Release 3.9.1235

Release date: 19 Nov 2019

New Features

Added support for JSON Web Token (JWT)

Using JSON Web Tokens, SmartKey is able to offer another form of authentication based on JSON-based standards. The option for JWT authentication is available on the create/edit app screen.

To create the app with JWT authentication, users are required to fill in:

  • Valid Issuers
  • Provide either Stored Signing Keys or Fetched Signing Key

Click Save to create the JWT-Authenticated app.

Enhancements to existing functions

Certificate expiry for App authentication will be enforced starting from this release

In Release 3.5, SmartKey added the ability to display Certificate Expiration Date for Apps. Starting from this release, SmartKey will start to strictly enforce the expiration date. This means that anyone using an expired certificate for app authentication will fail the authentication. It will prompt an error notification due to the expired certificate.

Important: Users who are currently using expired certificates for app authentication will find that authentication will fail. It is recommended that you update your expired certificates.

Bug Fixes

  • Fixed the display of App permissions. Previously, when user edits the App permissions but cancels the edits, the icon display of App permissions will still display his edits. Now, the behavior has been changed to: icon display of App permission will display edits only if it is saved.

  • Fixed a minor UI issue in “add/edit users in group” and “add/edit group for user”. When the name of the user is too long, it would cover up the role options. This has been fixed by placing the role options on a separate row.

Quality of Life improvements

  • In the Create App screen, when there are missing required fields, the “Save” button will be disabled. In this release, users will be prompted with a message which tells them what required fields need to be filled out.

  • Improved the position of Copy UUID tooltip to make it more visible. It will now pop up briefly in the middle of the screen.

  • Added an explicit warning to inform users that once they deactivate or delete their Security Object, it cannot be reverted. For Delete Security Object, the list of warnings is context dependent. For example, if Quorum approval is required, users will be warned that they must request for Quorum approval.

  • Improved tool tips for enable/disable buttons:

    • When the object is enabled, you will be able to mouseover the help icon to view a helpful tooltip about the enabled object. This applies to Security Objects, Apps, Plugins and Users.
    • The success message has been updated for enable/disable of any type of object and will persist on the screen for a longer time. The following table lists the action and corresponding message.
    Action Message
    Enable a security object The object is enabled. All cryptographic operations and export can be performed according to key permission.
    Disable a security object The object has been disabled. No crypto-operations or export may be performed on the object. You can enable it again.
    Enable an app/plugin The app/plugin is enabled and it can do cryptographic operations.
    Disable an app/plugin The app/plugin is disabled and can no longer do cryptographic operations. You can enable it again.
    Enabling a user The user’s access to the account is restored.
    Disabling a user The user is successfully disabled from access to the account. You can enable the user again.