--- title: Release Notes description: A record of new features and improvements made in each version of PingAuthorize. component: pingauthorize version: 10.3 page_id: pingauthorize:release_notes:paz_release_notes_legacy_home canonical_url: https://docs.pingidentity.com/pingauthorize/11.1/release_notes/paz_release_notes_legacy_home.html llms_txt: https://docs.pingidentity.com/pingauthorize/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-10-12T20:00:09Z superseded_by: https://docs.pingidentity.com/pingauthorize/11.1/release_notes/paz_release_notes_legacy_home.html section_ids: pingauthorize-10-3-0-6-september-2026: PingAuthorize 10.3.0.6 (September 2026) fixed-a-security-issue: Fixed a security issue fixed-an-issue-with-gateway-api-request-timeouts: Fixed an issue with Gateway API request timeouts pingauthorize-10-3-0-5-august-2026: PingAuthorize 10.3.0.5 (August 2026) improved-handling-of-null-values-in-redis: Improved handling of null values in Redis added-correlation-id-to-gateway-request-and-response-logs: Added correlation ID to gateway request and response logs fixed-inconsistent-url-decoding-behavior: Fixed inconsistent URL decoding behavior fixed-timeouts-when-content-length-header-is-present: Fixed timeouts when Content-Length header is present fixed-502-errors-when-using-an-http-proxy-with-api-external-servers: Fixed 502 errors when using an HTTP proxy with API external servers fixed-a-server-shutdown-delay-issue: Fixed a server shutdown delay issue fixed-an-issue-with-server-updates-in-containerized-environments: Fixed an issue with server updates in containerized environments update-tool-logs-a-benign-warning: update tool logs a benign warning pingauthorize-10-3-0-4-may-2026: PingAuthorize 10.3.0.4 (May 2026) fixed-a-manage-profile-replace-profile-error: Fixed a manage-profile replace-profile error pingauthorize-10-3-0-3-march-2026: PingAuthorize 10.3.0.3 (March 2026) version-increased-for-administrative-purposes: Version increased for administrative purposes pingauthorize-10-3-0-2-january-2026: PingAuthorize 10.3.0.2 (January 2026) added-more-control-over-timestamp-precision: Added more control over timestamp precision improved-expired-certificate-handling-for-tls-negotiation: Improved expired certificate handling for TLS negotiation fixed-an-issue-with-performlocalcleanup-in-interactive-mode: Fixed an issue with --performLocalCleanup in interactive mode pingauthorize-10-3-0-1-october-2025: PingAuthorize 10.3.0.1 (October 2025) version-incremented-for-administrative-purposes: Version incremented for administrative purposes pingauthorize-10-3-0-0-july-2025: PingAuthorize 10.3.0.0 (July 2025) removed-support-for-java-11: Removed support for Java 11 support-for-internet-explorer-11-has-been-deprecated: Support for Internet Explorer 11 has been deprecated policy-editor-configuration-properties-have-been-deprecated: Policy Editor configuration properties have been deprecated removed-extra-policy-editor-version-number: Removed extra Policy Editor version number documented-custom-spel-functions: Documented custom SpEL functions added-runtime-support-for-java-21: Added runtime support for Java 21 added-support-for-camel-4-0: Added support for Camel 4.0 override-short-circuiting-in-combining-algorithms: Override short-circuiting in combining algorithms added-circuit-breaker-functionality-for-services: Added circuit breaker functionality for services added-a-branch-counter-to-the-policy-editor: Added a branch counter to the Policy Editor added-advanced-logging-for-http-event-types: Added advanced logging for HTTP event types added-support-for-expensive-http-thread-detection: Added support for expensive HTTP thread detection added-correlation-id-support-in-service-logs: Added correlation ID support in service logs removed-unused-dependencies: Removed unused dependencies improved-api-security-gateway-timeout-behavior: Improved API security gateway timeout behavior improved-policy-query-debug-logging: Improved policy query debug logging made-the-collect-support-data-tool-more-secure: Made the collect-support-data tool more secure added-support-for-policy-editor-paging: Added support for Policy Editor paging fixed-an-issue-with-policy-query-responses: Fixed an issue with policy query responses fixed-an-issue-with-custom-oauth-parameters: Fixed an issue with custom OAuth parameters fixed-an-issue-with-self-governance-for-deployment-package-stores: Fixed an issue with self-governance for deployment package stores fixed-an-issue-with-aws-s3-logging: Fixed an issue with AWS S3 logging fixed-an-issue-with-decision-request-handling: Fixed an issue with decision request handling fixed-an-issue-with-database-connection-pools: Fixed an issue with database connection pools fixed-an-issue-with-scim-responses: Fixed an issue with SCIM responses fixed-an-issue-with-the-monitor-history-plugin: Fixed an issue with the Monitor History Plugin pingauthorize-10-2-0-9-september-2026: PingAuthorize 10.2.0.9 (September 2026) added-correlation-id-to-gateway-request-and-response-logs-2: Added correlation ID to gateway request and response logs fixed-a-security-issue-2: Fixed a security issue fixed-an-issue-with-gateway-api-request-timeouts-2: Fixed an issue with Gateway API request timeouts pingauthorize-10-2-0-8-august-2026: PingAuthorize 10.2.0.8 (August 2026) version-increased-for-administrative-purposes-2: Version increased for administrative purposes pingauthorize-10-2-0-7-april-2026: PingAuthorize 10.2.0.7 (April 2026) added-more-control-over-response-timestamp-precision: Added more control over response timestamp precision fixed-an-issue-with-performlocalcleanup-in-interactive-mode-2: Fixed an issue with --performLocalCleanup in interactive mode pingauthorize-10-2-0-6-march-2026: PingAuthorize 10.2.0.6 (March 2026) version-increased-for-administrative-purposes-3: Version increased for administrative purposes pingauthorize-10-2-0-5-november-2025: PingAuthorize 10.2.0.5 (November 2025) improved-expired-certificate-handling-for-tls-negotiation-2: Improved expired certificate handling for TLS negotiation pingauthorize-10-2-0-3-august-2025: PingAuthorize 10.2.0.3 (August 2025) fixed-an-issue-with-scim-responses-2: Fixed an issue with SCIM responses fixed-an-issue-with-the-monitor-history-plugin-2: Fixed an issue with the Monitor History Plugin pingauthorize-10-2-0-1-march-2025: PingAuthorize 10.2.0.1 (March 2025) version-incremented-for-administrative-purposes-2: Version incremented for administrative purposes pingauthorize-10-2-0-0-december-2024: PingAuthorize 10.2.0.0 (December 2024) deprecated-support-for-java-11: Deprecated support for Java 11 custom-sdk-extensions-using-javax-packages-will-need-to-be-migrated-and-recompiled-in-10-3: Custom SDK extensions using Javax packages will need to be migrated and recompiled in 10.3 advanced-oauth-settings-for-http-services: Advanced OAuth Settings for HTTP Services added-a-new-policy-query-response-view: Added a new policy query response view added-debug-logging-for-policy-query-requests: Added debug logging for policy query requests added-ability-to-customize-policy-query-debug-log-views: Added ability to customize policy query debug log views added-support-for-attribute-logging-to-policy-query-responses: Added support for attribute logging to policy query responses added-support-for-mapped-diagnostic-context: Added support for Mapped Diagnostic Context added-support-for-a-new-signature-algorithm: Added support for a new signature algorithm added-native-support-for-decision-point-spel-functions: Added native support for decision-point-spel-functions added-support-for-camel-3-22-2: Added support for Camel 3.22.2 added-key-and-trust-manager-caching: Added key and trust manager caching improved-policy-query-error-handling: Improved policy query error handling made-it-easier-to-resolve-policy-query-attributes: Made it easier to resolve policy query attributes allowed-proxied-requests-for-http-external-servers: Allowed proxied requests for HTTP external servers fixed-an-issue-with-policy-query-api-responses: Fixed an issue with Policy Query API responses fixed-an-issue-with-testing-large-elements: Fixed an issue with testing large elements fixed-an-issue-with-redundant-policies-when-using-the-policy-editor-management-api: Fixed an issue with redundant policies when using the Policy Editor Management API fixed-an-issue-with-the-policy-editor-login-screen: Fixed an issue with the Policy Editor login screen fixed-a-performance-issue-with-policy-queries: Fixed a performance issue with policy queries fixed-an-issue-with-merging-branches: Fixed an issue with merging branches fixed-a-policy-editor-sign-off-issue: Fixed a Policy Editor sign-off issue fixed-an-issue-with-the-decision-visualizer: Fixed an issue with the Decision Visualizer fixed-an-issue-with-deployment-package-store-requests: Fixed an issue with deployment package store requests changed-the-collect-support-data-monitor-file-behavior: Changed the collect-support-data monitor file behavior fixed-an-issue-with-promotheus-http-servlet-error-messages: Fixed an issue with Promotheus HTTP servlet error messages fixed-an-issue-with-config-diff: Fixed an issue with config-diff removed-suppression-messages-for-disabled-alerts: Removed suppression messages for disabled alerts pingauthorize-10-1-0-6-march-2026: PingAuthorize 10.1.0.6 (March 2026) version-increased-for-administrative-purposes-4: Version increased for administrative purposes pingauthorize-10-1-0-5-february-2026: PingAuthorize 10.1.0.5 (February 2026) added-more-control-over-response-timestamp-precision-2: Added more control over response timestamp precision improved-expired-certificate-handling-for-tls-negotiation-3: Improved expired certificate handling for TLS negotiation fixed-an-issue-with-performlocalcleanup-in-interactive-mode-3: Fixed an issue with --performLocalCleanup in interactive mode pingauthorize-10-1-0-4-september-2025: PingAuthorize 10.1.0.4 (September 2025) fixed-an-issue-with-the-monitor-history-plugin-preserving-files: Fixed an issue with the Monitor History plugin preserving files pingauthorize-10-1-0-3-may-2025: PingAuthorize 10.1.0.3 (May 2025) added-key-and-trust-manager-caching-2: Added key and trust manager caching fixed-an-issue-with-deployment-package-store-requests-2: Fixed an issue with deployment package store requests fixed-scim-response-errors: Fixed SCIM response errors removed-suppression-messages-for-disabled-alerts-2: Removed suppression messages for disabled alerts pingauthorize-10-1-0-2-september-2024: PingAuthorize 10.1.0.2 (September 2024) added-a-new-policy-query-response-view-2: Added a new policy query response view added-policy-query-debug-logging: Added policy query debug logging added-support-for-mapped-diagnostic-context-2: Added support for Mapped Diagnostic Context added-support-for-a-new-signature-algorithm-2: Added support for a new signature algorithm improved-policy-query-error-handling-2: Improved policy query error handling improved-resolution-of-query-attributes: Improved resolution of query attributes fixed-an-issue-with-policy-query-api-responses-2: Fixed an issue with Policy Query API responses fixed-an-issue-with-the-decision-visualizer-2: Fixed an issue with the Decision Visualizer fixed-a-memory-leak-issue: Fixed a memory leak issue fixed-an-issue-with-config-diff-2: Fixed an issue with config-diff pingauthorize-10-1-0-0-june-2024: PingAuthorize 10.1.0.0 (June 2024) make-real-time-data-calls-to-relational-databases: Make real-time data calls to relational databases implement-third-party-decision-log-publishers-with-the-pingdata-server-sdk: Implement third-party decision log publishers with the PingData Server SDK map-decision-request-headers-to-trust-framework-attributes: Map decision request headers to Trust Framework attributes determine-whether-service-call-results-were-retrieved-from-cache: Determine whether service call results were retrieved from cache enable-camel-service-connections-with-the-command-line: Enable Camel service connections with the command line enable-json-formatting-for-default-policy-editor-loggers: Enable JSON formatting for default Policy Editor loggers added-support-for-new-platforms: Added support for new platforms improved-database-service-security: Improved database service security updated-default-configuration-archive-maximum: Updated default configuration archive maximum fixed-an-issue-with-creating-copies-of-policies: Fixed an issue with creating copies of policies fixed-an-issue-with-library-statement-duplication: Fixed an issue with Library statement duplication fixed-an-issue-with-saving-ldap-services: Fixed an issue with saving LDAP services fixed-an-issue-with-http-service-requests: Fixed an issue with HTTP service requests fixed-an-issue-with-self-governance-decision-requests: Fixed an issue with self-governance decision requests fixed-an-issue-with-policy-query-api-responses-3: Fixed an issue with Policy Query API responses fixed-an-issue-with-the-cli-tools-reference: Fixed an issue with the CLI tools reference fixed-an-issue-with-the-comparators-list: Fixed an issue with the comparators list fixed-an-issue-with-unnamed-trust-framework-elements: Fixed an issue with unnamed Trust Framework elements fixed-an-issue-with-copying-policy-editor-elements: Fixed an issue with copying Policy Editor elements fixed-an-issue-with-http-service-log-messages: Fixed an issue with HTTP service log messages fixed-an-issue-with-pip-key-store-service-calls: Fixed an issue with PIP key store service calls pingauthorize-10-0-0-6-june-2025: PingAuthorize 10.0.0.6 (June 2025) fixed-an-issue-with-deployment-package-store-requests-3: Fixed an issue with deployment package store requests pingauthorize-10-0-0-4-october-2024: PingAuthorize 10.0.0.4 (October 2024) fixed-a-pingauthorize-server-performance-issue: Fixed a PingAuthorize Server performance issue fixed-a-config-diff-error: Fixed a config-diff error fixed-an-alert-types-issue: Fixed an alert types issue pingauthorize-10-0-0-3-july-2024: PingAuthorize 10.0.0.3 (July 2024) fixed-an-issue-with-http-service-requests-2: Fixed an issue with HTTP service requests fixed-an-issue-with-unbounded-query-attributes: Fixed an issue with unbounded query attributes fixed-an-issue-with-policy-query-api-responses-4: Fixed an issue with Policy Query API responses fixed-an-issue-with-http-service-log-messages-2: Fixed an issue with HTTP service log messages fixed-an-issue-with-pip-key-store-service-calls-2: Fixed an issue with PIP key store service calls pingauthorize-10-0-0-2-march-2024: PingAuthorize 10.0.0.2 (March 2024) fixed-a-header-exclusion-issue-with-http-service-caching: Fixed a header exclusion issue with HTTP service caching fixed-a-header-display-issue-with-http-service-caching: Fixed a header display issue with HTTP service caching pingauthorize-10-0-0-1-january-2024: PingAuthorize 10.0.0.1 (January 2024) version-incremented-for-administrative-purposes-3: Version incremented for administrative purposes pingauthorize-10-0-0-0-december-2023: PingAuthorize 10.0.0.0 (December 2023) send-more-flexible-decision-requests-with-policy-queries: Send more flexible decision requests with policy queries cache-dynamic-service-responses: Cache dynamic service responses copy-trust-framework-attribute-resolvers: Copy Trust Framework attribute resolvers disable-rules-in-the-policy-tree: Disable rules in the policy tree added-support-for-apache-camel-3-21-2: Added support for Apache Camel 3.21.2 added-support-for-java-17-and-removed-support-for-java-8: Added support for Java 17 and removed support for Java 8 disabled-sni-hostname-checks-by-default: Disabled SNI hostname checks by default disabled-oidc-implicit-grant-flow: Disabled OIDC Implicit grant flow added-indexes-to-improve-database-query-performance: Added indexes to improve database query performance fixed-scim-case-sensitivity-issue: Fixed SCIM case-sensitivity issue fixed-attribute-caching-memory-error: Fixed attribute caching memory error fixed-missing-statements-array-in-policy-testing: Fixed missing statements array in policy testing fixed-error-response-handling-in-app-warn: Fixed error response handling in APP WARN removed-serverroot-requirement-from-the-check-replication-domains-tool: Removed --serverRoot requirement from the check-replication-domains tool fixed-duplication-issue-when-running-dsjavaproperties-initialize: Fixed duplication issue when running dsjavaproperties --initialize replaced-nullpointerexception-error-for-alert-handlers-lacking-configuration: Replaced NullPointerException error for alert handlers lacking configuration addressed-inability-of-ldap-request-handlers-to-respond-to-incoming-client-requests: Addressed inability of LDAP Request Handlers to respond to incoming client requests previous_releases: Previous Releases --- # Release Notes New features and improvements in PingAuthorize. Updated October 2026. Subscribe to get automatic updates: [icon: rss-square, set=fa][PingAuthorize Release Notes RSS feed](paz_release_notes_legacy_home.xml) ## PingAuthorize 10.3.0.6 (September 2026) ### Fixed a security issue Security PAZ-24037 We fixed a security issue. Learn more in the security advisory [SECADV057](https://support.pingidentity.com/s/article/SECADV057-PingAuthorize-Cross-Request-Response-Leakage) (requires sign-on). ### Fixed an issue with Gateway API request timeouts Fixed We fixed an issue where Gateway API requests to an upstream API server could abort after 30 seconds, ignoring configured timeout properties if they were set to a value of 30 seconds or more. The API security gateway now honors the `connect-timeout` and `response-timeout` values configured on the associated external server. As a result, request handling can now impact concurrent traffic in Gateway mode. If concurrent traffic results in slower responses, increase the [`num-request-handlers`](../pingauthorize_server_administration_guide/paz_api_security_gw_performance_tuning.html) value to allow for higher concurrency. ## PingAuthorize 10.3.0.5 (August 2026) ### Improved handling of null values in Redis Improved PAZ-19569 We've enhanced the Redis attribute cache to handle missing or null values more gracefully, with improved validation and clearer logging to simplify troubleshooting and improve system stability. ### Added correlation ID to gateway request and response logs Improved PAZ-22371 API security gateway request and response logs now include the correlation ID and request ID associated with each client request, enabling end-to-end correlation with policy decision and service logs. Learn more in [Managing HTTP correlation IDs](../pingauthorize_server_administration_guide/paz_manage_http_corr_ids.html). ### Fixed inconsistent URL decoding behavior Fixed PAZ-20178 We've fixed an issue where inconsistent URL decoding could allow double-URL-encoded requests to bypass path-based access controls in API security gateway mode. URL decoding behavior is now standardized: * **Policy evaluation**: The PingAuthorize Server now decodes the incoming request URL, including the path and query parameters, exactly once before policy evaluation. * **Request forwarding**: The PingAuthorize Server now forwards the original, unmodified request URL to the backend resource server. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Backend resource servers must now perform their own URL decoding in accordance with [RFC-3986](https://datatracker.ietf.org/doc/html/rfc3986). If your resource servers previously relied on PingAuthorize to forward fully-decoded request URLs, now these servers might fail to process encoded URLs correctly. You must update these servers to handle encoded URLs or deploy a proxy to decode traffic before it reaches the server. | ### Fixed timeouts when `Content-Length` header is present Fixed PAZ-20867 When reserializing a response body, the sideband API now adjusts the `Content-Length` header to match the response body that's actually returned. ### Fixed 502 errors when using an HTTP proxy with API external servers Fixed PAZ-22700 We fixed an issue where gateway API endpoint requests failed with `502 Bad Gateway` when the API external server had an HTTP proxy external server configured. ### Fixed a server shutdown delay issue Fixed DS-51291 We fixed an issue where a large number of peer connections or unresponsive peers could cause excessively long server shutdown times. ### Fixed an issue with server updates in containerized environments Fixed DS-51723 We fixed an issue where running `update` or `revert-update` in a containerized environment could fail with an `Error determining current build information` message. This error could occur if the JVM path recorded in `config/java.properties` wasn't present in the current container image. ### `update` tool logs a benign warning Info DS-51930 When you run `update` to apply a server update, the tool logs a benign `Unexpected non-EA suffix` warning. The warning has no effect on the update and can be safely ignored. ## PingAuthorize 10.3.0.4 (May 2026) ### Fixed a `manage-profile replace-profile` error Fixed DS-51396 We fixed an issue where the `manage-profile replace-profile` tool could fail with a `DirectoryNotEmptyException` error during upgrades in environments where the `logs` directory was mounted as a separate volume. This failure was caused by the tool holding an internal lock on a background optimization file during the upgrade process. Now, the tool correctly releases these locks and skips the migration of non-essential cache files. Additionally, we fixed a defect where the `setup` tool didn't always correctly apply the `--optionCacheDirectory` argument. ## PingAuthorize 10.3.0.3 (March 2026) ### Version increased for administrative purposes Info The PingAuthorize version number was incremented due to changes released for PingDirectory. There are no release notes for this version of PingAuthorize. ## PingAuthorize 10.3.0.2 (January 2026) ### Added more control over timestamp precision Improved PAZ-20713 We've added a new Policy Decision Service configuration property, `use-microseconds-timestamp`, which allows you to enforce microsecond-precision timestamps for `governance-engine` API responses. This option improves compatibility with clients that expect legacy timestamp formats. Learn more in [JSON PDP API response format](../pingauthorize_server_administration_guide/paz_json_pdp_api_flow.html#json_pdp_response). ### Improved expired certificate handling for TLS negotiation Fixed DS-49269, DS-49270 We fixed an issue that could cause the server to select an expired certificate when performing TLS negotiation with an external server that has a key manager provider and requests a client certificate chain. The server now presents an expired certificate only if the key store doesn't include any certificate chains with currently valid certificates. We also added the `ssl-cert-nickname` property to the external server configuration, which allows you to control which client certificate chain the server presents to that external server. If this property isn't configured, the server attempts to automatically select an appropriate certificate chain. ### Fixed an issue with `--performLocalCleanup` in interactive mode Fixed DS-48553 Running `remove-defunct-server --performLocalCleanup` in interactive mode no longer attempts to establish a connection to another live server in the topology. ## PingAuthorize 10.3.0.1 (October 2025) ### Version incremented for administrative purposes Info The PingAuthorize version number was incremented due to changes released for PingDirectory. There are no release notes for this version of PingAuthorize. ## PingAuthorize 10.3.0.0 (July 2025) ### Removed support for Java 11 Info Support for Java 11 has been removed. You must be running Java 17 or a later supported version, as detailed in the [System requirements](../installing_and_uninstalling_pingauthorize/paz_system_requirements.html). Learn more about upgrading a PingAuthorize instance running Java 11 in [Considerations when upgrading to version 10.3](../upgrading_pingauthorize/paz_upgrade_consids.html). ### Support for Internet Explorer 11 has been deprecated Info Support for Internet Explorer 11 has been deprecated and will be removed in a future release. ### Policy Editor configuration properties have been deprecated Info The following `configuration.yml` properties have been deprecated in the Policy Editor: * `core.DecisionResponse.AuditLogView`: To avoid issues when upgrading to future versions of PingAuthorize, define a new top-level `auditLogging.responseView` property and migrate your audit logging configuration to it. The `auditLogging` property overrides any configuration defined with the deprecated `core.DecisionResponse.AuditLogView` property. * `core.Attribute.Cache`: To avoid issues when upgrading to future versions of PingAuthorize, define a new top-level `cache` property and migrate your caching configuration to it. The `cache` property overrides any configuration defined with the deprecated `core.Attribute.Cache` property. ### Removed extra Policy Editor version number Info We removed an extra application version number displayed by the Policy Editor. ### Documented custom SpEL functions Info We added documentation for a library of custom SpEL functions introduced in PingAuthorize 10.2, focusing on common use cases for working with collections, dates and times, and Uniform Resource Identifiers (URIs). Learn more in [SpEL processing examples](../pingauthorize_policy_administration_guide/paz_spel_example_functions.html). ### Added runtime support for Java 21 New PAZ-15881, PAZ-17469 We added JRE support for Oracle JDK 21 and OpenJDK 21. ### Added support for Camel 4.0 New PAZ-17485 Although Camel services have been removed from the default PingAuthorize configuration, you can now use Camel version 4.0 if your policies depend on such services. Learn more in [Enabling Camel service connections](../pingauthorize_policy_administration_guide/paz_camel_enable.html). ### Override short-circuiting in combining algorithms New PAZ-11577 By default, combining algorithms stop evaluating a policy's child elements as soon as a final decision is reached. You can use the new **Evaluate All** option to override this behavior and ensure that all child policies or rules are evaluated, even if a final decision has been reached. This option allows additional statement information to propagate up to the parent policy, which can help with auditing, debugging, and analyzing policy outcomes. Learn more in [Combining algorithms](../pingauthorize_policy_administration_guide/paz_rules_combine_algs.html). ### Added circuit breaker functionality for services New PAZ-18011 We added circuit breaker functionality for policy information points (PIPs). Circuit breakers enhance system resilience by preventing cascading failures from unhealthy PIPs. When a service fails repeatedly, the circuit breaker temporarily halts requests to that service and periodically tests for recovery. Learn more about circuit breaker configuration in [Connecting a service](../pingauthorize_policy_administration_guide/paz_connecting_a_service.html). ### Added a branch counter to the Policy Editor New PAZ-17552 The Policy Editor Branch Manager now displays a visual count of all branches defined in the system. You can define up to 100 top-level branches, including system and self-governance branches. Learn more in [Creating a branch](../pingauthorize_policy_administration_guide/paz_create_branch.html). ### Added advanced logging for HTTP event types New PAZ-17947 We added more detailed HTTP event logging to the file-based trace logger. You can now enable logging for individual event types across the entire HTTP request lifecycle. These events provide deeper visibility into request handling and can help identify performance bottlenecks. Learn more in [Advanced HTTP event logging](../troubleshooting_pingauthorize_server/paz_advanced_http_logging_monitoring.html). ### Added support for expensive HTTP thread detection New PAZ-18104 We added expensive HTTP thread monitoring to help identify and troubleshoot performance bottlenecks in the HTTP connection handler. When an HTTP thread's execution time exceeds a configured threshold, PingAuthorize can generate a thread dump. This provides valuable insight into the exact point of delay, enabling quicker identification and resolution of slowdowns. Learn more in [Detecting expensive HTTP threads](../troubleshooting_pingauthorize_server/paz_detecting_expensive_threads.html). ### Added correlation ID support in service logs New PAZ-18013 We added a `correlationId` field to trace log messages that record details of downstream service calls. Correlation IDs help link service logs with other messages from the same decision request, giving you deeper visibility into the full request lifecycle. Learn more about HTTP correlation ID behavior in [Managing HTTP correlation IDs](../pingauthorize_server_administration_guide/paz_manage_http_corr_ids.html). ### Removed unused dependencies Improved DS-49566 We reduced the size of the PingAuthorize Server distribution by removing unnecessary `.jar` files. ### Improved API security gateway timeout behavior Improved PAZ-17936 We made the following improvements to API security gateway request timeout behavior: * The security gateway now provides clearer JSON-formatted error messages for easier troubleshooting. * Error logs now record a `GatewayTimeout` message. This replaces the less specific `IllegalStateException` message, enabling quicker and more precise identification of the issue. ### Improved policy query debug logging Improved PAZ-18509 We changed how policy query permutations are recorded in the policy query debug log. Now, each permutation is logged as an individual entry. This makes it easier to ingest and analyze detailed query logs in your SIEM or other log management systems, especially for query requests that generate many permutations. Learn more in [Policy query logging](../pingauthorize_policy_administration_guide/paz_policy_query_logging.html). ### Made the collect-support-data tool more secure Improved PAZ-18106 To better protect sensitive information, we updated the `collect-support-data` tool. The tool now automatically redacts deployment package content from generated support file bundles, ensuring your proprietary data is kept more secure. ### Added support for Policy Editor paging Improved PAZ-18422 To improve performance and usability when navigating large datasets, we added support for paging across all list and tree elements in the Policy Editor, including nested elements. Elements are loaded in fixed pages of 100, with a **Load more** option available to retrieve additional items incrementally. ### Fixed an issue with policy query responses Fixed PAZ-18152 We fixed an issue where attributes marked as secret were incorrectly encrypted in responses from the `governance-engine/query` endpoint, in addition to being encrypted in the policy query debug log. ### Fixed an issue with custom OAuth parameters Fixed PAZ-16760 We fixed an issue where key-value pairs defined as custom OAuth parameters didn't reset after the authentication type for an HTTP service was changed. ### Fixed an issue with self-governance for deployment package stores Fixed PAZ-16349 We fixed an issue where the self-governance decision engine didn't intercept requests to deployment package stores. ### Fixed an issue with AWS S3 logging Fixed PAZ-18565 We fixed an issue where AWS S3 credentials were inadvertently included in application logs. ### Fixed an issue with decision request handling Fixed PAZ-16549 To improve request handling, we fixed an issue that caused a `NullPointerException` message to be logged when decision requests were missing the `attributes` property in the request body. ### Fixed an issue with database connection pools Fixed PAZ-18403 We fixed an issue where some database service connections didn't properly close JDBC statement objects. This could lead to connection pool limits being reached because of unreleased resources, even at low traffic levels. ### Fixed an issue with SCIM responses Fixed DS-48511 We fixed an issue with inconsistencies in `id-attribute` values returned in SCIM operation responses. Also, we fixed an issue with SCIM GET operations where a filter used to search for an entry would result in a 404 error. ### Fixed an issue with the Monitor History Plugin Fixed DS-46253 We fixed an issue where the Monitor History Plugin wouldn't preserve files longer than 14 days when the `retain-files-sparsely-by-age` setting was set to `true`. ## PingAuthorize 10.2.0.9 (September 2026) ### Added correlation ID to gateway request and response logs Improved PAZ-22371 API security gateway request and response logs now include the correlation ID and request ID associated with each client request, enabling end-to-end correlation with policy decision and service logs. Learn more in [Managing HTTP correlation IDs](../pingauthorize_server_administration_guide/paz_manage_http_corr_ids.html). ### Fixed a security issue Security PAZ-24037 We fixed a security issue. Learn more in the security advisory [SECADV057](https://support.pingidentity.com/s/article/SECADV057-PingAuthorize-Cross-Request-Response-Leakage) (requires sign-on). ### Fixed an issue with Gateway API request timeouts Fixed We fixed an issue where Gateway API requests to an upstream API server could abort after 30 seconds, ignoring configured timeout properties if they were set to a value of 30 seconds or more. The API security gateway now honors the `connect-timeout` and `response-timeout` values configured on the associated external server. As a result, request handling can now impact concurrent traffic in Gateway mode. If concurrent traffic results in slower responses, increase the [`num-request-handlers`](../pingauthorize_server_administration_guide/paz_api_security_gw_performance_tuning.html) value to allow for higher concurrency. ## PingAuthorize 10.2.0.8 (August 2026) ### Version increased for administrative purposes Info The PingAuthorize version number was incremented because of changes released for PingDirectory. There are no release notes for this version of PingAuthorize. ## PingAuthorize 10.2.0.7 (April 2026) ### Added more control over response timestamp precision Improved PAZ-20713 We've added a new Policy Decision Service configuration property, `use-microseconds-timestamp`, that allows you to enforce microsecond-precision timestamps for `governance-engine` API responses. This option improves compatibility with clients that expect legacy timestamp formats. Learn more in [Configuring response timestamp precision](../pingauthorize_server_administration_guide/paz_json_pdp_api_flow.html#config_response_timestamp_precision). ### Fixed an issue with `--performLocalCleanup` in interactive mode Fixed DS-48553 Running `remove-defunct-server --performLocalCleanup` in interactive mode no longer attempts to establish a connection to another live server in the topology. ## PingAuthorize 10.2.0.6 (March 2026) ### Version increased for administrative purposes Info The PingAuthorize version number was incremented due to changes released for PingDirectory. There are no release notes for this version of PingAuthorize. ## PingAuthorize 10.2.0.5 (November 2025) ### Improved expired certificate handling for TLS negotiation Fixed DS-49269, DS-49270 We fixed an issue that could cause the server to select an expired certificate when performing TLS negotiation with an external server that has a key manager provider and requests a client certificate chain. The server now presents an expired certificate only if the key store doesn't include any certificate chains with currently valid certificates. We also added the `ssl-cert-nickname` property to the external server configuration, which allows you to control which client certificate chain the server presents to that external server. If this property isn't configured, the server attempts to automatically select an appropriate certificate chain. ## PingAuthorize 10.2.0.3 (August 2025) ### Fixed an issue with SCIM responses Fixed DS-48511 We fixed an issue with inconsistencies in `id-attribute` values returned in SCIM operation responses. We also fixed an issue with SCIM GET operations where a filter used to search for an entry would result in a 404 error. ### Fixed an issue with the Monitor History Plugin Fixed DS-46253 We fixed an issue where the Monitor History Plugin wouldn't preserve files longer than 14 days when the `retain-files-sparsely-by-age` setting was set to `true`. ## PingAuthorize 10.2.0.1 (March 2025) ### Version incremented for administrative purposes Info The PingAuthorize version number was incremented due to changes released for PingDirectory. There are no release notes for this version of PingAuthorize. ## PingAuthorize 10.2.0.0 (December 2024) ### Deprecated support for Java 11 Info PAZ-16269 Support for Java 11 has been deprecated. PingAuthorize 10.3 and later will not support Java 11. To prevent problems when upgrading PingAuthorize, you should upgrade to Java 17. Learn more in [System requirements](../../11.1/installing_and_uninstalling_pingauthorize/paz_system_requirements.html). ### Custom SDK extensions using Javax packages will need to be migrated and recompiled in 10.3 Info Several components will be upgraded in version 10.3 of PingAuthorize. If any of your custom Server SDK extensions have classes that import `javax.*` packages, you will need to migrate them to the equivalent `jakarta.*` packages and then recompile the extensions. ### Advanced OAuth Settings for HTTP Services New PAZ-16062 For HTTP Services using the OAuth 2.0 (Client Credentials) grant type for authentication, we added the ability to include custom key-value pairs as additional parameters in the body of token endpoint requests. This level of customization is useful when integrating with authorization services that enforce specific configuration constraints. Learn more in [HTTP services](../pingauthorize_policy_administration_guide/paz_http_services.html#http_auth_methods). ### Added a new policy query response view New PAZ-12855 To provide enhanced visibility into the logic underlying policy query responses, we added support for a new `unfiltered` policy query response view. This view includes every decision used to compose the final policy query response, regardless of the outcome or the presence of statements. Learn more in [Configuring query response granularity](../pingauthorize_policy_administration_guide/paz_troubleshooting_policy_queries.html#configure_query_response_granularity). ### Added debug logging for policy query requests New PAZ-12855 We added debugging capabilities for policy query audit logging in the PingAuthorize Server and the Policy Editor. Enabling debug logging brings enhanced visibility to the attribute data and policy dependencies involved in policy query responses. Learn more in [Policy query logging](../pingauthorize_policy_administration_guide/paz_policy_query_logging.html#enable_embedded_debug_logging). ### Added ability to customize policy query debug log views New PAZ-16050 For policy query audit logs with debug logging enabled, we added the ability to specify additional levels of detail to include in each query permutation's `response` field. This level of customization enables you to increase or decrease visibility into query requests and responses in both development and production environments. Learn more in [Configuring the query permutation view](../pingauthorize_policy_administration_guide/paz_policy_query_logging.html#query_permutation_view_config). ### Added support for attribute logging to policy query responses New PAZ-16050 You can now exercise control over which attributes get logged as part of policy query responses in [embedded](../pingauthorize_server_administration_guide/paz_enable_detailed_logging.html#policy_decision_logger) or [external PDP mode](../pingauthorize_server_administration_guide/paz_pe_enable_query_debug_logging.html). This configuration logs full details of the specified attributes when they're evaluated as part of the policy query request. ### Added support for Mapped Diagnostic Context New PAZ-13188 We added support for Mapped Diagnostic Context (MDC) capabilities in PingAuthorize Server and Policy Editor logging. MDC enriches log messages with additional request context, enabling you to diagnose issues across application components. Learn more in [Enabling Mapped Diagnostic Context for Policy Editor logs](../pingauthorize_server_administration_guide/paz_pe_mdc_logging.html). | | | | - | -------------------------------------------------------------- | | | MDC logging is enabled by default in the PingAuthorize Server. | ### Added support for a new signature algorithm New PAZ-13089 We added support for Elliptic Curve Digital Signature Algorithm (ECDSA)-encoded signatures for JWT tokens when using the `Has Valid Signature For JWKS` and `Has Invalid Signature For JWKS` attribute comparators. Learn more in [Conditions](../pingauthorize_policy_administration_guide/paz_conditions.html). ### Added native support for `decision-point-spel-functions` New PAZ-15718 We added the `decision-point-spel-functions` library to the PingAuthorize Server distribution. These functions add native capabilities for collection, datetime, and URI processing with SpEL. ### Added support for Camel 3.22.2 New PAZ-15845 Although Camel services have been removed from the default PingAuthorize configuration, you can now use Camel version 3.22.2 if your policies depend on such services. Learn more in [Enabling Camel service connections](../pingauthorize_policy_administration_guide/paz_camel_enable.html). ### Added key and trust manager caching New DS-49135 Added the ability to cache key managers and trust managers to prevent loading keystore and truststore files from disk when establishing connections to process requests. Use the `enable-key-manager-caching` and `enable-trust-manager-caching` configuration properties to enable or disable caching. Learn more in [Configuring key and trust manager providers](../pingauthorize_server_administration_guide/paz_config_key_trust_manager.html). ### Improved policy query error handling Improved PAZ-12527 We improved and standardized error handling for requests sent to the JSON PDP API's `governance-engine/query` endpoint. ### Made it easier to resolve policy query attributes Improved PAZ-12724 When making a policy query request, you might want to use a single-valued attribute to resolve a `query` attribute. Now, you can include this single-valued attribute in the `query` section, rather than the `context` section of the JSON PDP API request. ### Allowed proxied requests for HTTP external servers Improved DS-48729 We updated the PingAuthorize Server's HTTP external server configuration to allow requests to be forwarded through an HTTP proxy server. ### Fixed an issue with Policy Query API responses Fixed PAZ-12752 We fixed an issue where the same request sent to the JSON PDP API's `governance-engine/query` endpoint could produce inconsistent responses. ### Fixed an issue with testing large elements Fixed PAZ-11133 We fixed an issue where running test scenarios that exceeded 50 kB in size would produce the following error: `Failed to execute 'setItem' on 'Storage': Setting the value of 'xxx' exceeded the quota.` Now, although test scenarios of this size will still execute, these scenarios will not be stored in the Policy Editor's local cache. Learn more in [Testing policies](../pingauthorize_policy_administration_guide/paz_policy_testing.html). ### Fixed an issue with redundant policies when using the Policy Editor Management API Fixed PAZ-12166 We fixed an issue where creating a copy of an existing policy with the Policy Editor Management API would generate a redundant copy of that policy. This occurred because the version ID of the original policy was supplied in the POST request to create the policy copy. With this fix, users can no longer provide a version ID when creating a new policy. ### Fixed an issue with the Policy Editor login screen Fixed PAZ-2355 We fixed an issue where the Policy Editor login screen was incorrectly aligned on displays with insufficient vertical height. ### Fixed a performance issue with policy queries Fixed PAZ-16415 We fixed an issue where policy query responses were constructed with an excessively broad response view, causing performance issues. ### Fixed an issue with merging branches Fixed PAZ-15930 We fixed an issue that would cause false conflicts when merging policy branches in the Policy Editor. ### Fixed a Policy Editor sign-off issue Fixed PAZ-16253 We fixed an issue that would prevent complete sign-off from the Policy Editor when using the Authorization Code with PKCE grant type. ### Fixed an issue with the Decision Visualizer Fixed PAZ-11767 We fixed an issue where pasting an audit log entry without the `decisionTree` or `evaluationLog` field into the Policy Editor's Decision Visualizer would incorrectly return a `Cannot read properties of undefined (reading 'create')` error in addition to a `decisionTree or evaluationLog must be enabled to visualize decision tree` error. ### Fixed an issue with deployment package store requests Fixed PAZ-16140 We fixed an issue with the PingAuthorize Server that caused logs and monitors to make requests to deployment package stores more frequently than the configured polling interval, creating performance issues. ### Changed the `collect-support-data` monitor file behavior Fixed DS-47384 For the PingAuthorize Server, we changed the `collect-support-data` tool to use the latest `monitor-history` file if it can't find `ldap/monitor.ldif` when exchanging monitor data. ### Fixed an issue with Promotheus HTTP servlet error messages Fixed DS-49161 We fixed an issue with the PingAuthorize Server where the Prometheus HTTP servlet would publish an excessive number of error messages to the error log when it lost connection to its remote counterpart. ### Fixed an issue with `config-diff` Fixed DS-49071 We fixed an issue with the PingAuthorize Server where running the `config-diff` tool would result in an `Unknown property` error when comparing configuration objects of different types. ### Removed suppression messages for disabled alerts Fixed DS-49119 We fixed an issue with the PingAuthorize Server where alert types that were disabled would still output suppression messages. ## PingAuthorize 10.1.0.6 (March 2026) ### Version increased for administrative purposes Info The PingAuthorize version number was incremented due to changes released for PingDirectory. There are no release notes for this version of PingAuthorize. ## PingAuthorize 10.1.0.5 (February 2026) ### Added more control over response timestamp precision Improved PAZ-20713 We've added a new Policy Decision Service configuration property, `use-microseconds-timestamp`, which allows you to enforce microsecond-precision timestamps for `governance-engine` API responses. This option improves compatibility with clients that expect legacy timestamp formats. Learn more in [JSON PDP API response format](../pingauthorize_server_administration_guide/paz_json_pdp_api_flow.html#json_pdp_response). ### Improved expired certificate handling for TLS negotiation Fixed DS-49269, DS-49270 We fixed an issue that could cause the server to select an expired certificate when performing TLS negotiation with an external server that has a key manager provider and requests a client certificate chain. The server now presents an expired certificate only if the key store doesn't include any certificate chains with currently valid certificates. We also added the `ssl-cert-nickname` property to the external server configuration, which allows you to control which client certificate chain the server presents to that external server. If this property isn't configured, the server attempts to select an appropriate certificate chain automatically. ### Fixed an issue with `--performLocalCleanup` in interactive mode Fixed DS-48553 Running `remove-defunct-server --performLocalCleanup` in interactive mode no longer attempts to establish a connection to another live server in the topology. ## PingAuthorize 10.1.0.4 (September 2025) ### Fixed an issue with the Monitor History plugin preserving files Fixed DS-46253 We fixed an issue where the Monitor History plugin wouldn't preserve files for longer than 14 days when `retain-files-sparsely-by-age` was set to `true`. ## PingAuthorize 10.1.0.3 (May 2025) ### Added key and trust manager caching New DS-49135 We added the ability to cache key managers and trust managers to prevent loading key store and trust store files from disk when establishing connections to process requests. Use the `enable-key-manager-caching` and `enable-trust-manager-caching` configuration properties to enable or disable caching. Learn more in [Caching key and trust managers](../pingauthorize_server_administration_guide/paz_config_key_trust_manager.html#cache_key_trust_managers). ### Fixed an issue with deployment package store requests Fixed PAZ-16140 We fixed an issue with the PingAuthorize Server that caused logs and monitors to make requests to deployment package stores more frequently than the configured polling interval, causing performance issues. ### Fixed SCIM response errors Fixed DS-48511 We fixed an issue with inconsistencies in `id-attribute` values returned in SCIM operation responses. We also fixed an issue with SCIM GET operations, where a filter used to search for an entry would result in a 404 error. ### Removed suppression messages for disabled alerts Fixed DS-49119 We fixed an issue where alert types that were disabled would still output suppression messages. ## PingAuthorize 10.1.0.2 (September 2024) ### Added a new policy query response view New We added support for a new `unfiltered` policy query response view. This view includes every decision used to compose the final query response, regardless of the outcome or the presence of statements. Learn more in [Configuring query response granularity](../pingauthorize_policy_administration_guide/paz_troubleshooting_policy_queries.html#configure_query_response_granularity). ### Added policy query debug logging New We added debugging capabilities for policy query audit logging. Enabling the `DEBUG` log level brings enhanced visibility to the attribute data and decision logic underlying query responses. Learn more in [Troubleshooting policy queries](../pingauthorize_policy_administration_guide/paz_troubleshooting_policy_queries.html#policy_query_logging). ### Added support for Mapped Diagnostic Context New We added support for Mapped Diagnostic Context (MDC) capabilities in logging. MDC enriches log messages with additional request context, enabling you to diagnose issues across application components. Learn more in [Enabling Mapped Diagnostic Context for Policy Editor logs](../pingauthorize_server_administration_guide/paz_pe_mdc_logging.html). ### Added support for a new signature algorithm New We added support for Elliptic Curve Digital Signature Algorithm (ECDSA)-encoded signatures for JWT tokens when using the `Has Valid Signature For JWKS` and `Has Invalid Signature For JWKS` attribute comparators. Learn more in [Conditions](../pingauthorize_policy_administration_guide/paz_conditions.html). ### Improved policy query error handling Improved We improved and standardized error handling for requests sent to the `governance-engine/query` endpoint. ### Improved resolution of query attributes Improved When making a policy query request, you might want to use a single-valued attribute to resolve a `query` attribute. Now, you can include this single-valued attribute in the `query` section, rather than the `context` section of the request. ### Fixed an issue with Policy Query API responses Fixed PAZ-12752 We fixed an issue where the same request sent to the `governance-engine/query` endpoint could produce inconsistent responses. ### Fixed an issue with the Decision Visualizer Fixed PAZ-11767 We fixed an issue where pasting an audit log entry without the `decisionTree` or `evaluationLog` field into the Decision Visualizer would incorrectly return a `Cannot read properties of undefined (reading 'create')` error in addition to a `decisionTree or evaluationLog must be enabled to visualize decision tree` error. ### Fixed a memory leak issue Fixed PAZ-13013 We fixed an issue where, when using the PingAuthorize Server's API security gateway in embedded PDP mode, policy decision logging could cause a memory leak and negatively impact the performance of long-running server instances. ### Fixed an issue with `config-diff` Fixed DS-49071 We fixed an issue where `config-diff` would result in an `Unknown property` error when comparing configuration objects of different types. ## PingAuthorize 10.1.0.0 (June 2024) ### Make real-time data calls to relational databases New We added a new Database service type, enabling you to use relational databases as policy information points (PIP) during policy development. Services retrieve information from external data sources for use in context-aware authorization decisions. Now, you can dynamically query and transform such information from relational databases. Learn more in [Database services](../pingauthorize_policy_administration_guide/paz_database_services.html). ### Implement third-party decision log publishers with the PingData Server SDK New We added a new Policy Decision Logger extension to the [Server SDK](https://www.pingidentity.com/en/resources/downloads/pingauthorize.html) for developing third-party decision log publishers. This extension enables you to configure custom decision logging behavior and log destinations. You can extend the provided `PolicyDecisionLogger` API in the Server SDK to implement your custom logic. Learn more in [Managing Server SDK Extensions](../pingauthorize_server_administration_guide/paz_managing_sdk_extensions.html) and the `doc/getting-started` directory in your SDK download. ### Map decision request headers to Trust Framework attributes New We added the ability to map headers of incoming [JSON PDP API](../pingauthorize_server_administration_guide/paz_json_pdp_api_flow.html) requests to Trust Framework attributes. PingAuthorize uses these mappings to dynamically populate attribute values with the values of incoming request headers, enabling you to leverage header data as decision context in request bodies. Learn more in [Configuring policy request header mappings](../pingauthorize_server_administration_guide/paz_policy_request_header_mappings.html). ### Determine whether service call results were retrieved from cache New We added the ability, for any call to external services with caching enabled, to determine whether the result of that call was retrieved from the cache. Learn more in [Service caching](../pingauthorize_policy_administration_guide/paz_service_caching.html). ### Enable Camel service connections with the command line New We added the ability to enable Camel service connections in the Policy Editor with the command line. To ensure that Camel is used with the appropriate permissions and security controls, Camel services are disabled by default in the Policy Editor. Now, instead of manually updating the Policy Editor's configuration, you can enable Camel service connections with the `--enableCamelService` option in [non-interactive setup mode](../installing_and_uninstalling_pingauthorize/paz_install_pe_noninteractive.html). Learn more in [Enabling Camel service connections](../pingauthorize_policy_administration_guide/paz_camel_enable.html). ### Enable JSON formatting for default Policy Editor loggers New We added support for the `dropwizard-json-logging` library to the default Policy Editor loggers. Now, you can add this library in the Policy Editor's `configuration.yml` file to each logger stream you wish to enable JSON formatting for. The availability of this library does not impact the application's default configuration. Learn more in [Enabling JSON formatting for Policy Editor logs](../pingauthorize_server_administration_guide/paz_json_formatting_policy_editor_logs.html). ### Added support for new platforms New We added support for Rocky Linux 9.3 and Red Hat Enterprise Linux 9.3. Learn more in [System requirements](../installing_and_uninstalling_pingauthorize/paz_system_requirements.html). ### Improved database service security Improved To address the possibility of remote code execution attacks with H2 database services, we made the database driver allow list configurable and unlisted H2 by default. Learn more in [Database services](../pingauthorize_policy_administration_guide/paz_database_services.html). ### Updated default configuration archive maximum Info To mitigate the performance impact of large archives, we updated the configuration archive to keep a maximum of 100 previous configurations by default ### Fixed an issue with creating copies of policies Fixed PAZ-12150 We fixed an issue where, in some cases, copying a policy created a redundant instance of that policy. ### Fixed an issue with Library statement duplication Fixed PAZ-9092 We fixed an issue where copying a rule containing a Library statement would create a new instance of that statement instead of reusing the existing one. ### Fixed an issue with saving LDAP services Fixed PAZ-12017 We fixed an issue where, after enabling caching for an LDAP service, specifying a Time to Live (TTL), and clicking Save, the specified TTL disappeared from the UI and backend configuration. ### Fixed an issue with HTTP service requests Fixed PAZ-12145 We fixed an issue where, when making HTTP service calls, the policy decision point would incorrectly assign default values to the request body and the `content-type` header. ### Fixed an issue with self-governance decision requests Fixed PAZ-3306 We fixed an issue where, when using an imported policy snapshot, self-governance decision requests were missing values in the `action` field. ### Fixed an issue with Policy Query API responses Fixed PAZ-12245 We fixed an issue where, when sending a Policy Query API request with an unbounded attribute in the `query` array, the system would return a 500 error status code if the unbounded attribute's value was resolved to an empty collection. ### Fixed an issue with the CLI tools reference Fixed PAZ-3469 We fixed an issue where the CLI tools reference page was incorrectly titled Configuration Reference. Now, the page is correctly titled CLI Tools Reference. ### Fixed an issue with the comparators list Fixed PAZ-11768 We fixed an issue where, when creating rules in the Policy Editor, the comparators list extended outside of the list area, preventing you from scrolling through the list. ### Fixed an issue with unnamed Trust Framework elements Fixed PAZ-12150 We fixed an issue where a user could leave new elements defined in the Trust Framework unnamed, giving them a default name of Untitled. Now, you must specify a name for such elements before saving them. ### Fixed an issue with copying Policy Editor elements Fixed PAZ-12150 We fixed an issue where Policy Editor elements created as copies would inherit the version ID of the original element. As a result, copies of elements would persist in the Policy Editor UI after being deleted but would return 404 errors when selected. Now, copies of Policy Editor elements have distinct version IDs. ### Fixed an issue with HTTP service log messages Fixed PAZ-12454 We fixed an issue where the `status` field of an HTTP service log message would include a status message, such as `OK`, rather than a status code. ### Fixed an issue with PIP key store service calls Fixed PAZ-12014 We fixed an issue where, when making a service call with a PIP key store for MTLS configured and the Server (TLS) option set to None or Default, the service would incorrectly return a `Client TLS certificate is required` error. ## PingAuthorize 10.0.0.6 (June 2025) ### Fixed an issue with deployment package store requests Fixed PAZ-16140 We fixed an issue with the PingAuthorize Server where logs and monitors made requests to deployment package stores more frequently than the configured polling interval, causing performance issues. ## PingAuthorize 10.0.0.4 (October 2024) ### Fixed a PingAuthorize Server performance issue Fixed PAZ-13013 We fixed an issue where, when using PingAuthorize Server's API security gateway in embedded PDP mode, policy decision logging could cause memory leaks and negatively impact the performance of long-running server instances. ### Fixed a `config-diff` error Fixed DS-49071 We fixed an issue where `config-diff` would result in an `Unknown property` error when comparing configuration objects of different types. ### Fixed an alert types issue Fixed DS-49119 We fixed an issue where alert types that were disabled would still produce suppression messages. ## PingAuthorize 10.0.0.3 (July 2024) ### Fixed an issue with HTTP service requests Fixed PAZ-12145 We fixed an issue where, when making HTTP service calls, the policy decision point would incorrectly assign default values to the request body and the `content-type` header. ### Fixed an issue with unbounded query attributes Fixed PAZ-12245 We fixed an issue where, when sending a Policy Query API request with an unbounded attribute in the `query` array, the system would return a 500 error status code if the unbounded attribute's value was resolved to an empty collection. ### Fixed an issue with Policy Query API responses Fixed PAZ-12752 We fixed an issue where the same request to the Policy Query API could produce inconsistent responses. ### Fixed an issue with HTTP service log messages Fixed PAZ-12454 We fixed an issue where the `status` field of an HTTP service log message would include a status message, such as `OK`, rather than a status code. ### Fixed an issue with PIP key store service calls Fixed PAZ-12014 We fixed an issue where, when making a service call with a PIP key store for MTLS configured and the Server (TLS) option set to None or Default, the service would incorrectly return a `Client TLS certificate is required` error. ## PingAuthorize 10.0.0.2 (March 2024) ### Fixed a header exclusion issue with HTTP service caching Fixed STAGING-22303 We fixed an issue with the exclusion of certain headers from the cache key of cached HTTP service responses. Now, each change to these header values no longer invalidates the service response cache, and the decision engine isn't forced to invoke the service again on subsequent requests. ### Fixed a header display issue with HTTP service caching Fixed PAZ-11726 We fixed an issue with the display of headers excluded from cached HTTP service responses in the Trust Framework. Now, you can navigate away from an HTTP service with caching enabled, navigate back to that service, and still see the excluded headers you originally defined. ## PingAuthorize 10.0.0.1 (January 2024) ### Version incremented for administrative purposes Info The PingAuthorize version number was incremented due to changes released for PingDirectory. There are no release notes for this version of PingAuthorize. ## PingAuthorize 10.0.0.0 (December 2023) ### Send more flexible decision requests with policy queries New With the new Policy Query API, you can now issue decision requests containing valueless and multivalued attributes to receive decisions more complex than `Permit` or `Deny`, enabling you to dynamically drive user interfaces. Learn more in [Policy queries](../pingauthorize_policy_administration_guide/paz_policy_queries.html). ### Cache dynamic service responses New To improve decision evaluation performance and reduce latency, you can cache dynamic service response values for faster retrieval on subsequent requests. When enabling caching for HTTP services, you can exclude certain headers from the service response. This prevents invalidation of the cache when values of those headers change. Learn more in [Service caching](../pingauthorize_policy_administration_guide/paz_service_caching.html). ### Copy Trust Framework attribute resolvers New To build your authorization logic more efficiently, you can make editable copies of attribute resolvers. Learn more in [Copying elements](../pingauthorize_policy_administration_guide/paz_entity_copy.html). ### Disable rules in the policy tree New To control the granularity of policy evaluation, you can disable rules in policies. This causes the decision engine to skip disabled rules during policy evaluation and allows you more flexibility in testing and deployment of policy logic. Learn more in [Creating policies and policy sets](../pingauthorize_policy_administration_guide/paz_create_policy_sets.html). ### Added support for Apache Camel 3.21.2 Info Although Camel services have been removed from the default PingAuthorize configuration, you can now enable Camel version 3.21.2 if your policies depend on such services. Learn more in [Enabling Camel service connections](../pingauthorize_policy_administration_guide/paz_camel_enable.html). ### Added support for Java 17 and removed support for Java 8 Info We have added support for Java 17 and removed support for Java 8. Learn more in [System requirements](../installing_and_uninstalling_pingauthorize/paz_system_requirements.html). For information on upgrading from a PingAuthorize instance installed with Java 8, refer to [Upgrade considerations introduced in PingAuthorize 10.0](../upgrading_pingauthorize/paz_upgrade_consids.html#upgrade_consids_100). ### Disabled SNI hostname checks by default Info PAZ-10754 To avoid `HTTP 400` responses when SNI hostname checks fail, these checks are now disabled by default for the PingAuthorize server and Policy Editor. We added a new `setup` option, `--disableSniHostnameChecks`, to control whether PingAuthorize performs this check. For important considerations when upgrading from a previous version and attempting to reuse your configuration, refer to [Upgrade considerations introduced in PingAuthorize 10.0](../upgrading_pingauthorize/paz_upgrade_consids.html#upgrade_consids_100). ### Disabled OIDC Implicit grant flow Info PAZ-1795 We have disabled the OIDC Implicit flow implementation in the Policy Editor because the OAuth Working Group no longer recommends its use. In its place, you should use the Authorization Code with PKCE flow. Learn more in [Configuring an OIDC provider for single sign-on requests from PingAuthorize](../installing_and_uninstalling_pingauthorize/paz_config_authn_server_openid_connect.html). ### Added indexes to improve database query performance Improved We added two database indexes to the `db-cli` module to improve performance when querying the `CurrentEntityVersion` and `EntityRelationship` tables. ### Fixed SCIM case-sensitivity issue Fixed PAZ-8473 We fixed an issue where requests to create SCIM entries were not always observing the `case-exact=false` property, leading to incorrect case-sensitivity errors. ### Fixed attribute caching memory error Fixed PAZ-10643 We fixed an issue where the decision engine only checked if an attribute cache entry had expired when accessing that entry, leading to `Out of Memory` errors. Now, attribute caching uses the Redis library directly, allowing a unique Time to Live (TTL) for each cache entry. Redis instances invalidate cache entries once the TTL has elapsed, rather than when the entries are accessed. Learn more in [Attribute caching](../pingauthorize_policy_administration_guide/paz_attr_caching.html). ### Fixed missing statements array in policy testing Fixed PAZ-6335 We fixed an issue, where, in the Response tab of policy testing, the root-level `statements` array was not appearing if left empty in the testing scenario. ### Fixed error response handling in `APP WARN` Fixed PAZ-10350 We fixed an issue where the HTTP Service Executor was not properly capturing error messages in the `APP WARN` logs from the policy information provider (PIP) endpoint. ### Removed `--serverRoot` requirement from the `check-replication-domains` tool Fixed DS-47655 We fixed the `check-replication-domains` tool so that the `--serverRoot` argument is no longer required. This argument now defaults to the server's root directory. ### Fixed duplication issue when running `dsjavaproperties --initialize` Fixed DS-45206 We fixed an issue where running `dsjavaproperties --initialize` would append duplicate arguments to the `common.java-args` in the `java.properties` file. ### Replaced `NullPointerException` error for alert handlers lacking configuration Fixed DS-47455 We fixed an issue where a `NullPointerException` error occurred when an alert or alarm was raised, and one more of the alert handlers was not configured. An alert notification is now recorded in `logs/errors` instead. ### Addressed inability of LDAP Request Handlers to respond to incoming client requests Fixed DS-46312 We fixed an issue where TLS timeouts prevented LDAP Request Handlers from responding to client requests. The `request-handler-per-connection` configuration property is now available for LDAP and LDAPS Connection Handlers. ## Previous Releases For information about enhancements and issues resolved in previous major and minor releases of PingAuthorize, refer to the following: * [9.3](https://cdn-docs.pingidentity.com/archive/pdf/pingauthorize/9.3/pingauthorize-9.3.pdf) * [9.2](https://cdn-docs.pingidentity.com/archive/pdf/pingauthorize/9.2/pingauthorize-9.2.pdf) * [9.1](https://cdn-docs.pingidentity.com/archive/pdf/pingauthorize/pingauthorize-91.pdf)