BeyondInsight and Password Safe 26.3 release notes

Application Connection Sets let a remote application draw credentials round-robin from a pool of managed accounts instead of a single account, so concurrent users no longer share or take over the same session. You define the set, add the managed accounts that belong to it, and specify the target server and port the application connects to, such as a Remote Desktop Services host.

• Password Safe assigns the next available account in the set when a session starts and blocks the session request when every account in the set is in use.
• A global session cooldown buffer of two minutes prevents an account from being reassigned immediately after a session ends.

ℹ️

For more information, see Configure Application Connection Sets for Remote Applications.

You can now store a time-based one-time password (TOTP) secret key alongside a credential, view the current code, and copy it when you sign in to a target application. This removes the need to keep authenticator secrets outside of BeyondInsight.

• Store a TOTP secret on a credential in Secrets Safe, then view and copy the current code from the web console or retrieve it through the API.
• Copy or autofill the code directly from the Workforce Passwords browser extension.
• Use TOTP as the multi-factor method when checking out a Password Safe managed account.

ℹ️

The maximum length of the TOTP secret key differs by credential type:

• 1024 characters in Secrets Safe
• 255 characters for Password Safe managed accounts.

For more information, see Store TOTP secret key in Secrets Safe.

Reporting and subscriptions features in on-premises deployments are now more closely aligned with the experience available in Password Safe Cloud. This is foundational work required to remove the Analytics & Reporting feature’s dependency on SSRS and includes some exciting new features for on-premises customers.

• Report Subscriptions can now be delivered as file downloads, either from an interactive grid or via the Public API
• Report Subscriptions now offer an email delivery method that does not rely on SSRS, in which a link to the file download is sent by email.
• Report subscriptions now support the creation, editing, and viewing of a logical custom name, making it easier to tell apart multiple subscriptions for the same report
  • When editing report subscriptions, the selected parameter values used for the report can now also be modified
  • Reports that are not available without SSRS have been deprecated. Equivalent non-SSRS reports have been added wherever possible.

🚧

Important

• These changes apply to on-premises deployments. These new capabilities are already available in Password Safe Cloud, which does not and has never relied on SSRS.
• These new features do not apply to subscriptions created for reports in the DEPRECATED folder.
• You cannot edit subscriptions for deprecated SSRS reports, and those subscriptions do not support a logical custom name. Shared folder and email delivery remain the only options for those subscriptions.

For more information, see Analytics and Reporting.

The Smart Rule editor now keeps your selections consistent as you page through and filter a selection grid, and the Smart Rules page loads reliably regardless of the reprocessing limit a rule holds.

ℹ️

For more information, see Smart Rules: Configure.

The Create Smart Rule button now opens a selection list so you choose the Smart Rule type before the configuration form opens. This makes the available rule types clear up front and reduces the chance of creating a rule of the wrong type.

ℹ️

For more information, see Create Smart Rules type.

The Analytics and Reporting Configuration Wizard includes an optional step that backs up existing report subscription details from the Report Server database, so subscription configuration is preserved when you reconfigure reporting.

This feature does not create new subscriptions. Instead, it provides subscription information that helps users manually recreate existing subscriptions.

🚧

Important

This change applies to on-premises deployments only.

Reporting continues to receive targeted performance work across releases. The following reports and items include performance enhancements:

• Smart Group parameter filter dataset on all reports
• Secrets Safe Entitlement Report
• Managed Account Password Age Report
• Account Password Age by Last Scan
• Password and Session Activity Report limit increase from 50,000 to 250,000 rows.

• Time-based one-time codes (TOTP) for Secrets Safe credential secrets
  A credential secret can now carry a TOTP configuration, and the current code can be retrieved through the API.
  • GET /api/public/v3/secrets-safe/secrets/{secretId}/totp/code: Returns the current one-time code with its validity window (Code, ValidFromUtc, ValidToUtc).
    Requires Secrets Safe (Read) or Workforce Passwords (Read).
• New request body version 3.3
  There is a new request body on version 3.3 to the following API endpoints:
  • POST /api/public/v3/secrets-safe/folders/{folderId}/secrets
  • PUT /api/public/v3/secrets-safe/secrets/{secretId}

Version 3.3 adds TotpEnabled and TotpSecretKey to the credential body. TotpSecretKey accepts a Base32 key or an otpauth:// URI and is required when TotpEnabled is set to true.

On update, null leaves the setting unchanged, false disables it, and true provisions or replaces it. The secret key is never returned in any response.

Secret response models now also return TotpEnabled and TotpParameters (Digits, PeriodSeconds).

• Connection Set credentials on applications
  
  GET application responses now include the ConnectionType property, which identifies the credential type used by the Application Session. The property returns the following:
  • ManagedAccount
  • FunctionalAccount
  • ConnectionSet for round-robin credential assignments