***************************
Technical Notes Version 4.3
***************************

`AuthControl Sentry 4.3.0 Tech. Notes`
""""""""""""""""""""""""""""""""""""""
Released: October 2026

Please read these notes before upgrading to version 4.3

Installation
^^^^^^^^^^^^

Please update the CMI, using the "Update CMI Menu" option before attempting to update any other packages. This prepares some features necessary for the remaining updates. Log out and back in again to apply the CMI changes.

Once the CMI is updated, you can install the remaining apps as usual.

If you want to update Apache Tomcat to the latest available version, 9.0.122, without installing the 4.3 apps, please follow this procedure:
* In the update menu, choose Install / Update Package
  * Enter the following package name: swivel-jre-prep
  * If the package is not available, try Flush Cache first
  * Install this package
* Choose Install / Update Package again
  * Enter the package name apache-tomcat
  * Install this package. Note that it also installs the latest available Java version, swivel-jre-1.8.0_502, as well
* You may find that Tomcat is stopped after this update, in which case, make sure you start it again.

The reason for the additional package is that we are installing Java differently, to ensure that older versions are removed. This runs into conflict with previous configuration settings, so they have to be changed in a separate installation. This can't be done at the same time as installing the new Java package. Updating the CMI also does this, which is why it needs to be done separately.

.. _v43_technotes_passkeys:

Passkey Support
^^^^^^^^^^^^^^^

In order to enable passkey support, you need to complete a number of configuration changes in the Core Web Administration:

* In Policy -> Passkeys:

  * Set Enable Passkey authentication to Yes
  * Set the relying party identifier to your qualified hostname (for example "sentry.company.com")
  * Set the relying party name as required
  * Set the Public URL to the full hostname, including https://, that will be used. This must be accessible by any users wishing to register passkeys
  * You can usually leave the provision URL for passkeys as it is, which will prefix the public URL
  * Allowed RP Ids is optional: the one you configured earlier is always accepted, but this allows for additional RP Ids.
  * If you enable Attestation, be aware that this effectively restricts passkeys to hardware, as most software passkey providers don't support it
  * The additional options: "Passkey Device Allow/Deny List" and "Passkey Attestation Trust Roots" are advanced options. Use these only if you know how they work.

* In Repository -> Groups

  * Enable Passkeys on at least one group.
  * You need to run User Sync from the User Administration page (or as a scheduled sync) to enable passkeys on members of that group

Once Passkey support is configured in the Core, you can enable it in User Portal and SSO, using the Authentication and Display Settings menus in user portal, and Authentication Methods in SSO.
Note that SSO has two passkey authentication methods: FIDO2 Passkeys and Hardware Passkeys. You don't have to use both: FIDO2 Passkeys includes all hardware keys, but if you want to enforce hardware-only, use the second method.

PINpad2 Support
^^^^^^^^^^^^^^^

No special preparation is required to use PINpad2 in the Core: it is available to any user with Single channel rights. However, you should be aware of the following:

* Initially, a user's PINpad2 PIN is the same as their usual PIN. PINpad2 PINs are never set on creation.
* Once you configure a PINpad2 PIN for a user, it is always independent of the usual PIN
* You can change the PINpad2 look and feel under Server -> Single Channel. However, be aware that if you select an emoji-based set, it is difficult to work out the current PIN if it is not explicitly set
* Once a user's PINpad2 PIN is set, the look and feel is fixed, irrespective of the default setting. However, if they change their PIN through the user portal, the new PIN will be selected using the default setting.
* You need to enable the option to change PINpad2 PIN in user portal: it is off by default.
* If a user's PINpad2 PIN has not yet been set, they can set one in user portal without needing to enter the old one.
* Using the Reset option, either in user portal or in User Administration, sends the PIN to the user as descriptions, if the default setting uses emojis.