Identity, Authentication, and User Management Updates

EPC 15.4 introduces major improvements to security, authentication, and user management through enhancements to the SSO Identity Provider (IdP) broker and Local User Management components. These changes affect authentication configuration and user administration.

SSO (Single Sign-On) Users

Action Required: SSO must be reconfigured during the upgrade.

• Existing SSO configurations must be updated to align with the new authentication framework.
• This is a one-time step to ensure secure access.
• No impact to end users: application functionality, UI behavior, and workflows remain unchanged.
  

Local User Management

New Interface & Enhanced Security:

• Redesigned centralized user management UI.
• Stronger password policies with configurable expiration rules.
• Enhanced security controls aligned with modern authentication standards.
• Additional self-service features (e.g., “Forgot Password”).
• Improved account protection and administrative enforcement.
  

These enhancements improve security, usability, and administrative control without affecting existing user access or workflows.

Key Benefits

Centralized SSO & MFA:

• Single sign-on for multiple applications (EPC, QMS, DBP, admin tools).
• Unified MFA policy across applications, reducing per-app MFA setups.

Standards-Based Integration:

• OpenID Connect support added (in addition to existing SAML).
• Eliminates need for custom MFA code per app.
• Flexible MFA enforcement by user group/role, application, network/location, or risk level.
• Supports common MFA methods: TOTP authenticator apps, WebAuthn/FIDO2, and more.

Improved Account & Lifecycle Management:

• Central user management, password policies, account lockout, session and device controls.
• Easier auditing of authentication events.
• Compatible with “bring your own IdP” (Azure AD, Okta, etc.) while enforcing additional local MFA if needed.

Long-Term Roadmap Benefits:

• User, group, and role synchronization on demand (not just on login).
• Decoupled system administrator vs. application/content administrator environments.