Password Safe ECM Plugin 26.3.1 release notes
🆕 New features
Configurable authentication token cache lifetime
A new optional authTokenCacheTtlMinutes app setting controls how long the plugin retains cached authentication tokens. Set it above 0 to expire cached tokens after that many minutes.
- Omit the setting, or set it to 0, to keep the existing never-expire behavior.
- Set
disableAuthTokenCaching=trueto disable the token cache entirely.
✨ Enhancements
Caller identity enforcement on credential operations
Credential retrieval and credential-used notifications now verify that the requesting user encoded in the credential ID matches the authenticated representative, and deny mismatched requests. The plugin normalizes both DOMAIN\username and username@domain formats before comparison.
Composite credential ID integrity
Composite credential IDs are protected with an HMAC derived from the per-site API key. An embedded configuration name can no longer be tampered with to reach another site's configuration.
Stronger token cache encryption
Cached tokens are encrypted with AES-256-CBC using PBKDF2-SHA256 key derivation, 100,000 iterations with a random per-value salt, and authenticated with HMAC-SHA256 verified in constant time. Previously, key derivation was unsalted and the ciphertext was unauthenticated.
Authentication token cache isolation
The cache key is now length-prefixed, which eliminates a collision case in which two different username and domain combinations could resolve to the same key and be served each other's cached token.
RunAsUser input validation
The plugin validates the username submitted in the sign-app-in request and rejects control characters and the PS-Auth parameter delimiter, which could otherwise alter the outbound authorization header.
All other characters are accepted, including those required by Microsoft Entra and Active Directory user principal names (UPNs).
Encryption key protection
The credential store encryption key is protected with the Data Protection API (DPAPI) rather than stored alongside the data it protects.
Wildcard endpoint filter hardening
Wildcard endpoint filters are fully escaped so that only * is treated as a wildcard, and matching runs under a 1-second timeout.
Matching behavior for ordinary hostnames and IP addresses is unchanged.
TLS configuration scoped to the plugin
The plugin no longer alters TLS settings for the entire Endpoint Credential Manager (ECM) host process. It sets an explicit TLS 1.2 or higher floor on its own HTTP client and scopes the certificate validation callback to that client.
Configuration deserialization
Configuration deserialization uses DataContractSerializer in place of BinaryFormatter. A one-time migration runs when you upgrade.
Case-insensitive multi-site configuration names
Duplicate multi-site configuration names are blocked case-insensitively, and configuration lookup is case-insensitive. Display-name casing is preserved as you entered it.
Plugin version logged on every health check
The plugin logs its version on every health check. Previously, the version was logged only at plugin load, so a log that did not span a service restart did not identify the build.
🛠️ Issues resolved
| Product area | Description | Resolution |
|---|---|---|
| Password Safe | Credential injection fails for any Password Safe user whose username contains a number sign (#), which includes every Microsoft Entra B2B guest account. The credential list is returned empty with no error shown. Accented and non-Latin usernames are affected by the same cause. | Credential injection now handles the number sign (#), accented characters, and non-Latin characters in usernames, and returns the full credential list. |
| Configuration | The allowInvalidCertificates setting takes effect only if the first Password Safe endpoint initialized in the process has it enabled. Other endpoints silently inherit that policy. | The plugin resolves allowInvalidCertificates per endpoint and logs a warning naming the host while the setting is active. |
| Authentication | Session cookie handling assumes a single cookie, and a Set-Cookie header on an unsuccessful response displaces a working session. | The plugin merges cookies by name, and a Set-Cookie header on an unsuccessful response no longer displaces a working session. |
| Password Safe | Systems that share the same name are silently dropped from endpoint search results. | Endpoint search results now include all systems that share a duplicate name. |
| Configuration | Filtering optional includes by platform returns a NullReferenceException. | Filtering optional includes by platform now completes without error. |
| Authentication | A credential retrieval request whose domain does not match the authenticated representative's domain is processed. | Cross-domain credential retrieval requests are now rejected. |
| Authentication | Decrypting a cached token can silently return a truncated value. | Cached token decryption now returns the complete token value. |
| Authentication | A cached token that fails to decrypt surfaces an exception. | The plugin now evicts a cached token that fails to decrypt and re-authenticates. |
🗒️Notes
- Ensure .NET Framework 4.8 is installed before upgrading
- No configuration changes required
- All existing configurations remain compatible
- Existing configurations are migrated automatically from the previous serialization format on first load
- Cached authentication tokens do not carry across the upgrade because the token cache encryption format changed. Representatives re-authenticate transparently on their next request; no user action is required.
- Optionally set authTokenCacheTtlMinutes to enable auth token cache expiry. Leaving it unset preserves the previous behavior
📝Requirements
- A one-time configuration migration from
BinaryFormattertoDataContractSerializerruns automatically when you upgrade to 26.3.1 - Requires BeyondTrust ECM 1.6.2606 or later
- BeyondTrust Password Safe: Compatible with 22.2 and later
⌛ End of support
The product versions below have reached, or are nearing, their end of support. Upgrade to the latest version to continue receiving updates and support. Support ends on the last day of the month listed below.
For more information about supported versions, see Product Support Life Cycle.
| Product version | End of support |
|---|---|
| Out of support | |
| Password Safe 24.2.0 | September 2026 |
| Near end of support | |
| Password Safe 24.3.0 | December 2026 |
