16

AD Bridge now supports SUSE Linux Enterprise Server (SLES) 16, including a purpose-built SELinux policy for enforcing mode and support for the new /usr/etc configuration layout. AD Bridge writes all edits and backup files to /etc, leaving /usr/etc untouched.

ℹ️
If you use the MOTD Group Policy, add session optional pam_motd.so to /etc/pam.d/common-session. SLES 16 does not include this in the PAM stack by default.

Improvements to pbis-support.pl

The pbis-support.pl script includes the following improvements:

Improved sshd detection on newer systems. The script now detects sshd correctly on RHEL 9 and later, Rocky 10, Oracle 10, Alma 10, Ubuntu 22.04 and 24.04, and SLES 15 SP7 and later. These distributions use a prefixed ps output format for sshd, which previously caused the script to report sshd as not running.
Collects pam_access configuration. Support packs now include /etc/security/access.conf, if present, giving BeyondTrust Support visibility into host-based access control rules that can affect AD user login.

SHA-256 file digest for RPM packages

AD Bridge RPM packages now use SHA-256 as the file digest algorithm, replacing MD5. This ensures RPM package verification succeeds on systems running in FIPS mode, where MD5 is not permitted.

The change applies to all supported RPM architectures: x86_64, aarch64, ppc64le, and s390x. Package signatures use RSA/SHA-256. You can verify package integrity by running rpm -v --checksig <package file>.

🛠️ Issues resolved

Product area	Description	Resolution
Platform compatibility and SELinux	On RHEL 10 and Rocky Linux 10, AD users could not log in at the console (GUI or Ctrl+Alt+F3) when SELinux was in enforcing mode.	The SELinux policy for RHEL 10 and Rocky Linux 10 now permits AD user console login in enforcing mode.
Authentication and login	On Ubuntu 26.04 and other distributions running OpenSSH 10.x, SSH sessions for AD users ended before the password prompt appeared.	The PAM module no longer changes the case of the domain portion of the username, so UPN, NT4, and short-name login formats authenticate successfully.
System configuration and policy	The MOTD Group Policy removed leading whitespace from the first line of the message of the day, breaking ASCII art and custom banner formatting.	The MOTD Group Policy now preserves all leading whitespace on the first line, displaying banner content exactly as configured.
System configuration and policy	On Rocky Linux 10.2, SELinux blocked SSH login for AD users in enforcing mode.	The SELinux policy for Rocky Linux 10.2, RHEL 10.2, and Alma Linux 10.2 now permits `sshd-session` to communicate with AD Bridge socket files in enforcing mode.
System configuration and policy	On RHEL 8, RHEL 9, and Oracle Linux, the Auditing and Reporting Group Policy added legacy `$ModLoad` directives to `/etc/rsyslog.conf`, disrupting rsyslog communication with other processes. Manual corrections were reverted at the next Group Policy refresh.	The Group Policy no longer writes `$ModLoad` or `$ActionFileDefaultTemplate` directives to `/etc/rsyslog.conf`. Only the syslog-reaper pipe entries are added.
System configuration and policy	The syslog Group Policy appended duplicate entries to `syslog-ng.conf` using invalid triple-dot level range syntax, causing syslog-ng to fail to start.	The Group Policy now writes the correct double-dot level range syntax and does not duplicate existing syslog-reaper entries.
System configuration and policy	On RHEL 10.2, Alma Linux 10.2, and Rocky Linux 10.2, domain join displayed an "Unknown PAM configuration" warning for the switchable-auth service.	The PAM configuration module now recognizes switchable-auth as a non-authentication service, and domain join completes without warnings.
Machine password changes	After a machine password change, saving the new password to Active Directory failed with an `LDAP_LOCAL_ERROR(-2)` error following an extended domain controller outage.	The machine password change process now acquires a fresh TGT using the new password and uses the machine credentials cache before saving the updated keytab.
Machine password changes	The machine password change process deadlocked when the machine sync thread attempted to acquire a read lock while already holding a write lock.	The machine password read lock now detects when the calling thread already holds the write lock and proceeds without re-acquiring it.
Licensing	When the license container held more than 1,000 license keys, agents failed to acquire a license and defaulted to a basic license.	License container queries now use LDAP paged results, so agents acquire a license regardless of the number of keys in the container.
BeyondTrust Bridge console	Searching by UID or GID on the Users page returned an error when the search schema loaded before Entra ID authentication finished initializing.	UID and GID search on the Users and Groups pages now works reliably on first navigation.
BeyondTrust Bridge console	Rapidly clicking the Users navigation item displayed an "Unexpected exception occurred" error dialog.	The Users page no longer displays an unexpected exception error when you navigate to it quickly.
BeyondTrust Bridge console	When you deployed the Entra ID app registration for the first time, the client secret received a non-descriptive name containing only the hostname.	The initial client secret name now includes both the username and the hostname.
BeyondTrust Bridge console	The UID and GID search fields accepted an unlimited number of characters, allowing excessively long numeric values that could not return valid results.	UID and GID search fields are now capped at 2,147,483,647, and text search fields are limited to 256 characters.
BeyondTrust Bridge console	Logging in from the account icon while on the User Management page did not refresh the page, leaving the Users and Groups tiles non-clickable.	The User Management page now refreshes automatically after login, making the Users and Groups tiles immediately clickable.
Domain join and error handling	The offline join workflow left the AD authentication provider in an Unknown state after the join completed.	The offline join script now parses site information correctly, and lsass tolerates a missing `ClientSiteName` value by treating it as equivalent to no site assignment.
Domain join and error handling	On RPM-based systems with a minimal installation and SELinux enforcing, the installer completed without applying the SELinux policy.	The RPM installer now checks for required SELinux utilities during preinstall and displays a message directing you to install `policycoreutils-python-utils` when they are missing.
Domain join and error handling	Querying Entra ID groups by ID while offline with an empty cache returned a generic unknown error.	The group lookup command now returns a descriptive connectivity error when the Entra ID endpoint is unreachable.