ANNOUNCEMENT · ON-PREMISE · AUTHENTICATION SERVER

Octopus Authentication Server 6.8.9 is now available.

Virtual smart cards, programmatic Management Console access, self-service password reset and hardened TLS and SSH defaults.

In short

Version 6.8.9 for on-premise deployments is out. Before you upgrade, check that your LDAP clients, integrations and SSH tools support TLS 1.2 with modern ciphers, since the new hardened defaults may block older clients.

Virtual smart card authentication

Users can now log in to Windows, web apps and other integrated services using virtual smart cards. The required parameters are in the sslclientcert file under /etc/nginx; see the Admin Guide for setup, including the Windows MSIUpdater settings.

Programmatic access to the Management Console

Integrations can call the MC using OAuth2 client credentials issued by a dedicated Authorization Server. Clients are managed in the new Security > Clients tab, each with an MC role (Admin, Helpdesk or Auditor) and up to two secrets for zero-downtime rotation.

User-initiated password reset

A new User Portal self-service option (Portal > Self Service) lets users reset their AD password, for example if they suspect it was compromised. The new password is generated automatically, once every 24 hours.

Auto Password Rotation: Reset Now

Admins can trigger an immediate password rotation for all members of a group.

Full sync per user

Run a full directory sync for a single user from the Users list or the user details page (AD and Remote AD directories).

UPN attribute for Oracle/Open LDAP

A new schema imports the User Principal Name attribute from Oracle/Open LDAP directories and shows it in the user details.

Reference nginx configuration files

Each SDO-provided nginx configuration file now has a reference copy with the .sdo.orig suffix. Your active files are never overwritten on upgrade, so you can compare and apply the recommended settings when you choose.

Platform upgrades

nginx 1.30.6, Node.js 24.22.1, and updated open source components including axios 1.21.0 and undici 7.30.2.

Check client compatibility before you upgrade. Version 6.8.9 hardens the default TLS and SSH settings. Clients that do not support them, typically older LDAP clients, integrations and SSH/SCP tools, will not be able to connect:

• LDAP (port 636): TLS 1.2 and higher only, with ECDHE/AEAD ciphers. Applied immediately on upgrade; ldap-service.json is replaced, so reapply any custom changes afterwards.
• SSH: ciphers restricted to chacha20-poly1305, aes256-gcm and aes128-gcm, with weak key exchange and MAC algorithms removed. Applied on upgrade; the sshd configuration is replaced, so reapply any custom changes.
• nginx (web): TLS 1.2 and 1.3 only. Applied by default on new installations; on upgrades your active configuration is kept, and you can apply the hardened settings from /etc/nginx/sslconf.sdo.orig.

Upgrade path

Upgrading to 6.8.9 requires Octopus Authentication Server 6.6.2 or higher. If you are on an earlier version, please contact SDO Customer Support before upgrading.

Zimbra directory integration removed

Octopus Authentication Server no longer supports Zimbra directory integration.

Recommended agent versions

Some features require the latest agents. We recommend Octopus Desk for Windows 4.3.6 and Octopus Desk for Mac 4.4.12 or later, and the latest Octopus Authenticator mobile app.

Supported operating systems

Red Hat 8.10, 9.6 and 9.8; Oracle Linux and Rocky Linux 8.10 and 9.8. Linux 7 (el7) is not supported.