SignOn Policy now available for custom login experiences
Aembit has added support for defining a SignOn Policy, enabling you to customize the login experience for your users.
For more information, please see the SignOn Policy page.
Changelog — New Feature
Dynamic steering to specific hostnames now available
Aembit now supports dynamically steering only specific traffic to the Agent Proxy.
The dynamic steering feature introduces the ability to restrict this proxied traffic to a specific list of hostnames. When this feature is enabled, only egress traffic to the user-specified hostnames will be proxied. This enables you to have more precise control over which destinations’ traffic is managed by the Agent Proxy.
OAuth 2.0 Authorization Code Credential Provider now available
Aembit now supports 3-legged OAuth (3LO) workflows through the new OAuth 2.0 Authorization Code Credential Provider. Applications can request a user’s permission to access their account data and act on the user’s behalf.
With 3LO support, an application can access services or applications that the user has authorized.
Aembit supports the following third-party services with OAuth 2.0 Authorization Code Credential Providers:
For configuration details, see the OAuth 2.0 Authorization Code Credential documentation.
An expansion to Client Workload identification and Trust Provider match rules also shipped in this release; see Expanded Client Workload identification and Trust Provider match rules.
OAuth 2.0 Authorization Code Credential Provider enters beta
Aembit has released beta support for the OAuth 2.0 Authorization Code Credential Provider.
Many organizations require Credential Provider support for various 3rd party SaaS services which only support short lived credentials with the OAuth 2.0 Authorization Code Flow. These services included:
- Atlassian
- GitLab
- Slack
- GCP BigQuery
- Apigee
- PagerDuty
This beta release enables users to use 3rd party SaaS services and have short-lived access tokens generated on demand for authentication to APIs that these 3rd party services provide.
For more information on how to configure the OAuth 2.0 Authorization Code Credential Provider to be used with any of these 3rd party services, please see the OAUth 2.0 Authorization Code Credential Provider page.
AWS Role Trust Provider now available
Aembit has released an update to support AWS Role-Based Trust Providers.
The ability to create and use different types of Trust Providers in your Aembit environment enables you to have flexibility in how resources are managed. With this enhancement, you now have an additional option when selecting a Trust Provider.
For more information on AWS Role-Based Trust Providers, please see the AWS Role Trust Provider page.
Resource Sets now available
Many organizations have certain security requirements that specify which resources should be managed by a group. To address these security needs, Aembit has released a new Resource Sets feature that enables you to determine which groups will have access to various resources.
You may find it necessary to segment management responsibilities for certain entities and resources in your Aembit environment between different individuals and groups for security reasons. To accommodate this requirement, Aembit has released the Resource Sets feature.
Resource Sets enable you to group entities and resources (e.g. Credential Providers, Trust Providers, Identity Providers, etc.) into a single collection and assign specific users to manage these resources.
For more detailed technical information on how to use create and manage Resource Sets, please refer to the Resource Sets technical documentation.
AWS Lambda Container deployment now supported
There are many different deployment options you can currently use to deploy Aembit Edge Components in your environment, including GitHub Actions, GitLab Jobs, and Kubernetes.
To increase the available deployment options for our users, Aembit now provides support for users who wish to deploy Aembit Edge Components to an Amazon Web Services (AWS) Lambda Container.
For more detailed information on how to deploy Aembit Edge Components to AWS Lambda Containers, please refer to the AWS Lambda Container technical documentation.
GitLab CI/CD Jobs now supported as Client Workloads
Aembit now supports GitLab CI/CD Jobs as Client Workloads.
For more information on how to configure GitLabs Jobs with Aembit Client Workloads, please refer to the Script-based Agent page.
Kerberos Trust Provider now available for Active Directory
Aembit has released a Kerberos Trust Provider that enables the attestation of Client Workloads running in virtual machine environments joined to Active Directory. This attestation method is specifically designed for on-premise deployments where alternative attestation methods, such as AWS or Azure metadata service trust providers, are not available.
For more detailed information on this Kerberos Trust Provider, please refer to the Kerberos Trust Provider technical documentation.
Aembit Terraform Provider now available
Aembit has officially released a Terraform Provider to the Hashicorp Terraform Registry.
The Aembit Terraform Provider enables users to manage Aembit Cloud resources using terraform manually or via CI/CD workflows.
For more detailed information about the Aembit Terraform Provider, please see the Aembit Terraform documentation.
SAML SSO authentication now available for administrators
Aembit now supports SAML/SSO authentication for administrators who wish to simplify the Aembit Tenant login process for their users. Instead of requiring a user to enter their username/password credentials every time a user tries to access the Aembit Tenant, users will now be able to use a 3rd party SAML SSO Provider (e.g. Google, Okta, Microsoft Entrata) to log into the tenant.
For more information on how to configure Identity Providers using SAML, please see the Configuring Identity Providers technical documentation.
Wiz integration now available for vulnerability assessment
Aembit now supports Wiz integration. Using the Wiz Integration API, you can work with both your Aembit Tenant and Wiz to identify customer assets and vulnerabilities.
For more detailed information about the Aembit -> Wiz integration, please refer to the Wiz Integration page on the Aembit technical documentation site.
CrowdStrike integration now available for security posture checks
Aembit now supports integration with CrowdStrike. This integration allows you to leverage CrowdStrike’s service to prevent Server Workload access from Client Workloads that do not meet an expected state.
For more information about this integration, please refer to the CrowdStrike Integration page on the Aembit technical documentation site.
Agent Controller high availability now supported
The Aembit Agent Controller can now be installed in high availability configurations. Because the Agent Controller is a critical Aembit Edge Component that manages Agent Proxy registration and credential acquisition for Aembit Cloud access, HA support was necessary to ensure the continuous availability of the Agent Controller.
For information on installing and configuring Agent Controller in high availability environments, please see the Agent Controller High Availability page.
CrowdStrike Falcon Sensor integration for virtual machine verification
In an effort to ensure only Client Workloads that run in a secure environment can access Server Workloads, Aembit has enabled integrations with CrowdStrike and its CrowdStrike Falcon Sensor. CrowdStrike Falcon Sensor checks multiple items on the virtual machine (VM) to verify the VM is secure.
Dynamic Claims now available for Credential Providers
Aembit has released a new feature for Credential Providers called “Dynamic Claims.” This feature allows you to set the Subject claim and Custom claims with either literal strings or dynamic values when setting up Credential Providers in your Aembit client tenant.
For more detailed information about Dynamic Claims, please refer to Dynamic Claims page
This feature is currently only supported for Vault integration.