Release Notes

New DS-44421

We’ve rebuilt the PingAuthorize admin console from AngularJS to a modern React-based interface. The updated console offers improved performance, accessibility, and maintainability while preserving familiar configuration and monitoring workflows.

In addition to this restyling, we’ve introduced:

Learn more in Using the PingAuthorize admin console.

New PAZ-17047

You can now force step-up authentication when users access sensitive resources. When authenticated users try to access higher-risk data, such as salary information, health records, or premium content, you can require a higher level of authentication and also set limits on the amount of time allowed since the last authentication event.

Use the new Auth Challenge statement type to implement step-up authentication requirements in your policies. Learn more in Step-up authentication for APIs.

New PAZ-17686

PingAuthorize now includes productized JSON data manipulation functions for SpEL, making it easier to query, filter, and transform JSON data directly within policies.

This release introduces the following functions:

By providing native support for common JSON operations, these functions improve policy clarity, consistency, and performance while reducing reliance on custom expressions.

Learn more in SpEL processing examples.

New PAZ-19054

The ID Token Validator and JWT Access Token Validator now support the PS256, PS384, and PS512 signing algorithms for OIDC-based logins to the PingAuthorize admin console or Policy Editor.

Learn more in Access token validator types.

New PAZ-17947

We’ve added support for HTTP metrics in the Periodic Stats Logger, offering deeper insights into HTTP request flow and PingAuthorize Server performance. When enabled, the server captures detailed statistics at rolling 1-minute, 5-minute, and 15-minute intervals to help monitor short-term spikes and longer-term trends.

Learn more in Enabling HTTP metrics in the Periodic Stats Logger.

Info PAZ-20178

We’ve standardized URL decoding behavior:

Info PAZ-18453

We’ve added documentation for the PingAuthorize Server’s Monitor History plugin, a server component designed to help analyze performance issues and server crashes. This new documentation details how to:

Learn more in Using the Monitor History plugin.

Info PAZ-18383

We’ve upgraded to AWS Java SDK v2. This upgrade changes the default behavior for Amazon S3 connections to use virtual-hosted-style URLs, disabling legacy path-style access by default.

If your Amazon S3 deployment package stores require path-style access (for example, https://s3.amazonaws.com/<bucket-name>), enable the Use Path Style Access option in the PingAuthorize S3 store configuration to maintain connectivity.

Learn more in Adding an Amazon S3 deployment package store to PingAuthorize.

Improved PAZ-19611

We’ve enhanced the /query endpoint of the JSON PDP API to support more expressive and open-ended authorization queries:

Learn more in Query requests.

Improved PAZ-19569

We’ve enhanced the Redis attribute cache to handle missing or null values more gracefully, with improved validation and clearer logging to simplify troubleshooting and improve system stability.

Improved PAZ-20713

We’ve added a new Policy Decision Service configuration property, use-microseconds-timestamp, which allows you to enforce microsecond-precision timestamps for governance-endpoint API responses. This option improves compatibility with clients that expect legacy timestamp formats.

Learn more in JSON PDP API response format.

Improved PAZ-18291

Compound conditions in the Policy Editor now short-circuit by default, matching the existing behavior of the PingAuthorize Server. This ensures that policy evaluation stops as soon as a condition is met, improving performance and providing a consistent experience between policy testing and decision runtime.

Improved DS-50603

For new installations, bin/setup no longer sets the JVM option ConcGCThreads, allowing modern JVMs to select the optimal value automatically.

Improved PAZ-13111

We’ve improved the performance of policy queries by applying an optimization pass that significantly reduces the size of internal policy structures.

Improved SUPP-441

To add details about the server state before shutdown, the collect-support-data tool now includes up to five of the latest timestamped server.out files in the CSD archive.

Fixed DS-49269, DS-49270

We’ve fixed an issue that could cause the server to select an expired certificate when performing TLS negotiation with an external server that has a key manager provider and requests a client certificate chain.

The server now presents an expired certificate only if the key store doesn’t include any certificate chains with currently valid certificates.

We’ve also added the ssl-cert-nickname property to the external server configuration, which allows you to control which client certificate chain the server presents to that external server. If this property isn’t configured, the server attempts to automatically select an appropriate certificate chain.

Fixed PAZ-12964

We’ve fixed an issue where a SpEL expression returning an array (such as from the .split() function) would cause a PROCESSING_ERROR. These results are now correctly handled as collections.

Fixed PAZ-5577

We’ve fixed an issue where deployment packages actively deployed to a deployment package store could be deleted. Now, to delete a deployment package, you must first deploy a different package to the relevant store.

Fixed PAZ-18631

We’ve fixed an issue where the Policy Editor’s /dependencies endpoint returned extraneous data, leading to incorrect pagination. The endpoint now reports only valid child policies, ensuring consistent and accurate results.

Fixed PAZ-20345

We’ve fixed an issue where HTTP Service calls would incorrectly time out after 10 seconds, even when a longer request timeout was configured.

Fixed PAZ-19762

We’ve fixed an issue in the admin point application configuration that could prevent the Policy Editor from starting properly.

Fixed PAZ-20178

We’ve fixed an issue where inconsistent URL decoding could allow double-URL-encoded requests to bypass path-based access controls in API security gateway mode.

Fixed DS-50197

We’ve fixed an issue where using the manage-profile tool to replace a profile would fail if the new profile and original profile each contained topology external servers with identical names.

Fixed DS-48553

Running remove-defunct-server --performLocalCleanup in interactive mode no longer attempts to establish a connection to another live server in the topology.