Keycyte PAM 3.2 · Release Notes

Upgrade Notes

Read these notes before you upgrade an existing installation to Keycyte PAM 3.2.

Before You Upgrade

• Back up. Create a backup on Settings > Backup and copy it off the host. Also back up the installation package folder, including the .env file, and the ~/record and ~/drive directories.
• Keep the encryption key. The new version must use the same encryption key (KEYSTORE_KEY_HEX) and session secret (SESSION_SECRET_KEY) as the current installation. Otherwise stored secrets, backups and recordings cannot be decrypted.
• Upgrade the Password Manager first. The self-first password change of Keycyte PAM 3.2 requires the Password Manager service of the same release. Deploy the new Password Manager before or together with the PAM server.
• Plan a maintenance window. Active sessions are interrupted while the containers restart.
• Several nodes. Upgrade all nodes to the same version.

Database Schema

The database schema is migrated automatically when the PAM server starts. The PAM server creates new tables and adds new columns and indexes; it does not drop existing columns or indexes. No manual database step is required. If the migration fails, the PAM server does not start and logs Failed to run ent auto-migration.

Changed Behavior

Check the following changes after the upgrade:

• Role schedules are enforced. Weekly schedules, overnight time windows and custom date ranges now work as configured. Roles that denied access because of the earlier issues start granting access within their configured windows. Review the schedules of your server, password and user roles.
• Password change method. Existing password policies use the new default change method: the account changes its own password first, then falls back to a privileged reset. Review the Change Method of your password policies.
• ADMIN accounts need a permission profile. ADMIN accounts are restricted by permission profiles. Review the profiles on Settings > Permission Profiles and the profile assigned to each ADMIN account. When a backup taken before permission profiles existed is restored, every ADMIN account receives the built-in full profile.
• Deleted vault entries go to the recycle bin. Deleting a vault entry moves it to Settings > Recycle Bin until its retention period ends. The archived password is not changed on the target system during this period.
• 3rd party application servers. Servers of the 3rd party application type that store the application’s name instead of its ID must be edited: open the server, select the application again and save.
• MFA lockout. The account lockout after failed MFA verifications applies to all user types. Its duration is set with KEYCYTE_MFA_LOCKOUT_DURATION_MIN (default 15 minutes).
• Service access keys. Service access keys are read only from the environment (.env). They cannot be created or rotated in the Admin Panel.
• Request rate limiting. The PAM server no longer limits the request rate per client. Configure rate limiting on a reverse proxy if you need it.
• Session cookie. The session cookie is sent with the __Host- prefix. If you upgrade from a version that did not use the prefix, users are signed out once after the upgrade and must sign in again.