Release Version 2.2.0

July 30, 2025

New Features

General Features

  • FIPS 140-2 Compliance – (All services and servers are FIPS compliant, except CA service.)
  • RLS for PostgreSQL
  • Event Logging Service
  • RabbitMQ for Message Queuing
  • Support for Oracle 19c Enterprise Edition Database

User Management

  • Onboard Users:
    • Onboard Users with PIV ID for derived credential issuance
    • Removed the Assign to Role field. Role assignment is now handled at the group level with a new feature that enables assigning roles to groups.
  • Enrollment:
    • Fingerprints preview during enrollment
    • ANSI support for fingerprints
    • Investigation – Background and Biometrics Investigation
  • Express Enrollment – full and partial bulk enrollment with a preview of the enrollment records and results.
  • Issuance
    • Support to issue PIV-I, Derived Mobile Credentials
  • Granular credential issuance –
    • PIV, CIV, PIV-I, FIDO2, DPIV, DFIDO2
    • Issuance in single instance works
    • PIV+FIDO2, DPIV+DFIDO2 - Granular issuance FIDO2 application (credentials) not working
  • Granular Lifecycle Management for operators and users – Identities, Applications, and Credentials.
    • When multiple devices are connected during PIN reset, PIN change, device update, certificate renewal, PIV card activation, support for the following validations:
      • validate the connected devices.
      • if the selected device that the user/operator is trying to perform one of the above-listed actions is not connected, display alert to connect the selected device to continue.
      • if the selected device is connected, remove all the other connected devices from the connected readers list and show only the reader which has the selected device.

Authentication

  • Authentication using OTP authenticators - Unifyia ID Wallet, Google, Microsoft, Okta Verify, Others
  • Authentication using PIV-I, CIV IDs, derived mobile identities
  • CBA authentication for domain joined systems with Entra ID.

Configurations

Passkey (FIDO2) Policy

  • Supports creating or managing FIDO2 passkeys policies for other relying parties such as Entra ID and Okta.

Groups

  • Provision to add groups and assign roles to the groups.
  • Provision to edit the group name and assigned roles.
  • Support to view the list of groups with the option to view the number of users assigned to a group.

Device Profile

  • Support clearing containers before issuance
  • Support for setting maximum PIN retries
  • Support for setting maximum PUK retries
  • Support to configure application interfaces (Interface Control for USB, NFC) for ZTPass on NXP P71D600, Arculus Authentikey, and YubiKey 5 Series devices.
  • Support to securely lock with a code the selected interfaces to prevent unauthorized access or use.
  • Support to reset the device to factory settings using the Manufacturer Master and/or Admin keys
  • Support to store device profile keys in HSM (Utimaco Cryptoserver)
  • Support for Yubikey 4 Series for PIV issuance.
  • Support for Aruculus Authentikey and Swissbit iShield Key for PIV+FIDO2 Issuance
  • Category based device profiles
  • Support for Identities type category:
    • PIV-I
    • PIV+FIDO2
    • DPIV+DFIDO2
    • Derived Mobile Identities (DMobile ID)

Workflows

  • Support for new identity types that enable the issuance of multiple credential:
    • PIV-I ID
    • PIV + FIDO2, Mobile ID
    • FIDO2, Mobile ID
    • Derived Mobile Identities (DMobile ID)
    • DPIV + DFIDO2
    • DPIV + DFIDO2, DMobile ID
    • DPIV, DMobile ID
    • DFIDO2, DMobile ID
  • Define certificate validity
  • Define device and certificate update policy
  • Define device certificate reissuance policy
  • Support to add Subject DN
  • Support to issue Card Authentication, Digital Signature and Key Management certificates for ID Wallet
  • When an external CMS is integrated, provision in the workflow to establish a separate process for the external CMS. If the option is canceled, the system will proceed with creating a workflow for the platform.
  • Issuance of PIV ID for integrated external credential management systems (External CMS)
  • FIDO2 Registration for the platform users and/or relying parties.
    • Separation of options for issuance of Passkeys (FIDO2) for platform users and relying party (RP) users. Organizations can select either one of the options or both.
    • Provision to enable/disable the issuance of FIDO2 passkeys for platform users
    • Provision to enable/disable FIDO2 passkeys provisioning for relying parties. Provision to select multiple relying parties.
    • Currently supported for the Entra ID and Okta applications.
  • Provision to define a format for the common name in the SubjectDN of the certificates. Available formats are:
    • CN=firstname lastname, e.g., Jane Smith
    • CN=firstname lastname intended usage short,e.g., Jane Smith Auth
    • CN=firstname lastname intended usage, e.g., Jane Smith Authentication
    • CN=firstname lastname (Affiliate), e.g., Jane Smith (Affiliate)
    • CN=firstname initial. Lastname, e.g., Jane A. Smith
    • CN=firstname middlename lastname, e.g., Jane Alex Smith
    • CN=lastname.firstname.middlename, e.g., Smith.Jane.Alex
    • CN=firstname lastname - intended usage – expiry, e.g., Jane Smith - Signature - Expires 01/15/2025
    • CN=firstname lastname - intended usage - agency identifier, e.g., Jane Smith - Signature – 123456
    • CN=firstname lastname - intended usage - SKI identifier, e.g., Jane Smith - Authentication – 123456
  • Support to search the user either by UPN and Email to writeback the issuance status to the selected active directory.
  • Removed the PIV Credential Verification and Derived Credential Lifecycle configurations sections from under the Smart Card/Security Key Credential Issuance section and moved it to a separate panel in the workflow under the Mobile ID configuration panel. This panel is displayed at the end of the workflow page.

Notifications

Below is the list of new notifications:

  • Registrar Notifications:
    • Users with Expired Biometrics
    • Users with Expiring Biometrics
  • User Notifications:
    • Account Suspended Due to Expired Biometrics
    • Enrollment Verification Status
    • Enrollment Verification Successful
    • Biometrics Update Request
    • Certificate Expired Notice

General Settings

  • Configurable PIV, PIV-I, CIV profile - Subject DN and FASC-N
  • Policies and Settings: The following are the new policies and settings available under the General Settings menu:
    • General
    • Read Name from Certificate Common Name during Onboarding with PIV ID
    • ITAR Country List Check
    • Enable Digital Signing
    • Session Sign Out
      • Support to configure the session sign-out policy with a warning to the user
    • Subscriber Agreement
      • Enable/Disable the Display Subscriber Agreement During Activation option
      • Add organization specific text for the subscriber agreement
    • Enrollment Policy
      • Biometrics Validity Expiration
      • Select Expiration Days
      • Notify operators of biometric expiration set to expire in (days)
      • Email Notification Frequency
      • Biometrics Expiry Check Scheduler
    • Card Expiration Policy
    • Card Expiry Check
  • PIV Verification Policy
    • Allowed OIDs for Verified

Security Audit

  • A new feature to configure security audit events.
  • Support to enable/disable the events that must be logged and/or signed with the digital signature certificate of the logged-in user.

Conditional Access

  • Define a set of IP addresses to be whitelisted for administrator access.

Integrations

Configure Directories

  • A new option to sync all the users from a directory is implemented.

External Credential Management Systems (External CMS)

  • Add, edit, and delete External CMS
  • List integrated external credential management systems
    • A page to set the connection parameters to connect to an external CMS
    • Card Production Request (CPR) for PIV, PIV-I, CIV
    • Define policies for issuance to be linked to the selected ID (PIV, PIV-I, CIV).
  • Supported external CMS - HID CMS

External Credential Management Systems

  • Provision to securely store the device profile keys in a HSM by integrating an HSM
  • Add, edit, and delete HSM
  • List HSMs
  • Supported HSM – Utimaco CryptoServer
  • Generate a tenant key for encrypting the factory keys (Manufacturer Master and/or Admin keys) before saving them in the database if the option Enable Factory Reset is active.

Passkeys (FIDO2) Provisioning

  • Provision to configure parameters to add RPs for passkeys (FIDO2) provisioning to enable issuance of passkeys to relying party users.
  • Support to add provisioning APIs.
  • Add, edit, and delete Relying Parties (RPs)
  • List Relying Parties
  • Supported RPs – Entra ID and Okta

Reports

The following are the new reports supported in this version:

  • Background Investigation Pending Report
  • Credentials About to Expire Report
  • Users Pending Approval Report
  • Revoked PIV Credentials Report
  • Card Applicant Status Report
  • Event Log Report

Known Issues

Improvements

User Management

  • Issuance
    • When multiple readers are connected with authenticators during issuance, support for the following validations:
      • Validate the connected authenticator status.
      • If all the connected authenticators have been already issued (personalized + printed or personalized), then alert the operator to connect a new, unassigned authenticator to continue issuance.
      • Next, display the card reader and the new authenticator’s name after verifying the product name of the selected device profile.

Bug Fixes

  • During the personalization of the PIV + FIDO credentials, the progress bar displays more than 100% progress.

  • Bulk Enrollment:

  • During bulk enrollment, if the template exceeds 20 users, a "Gateway Timeout" error occurs. However, user records are saved, and a success message is displayed upon selecting "Save."

  • After enrollment, the user status is incorrectly set to "Ready for Issuance" instead of "Pending Investigation" when the enrollment approval option is selected in the workflow.

  • Enrollment:

  • Single and dual fingerprint capture are not supported by the HID Crossmatch Guardian 100 fingerprint scanner.

  • Reports:

  • In the Clients and Apps report, sorting is incorrect, and records are not displaying properly. The application version field search is also not functioning.

    • Sorting on the Application Name Column is not working.
    • Reports for Authentication, Client and Apps, and Issued Credentials fail to generate data and cannot be downloaded.
    • The "Revoked PIV Credentials Report" includes users with expired credentials.
    • The "Background Investigation Pending" template displays no data.
    • The Event Log report fails to download in both PDF and CSV formats. Sorting by columns Event Message and Event Details is not functional.
    • PDF downloads for the User Status, User Enrollment Details, User Issuance Details, and Issued Devices reports are poorly aligned due to missing data.
    • The report generated when the frequency is set to one time, field names(labels) are missing and sorting functionality is not available.
    • UI issues, including date filters and sorting-related problems, are present in every report.

  • Notifications: Identity Credential Expiration Warning notification is not triggered.

  • ZTPass P71D600 Card Issues:

    • Once the user changes the PIN for the ZT Pass P71D600 card (PIV+FIDO issuance), he is unable to log in with the changed PIN.
    • Reset PIN with PUK is not working for the ZT Pass P71D600 card for PIV+FIDO2.
    • After scanning the QR code on a mobile device during FIDO credential login, the system does not request a PIN and logs the user in automatically. The PIN should be prompted for. In Android mobile devices, the support for PIN is not available. Hence, the login is successful without a PIN. On iOS devices, the user is prompted for PIN before login.
    • After the admin resets the user’s device PIN post-issuing PIV+FIDO credentials, the PIN is reset for both PIV and FIDO credentials. However, the FIDO credentials' PIN should remain unchanged.
      • Granular PIV reset PIN available for PIV application.
      • FIDO PIN reset support for the Arculus AuthentiKey is available but only in the NFC mode.