Authentication Service and Privilege Elevation Service 6.3.0 Release Notes (Server Suite 2026 )

Release Date: September 30, 2026

The Authentication and Privilege Elevation release notes describe changes to the following feature areas:

Access Manager DirectControl Agent for *NIX Report Services
Access Module for PowerShell DirectControl Command Line Utilities Roles and rights
Active Directory environment Endpoint enrollment RunAsRole
ADedit Agent for Windows Group Policy Management Smart Card
Application Manager LDAP Proxy Windows configuration and environment
Audit Trail Events Licensing Service Windows installation
Compatibility with third party products Network manager Windows Installer
Configuration parameters NIS Windows SDK
Desktop with elevated privileges OpenSSH Zone Provisioning Agent

Be sure to also review the Authentication Service and Privilege Elevation Service Limitations that apply to multiple releases.

New Features

This section describes new features included in this release.

Server Suite DirectControl Agent for Linux/UNIX

  • When FIPS mode is enabled, DirectControl now uses the OS FIPS provider by default for FIPS 140-3 compliance, as the OS FIPS provider is FIPS 140-3 validated. DirectControl currently supports the OS FIPS provider on RHEL 9 and RHEL 10 x86_64 only. Agents upgraded with FIPS mode already enabled continue to use the DirectControl FIPS provider, to avoid interruption. (749009)

  • Added a new parameter, nss.enumeration.enable, to control whether Active Directory entries (users, groups, and so on) are returned for NSS enumeration. See nss.enumeration.enable. (712623)

  • Added an opt-in NSS level cache on Linux to reduce LRPC2 overhead for repeated user and group lookups in long-running processes, which mitigates the performance impact of NSCD deprecation on Fedora 36 and later and RHEL 10 and later. The cache is disabled by default; to enable it, set nss.cache.enabled: true. See (700172)

  • Added support for returning multiple domain controllers to MIT Kerberos for automatic failover when the primary domain controller is unavailable. (707533)

  • Added a new parameter, adclient.local.account.group.notification.cli, that invokes a configured command when Local Account Management adds or modifies (-g) or removes (-G) a managed local group. See adclient.local.account.group.notification.cli. (736505)

  • Added a new parameter, adclient.krb5.service.principals.autoupdate, that specifies whether adclient adds the service principals defined in adclient.krb5.service.principals to the computer account, together with their key table entries, without re-joining the domain. The default value is false. (737874)

Report Services

  • SQL Server 2025 is supported. (696417)

  • PostgreSQL 18 is supported. (725703)

Improvements

This section provides an overview of the product improvements in this release.

Server Suite DirectControl Agent for Linux/UNIX

  • On SUSE, DirectControl disables pam-config when it is installed and re-enables it when it is uninstalled. (693811)

  • The adproperty command supports adding and removing specific property values. (715775)

  • The group policy parameter gp.mappers.certgp.pl.additional.cafiles supports PEM format certificates in addition to DER format. (700443)

  • Added wildcard (*) pattern matching to nss.program.ignore and nss.process_group.ignore. The entry falcon-sensor* is now included in the default Linux ignore list, so CrowdStrike Falcon agents are excluded from DirectControl NSS lookups by default. (713899)

  • The adkeytab -G command rejects unwritable key table paths up front with a message that names the account, uid, and directory, instead of reporting a misleading error. The daemon debug log preserves the real operating system errno instead of a leaked ENOENT. (736785)

  • The command adcache --reorg is obsolete and has been removed from the man page and the command line help. (746193)

Server Suite OpenLDAP

  • Upgraded OpenLDAP to 2.6.13. (700685)

Server Suite LDAP Proxy

  • Upgraded OpenLDAP to 2.6.13. (700685)

Server Suite OpenSSH

  • Delinea OpenSSH is upgraded based on openssh-10.4p1. (683438)

Fixed Issues

This section lists notable issues that have been fixed in this release.

Security

Server Suite DirectControl Agent for Linux/UNIX

  • Fixed an issue where a SELinux policy module upgrade failure prevented adclient from starting in enforcing mode, caused by a module name conflict between the old (centrifydc-2) and new (CentrifyDC) internal names. (706394)

  • Fixed thread safety issues when reading parameters from the configuration file. (720855)

  • Fixed an issue where pam.create.k5login wrote only the sAMAccountName form for a gMSA. It now writes both the sAMAccountName and UPN forms. (724709)

  • Fixed an issue where SSH login failed on RHEL 10.2 with SELinux enabled and selinux-policy version 42.1.18 or later installed, caused by a missing file context for sshd-session in centrify-openssh.pp. (743849)

  • Fixed an issue where the adclient authselect profile removed unspecified NSS entries on Red Hat Enterprise Linux 10. (745992)

  • Fixed an issue where Group Policy was intended to restart adclient but instead stopped it. (750986)

  • Fixed an issue where adjoin crashed on Solaris SPARC during the Kerberos and Active Directory join. (751081)

  • Fixed an issue where multi-threaded applications crashed when performing concurrent user lookups or authentication through the agent NSS and PAM modules, caused by a non-thread-safe random number generator call in the LRPC2 client. (752611)

  • Fixed an issue introduced in Release 2025 where error messages could appear in the DirectControl log if a process was unable to read the centrifydc.conf file. (752619)

  • Fixed an issue where adclient may dump core when dumping the loaded parameters with the adinfo -y config command. (757342)

  • Fixed an issue where an adclient crash also brought down cdcwatch on systems that use systemd. (760306)

  • Fixed an issue where adclient crashed because select() in the OpenLDAP socket I/O layer wrote beyond the fd_set buffer when socket file descriptors exceeded FD_SETSIZE (4096, as defined in OpenLDAP). The select() call has been replaced with poll(), which has no file descriptor limit. (702027)

Server Suite DirectControl Agent for Windows

  • Fixed an issue where the Windows agent did not update its Identity Services Platform enrollment to the new tenant when the MFA tenant of a zone changed, or when the computer moved to a zone with a different tenant. (665064)

Access Module for PowerShell

  • Fixed an issue where New-CdmUserProfile failed to create a UNIX user profile in an RFC 2307 zone when the service account could authenticate only to a child domain and the forest root domain controller was unreachable. (720378)

  • Fixed an issue where Get-CdmRfc2307NisNetGroup failed with the error “Zone parameter must be provided” even when a valid -Zone parameter was specified. The cmdlet now correctly retrieves RFC 2307 NIS net groups from the specified zone. (724827)