Fixed DS-51712 PingDataSync

We fixed a critical issue where a PingOne real-time sync source could stall and stop processing changes until an administrator manually restarted the affected sync pipes. The source intermittently computed invalid filter bounds or polling windows too small to retrieve entries.

Fixed DS-51723 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue introduced in 10.3.0.1 where running update or revert-update in a containerized environment could fail with an Error determining current build information. This error could occur if the JVM path recorded in config/java.properties wasn’t present in the current container image.

Fixed DS-51487 PingDirectory

We fixed an issue where a replica could silently miss attribute updates after the Replication Repair control was used to delete an entry on that replica, and then the entry was later re-added. Other replicas would have the updated attribute, while the affected replica didn’t.

Fixed DS-51291 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue where a large number of peer connections or unresponsive peers could cause excessively long server shutdown times.

Improved DS-51409 PingDirectory

The verify-index tool now checks for entries whose DN2ID index key can’t be found because an attribute syntax or matching rule was altered after the entry was created.

Info DS-51930 PingDirectory, PingDirectoryProxy, PingDataSync

When you run update to apply a server update, the tool logs a benign Unexpected non-EA suffix warning. The warning has no effect on the update and can be safely ignored.

New DS-13850 PingDataSync

We updated the Password Sync Agent to version 4.8.

Improved DS-50863 PingDirectory, PingDirectoryProxy, PingDataSync

To help you tune the server’s rate-limiting operations, and to identify unusual client activity, you can now allow operations to exceed the configured per-connection and per-policy operation rates in a log mode. The server adds information about the client connections that exceed those rates to the error log.

To learn more, refer to the configuration documentation included with the server for the following client connection policy properties:

Fixed DS-50986 PingDirectory, PingDataSync

We fixed an issue where subtree delete operations were recorded out of order in the changelog for servers in a replication topology.

Fixed DS-51456 PingDirectory, PingDataSync

We fixed an issue where the server didn’t correctly generate LDAP changelog records for subtree deletions. On the target server, records could be written out of order, preventing reliable replay on other destinations. Servers replicating the request might include only the base subtree deletion without records for subordinate entry deletions.

Fixed DS-51147 PingDirectory

We fixed an issue where the server didn’t initialize the changelog backend’s encryption tokenizer when data encryption was enabled, preventing encrypted changelog recovery after unscheduled shutdowns.

Fixed DS-51349 PingDirectory

We fixed an issue where reencoding an entry’s password also updated the value of its pwdChangedTime attribute.

Fixed DS-51396 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue where the manage-profile replace-profile tool could fail with a DirectoryNotEmptyException error during upgrades in environments where the logs directory was mounted as a separate volume. This failure was caused by the tool holding an internal lock on a background optimization file during the upgrade process. Now, the tool correctly releases these locks and skips the migration of non-essential cache files.

Additionally, we fixed a defect where the setup tool didn’t always correctly apply the --optionCacheDirectory argument.

Fixed DS-51137 PingDirectory

We fixed an issue in the Pluggable Pass-Through Authentication plugin where successful sign-ons were recorded as authentication failures when try-local-bind was enabled. Now, users won’t be incorrectly locked out due to valid pass-through authentications.

Fixed DS-13850 PingDataSync

We fixed an issue where the Password Sync Agent overrode or deleted values during command-line installation.

Security DS-51122 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed a security issue that could potentially affect customers using the PingDirectory, PingDirectoryProxy, or PingDataSync servers. We advise customers to apply this maintenance patch or upgrade to the latest version of the servers. Learn more in SECADV052 (requires sign-on).

Fixed DS-49269, DS-49270 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue that could cause the server to select an expired certificate when performing TLS negotiation with an external server that has a key manager provider and requests a client certificate chain.

The server now presents an expired certificate only if the key store doesn’t include any certificate chains with currently valid certificates.

We also added the ssl-cert-nickname property to the external server configuration, which allows you to control which client certificate chain the server presents to that external server. If this property isn’t configured, the server attempts to select an appropriate certificate chain automatically.

Fixed DS-50255 PingDataSync

We fixed an issue where the server would infinitely retry operations that would never succeed. This issue specifically affected sync pipes syncing to or from LDAP endpoints and could have prevented the server from processing other operations.

Fixed DS-48553 PingDirectory, PingDirectoryProxy, PingDataSync

Running remove-defunct-server --performLocalCleanup in interactive mode no longer attempts to establish a connection to another live server in the topology.

Fixed DS-50473 PingDirectory

We fixed an issue that caused the Delegated Admin landing page to throw an error after server startup.

Fixed DS-50632 PingDirectory

We fixed a critical server issue where some LDAP requests failed with a ConcurrentModificationException in the AuthenticationInfo module.

Fixed DS-50473 PingDirectory

We fixed an issue that caused the Delegated Admin landing page to throw an error after server startup.

Fixed DS-50457 PingDirectory

We fixed an issue where the Changelog Password Encryption plugin didn’t add encrypted attributes to the changelog for entries created with the Generate Password request control.

Fixed DS-50372 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue with server upgrades failing for FIPS-compliant servers running in a Linux environment with native FIPS mode enabled.

You can identify this upgrade failure by the following error message:

Error initializing update: Error determining build information for the server at /opt/PingDirectory: 1. Output from /opt/PingDirectory/bin/status -F was: .

Fixed DS-50541 PingDirectory

We fixed an issue that caused upgrades for servers running version 10.0.0.x or later with no userRoot backend to fail.

During an upgrade, the update tool tried to delete some configuration entries for inverted static group support that didn’t exist.

Fixed DS-50286 PingDirectory

We fixed an issue with running an LDIF import as an administrative task. Previously, the import process didn’t verify that the source LDIF file existed before clearing the backend.

Fixed DS-50377 PingDirectory

We fixed an issue where the Referential Integrity plugin rejected delete operations when the DN of the delete operation was out of scope.

Improved DS-48416 PingDirectory

To increase dsreplication initialize speed for high-latency connections, the operating system now sets the optimal receive buffer size automatically, allowing a larger TCP window for initialization.

To set the receive buffer manually, configure the following Java property to the desired size:

Supply a value of 1000000 to revert to the default buffer size before this change.

Improved DS-50622 PingDirectory, PingDirectoryProxy

We improved concurrent bind request throughput for heavy authentication workloads passing through PingDirectoryProxy.

Issue DS-50632 PingDirectory

We identified a critical server issue where some LDAP requests fail with a ConcurrentModificationException in the AuthenticationInfo module.

Info DS-49541 PingDirectory, PingDirectoryProxy, PingDataSync

Support for Java 11 has been removed. You must be running Java 17 or a later supported version, as detailed in the System requirements. Learn more about upgrading a PingDirectory server running Java 11 in Considerations when upgrading to version 10.3.

Info PingDirectory, PingDirectoryProxy, PingDataSync

Support for Internet Explorer 11 has been deprecated and will be removed in a future release.

Info PingDataSync

Support for the sync-pipe-view tool has been deprecated, and the tool will be removed in a future release.

New DS-49681 PingDirectory, PingDirectoryProxy

We added a mechanism to forward the authenticated user’s entry to backend servers in an entry-balanced proxy configuration. This change makes it easier to authorize requests in backend sets that don’t contain the user’s entry.

You can use this mechanism instead of the authz-dn property in the entry-balancing request processor configuration or the ds-authz-map-to-dn operational attribute in user entries, which are both used to map requests as the authenticated user to a different surrogate user in the other backend sets.

Learn more in Forwarding authorization identities in requests.

New DS-49530 PingDirectory

We added support for the following HTTP request controls in the Directory REST API:

Learn more in the Directory REST API documentation.

New DS-43335 PingDirectory, PingDirectoryProxy

We added support for LDAP and LDAPS clients accessing the server through a software load balancer using the PROXY protocol, which allows the server to see the actual address and port of the end client system rather than just the address of the load balancer.

The server supports LDAP clients using TCP over IPv4 or IPv6 with header versions 1 and 2. It also accepts valid PROXY protocol headers with other protocols and address families, but it only updates the client address and port for TCP-based clients.

Learn more in Using the HAProxy PROXY protocol.

New DS-48531 PingDirectory

We added support for two Thales Luna HSM Server SDK extensions, which are available as separate downloads. To get the extensions, contact your Ping Identity account representative.

Improved DS-49418 PingDirectory

We changed the default server behavior for failed authentication attempts to unavailable user accounts. If a user’s account becomes unavailable (for example, because the account is locked, disabled, or the password has expired), the server won’t update the user’s recent login history for failed authentication attempts.

This change can prevent excessive write operations to a user entry in cases where the user can’t possibly authenticate, including when accounts could be subject to password guessing or denial-of-service attacks.

Improved DS-49516 PingDirectory

We improved the eviction logic for encoded password caches to help ensure that frequently used passwords remain cached. When a cache becomes full and needs to add a record, the server evicts the least-recently-used record to make room. Previously, the server evicted the oldest record from the cache.

Improved DS-48158 PingDirectory

We improved the dsreplication initialize failure behavior for source backends supplied in a JSON topology file. A backend must be enabled before it can be initialized. If dsreplication initialize doesn’t successfully initialize the target backend from one source, the command re-enables the target backend before attempting to initialize it from the next source in the JSON file.

Improved DS-49377 PingDirectory

We added a configuration property for the file-based audit log publisher that can exclude virtual attributes from delete audit log records that use the reversible form of logging.

Excluding virtual attributes reduces the size of these log messages and can eliminate the potential performance impact of computing their values. Virtual attributes are still included by default in delete audit log messages generated by the regular file-based audit logger, but they are now suppressed by default in the data recovery log.

Improved DS-49550 PingDirectory, PingDirectoryProxy, PingDataSync

We updated manage-profile replace-profile to allow changing the value of the --fips-provider argument in setup-arguments.txt from BCFIPS to BCFIPS2. This makes it possible to update an existing instance running in FIPS 140-2 compliance mode to use FIPS 140-3 compliance mode.

Improved DS-49731 PingDirectory, PingDirectoryProxy, PingDataSync

We updated the Version and SSL Context monitor entries to always include the fips-compliant-mode, fips-140-2-compliant-mode, and fips-140-3-compliant-mode attributes, even when the server is running in non-FIPS-compliant mode. We also exposed those attributes in the Version monitor entry in the admin console’s Status section.

Improved DS-49944 PingDirectory, PingDirectoryProxy, PingDataSync

We added an option to allow LDAP external servers to create connection pools without any initial connections so that all connections for use in the pool are created on demand. This can help make it faster to initialize components that use one or more LDAP external servers, but initial attempts to communicate with those servers could take longer as a result of needing to establish new connections.

Improved DS-49558 PingDirectory, PingDirectoryProxy

We added the include-parseable-attribute-names option to the Processing Time Histogram plugin to output entries in a format that’s easier to parse. These reformatted entries are duplicates and still exist in their original format. Changing this option requires a server restart to take effect.

Improved DS-50069 PingDirectory

We added the --skipImportLdif argument to manage-profile setup. You can supply this argument to set up a server without importing any LDIF files contained in the profile directory structure.

Fixed DS-49716 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue that could prevent installing or running servers using Java 17 or later on Red Hat Enterprise Linux (RHEL) systems when the operating system itself is configured to run in FIPS-compliant mode.

This operating system setting is unrelated to whether the PingDirectory server has been set up to run in FIPS-compliant mode.

Fixed DS-49547 PingDirectory

We fixed the replication server configuration property listen-on-all-addresses so that when the property is set to false, replication servers only listen to the replication port on the interface that corresponds to the hostname of the server instance for that replication server.

Fixed DS-49851 PingDirectory

We fixed an issue where replication assurance wasn’t applied to the internal operation performed by the password modify extended operation.

Fixed DS-35915 PingDirectory

We fixed a bug where dsreplication enable ignored the --noPropertiesFile option and incorrectly applied options from the tools.property file.

Fixed DS-49890 PingDirectory

We fixed an issue where a PingDirectory server would continue sending binary data to the destination server after a failed attempt to initialize using dsreplication initialize. This behavior interfered with further initialization attempts from any other server.

Fixed DS-44645 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue that prevented the replace-certificate tool from using the JVM-default trust store when replacing the listener certificate in interactive mode.

Fixed DS-49769 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue where replace-certificate replace-listener-certificate didn’t obey the --trust-store-update-type argument.

Fixed DS-50108 PingDirectory, PingDirectoryProxy

We fixed an issue where password resets done with the bypass-pw-policy privilege would circumvent the force-change-on-reset property of password policies.

Fixed DS-49878 PingDirectory

We fixed an issue where the Modifiable Password Policy State plugin didn’t obey the value of the filter property.

Fixed DS-49872 PingDirectory

We fixed an issue where the Entry Counter plugin couldn’t evaluate criteria filters against virtual attributes with require-explicit-request-by-name set to true.

Fixed DS-49816 PingDirectory

We fixed an issue with the Entry Counter plugin where an enabled plugin couldn’t be modified.

Fixed DS-46253 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue where the Monitor History plugin wouldn’t preserve files for longer than 14 days when retain-files-sparsely-by-age was set to true.

Fixed DS-49781 PingDirectory

We fixed an issue where SCIM requests that attempted to modify the ds-pwp-modifiable-state-json attribute would fail.

Fixed DS-48511 PingDirectory, PingDirectoryProxy

We fixed an issue with inconsistencies in id-attribute values returned in SCIM operation responses. We also fixed an issue with SCIM GET operations where a filter used to search for an entry would result in a 404 error.

Fixed DS-49619 PingDirectory

We fixed an issue where SCIM 2.0 PUT operations involving multivalued complex attributes would incorrectly remove some of the values.

Fixed DS-49912 PingDirectory

We fixed an issue in the REST API where PUT requests would return a 500 response when attempting to replace the value of a virtual attribute.

Fixed DS-46314 PingDirectory

We fixed an issue where REST API calls failed due to attribute syntax violations, even though the server had been configured to allow syntax violations for those attributes.

Fixed DS-43814 PingDirectory, PingDirectoryProxy

We added the missing connection-pool debug type to the server’s support for LDAP SDK debug logging.

Fixed DS-49991 PingDirectory

We suppressed inaccurate server startup warning messages about some Apache commons-logging classes being scanned from multiple locations. The scan detected older versions of those classes packaged inside a Spring JCL .jar file needed by the admin console, but the older versions aren’t loaded at runtime.

Fixed DS-49551 PingDirectory

We fixed a null pointer exception error logged when restarting a PingDirectory server configured with Delegated Admin.

Fixed DS-49409 PingDirectory

We fixed an issue where Delegated Admin could leak memory due to unfinalized memory consumers.

Fixed DS-49700 PingDataSync

We fixed an issue where the remove-defunct-server tool could leave a PingDataSync topology in a state where new servers couldn’t be added.

Fixed DS-50043 PingDataSync

We fixed an issue where password synchronization from multiple Active Directory subdomains through multiple sync pipes could fail abruptly.

Fixed DS-49212 PingDataSync

We changed the resync tool to exclude unicodePwd automatically from AD sync sources and password from PingOne sync sources.

By design, the resync tool updates the existing values for included attributes at the destination to match what’s found at the source. If resync can’t retrieve an attribute value at the source, it removes any existing values at the destination. Because resync can’t retrieve these password attributes from their sources, we’ve excluded them from the attributes for resync consideration to avoid disrupting the values at the destination.

You can still include these attributes manually in a resync operation by providing the --includeSourceAttr argument.

Fixed DS-49917 PingDataSync

We fixed an issue where PingDataSync would log an operation as not applied if the only changes applied were to password policy state attributes.

Fixed DS-49035 PingDataSync

We fixed an issue where third-party change detectors didn’t properly persist the state of processing at the sync source. This could’ve caused change detector malfunctions with the set-startpoint task, with saving the change detector’s state upon server shutdown, or with communicating that state to failover instances.

Fixed DS-49854 PingDataSync

We fixed an issue in the server SDK’s example LDAP sync destination plugins, where the plugins dropped modify DN operations that didn’t affect the RDN.

Issue DS-50171 PingDirectory

If dsreplication initialize fails because of a communication error between the source PingDirectory server and the remote destination server, the source server continues attempts to send binary data. This causes new initialization attempts on the destination server from any other server to fail until the source server has finished sending all data.

To work around this issue, restart the source PingDirectory server.

Issue DS-50286 PingDirectory

When you run an LDIF import as an administrative task, the import process doesn’t verify that the source LDIF file exists before clearing the backend.

Before running an LDIF import as an administrative task, do the following:

Issue TRIAGE-28464 PingDirectory, PingDirectoryProxy, PingDataSync

For FIPS-compliant servers running in a Linux environment with native FIPS mode enabled, the server upgrade could fail when targeting version 10.3. The error message for this type of upgrade failure looks similar to the following:

Error initializing update: Error determining build information for the server at /opt/PingDirectory: 1. Output from /opt/PingDirectory/bin/status -F was: .

To work around this issue, do the following before attempting to upgrade the server: