About the Helix Authentication Service Administrator Guide

• Support for Azure App Service and Ingress NGINX controller in Kubernetes.

• A setting to hide the version numbers of the HAS server, which enhances security. See STATUS_ENABLED.

• A setting to ALLOW_USER_RENAME in Helix Core user and group provisioning.

• A single instance of HAS can be configured for Multiple Helix Core servers, and to configure HAS for this purpose, see TOML file format for HAS.

• Logging can support structure logging for user provisioning. For an example of this configuration, see the logging.config.cjs file in the helix-authentication-service directory.

• With Helix Swarm 2024.1 and later, configuration between Helix Swarm and Helix Authentication Service is no longer needed. The following is relevant for Helix Swarm 2018.3 through 2023.4:

  • To specify the SP entity identifiers for multiple Helix Swarm instances connecting to one P4D instance, wildcards are supported in the IDP_CONFIG_FILE.

For a complete list of what's new in the product, see the 2024.1 release notes.

• Web-based administration is a convenient alternative to manually editing the .env file to configure OIDC and SAML providers.

• SAML_FORCE_AUTHN can force the user to authenticate with each login request.

• OIDC_MAX_AGE sets the maximum age in seconds before reauthentication is required.

• CLIENT_CERT_FP and CLIENT_CERT_CN support using bracketed list with comma-separated values.

• If you want to use HAS with Helix Swarm, a script can help you with Swarm troubleshooting.

• An additional troubleshooting tip is Azure AD SAML authentication method mismatch.

• The BEARER_TOKEN_FILE setting makes sending your configuration file to Perforce Support more secure.

• Example Identity Provider configurations have been updated.

For a complete list of what's new in the product, see the 2023.2 release notes.

• Support for a configuration involving Multiple providers

• SAML_CERT_FILE and SAML_KEY_FILE for connecting to a SAML IdP and when signing SAML responses for client applications, such as Swarm.

For a complete list of what's new in the product, see the 2023.1 release notes.

• See Warning and workaround for SAML security.

• Support for debugging for SAML and the provisioning of groups and users. See DEBUG_SAML and DEBUG_SCIM in Other Settings.

• Support for debugging HAS when load balancing is involved. See DEBUG_PROXY in Other Settings.

• CLIENT_CERT_FP provides additional security (see Other Settings).

• OIDC_SELECT_ACCOUNT has been added to the OpenID Connect settings

• The Example Helix Swarm configuration has been improved.

• A new feature in provisioning is How to re-activative a user.

For a complete list of what's new in the product, see the 2022.2 release notes.

• Support for Hansoft, Helix TeamHub, and Helix DAM. See Supported client applications and minimal versions.

• Implementation of a System for Cross-domain Identity Management (SCIM) for Helix Core user and group provisioning through your cloud service provider.

• Support for authentication through JSON web tokens. See Settings for JSON web token authentication.

• Support for Redis with client certificates. See REDIS_CERT_FILE.

• SVC_GROUP and SVC_USER added as settings for the process that runs Helix Authentication Service.

• rename ecosystem.config.js to ecosystem.config.cjs

• change the extension of the file referred to by LOGGING to be .cjs instead of .js

• change the extension of the file referred to by IDP_CONFIG_FILE to be .cjs instead of .js

For a complete list of what's new in the product, see the 2022.1 release notes.

Simplifies installation and configuration for package and install script users:

• no need to download and work with pm2
• the example.env file provides a starting point for your .env file. See Configuring.

Adds support for using the identity provider's metadata as a file instead of URL. See SAML settings > SAML_IDP_METADATA_FILE