CA Technologies

eTrust SSO r12.0 Readme

3.0 eTrust SSO Server
3.1 Defects Fixed in CR08
3.2 Defects Fixed in CR07
3.3 Defects Fixed in CR05
3.4 Defects Fixed in CR04
3.5 Defects Fixed in CR01
3.6 Enhancements
  3.6.1 CR07
  3.6.2 CR06
  3.6.3 CR05
  3.6.4 CR04
  3.6.5 CR03

4.0 eTrust SSO Client
4.1 Defects Fixed in CR08
4.2 Defects Fixed in CR07
4.3 Defects Fixed in CR04
4.4 Defects Fixed in CR03
4.5 Defects Fixed in CR02
4.6 Defects Fixed in CR01
4.7 Enhancements
  4.7.1 CR06
  4.7.2 CR05
  4.7.3 CR04
  4.7.4 CR03
  4.7.5 CR02
  4.7.6 CR01
4.8 Known Issues
  4.8.1 CR05
    4.8.1.1 Cannot Connect to IE7 without specifying an URL with the html_browse extension
    4.8.1.2 Cannot Connect to a URL using html_connect Extension if the Username is Administrator
  4.8.2 Icons for Disabled and Offline Applications Are Not Grayed Out

5.0 Policy Manager
5.1 Defects Fixed in CR04
5.2 Enhancements
5.2.1 CR05
5.3 Known Issues
5.3.1 Policy Manager Registry Keys are Deleted After Upgrading the eTrust SSO Server

6.0 Certificate Authentication
6.1 Defects Fixed in CR03
6.2 Defects Fixed in CR02
6.3 Enhancements (Certificate Authentication)
6.3.1 CR05

7.0 LDAP Authentication
7.1 Enhancements
7.1.1 CR05

8.0 RSA Authentication
8.1 Enhancements
8.1.1 CR05

9.0 Windows Authentication
9.1 Defects Fixed in CR01
9.2 Enhancements
9.2.1 CR05

10.0 Active Directory Listener
10.1 SSO--Defects Fixed in CR06
10.2 Defects Fixed in CR02
10.3 Defects Fixed in CR01
10.4 Enhancements
10.4.1 CR05

11.0 Password Synchronization Agent
11.1 Defects Fixed in CR04
11.2 Defects Fixed in CR01
11.3 Enhancements
11.3.1 CR05

12.0 Application Wizard
12.1 Defects Fixed in CR04
12.2 Defects Fixed in CR01
12.3 Enhancements
12.3.1 CR05

13.0 eTrust SSO Integration Kit
13.1 Defects Fixed in CR04
13.2 Enhancements
  13.2.1 CR05
  13.2.2 CR03
  13.2.3 CR02
  13.2.4 CR01

14.0 Session Administrator
14.1 Enhancements
14.1.1 CR05
14.1.2 CR01

15.0 PSLang
15.1 Enhancements
15.1.1 CR05

16.0 Localization Support

17.0 Contact CA Support

1.0 Welcome

Welcome to the eTrust SSO r12.0 readme. This readme contains issues and other information discovered after publication. The known issues, enhancements, and list of fixed defects for each CR are arranged component wise. For a complete list of the known issues for this release and details about how the features and enhancements for this release might affect you, see the eTrust SSO r12 Release Notes.

2.0 Platform Support

For latest information about platforms, CA products, and third-party software that eTrust SSO components support, see the Compatibility Matrix on the Technical Support site: http://ca.com/support.

2.1 CR08

The support for the following operating systems are provided for all the components in the build release number 12.0.0.8:

VMWARE ESX 4.0 and 4.1

WINDOWS 2008 SP2 (32 bit)

RSA Authentication Agent r7.1

3.0 eTrust SSO Server

3.1 Defects Fixed in CR08

The following issues are fixed in this release:

Problem ID	Description	Resolution
1103	The Watchdog service becomes unresponsive randomly. When the service is manually restarted, the problem does not reoccur.	This issue is fixed. The default value of WDOnlineChecksMode has been changed to zero (0).
1105	When upgrading to 12.0 CR7, "EnforcePasswordPoliciesInLearnMode" option is not available in Policy Manager.	This issue is fixed. The required entries are added in the AccessControl database. Now, the “EnforcePasswordPoliciesInLearnMode” option is available in Policy Manager.
1107	When SSO 8.0 Clients connect to SSO Server 12.0, CPU utilization of 12.0 Server is High, when compared to SSO 8.1 Server.	This issue is fixed.
1108	SSO installation fails due to the presence of same version of CA Directory, which is bundled with SSO Server installer.	This issue is fixed. A check is provided in the SSO Server installer to confirm whether CA Directory of the same version is already installed.

3.2 Defects Fixed in CR07

The following eTrust SSO Server defect is fixed in the build release number 12.0.0.5070:

Problem ID	Description	Resolution
1037	In the learn mode, the eTrust SSO Server does not enforce password policies.	This issue is fixed. You can now configure the eTrust SSO Server to enforce password policies in the learn mode. Note: For more information about how to configure the eTrust SSO Server to enforce password policies in the learn mode, see the Enhancements to the eTrust SSO Server topic in this guide.
1049	During the eTrust SSO Server installation on Windows 2008, the DSAs fail to start with the following message: "DSA has multiple interfaces that resolve to the same address".	If the Windows 2008 Server is configured to use IPv4 and IPv6 interfaces, the DSAs fail to start as the hostname in the DSA configuration resolves to the IPv4 and IPv6 interfaces. This issue is fixed now. The DSA now resolves to only one interface.
1068	During user logout, the session tokens are not deleted from the memory. So, memory leaks in the eTrust SSO Server	This issue is fixed. During user logout, the session tokens are deleted from the eTrust SSO Server memory.

Problem ID

Description

Resolution

1037

In the learn mode, the eTrust SSO Server does not enforce password policies.

This issue is fixed. You can now configure the eTrust SSO Server to enforce password policies in the learn mode.

Note: For more information about how to configure the eTrust SSO Server to enforce password policies in the learn mode, see the Enhancements to the eTrust SSO Server topic in this guide.

1049

During the eTrust SSO Server installation on Windows 2008, the DSAs fail to start with the following message:

"DSA has multiple interfaces that resolve to the same address".

If the Windows 2008 Server is configured to use IPv4 and IPv6 interfaces, the DSAs fail to start as the hostname in the DSA configuration resolves to the IPv4 and IPv6 interfaces. This issue is fixed now. The DSA now resolves to only one interface.

1068

During user logout, the session tokens are not deleted from the memory. So, memory leaks in the eTrust SSO Server

This issue is fixed. During user logout, the session tokens are deleted from the eTrust SSO Server memory.

3.3 Defects Fixed in CR05

The following eTrust SSO Server defect is fixed in the build release number 12.0.0.5064:

Problem ID	Description	Resolution
963	If you upgrade the eTrust SSO Server it breaks the unique IDs of the Watchdog service.	Watchdog Service now installed with a unique account ID in server farm setup. Note: If you have already configured the watchdog account manually, the eTrust SSO server detects the watchdog environment by verifying the existence of pswd-pers account in local system accounts. If the pswd-pers account is not found, the eTrust SSO Server assumes that you have manually configured the watchdog account and does not reset the environment. So, delete the pswd-pers account if you have configured the watchdog environment manually.

3.4 Defects Fixed in CR04

The following eTrust SSO Server defect is fixed in the build release number 12.0.0.5059:

Problem ID	Description	Resolution
963	If you upgrade the eTrust SSO Server it breaks the unique IDs of the Watchdog service.	Watchdog Service now installed with a unique account ID in server farm setup. Note: Copying Access Control Databases from one server to another server in a farm setup will need the Watchdog credentials reset for authentication to SSO server. Please consult CA Support for resetting Watchdog credentials.

3.5 Defects Fixed in CR01

The following eTrust SSO Server defects are fixed in the build release number 12.0.5038:

Problem ID	Description	Resolution
865	Unable to add the eTrust SSO Server performance counters to Windows Performance Monitoring service PerfMon.msc.	This issue is fixed. You can now add the eTrust SSO Server performance counters to PerfMon.msc.
872	When eTrust SSO Server is installed on a server with a locale that is not certified, login to the Policy Manager fails with the following error: Failed to unpack data	This issue is fixed. If you install the eTrust SSO Server with a locale that is not certified, the locale is set to the default locale, ENU.

Problem ID

Description

Resolution

865

Unable to add the eTrust SSO Server performance counters to Windows Performance Monitoring service PerfMon.msc.

This issue is fixed. You can now add the eTrust SSO Server performance counters to PerfMon.msc.

872

When eTrust SSO Server is installed on a server with a locale that is not certified, login to the Policy Manager fails with the following error:

Failed to unpack data

This issue is fixed. If you install the eTrust SSO Server with a locale that is not certified, the locale is set to the default locale, ENU.

3.6 Enhancements

3.6.1 CR07

A new property EnforcePasswordPoliciesInLearnMode is added to the Policy Manager properties to let you enforce password policies in the learn mode.

To configure the eTrust SSO Server to enforce password policies

Select the Resources icon in the program bar.
The Resources window appears.

Expand the Configuration Resources folder, and select Policy Server Settings.
The list of Policy Server settings opens in the right pane.

Double-click the General settings.
The View or Set GPSCONFIGPROPERTY Properties - Settings dialog opens.

Select the EnforcePasswordPoliciesInLearnMode property and click the edit icon to edit the property.

Set the property value to Yes, and click OK.
Note: The default value of this property is set to Yes. If you set this property value to No, the eTrust SSO Server does not enforce password policies during the learn mode.

Click OK.
The eTrust SSO Server is configured to enforce password policies.

3.6.2 CR06

The CR06 build number 12.0.0.5068 includes the following enhancement:

A new parameter CreateUserAPPLCache is added to the psbgc.ini file.

CreateUserAPPLCache
Specifies that the psbgc utility requests the SSO Server to cache authorization rules to build the application lists.

Value: [Yes|No]
- Yes
  Specifies that the psbgc utility retrieves and caches the user-application list.
- No
  Specifies that the psbgc utility does not cache the user-application list.
Default: No

Note: We recommend that you set the CreateUserAPPLCache to Yes for increased performance under heavy loads on the eTrust SSO Server.

3.6.3 CR05

The CA SSO Server CR05 build embeds the following components in build release number 12.0.0.5064:

CA Access Control r12.5 build number: 12.51.543

CAPKI r4.1.3

3.6.4 CR04

The CR04 build includes the following enhancements:

The CA SSO Server embeds CA Directory r12 SP1 build number: 12.0.4076.

The user data store is enhanced to include a new property DisplayName_USER@<datastore>. This property identifies the user attribute that is displayed on the eTrust SSO GINA when a user locks a workstation.
Note: To display a user attribute on the eTrust SSO GINA dialog, you must identify the attribute using the DisplayName_USER@<datastore> property and you must also set the DisplayCustomName attribute in the Client.ini file. For more information about the DisplayCustomName attribute, see the enchancements section of SSO Client CR04.
- To add DisplayName_User property in the eTrust SSO Server
1. Login to the Policy Manager.
2. Select the Resources icon in the program bar.
  The Resources window appears.
3. Expand the User Resources folder, right-click User Attributes and select New.
  The Create New USER_ATTR Resource - General dialog appears.
4. Enter the following values:
  Name
  
  Specify DisplayName_USER as the name of the attribute.
  
  Data Store
  
  Specify a user directory where the user attributes are stored. Click Browse to select the user directory.
  
  DBField
  
  Specify the user attribute that you want to display on the eTrust SSO GINA dialog.
5. Click OK.
  The user attribute is created.

3.6.5 CR03

The CR03 build includes the following enhancements:

The PSMaint utility is enchanced to include the following functionality in eTrust SSO Server build release no. 12.0.0.5056:
- A switch 'WD' is added to start and stop the Watchdog services. To start and stop the Watchdog service, use the following commands:
```
PSMaint.cmd -start WD
PSMaint.cmd -stop WD
```
- An option to accept archive directory names that have spaces. If the directory name contains spaces, the directory name must be enclosed within double quotes. For example, if directory name is Archival Directory, it must be modified as "Archive Directory" for input to the PSMaint utility.
- The archive files are copied to a temp folder, zipped, and only on confirmation that the zipping was successful that the logs are deleted.

eTrust SSO includes CA Access Control r12.0 build release no.12.1.0812.

4.0 eTrust SSO Client

4.1 Defects Fixed in CR08

The following issues are fixed in this release:

Problem ID	Description	Resolution
1093	When ssoLaunchbar.exe is launched, the system crashes with a blue screen	This issue is fixed. SSOEvents is modified to make it thread-safe.
1094	Cert Authentication hangs during UPN name-mapping.	This issue is fixed. The local allocated memory is freed with corresponding free API.
1096	When the SSO Client service is started, it hangs.	This issue is fixed.
1098	When SSO launches the browser-based application and if you close the browser before the application is completely loaded, the script interpreter crashes.	This issue is fixed. All calls to Release() function on pointers to COM objects are now guarded.
1099	After the SSO Client r12.0 is installed, a significant delay is noticed in the startup of the Windows OS.	This issue is fixed. Now, winlogon.exe uses the SSO events asynchronously.
1104	The system crashes while taking control of the "password change" screen from your Oracle web form application.	This issue is fixed. NULL check has been applied while taking control of the "password change" screen.
1106	A delay is observed when a fast user switching on Windows 7.	This issue is fixed. Code is modified to send a logoff notification to the LogonUI.exe.

4.2 Defects Fixed in CR07

The following eTrust SSO client defects are fixed in the build release number 12.0.0.5070:

Problem ID	Description	Resolution
1045	The eTrust SSO tcl extensions getscrape and waittext do not support IE8.	This issue is fixed. The getscrape and waittext extensions now support IE8.
1048	The html_connect extension uses only the document title of a window to identify it. So, if you are using Window title as an input to the html_connect extension, you cannot connect to that window.	This issue is fixed. The html_connect extension is modified to connect to a window using both the window title and document title of a web page. By default, the html_connect extension uses the window title to identify a window. If you want to identify a window using the document title, use the newly added key, -doctitle, with the html_connect extension. Note: For more information about the newly added option, see the html_connect extension description in the tcl Scripting Reference Guide.
1050	The eTrust SSO interpreter and the Application Wizard are unable to identify the controls from a web page.	This issue is fixed. If the web page does not have a window title, the eTrust SSO interpreter fails to connect to the web page. So, the Application Wizard cannot identify the controls on that web page. This issue is fixed. If the web page does not have a window title, the eTrust SSO interpreter uses the URL of the web page to connect to it.
1051	If you enter a noncompliant password in the learn mode, a progress window "Setting application password" appears in the background.	This issue is fixed.
1066	The eTrust SSO interpreter extension type does not support Unicode characters when you are using a remote desktop connection in a full screen mode.	This issue is fixed. You can now use the eTrust SSO interpreter to type Unicode characters.
1075	eTrust SSO credentila provider does not automatically login users even if DefaultPassword value is specified in clear text in the following registry key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	This issue is fixed.
1076	The value for the Token code field in the RSA Authentication dialog is not masked.	This issue is fixed. To mask the Token code field value, set the value of the HidePinInputField in the Auth.ini file to Yes.
1077	If the [PasswordDialogLabels] section in the Client.ini file does not contain any parameters, the eTrust SSO interfaces such as the Launchbar, Tools, and GINA crash.	This issue is fixed.

4.3 Defects Fixed in CR04

The following eTrust SSO client defects are fixed in the build release number 12.0.0.5058:

Problem ID	Description	Resolution
954	eTrust SSO must not prompt users to reauthenticate when Windows authentication method is configured with AutoNetworkAuth=yes.	A new configuration parameter "SuppressExpirationNotification" is added to the Client.ini. SuppressExpirationNotification Controls the display of the dialog that states "Please re-authenticate to continue this SSO operation" to users. Yes Suppresses the dialog that states Please re-authenticate to continue this SSO operation. No Displays the dialog to users.
955	Error invoking legacy 16-bit application from launchbar	This issue is fixed. The error in invoking legacy 16-bit application from launchbar is corrected.
956	The html_selectitem extension does not simulate mouse clicks.	This is issue is fixed. Added support to fire Onchange event for html_SelectItem.
958	In eTrust SSO-Citrix integration or in a remote session, eTrust SSO does not generate SSO TK cookies upon successful login. So, the eTrust SSO-SiteMinder integration fails.	This issue is fixed. eTrust SSO generates cookies for remote sessions for all agents except when the authentication method is set to Citrix.
959	PwdEncUtil.exe encrypts user information available in the default user directory only.	PwdEncUtil.exe encrypts user information available in all the user data stores.
960	If the smartcard used for authentication is removed during a login through GINA, the user is authenticated even if the option scremove is set to 1.	This issue is fixed. If you remove the smartcard during the Windows login process, the workstation is locked or logged off according to the settings of scremove option.
962	Increase in engsvc.exe memory usage.	Handle leak in engine service is corrected.
965	HTML_BROWSE -grab extenstion	Added a new option "grab" to html_browse command to specify whether to grab the html page. The default value is TRUE i.e the page will be scraped by default if -grab is not specified. Following values can be used: Value: [y\|n] Default: y
966	HTML_BROWSE -size extenstion	A new extension "size" is added to html_browse command to specify how IE should be displayed when launched. Following values can be used min - Indicates that IE should be opened in minimized state max - Indicates that IE should be opened in maximized state same - Indicates that IE should be opened at the same size it was. open - Indicates that IE should be restored.
967	Pop-up disabled during offline	Added a new entry "DisplayOfflineModeConfirmation" in OfflineOperation section in the client ini file. If it is set to yes, user is prompted that server is offline and waits for user input to continue or abort the login process. If it is set to no, there will not be any prompt and user will work offline. [OfflineOperation] DisplayOfflineModeConfirmation Value: [yes\|no] Default: yes
985	When you upgrade from eTrust SSO Client from r8.1 to r12, the installer prompts users to change the install folder. The installer does not upgrade the eTrust SSO Client to the same location.	This issue is fixed. The installer upgrade the eTrust SSO Client using the same folder structure as in earlier releases.
987	The file C:\Program Files\CA\Single Sign-On\Client\cfg\Configuring the SSO Client.html contains information related to SSO r8.1.	This issue is fixed. The file is updated to reflect SSO r12 information.

4.4 Defects Fixed in CR03

The following eTrust SSO client defects are fixed in the build release number 12.0.0.5056:

Problem ID	Description	Resolution
942	When users start a computer and insert their smart cards for authentication, the Authentication ‑ Certificate dialog opens, but the cursor focus is not set to the password field.	This issue is fixed. When users insert a smart card, the Authentication - Certificate dialog opens and the cursor focus is set to the Password field.
936	Winlogon.exe crashes when you install eTrust SSO Client on computers where SafeBoot is also installed.	This issue is fixed. winlogon.exe no longer crashes.
928	eTrust SSO applications configured to launch on Windows startup fail to launch with the following error: cannot retrieve variables	This issue is fixed. eTrust SSO applications no longer fail to launch on Windows startup.
926	When using certificate authentication, if you logoff Windows and insert smart card for reauthentication, eTrust SSO Client does not recognize the smart card.	This issue is fixed. eTrust SSO Client recognizes smart cards if you logoff Windows and re-insert the smart card.

4.5 Defects Fixed in CR02

The following CA SSO client defects are fixed in the build release number 12.0.0.5048:

Problem ID	Description	Resolution
893	When users launch applications through a Citrix Metaframe Server, the memory usage of engsvc.exe increases incrementally.	This issue is fixed. engsvc.exe does not increase its memory usage when users launch applications through Metaframe server. The following new configuration section [SessionCleanup] is added to Client.ini to enable orphan token cleanup process in engine service: SessionCleanupIntervalInMins Specifies the interval between successive cleanups of memory used by tokens. The interval must be in minutes. Default: 0
912	Users can use their smart cards with only one smart card reader to authenticate with CA SSO Client. Users cannot use a smart card with more than one smart card reader to authenticate with CA SSO	This issue is fixed. Users can use their smart cards with any Smart Card Reader to authenticate with CA SSO Client.

Problem ID

Description

Resolution

893

When users launch applications through a Citrix Metaframe Server, the memory usage of engsvc.exe increases incrementally.

This issue is fixed. engsvc.exe does not increase its memory usage when users launch applications through Metaframe server.

The following new configuration section [SessionCleanup] is added to Client.ini to enable orphan token cleanup process in engine service:

SessionCleanupIntervalInMins
Specifies the interval between successive cleanups of memory used by tokens. The interval must be in minutes.

Default: 0

912

Users can use their smart cards with only one smart card reader to authenticate with CA SSO Client. Users cannot use a smart card with more than one smart card reader to authenticate with CA SSO

This issue is fixed. Users can use their smart cards with any Smart Card Reader to authenticate with CA SSO Client.

4.6 Defects Fixed in CR01

The following CA SSO client defects are fixed in the build release number 12.0.5041:

Problem ID	Description	Resolution
836	If the certificate store path is invalid, the CA SSO Client displays inaccurate error messages during certificate authentication.	A new error message is included to reflect the validity of certificate path entries in the Auth.ini file.
842	The SSO PWDBOX extension displays an inaccurate and confusing error message when users change passwords and the new password and confirm password fields do not match.	This issue is fixed. The error message format is changed to the same format used in CA SSO r8.0.
850	Launchbar crashes when retrieving container applications that have only one application.	This issue is fixed. Upgrade your CA SSO client installation to CA SSO r12.0 CR01.
868	CA SSO Client installation fails when you try to install the CA SSO client on a server with unsupported versions of Citrix MetaFrame Servers. The installation must not fail but must let you to continue the installation even with unsupported versions of the Citrix MetaFrame Server.	This issue is fixed. The CA SSO Client installation proceeds even with unsupported versions of Citrix MetaFrame Server.
870	In a Citrix environment, the CA SSO interpreter crashes with exceptions when users try to log in.	This issue is fixed. The CA SSO interpreter no longer crashes with exceptions when users try to log in.
871	CA SSO GINA is not displayed during a remote desktop session and the login fails with the following error: Workstation Login Failed Windows could not log you on (reported error 0x57) Win32 Error: The parameter is incorrect.	This issue is fixed. CA SSO GINA is available during a remote desktop session.
876	Roaming user profiles are not deleted.	This issue is fixed. The roaming profiles are now deleted
882	CA SSO Smartcard authentication does not support NetID software.	CA SSO Smartcard authentication now supports NetID software Two entries are added to [auth.CERT] section in auth.ini to address this issue. VSlotsPerReader Specifies the number of virtual slots NetID software configures for a Reader. This value must be equal to number of pins you configure. Default: 1 VSlotForAuth The Virtual Slot that is configured for Authentication. Default: 0 Range: 0 to <VSlotsPerReader>
888	CA SSO GINA crashes when users try to unlock workstations that are not connected to a network domain.	This issue is fixed. The CA SSO GINA no longer crashes when users try to unlock workstations that are not connected to a network domain.
889	The following error is recorded in the CA SSO Interpreter logs when you use the Exit command in a login script: ERROR - error evaluating script	This issue is fixed. The CA SSO Interpreter no longer returns an error merely because you use an Exit command in a login script.

4.7 Enhancements

4.7.1 CR06

The following enhancements are made in the build number 12.0.0.5067:

A new parameter HidePinInputField is added to the Auth.RSA section in the Auth.ini file.
- HidePinInputField
  Specifies if the eTrust SSO Client displays the PIN field in the RSA authentication dialog. Set the value to Yes to hide the PIN field. Set the value to No to display the PIN field.
  
  Value: [Yes|No]
  
  Default: No

The following options are added to the Client.ini file to let you configure the Password and Verify Password field labels.
PasswordFieldLabel

Specifies the label for the Password field.

Default: Password

VerifyPasswordFieldLabel

Specifies the label for the Verify Password Field.

Default: Verify Password

The following keys are added to the sso tcl extension pwdbox:
- –pswd_label
  Specifies the password label.
- –vrfy_pswd_label
  Specifies the verify password field label.

4.7.2 CR05

The following enhancements are made to eTrust SSO Client in the build release number 12.0.0.5063:

Renaming of New Password field
In the Set Login Information dialog, the New Password field is renamed to Password.

Limit number of concurrent sessions on a workstation
Note: The following enhancement is valid on Windows Vista and Windows 7 in workstation modes 4 and 5 only.

You can now configure the eTrust SSO Client to limit the number of concurrent sessions on a workstation. To create a new session, the eTrust SSO Client does the following:
1. Verifies if the number of concurrent sessions has reached the specified limit. If the limit is not reached, a new session is created.
2. If the specified limit is reached, the eTrust SSO Client verifies if there are any processes running in the oldest session. If there are no running processes, the eTrust SSO Client logs off the oldest session. If there are running processes in the oldest session, the eTrust SSO Client verifies the next oldest session and so on until it logs off a process.
This eTrust SSO Client behavior is controlled by the following entries in the [CredentialProvider] section of the Client.ini file:
- MaxConcurrentSessions
  Specifies the maximum number of concurrent sessions allowed on a workstation. To enable this setting, enter a positive value. The positive value enables this setting and also indicates the limit on the number of concurrent sessions allowed on a workstation. This setting is disabled by default.
  
  Default:0
- LimitChoice
  Specifies the behavior of the eTrust SSO Client when the concurrent session limit is reached and user requests a new session.
  
  Note: This setting is enabled only if the MaxConcurentSessions setting is enabled.
  Values: [0-1]
  
  0 - Close Oldest Session
  
  1 – Reject Logon
  
  Default: 0
- MonitorAppExes
  Specifies the applications that must not be logged off when the maximum concurrent sessions limit is reached and user requests a new session. The eTrust SSO Client monitors the applications mentioned in this entry. If these applications are running in a session, then that session is not logged off even if it is the oldest session.
  Example: MonitorAppExes=C:\windows\system32\calc.exe,D:\Program Files\Apps\def.exe

Support for IE Tabs
A new argument -newtab is added to the html_browse TCL extension to support tabs in IE7 and above.
- -newtab
  Specifies if the URL is opened in a new tab of the existing IE instance. For IE 7 or IE 8, if the value is set to Y (Yes), the specified URL is opened in a new tab. If the value is set to N (No), the specified URL is opened in a new IE instance. For IE 6 and earlier versions of IE, the specified URL is always opened in a new IE instance irrespective of the value for this key.
Note: Tabs are not supported for admin users on Windows Vista if UAC is ON.

4.7.3 CR04

The following enhancements are made to eTrust SSO Client:

A new attribute DisplayCustomName is added to the Client.ini file. This attribute controls the display of a user attribute in the SSO GINA.
- DisplayCustomName
  Specifies if the user attribute must be displayed on the eTrust SSO GINA dialog when the workstation is locked.
  
  Value: [Yes|No]

Note: To display a user attribute on the eTrust SSO GINA dialog, you must identify the attribute using the DisplayName_USER@<datastore> property on the eTrust SSO Server and you must also set the DisplayCustomName attribute in the Client.ini file. For more information about the DisplayName_USER@<datastore>, see the enchancements section of SSO Server CR04.

4.7.4 CR03

eTrust SSO Client is enhanced to include certificate filtering. Certificate filtering helps you to filter user certificates based on certain certificate parameters and display only the filtered certificates to the users. This certificate filtering is useful when users have more than one certificate to authenticate using smart cards and users do not know which certificate to use. The following entries are added to the Auth.Cert section of the Auth.ini file to configure certificate filtering:

AutoCertSelection
Specifies if eTrust SSO must filter certificates and display only the filtered certificates to the users.

Value: Yes|No.
- Yes
  Specifies that eTrust SSO filters and displays only the filtered certificates to the users. The other filtering related parameters are activated only if this option is set to Yes.
- No
  Specifies that eTrust SSO does not filter the certificates, but displays all the certificates to the users.
Default: No

FilterDLLPath
Specifies the path to the namemapping DLL that implements the filter.

Value: path

MappingMethod
Specifies the certificate parameter that the eTrust SSO Client uses for certificate filtering.

Value: [C|CN|DN|DNS|EMAIL|IP|L|O|OU|URI|UPN]

Default: CN

ExpectedValue
Specifies the value that is matched with the value of the parameter in MappingMethod. If this parameter matches the value for MappingMethod parameter, eTrust SSO Client displays only those certificates to the users.

Example: SHA1 value of thumb print

ShowFilteredCertificates
Specifies if eTrust SSO Client displays the list of filtered certificates to the users.

Value: Yes|No.
- Yes
  Specifies that eTrust SSO Client displays the list of filtered certificates to the users.
- No
  Specifies that eTrust SSO Client does not display the list of filtered certificates to the users. If you select this option, eTrust SSO Client uses the first certificate that matches the filter criteria to authenticate users.
Default: No

FilteringPattern
Specifies the filtering pattern that eTrust SSO Client uses to match the ExpectedValue parameter with the MappingMethod parameter.

Value: 0|1|2
- 0
  Specifies that the entire string from the ExpectedValue is matched with the value of the certificate parameter specified in MappingMethod.
- 1
  Specifies that the start of the string from the ExpectedValue is matched with the value of the certificate parameter specified in MappingMethod.
- 2
  Specifies that ExpectedValue is treated as a substring and is matched with substrings of value of the certificate parameter specified in MappingMethod.
Default: 0

4.7.5 CR02

In CR02, the following enhancements are made to eTrust SSO Client:

Support for IE8; but support does not include tabs functionality in IE8

4.7.6 CR01

The following enhancements are made to Credential Provider:

If a user login through the Credential Provider fails, eTrust SSO displays all the Credential Provider tiles. In eTrust SSO r12.0, eTrust SSO displayed only the Windows Logon tile for any login failures.

In shared workstation modes 0 through 3, Credential Provider is enhanced to let Windows administrators log in to eTrust SSO even when another user is logged into eTrust SSO. The administrator can log in to eTrust SSO using eTrust SSO agents from a Windows desktop. As shared workstations mode 0 through 3 support only one eTrust SSO session, eTrust SSO prompts the administrator to log off the current eTrust SSO user before logging in.

In shared workstation modes 4 and 5, Credential Provider is enhanced to let Windows administrators log in to eTrust SSO using an actively logged in eTrust SSO user. As shared workstation modes 4 and 5 support only one eTrust SSO session per user, eTrust SSO prompts the administrator to log off the existing session for the eTrust SSO user before logging in.

If a Windows user tries to unlock a workstation locked by another Windows user, Credential Provider prompts the Windows user to perform a Windows Switch User before logging in. This is valid for shared workstation mode 5.

4.8 Known Issues

4.8.1 CR05

The following are the known issues in this release:

4.8.1.1 Cannot Connect to IE7 without specifying an URL with the html_browse extension

Valid on IE7 in protected mode on Windows Vista with UAC enabled

Symptom:

I cannot connect to IE7 without specifying an URL with the html_browse extension when IE7 is in a protected mode on a Windows Vista machine with UAC enabled.

Solution:

When you do not specify a URL with html_browse extension, eTrust SSO tries to open IE with the default home page. If the default home page is an unprotected URL and IE is set to work in a protected mode, html_browse cannot launch the URL. To launch the URL, add a protected URL as the default home page.

4.8.1.2 Cannot Connect to a URL using html_connect Extension if the Username is Administrator

Valid on IE7 in protected mode on Windows Vista with UAC enabled

You cannot connect to a browser window using the html_connect extension if you are logged in as a user with the username Administrator when UAC and Protected mode are on with IE7 on Windows Vista.

4.8.2 Icons for Disabled and Offline Applications Are Not Grayed Out

Symptom:

The icons for disabled and offline applications are highlighted and are not grayed out in my application list.

Solution:

To gray out icons for disabled or offline applications, use the default eTrust SSO application icon. Use the following entry in the Launchbar section of Client.ini to set the eTrust SSO application icon as default for disabled applications:

DisplayDefaultIconForDisabledApp
Specifies that the default icon is displayed for disabled applications.

Value: [yes|no]

Default: no

5.0 Policy Manager

5.1 Defects Fixed in CR04

The following eTrust SSO Policy Manager defects are fixed in the build release number 12.0.0.5058:

Problem ID	Description	Resolution
986	Policy Manager cannot connect to the eTrust SSO Server over non-default communication ports.	This issue is fixed. The Policy Manager can now connect to eTrust SSO Server over non-default ports.
948	Silent installation and upgrade of Policy Manager fails on Windows XP	This issue is fixed. Silent installation of Policy Manager no longer fails.

5.2 Enhancements

5.2.1 CR05

The Policy Manager CR05 build embeds the following components in build release number 12.0.0.5064:

CAPKI r4.1.3

5.3 Known Issues

The following section explaings the known issues with the Policy Manager.

5.3.1 Policy Manager Registry Keys are Deleted After Upgrading the eTrust SSO Server

Symptom:

When I upgrade the eTrust SSO Server from an earlier CR build to the current release, the Policy Manager registry key entries in the AccessControl – ClientType node are deleted and the Policy Manager does not work.

Solution:

Reinstall the Policy Manager after upgrading the eTrust SSO Server.

6.0 Certificate Authentication

6.1 Defects Fixed in CR03

The following authentication agent defect is fixed in the build release number 12.0.0.5055:

Problem ID	Description	Resolution
945	Sample source code required for customizing namemapping DLL are not packaged.	This issue is fixed. The sample source code for customizing namemapping DLLs are packaged. Instructions for customizing the namemapping DLL are included in the ReadMe.txt at the following folder: SampleNameMapping

Problem ID

Description

Resolution

945

Sample source code required for customizing namemapping DLL are not packaged.

This issue is fixed. The sample source code for customizing namemapping DLLs are packaged. Instructions for customizing the namemapping DLL are included in the ReadMe.txt at the following folder:

SampleNameMapping

6.2 Defects Fixed in CR02

The following authentication agent defect is fixed in the build release number 12.0.0.5046:

Problem ID	Description	Resolution
911	During certificate authentication, eTrust SSO truncates all characters after the symbol '@' in the User Principal Name from the smart card, and maps this truncated attribute to the userPrincipalName in Active Directory. So, the mappings do not match and authentication fails.	This issue is fixed. eTrust SSO does not truncate the User Principal Name before comparing the attribute with the userPrincipalName in Active Directory.

Problem ID

Description

Resolution

911

During certificate authentication, eTrust SSO truncates all characters after the symbol '@' in the User Principal Name from the smart card, and maps this truncated attribute to the userPrincipalName in Active Directory. So, the mappings do not match and authentication fails.

This issue is fixed. eTrust SSO does not truncate the User Principal Name before comparing the attribute with the userPrincipalName in Active Directory.

6.3 Enhancements (Certificate Authentication)

6.3.1 CR05

The following enhancements are made to the Certificate Authentication Agents in the build release number 12.0.0.5065 to support the following features:

CRL as fallback revocation method

Fixed OCSP and CRL revocation methods for multiple CAs

Support for fallback revocation method
New values added for the RevocationMeth parameter, in the CA_certtga.ini, to have a fallback mechanism are as follows:
- FIXED_OCSP_FALLBACK_TO_CRL
- FIXED_OCSP_FALLBACK_TO_CRLDP
- AIA_OCSP_FALLBACK_TO_CRL
- AIA_OCSP_FALLBACK_TO_CRLDP
- CRLDP_FALLBACK_TO_CRL
For the above-mentioned methods, the user certificate is initially verified using first method (FIXED_OCSP or AIA_OCSP or CRLDP). In case of non-availability of the OCSP/CRLDP methods, it fall backs to CRL/CRLDP. For example, FIXED_OCSP_FALLBACK_TO_CRL will first check the user certificate using FIXED_OCSP and if OCSP is not available then only it checks with the CRL.

Support for multiple CAs
To support multiple values for FIXED_OCSP add different sections for OCSP in the CA_certtga.ini as follows:
- [OCSPresponder1]
  OcspSignCert=
  
  OcspSignCertPass=
  
  OcspResponder=
  
  TrustedPath=
  
  TrustedNames=
- [OCSPresponder2]
  OcspSignCert=
  
  OcspSignCertPass=
  
  OcspResponder=
  
  TrustedPath=
  
  TrustedNames=
To support multiple CRLs, add different sections for CRL in the CA_certtga.ini as given below:
- [CRL1]
  CrlFileName=
  
  CrlIssuerCert=
- [CRL2]
  CrlFileName=
  
  CrlIssuerCert=

7.0 LDAP Authentication

7.1 Enhancements

7.1.1 CR05

The LDAP Authentication Agent CR05 build embeds the following components in build release number 12.0.0.5063:

CAPKI r4.1.3

8.0 RSA Authentication

8.1 Enhancements

8.1.1 CR05

The RSA Authentication Agent CR05 build embeds the following components in build release number 12.0.0.5064:

CAPKI r4.1.3

9.0 Windows Authentication

9.1 Defects Fixed in CR01

The following authentication agent defect is fixed in the build release number 12.0.5040:

Problem ID	Description	Resolution
877	Unable to authenticate using Windows Authentication agents due to named pipe timeouts.	This issue is fixed. A new entry, NamedPipeTimeout is added to Connection section of CA_wintga.ini file of the WinAuth Agent. NamedPipeTimeout Specifies the time in seconds when a named pipe connection times out. Default: 1 second Note: The value for NamePipeTimeout must be the same as the ConnectionTimeout value in the Auth.ini file on eTrust SSO Client.

Problem ID

Description

Resolution

877

Unable to authenticate using Windows Authentication agents due to named pipe timeouts.

This issue is fixed. A new entry, NamedPipeTimeout is added to Connection section of CA_wintga.ini file of the WinAuth Agent.

NamedPipeTimeout
Specifies the time in seconds when a named pipe connection times out.

Default: 1 second

Note: The value for NamePipeTimeout must be the same as the ConnectionTimeout value in the Auth.ini file on eTrust SSO Client.

9.2 Enhancements

9.2.1 CR05

The Windows Authentication Agent CR05 build embeds the following components in build release number 12.0.0.5063:

CAPKI r4.1.3

10.0 Active Directory Listener

10.1 SSO--Defects Fixed in CR06

The following defect is fixed in the build release number 12.0.0.5067:

Problem ID	Description	Resolution
884	After upgrading your version of Active Directory Listener to CR05, uninstalling it does not remove the libetpki*.dlls in the bin folder.	This issue is fixed.

10.2 Defects Fixed in CR02

The following active directory listener defect is fixed in the build release number 12.0.0.5046:

Problem ID	Description	Resolution
884	The maximum length of the Verify Password field for eTrust SSO Server administrator is 14 characters. So, if the eTrust SSO Server administrator password is longer than 14 characters the entries in the Password and Verify Password fields do not match and the installer aborts.	The maximum length for the Verify Password field related to eTrust SSO Server administrator is modified to accept long passwords.

10.3 Defects Fixed in CR01

The following active directory listener defect is fixed in the build release number 12.0.5038:

Problem ID	Description	Resolution
884	The maximum length of the Verify Administrator Password field in the Active Directory Listener installer is 14 characters. So, if the administrator password is longer than 14 characters the entries in the Password and Verify Password fields do not match and the installer aborts.	The maximum length for the Verify Password field is modified to accept long passwords.

10.4 Enhancements

10.4.1 CR05

The Active Directory Listener CR05 build embeds the following components in build release number 12.0.0.5064:

CAPKI r4.1.3

11.0 Password Synchronization Agent

11.1 Defects Fixed in CR04

The following password synchronization agent defect is fixed in the build release number 12.0.0.5059:

Problem ID	Description	Resolution
989	When you uninstall the Password Synchronization Agent, the SingleSignOn key is not removed from the registry.	This issue is fixed. Uninstalling the Password Sychronization Agent removes the SingleSignOn key from the registry.

11.2 Defects Fixed in CR01

The following password synchronization agent defect is fixed in the build release number 12.0.5041:

Problem ID	Description	Resolution
832	Password filter blocks password changes to the Directory Services Restore Mode (DSRM) administrator account using ntdsutil command.	This issue is fixed. The password filter no longer blocks password changes for the DSRM administrator account.

11.3 Enhancements

11.3.1 CR05

The Password Synchronization Agent CR05 build embeds the following components in build release number 12.0.0.5064:

CAPKI r4.1.3

12.0 Application Wizard

12.1 Defects Fixed in CR04

The following application wizard defect is fixed in the build release number 12.0.0.5058:

Problem ID	Description	Resolution
988	The Application Wizard is unable to interpret controls on the CA Support portal.	This issue is fixed.

12.2 Defects Fixed in CR01

The following application wizard defect is fixed in the build release number 12.0.5039:

Problem ID	Description	Resolution
874	Application Wizard generates errors when scripts contain a "\" (backslash).	This issue is fixed. Application Wizard now handles scripts containing a "\" (backslash) appropriately and no longer generates errors.

12.3 Enhancements

12.3.1 CR05

The Application Wizard CR05 build embeds the following components in build release number 12.0.0.5063:

CAPKI r4.1.3

13.0 eTrust SSO Integration Kit

13.1 Defects Fixed in CR04

The following eTrust SSO Integration Kit is fixed in the build release number 12.0.0.5059:

Problem ID	Description	Resolution
984	Retrieval of user application list using SSO Java SDK fails.	This issue is fixed. Information about JAVA SDK and its usage was provided to the users.

13.2 Enhancements

13.2.1 CR05

The eTrust SSO Integration Kit CR05 build embeds the following components in build release number 12.0.0.5065:

CAPKI r4.1.3

13.2.2 CR03

The eTrust SSO integration kit build release no. 12.0.0.54 is enhanced to include the following documentation:

A new API ssoclapi_GetUserTokenEx() is added to the eTrust SSO Integration Kit. Use this API to retrieve the token status from eTrust SSO Server.

The SSOCLAPI error codes are included in the eTrust SSO Integration Kit.

Note: For more information about the new API and SSOCLAPI error codes, see the eTrust SSO Integration Kit.

13.2.3 CR02

The eTrust SSO Integration Kit is enhanced to include the following:

Samples for implementing a sample authentication using Credential Provider. The SampW32.dll is enhanced to handle authentication calls from Credential Providers.

Support for FIPS140-2 and IPv6.

13.2.4 CR01

The eTrust SSO Integration Kit consists of the following components:

eTrust SSO Sample Authentication Method for Windows operating system.

eTrust SSO Client API, SSOCLAPI, for Windows operating system.

eTrust SSO Server API in C and Java SDK for Windows operating system.

14.0 Session Administrator

14.1 Enhancements

14.1.1 CR05

The Session Administrator CR05 build embeds the following components in build release number 12.0.0.5064:

CAPKI r4.1.3

14.1.2 CR01

The eTrust SSO r12.0 CR01 Session Administrator is FIPS140-2 and IPv6 compliant.

15.0 PSLang

15.1 Enhancements

15.1.1 CR05

The PSLang CR05 build embeds the following components in build release number 12.0.0.5063:

CAPKI r4.1.3

16.0 Localization Support

In CA SSO r12.0 CR03, CA SSO Client (build release number 12.0.0.5055) is localized in the following languages:

French

German

Italian

Spanish

Note: If you run the product in a language environment not listed in the preceding list, you may experience problems.

17.0 Contact CA Support

Contact CA Support

For your convenience, CA Technologies provides one site where you can access the information you need for your Home Office, Small Business, and Enterprise CA Technologies products. At http://ca.com/support, you can access the following:

Online and telephone contact information for technical assistance and customer services

Information about user communities and forums

Product and documentation downloads

CA Support policies and guidelines

Other helpful resources appropriate for your product

Provide Feedback

If you have comments or questions about CA Technologies product documentation, you can send a message to techpubs@ca.com.

If you would like to provide feedback about CA Technologies product documentation, complete our short customer survey, which is available on the CA Support website at http://ca.com/docs.