Technical Notes Version 4.3

AuthControl Sentry 4.3.0 Tech. Notes

Released: October 2026

Please read these notes before upgrading to version 4.3

Installation

Please update the CMI, using the “Update CMI Menu” option before attempting to update any other packages. This enables the new 4.3 repository and does some other preparation necessary for the remaining updates. Log out and back in again to apply the CMI changes.

Once the CMI is updated, you can install the remaining apps as usual. You will probably have to Flush Cache to see the new 4.3 repository after the update.

Note that there is another CMI update available for 4.3, so you should run Update CMI Menu again. This version has options to manage Tomcat headers, so should be installed even if you only want to update Tomcat.

If you want to update Apache Tomcat or Java to the latest available versions, apache-tomcat-9.0.123 or swivel-jre-1.8.0_504, without installing the 4.3 apps, you can do this, but you must run the CMI update above first, or you will not be able to see the new updates. If you want to use the new tomcat security features, you will need to update CMI twice. Then proceed as follows:

  • In the update menu, choose Install / Update Package * Enter the package name: for Tomcat, the name is “apache-tomcat” and for Java only, it is “swivel-jre”. Note that the names should be all lower-case. Installing the Tomcat update also installs swivel-jre. * Install this package. Note that it also installs the latest available Java version, swivel-jre-1.8.0_502, as well

  • You may find that Tomcat is stopped after this update, in which case, make sure you start it again.

Passkey Support

In order to enable passkey support, you need to complete a number of configuration changes in the Core Web Administration:

  • In Policy -> Passkeys:

    • Set Enable Passkey authentication to Yes

    • Set the relying party identifier to your qualified hostname (for example “sentry.company.com”)

    • Set the relying party name as required

    • Set the Public URL to the full hostname, including https://, that will be used. This must be accessible by any users wishing to register passkeys

    • You can usually leave the provision URL for passkeys as it is, which will prefix the public URL

    • Allowed RP Ids is optional: the one you configured earlier is always accepted, but this allows for additional RP Ids.

    • If you enable Attestation, be aware that this effectively restricts passkeys to hardware, as most software passkey providers don’t support it

    • The additional options: “Passkey Device Allow/Deny List” and “Passkey Attestation Trust Roots” are advanced options. Use these only if you know how they work.

  • In Repository -> Groups

    • Enable Passkeys on at least one group.

    • You need to run User Sync from the User Administration page (or as a scheduled sync) to enable passkeys on members of that group

Once Passkey support is configured in the Core, you can enable it in User Portal and SSO, using the Authentication and Display Settings menus in user portal, and Authentication Methods in SSO. Note that SSO has two passkey authentication methods: FIDO2 Passkeys and Hardware Passkeys. You don’t have to use both: FIDO2 Passkeys includes all hardware keys, but if you want to enforce hardware-only, use the second method.

PINpad2 Support

No special preparation is required to use PINpad2 in the Core: it is available to any user with Single channel rights. However, you should be aware of the following:

  • Initially, a user’s PINpad2 PIN is the same as their usual PIN. PINpad2 PINs are never set on creation.

  • Once you configure a PINpad2 PIN for a user, it is always independent of the usual PIN

  • You can change the PINpad2 look and feel under Server -> Single Channel. However, be aware that if you select an emoji-based set, it is difficult to work out the current PIN if it is not explicitly set

  • Once a user’s PINpad2 PIN is set, the look and feel is fixed, irrespective of the default setting. However, if they change their PIN through the user portal, the new PIN will be selected using the default setting.

  • You need to enable the option to change PINpad2 PIN in user portal: it is off by default.

  • If a user’s PINpad2 PIN has not yet been set, they can set one in user portal without needing to enter the old one.

  • Using the Reset option, either in user portal or in User Administration, sends the PIN to the user as descriptions, if the default setting uses emojis.