New DS-50713 PingDirectory, PingDirectoryProxy, PingDataSync

We added JRE support for Oracle JDK 25 and OpenJDK 25.

New DS-48730 PingDirectory, PingDirectoryProxy, PingDataSync

The server now supports SMTP authentication by bearer access token. You can obtain a token through the OAuth 2.0 client credentials flow or configure a static token. Learn more in Working with the SMTP Account Status Notification Handler.

New DS-51377 PingDirectory

We added new single-run and recurring tasks that enable you to schedule server data cleanup, including PingFederate sessions and access grants.

The existing purge expired data plugin runs on a fixed 24-hour schedule from server startup, making it difficult to guarantee that large purge jobs run during a planned maintenance window. These new tasks allow you to reliably schedule purge operations so they don’t run during peak business hours after an unexpected server restart or deployment.

New DS-50863 PingDirectory, PingDirectoryProxy, PingDataSync

To help tune rate-limiting operations and identify unusual client activity, you can now allow operations to exceed the configured per-connection and per-policy operation rates in a log mode. The server adds information about the client connections that exceed those rates to the error log.

Learn more in the configuration documentation included with the server for the Client Connection Policy properties connection-operation-rate-exceeded-behavior and policy-operation-rate-exceeded-behavior.

New DS-51133, DS-51297, DS-51301 PingDataSync Preview

We added a Kafka sync source, which you can use to apply changes published in a Kafka topic to a sync destination. Learn more in Synchronize with Apache Kafka.

As part of this implementation:

New DS-44517 PingDataSync

We updated the Password Sync Agent (PSA) to version 4.9.

New DS-44517 PingDataSync

You can now configure the PSA to either trust all certificates presented by the PingDataSync server or to use the Windows Certificate Authority for validation.

Improved DS-49225 PingDirectory, PingDirectoryProxy, PingDataSync

You can now quickly identify peers causing topology connection-asymmetry alarms. The mirrored subtree manager monitor entry automatically includes the peer-inbound-only and peer-outbound-only attributes if any servers appear in only the inbound or outbound connection set. Connection-asymmetry alarm messages include the names of the peers involved.

Improved DS-50645 PingDirectory, PingDirectoryProxy, PingDataSync

To reduce server startup time when you run start-server, we reduced the number of Java processes that get created before starting the server. This change applies to Linux only and is enabled by default.

Improved DS-50820, DS-51183 PingDirectory

We improved the logic the server uses to prioritize composite index usage when evaluating substring filters.

Improved DS-51115 PingDirectory, PingDirectoryProxy, PingDataSync

The Prometheus Monitoring HTTP Servlet Extension now groups metrics with the same name under common HELP and TYPE headers, more closely following the standard for annotating metric families in Prometheus.

Improved DS-51180 PingDirectory

You can use the allow-upgrading-to-composite-index property, in the attribute index configuration, to specify whether the server should store an attribute index in its legacy form or update it to use a composite index behind the scenes.

Previously, this property was declared as read-only, and you could only specify its value when creating a new attribute index. Now, you can edit the property for existing indexes, although the server continues to maintain the index in its current form until you export the data to LDIF and re-import it.

Composite indexes are more scalable and versatile than legacy attribute indexes, although there could be cases where the server exhibits better performance for attribute indexes stored in the legacy format.

Improved DS-50203 PingDataSync

PingDataSync now detects when recovered Active Directory entries get deleted.

Improved DS-51186 PingDataSync

You can now reference JSON fields that are multiple levels deep when building constructed attribute mappings.

For example, suppose an organization stores all user contact information in a JSON object in the contact attribute. This might result in a deeply nested path to the user’s email address. With this change, you can extract that email value by referencing something like {contact.ubidEmailJSON.value} in the value-pattern parameter.

This change also adds support for automatically expanding intermediate JSON arrays in the path. Intermediate JSON arrays produce multiple values in the expected way.

Improved DS-51300 PingDirectory, PingDirectoryProxy

We clarified and enhanced the error messages displayed when schema elements can’t be registered with the schema.

Improved DS-51399 PingDirectory, PingDirectoryProxy, PingDataSync

We added a new mechanism for parsing and validating access control rules. The new parser runs alongside the existing one and might help identify problematic ACIs and provide more useful error messages for malformed rules.

All currently valid ACIs continue to be accepted and operate as before. The server raises an administrative alert upon encountering any ACIs not supported by the new parser.

Improved DS-51409 PingDirectory

The verify-index tool now checks for entries whose DN2ID index key can’t be found because an attribute syntax or matching rule was altered after the entry was created.

Improved DS-51360 PingDirectory

The server now raises an existing-schema-element-changed alert and logs a SEVERE_WARNING if existing schema elements are modified or deleted using LDAP. Adding new schema elements logs a NOTICE but doesn’t raise an alert.

Improved DS-44665, DS-44686, DS-49012, DS-51082 PingDataSync

We improved logging in the PSA for connection errors and DNS resolution failures.

Info DS-49199 PingDirectory, PingDirectoryProxy, PingDataSync

We removed SCIM 1.1 and related functionality from the server. Migrate any functionality to SCIM 2.0.

Info DS-50931 PingDirectory, PingDirectoryProxy, PingDataSync

We removed the Swagger UI and API endpoints for generating Swagger schema from the Consent and SCIM 2.0 APIs. Learn more about using these APIs in the developer documentation.

Info DS-51436 PingDirectory, PingDirectoryProxy, PingDataSync

We updated the opencsv library from the abandoned net.sf.opencsv 2.3 to com.opencsv 5.10.

Info DS-51450 PingDirectory, PingDirectoryProxy, PingDataSync

We upgraded the embedded HTTP server from Jetty 11 to Jetty 12. Most behavior is preserved, with the following exceptions:

Info DS-51333, DS-51351 PingDataSync

We removed the x86 version of the PSA.

Info DS-51525 PingDataSync

You can now install the PSA, version 4.8 and later, on Windows Server 2016. This is an unsupported Windows version and could result in erroneous PSA behavior. The installer displays a warning advising that Windows Server 2016 isn’t supported.

Fixed DS-51445 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue that could cause a small percentage of LDAP connections secured with TLS 1.3 to be prematurely terminated.

Fixed DS-51565 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed the --nodetach option for start-server so that it correctly prevents the server from starting in a detached manner.

Fixed DS-51396 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue where the manage-profile replace-profile tool could fail with a DirectoryNotEmptyException error during upgrades in environments where the logs directory was mounted as a separate volume. This failure was caused by the tool holding an internal lock on a background optimization file during the upgrade process. Now, the tool correctly releases these locks and skips the migration of non-essential cache files.

Additionally, we fixed a defect where the setup tool didn’t always correctly apply the --optionCacheDirectory argument.

Fixed DS-51245 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue where, after an upgrade, manage-profile generate-profile excluded dsconfig commands from the profile that set obscured properties.

Fixed DS-51291 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue where a large number of peer connections or unresponsive peers could cause excessively long server shutdown times.

Fixed DS-50990 PingDirectory, PingDirectoryProxy, PingDataSync

We resolved the following server startup warning:

SLF4J(E): A service provider failed to instantiate: org.slf4j.spi.SLF4JServiceProvider: Provider org.slf4j.impl.PingSLF4JServiceProvider not found.

Fixed DS-50165 PingDirectory, PingDirectoryProxy, PingDataSync

We fixed an issue where the admin console didn’t properly display icons when running in an environment without internet access, such as a closed environment.

Fixed DS-51327 PingDirectory

We fixed an issue where the Unique Attribute plugin could report a false-positive conflict. This could happen when a single LDAP operation modified multiple subtypes of the same unique attribute on the same entry.

Fixed DS-51456 PingDirectory, PingDataSync

We fixed an issue where the server didn’t correctly generate LDAP changelog records for subtree deletions. Records could be written out of order on the target server, preventing reliable replay on other destinations. Servers replicating the request could include only the base subtree delete without records for subordinate entry deletions.

Fixed DS-50986 PingDirectory, PingDataSync

We fixed an issue where subtree delete operations were recorded out of order in the changelog for servers in a replication topology.

Fixed DS-51149 PingDirectory, PingDirectoryProxy

We fixed an issue where an identity mapper would throw an error when one or more configured match base DNs were unavailable. We also added a tolerate-unavailable-base-dn configuration property to identity mapper objects to control the behavior of the mapper in this scenario.

Fixed DS-51230 PingDirectory, PingDirectoryProxy

We fixed internal server errors that could occur when using the REST API with attribute types or object classes not present in the schema.

Fixed DS-48998 PingDirectory

We fixed a benign null generator error message that could appear when the server cleared replication-missing-changes alarms.

Fixed DS-51524 PingDirectory

We fixed an issue where a running server would allow dependent schema elements to be registered in a file that would be loaded later than the elements they depended on. This wouldn’t cause immediate issues but would prevent the server from restarting until the schema files were modified to correct the misordering.

Fixed DS-51475 PingDirectory

We fixed an issue where signing on to Delegated Admin would fail because of how some access token validators handled client secrets containing URL special characters.

Fixed DS-51459 PingDirectory

We fixed an issue where changes to the pass-through-authentication-handler property on a Pluggable Pass Through Authentication plugin made using dsconfig wouldn’t take effect until the plugin was disabled and reenabled.

Fixed DS-51353 PingDirectory

We fixed an issue where several tools, plugins, and extended operations that rely on internal operations to modify entries wouldn’t update the modifiersName and modifyTimestamp values on those entries.

Fixed DS-51349 PingDirectory

We fixed an issue where reencoding an entry’s password also updated its pwdChangedTime attribute.

Fixed DS-51137 PingDirectory

We fixed an issue in the Pluggable Pass-Through Authentication plugin where successful sign-ons were recorded as authentication failures when try-local-bind was enabled. Now, users won’t be incorrectly locked out due to valid pass-through authentications.

Fixed DS-51147 PingDirectory

We fixed an issue where the server didn’t initialize the changelog backend’s encryption tokenizer when data encryption was enabled, preventing encrypted changelog recovery after unscheduled shutdowns.

Fixed DS-51487 PingDirectory

We fixed an issue where a replica could silently miss attribute updates after the Replication Repair control was used to delete an entry on that replica, and then the entry was later re-added. Other replicas would have the updated attribute, while the affected replica didn’t.

Fixed DS-51095 PingDirectory

We fixed an issue where dsreplication enable wouldn’t execute successfully on PingDirectory servers with Sensitive Password Attributes enabled.

Fixed DS-51350 PingDirectoryProxy

We fixed an issue where SASL PLAIN bind requests failed when passing through DN-mapping or attribute-mapping proxy transformations.

Fixed DS-51125 PingDirectoryProxy

We fixed an issue where PingDirectoryProxy would fail to start when using automatic backend discovery against external server instances with a location not defined in PingDirectoryProxy’s configuration.

Fixed DS-51558 PingDataSync

We fixed an issue where the server could write unredacted entry DNs to the sync-failed-ops log, even when log-redaction-regex was configured. Now, the server applies the configured redaction patterns to the DN field in sync-failed-ops log entries, consistent with how they are applied to message text.

Fixed DS-47327 PingDataSync

We fixed an issue where the create-sync-pipe-config wizard generated a groups object class mapping that omitted top. This caused the server to detect groups as out-of-sync on every change and incorrectly apply a modify operation to the sync destination, even when no mapped attribute had changed. This issue didn’t affect user entries.

Fixed DS-47329 PingDataSync

We fixed an issue where the create-sync-pipe-config wizard didn’t include a description attribute mapping when generating the groups attribute map for synchronization from PingDirectory to Active Directory. This caused group description changes to be silently dropped by the sync pipe.

The wizard now also prompts for a separate source base DN for groups, allowing you to specify a different OU than the one for users.

Fixed DS-45978 PingDataSync

We fixed an issue where password synchronizations to PingOne would log a benign error about schema failures.

Fixed DS-44411 PingDataSync

We fixed an issue where attribute mappings with conditional value patterns that filtered on the absence of an attribute wouldn’t properly map any values.

Fixed DS-47105 PingDataSync

We fixed an issue where UnboundIDSyncDestination would throw a NullPointerException when a LDAPSyncDestinationPlugin returned PreStepResult.ABORT_OPERATION for a preCreate or preModify call and the entry or modification set contained password-policy-state attributes, such as pwdAccountLockedTime.

Fixed DS-51464 PingDataSync

We fixed an issue where the PSA MSI installer would display dialog boxes during silent installations (/qn or /passive), blocking automated deployment scripts. The installer now honors quiet mode flags and logs messages instead of showing popups.

Fixed DS-51458 PingDataSync

We fixed an issue where the server could attempt to rename an entry to its existing DN in the following scenario:

Now, the server normalizes both DNs using the destination schema before comparison.

Fixed DS-49011, DS-51319 PingDataSync

We fixed the upgrade process for the PSA:

Fixed DS-50788, DS-51233 PingDataSync

We fixed an issue where installing the PSA failed when passwords contained the # character.

Fixed DS-13850 PingDataSync

We fixed an issue where the PSA overrode or deleted values during command-line installation.