Rapid channel changelog

OPENAM-28931: Fixed an issue where OAuth 2.0 authorization requests using Pushed Authorization Requests (PAR) could fail with an HTTP 400 error after a user successfully authenticated.

OPENAM-27975: Fixed redirect failures caused by long OAuth 2.0 authorization request URLs. Same-server redirect URLs now support up to 8192 characters. Cross-origin redirect URLs remain limited to 2000 characters.

AME-33978: The Enable Connection via Credential toggle for the PingOne Worker service now automatically enables or disables the relevant connection fields based on your selection.

AME-35088: You can now use a new validate action on the secrets endpoint to validate whether a secret mapping resolves to a valid secret in the configured secret store.

AME-34781: Fixed an issue where the Add AI Agent button in the AM native admin console caused an error for Advanced Identity Cloud tenants. This button is now hidden but you can still add agents through the Advanced Identity Cloud admin console.

AME-34898: Fixed an issue where SAML SSO flows could use a circle of trust set to Inactive.

IGA-4641^[2]: Fixed two bugs in certification campaigns where some reviewers didn’t receive assignment notifications and others received duplicate notifications, caused by a pagination issue and a race condition in staged campaigns.

IGA-4662^[2]: Fixed an issue where entitlement mappings used application display names instead of stable connector IDs, which could cause incorrect behavior if application names changed or contained special characters.

OPENAM-23079: Fixed an issue where the Apple social provider failed on Android devices. During native authentication flows, Advanced Identity Cloud was not including the code_verifier in requests to Apple’s token endpoint, which caused an invalid_grant error.

OPENAM-25429: The default Minimum Secret Key Length on the OATH Registration and Combined MFA Registration nodes has increased from 32 to 40 characters, for compatibility with Google Authenticator.

OPENAM-25556: Advanced Identity Cloud now honors the pubKeyCredParams sequence in WebAuthn credential creation requests.

OPENAM-25801: Fixed an issue where the SAML SP adapter returned the wrong failure code when it couldn’t map an assertion to a user profile.

OPENAM-26834: Hardened realm path handling for API requests to prevent potential security bypass.

OPENDJ-12269: Fixed an issue where the password substring check rejected passwords containing attribute values shorter than the minimum substring length, such as a two-character surname. Attribute values shorter than the minimum substring length are no longer checked for substrings by default.

OPENAM-26326, OPENAM-26452: A new realm-level OAuth2 Provider setting, Enable Rich Authorization Requests with RCS, lets Advanced Identity Cloud process authorization_details requests when an RCS is configured. This setting also controls whether authorization_details_types_supported is advertised on Advanced Identity Cloud’s well-known endpoint.

OPENAM-26458: You can now configure Authorization Detail Type(s) on individual OAuth 2.0 clients to control which authorization detail types, as defined in RFC 9396 Rich Authorization Requests, each client can request.

OPENAM-26470: Dynamic client registration requests can now include authorization_details_types to register the authorization detail types an OAuth 2.0 client supports.

OPENAM-26721: You can now skip signature verification when importing SAML metadata.

OPENAM-26073: Advanced Identity Cloud now includes v2.0 of the Patch Object node. This new version removes the Patch as Object configuration option and always updates the managed identity object as Advanced Identity Cloud. The v1.0 node is deprecated but continues to work in existing journeys.

OPENAM-26086: Advanced Identity Cloud no longer relies on an oversized browser cookie to carry the full OAuth 2.0 /authorize request through the login flow. Instead, it stores that request state securely in CTS (Core Token Service) and restores it after authentication. This prevents large requests, such as ones with a big id_token_hint, from failing with missing client_id after the user successfully signs on.

OPENAM-26106: Resolved an issue where the IdP account mapper could return the NameID value from the wrong SAML entity when a remote SP was used in multiple circles of trust with different NameID value mappings.

OPENAM-26180: Fixed an issue where ETag assertion was causing noisy CTS session assertion failures.

FRAAS-33591: The promotions API now returns report metadata ordered by creation date, with the most recent first.

IAM-3954, IAM-10782: Improved accessibility of numeric input fields and list fields throughout the admin console.

IAM-10610: You can now mark parameters in custom reports as optional, giving you more flexibility when running reports.

IAM-10764: Journey annotation notes now display multi-line formatting in view mode, matching how they appear when editing.

IAM-10917: The deferred release environment message displayed in a modal during promotions now uses clearer language and explains that updating your production release version during promotion is standard practice.

FRAAS-32040: Fixed a deadlock where the /environment/startup endpoint became unresponsive when Advanced Identity Cloud services failed to start because of bad configuration.

IAM-6882: Fixed an issue where the admin console displayed the incorrect product name.

IAM-7788: Fixed an issue where the Next Generation scripts editor displayed unpublished environment secrets and variables.

IAM-8343: Fixed an issue where the delete button for ESVs was not disabled for tenant auditors.

IAM-10686: Fixed an issue where navigation labels in the hosted pages editor wrapped inconsistently compared to the hosted account pages.

IAM-10728: Fixed a pagination issue where organization administrators with a limited user scope saw a no users found error after navigating past the last page of the user list.

IAM-10780: Fixed an issue where exporting a journey containing a Device Profile node with a custom matching script did not include the script, causing import failures.

IAM-10812: Fixed an issue where the edit icon in the Inner Tree Node and Scripted Decision Node opened an intermediate list instead of navigating directly to the linked resource.

OPENAM-28030: Journey name validation rules in the access management backend are now consistent with those in the access management native console and the Advanced Identity Cloud admin console.

OPENAM-28291: Fixed an issue where Page nodes using both a CAPTCHA node and live password validation could fail because the CAPTCHA token was reused on repeated validation requests. The fix is now available in Page node v3, which ensures that nodes with validation enabled generate a new CAPTCHA token for each validation request.

AME-34566: The Evaluator Version selector is now available in the Advanced Identity Cloud admin console for all remaining next-generation script types, including OIDC node, Social Provider Handler node, OAuth2 scripts, and Policy Condition scripts.

FRAAS-33086: You can now migrate user accounts from the deprecated PKCS5S2 password hashing scheme to a more secure algorithm.

IAM-2333: The Identities page now displays an Account Status column showing whether each user account is Active or Inactive.

IAM-3671, IAM-9388, IAM-10148, IAM-10174, IAM-10548: Improved accessibility across hosted journey pages and the admin console, including context-sensitive page titles, form field labels, and aria-describedby attributes for the Attribute Collector node.

IAM-8200: You can now use an environment secret or variable (ESV) to configure the from address for email providers.

IAM-9628: Proxy Connect enabled tenants can now manage Proxy Connect configuration directly in the Advanced Identity Cloud admin console, without using the API.

IAM-10069: Hosted journey pages now display hCaptcha text and challenges in the end user’s configured locale.

IAM-10536, IAM-10553, IAM-10558, IAM-10559: Improved color contrast for active UI components across multiple areas of the admin console to meet accessibility standards.

IAM-10595: Updated the column picker component for consistent behavior across data tables in the admin console and hosted account pages.

IAM-10596, IAM-10597, IAM-10598: Column visibility preferences for data tables in the admin console and hosted account pages are now customizable and saved between sessions.

IAM-10641: The AI Agents page now displays an Enable AI Agents button when the feature has not yet been enabled.

IAM-10796: Super administrators can now configure the redirect URI to use a custom domain when setting up federated administrator access.

IAM-10952: The Identities page now displays a loading spinner while identity data is being fetched.

OPENAM-27489: You can now create and edit social identity providers in the Advanced Identity Cloud admin console.

OPENAM-27492: You can now configure self-service journey mappings directly in the Advanced Identity Cloud admin console.

PF-39499^[3]: Microsoft 365 SSO applications now use the selected UPN Attribute Name setting for WS-Trust username authentication. Existing applications must be resaved for this change to take effect.

FRAAS-31319: Fixed an issue where log streaming relied on the source field for the original log source, which can conflict with Splunk’s reserved source field. Splunk log streaming now includes stream_source to preserve the original Advanced Identity Cloud log source.

IAM-4875: Fixed an issue where ESV values couldn’t be entered as the well-known endpoint URL when setting up Microsoft Entra ID as a federation IdP.

IAM-5457: Fixed an issue where using an ESV in the Password Policy view caused the page to freeze.

IAM-6374: Fixed an issue where journeys could be imported even when their referenced ESVs were not published.

IAM-8313: Fixed an issue where setting a managed object property to nullable caused it to disappear from the Password Policy attribute validation list.

IAM-10593: Fixed a layout issue on the Journeys page where journey counts for category tags were obscured for locales with longer words.

IAM-10776: Fixed an issue where the stored username was overwritten with an OTP value when Remember Me was enabled during MFA sign-on.

IAM-10833: Fixed an issue where the admin console incorrectly displayed "Rollback in progress" during a standard environment promotion.

IAM-10836: Fixed a regression where TextOutputCallback messages containing custom HTML were rendered with unexpected line breaks.

AME-33781: Advanced Identity Cloud now supports the WebAuthn conditional UI, also known as passkey autofill. This lets your end users sign in with a passkey if they’ve previously saved one in their browser.

IAM-1478: Autofill is now disabled for fields on pages where you add identities.

IAM-4646: Tenant administrators registered through federation no longer have the option to update their username and password on the sign-on screen.

IAM-9608: You can now assign an authorization policy to a SAML or OIDC application. This lets you restrict who can access an application to a subset of end users who have authenticated through a specific journey.

IAM-9937: The SaaS REST and SaaS REST (connector server) applications now let you add filter policies to object types when you configure provisioning. Adding filters at the API level reduces network overhead, boosts synchronization performance, and prevents unwanted data from entering your identity pipeline.

IAM-10132: The Advanced Identity Cloud admin console is now fully accessible using keyboard controls.

IAM-10810: The PingOne worker service now lets you configure the connection to PingOne using a credential JWT.

OPENAM-26335: The PingOne Verify Evaluation node now lets you suppress the display of the verification code in the PingOne Verify web UI.

OPENAM-27540: You can now configure a trusted CA certificate for each OAuth 2.0 client using the tls_client_auth authentication method, instead of relying only on realm-wide CAs.

IAM-8699: Advanced Identity Cloud now supports node versioning. When we make changes to a node in the future, we’ll create a new version of the node.

AME-34254: Added support for next-generation SAML SP account mapper scripts to the Advanced Identity Cloud admin console.

FRAAS-29198: Fixed an issue where promotions that failed due to the encrypted secrets verification check were not listing the configuration paths that needed updating.

IAM-5003: Fixed an issue where changing the locale on the terms and conditions creation page didn’t change the text in the editor.

IAM-9751: Fixed an accessibility issue where the VoiceOver screen reader was not vocalizing UI text correctly.

IAM-10040: Fixed an issue where the browser was incorrectly using autofill if a KBA Definition Node was within a Page node. The issue prevented use of tab and arrow functionality for that node.

IGA-4139: Updated the access filter component in the IGA access graph to accept dynamic filter options. This lets you use different UI components to customize the available filter options, based on context.

IGA-4275: Fixed a pagination issue in the Direct Reports view by removing sortable columns and default sort from the Direct Reports and Delegates pages.

OPENAM-26359: Added a new configuration option, Enable Rich Authorization Requests with RCS, to the OAuth2 Provider service. This resolves an issue with remote consent where authorize requests with authorization_details would fail with an invalid_request error if an RCS was not configured.

IAM-1715: Improve messaging on back button for 404 pages in the Advanced Identity Cloud admin console.

IAM-3829: You can now perform dry-run promotions in the Advanced Identity Cloud admin console.

IAM-3834: Distinguish between dry-run and actual promotions in the promotion report in the Advanced Identity Cloud admin console.

IAM-8149, IAM-8275, IAM-8988: Added the following configuration options to the Advanced Identity Cloud admin console when you create or edit a journey:

IAM-8972: You can now configure managed objects and relationships in the Advanced Identity Cloud admin console.

IAM-9819^[4]: Added the ability to export custom reports.

IAM-9822: You can now perform promotion rollbacks in the Advanced Identity Cloud admin console.

IAM-9903^[4]: Added the ability to import custom reports.

IAM-9960: Added a wider scope to the monitoring search feature by being able to search on /payload/message and just /payload in cases where the monitoring record’s payload is a string.

OPENIDM-22009: All connectors included with Advanced Identity Cloud were upgraded. Learn more in 1.5.20.34 Connector changes.

IGA-4036: Added the ability to add and remove members of an entitlement directly from the entitlement LCM users tab.

IAM-1907: Fixed an issue where custom endpoint search showed an incorrect message.

IAM-2537: Fixed an issue where non-dashboard URLs didn’t show a 404 page.

IAM-2615: Fixed an issue where border radius settings affected the hosted pages editor preview.

IAM-3453: Fixed styling issues with the back button.

IAM-5439: Fixed an issue where an ESV couldn’t be updated after its last value was deleted.

IAM-7502: Fixed an issue where the color in the Card Input Border Focus Color hosted pages setting wasn’t applied to the search field in the My Applications hosted account page.

IAM-9475: Fixed an issue in the hosted journey pages where a journey was allowed to continue in the event of a password mismatch when a message node was on the same page.

IAM-9752: Fixed an issue where VoiceOver gestures didn’t work on drop-down lists.

IAM-9842: Fixed an issue where VoiceOver didn’t announce text for some page elements.

IAM-9936: Fixed an issue with the query operation in the SaaS REST application where setting the type select field prevented the method select field from being cleared, and the other way around.

IAM-9952: Fixed an issue where the table header for the action column was empty on several pages in the hosted account pages.

IAM-9958: Fixed an issue where the table header for the action column was empty on several pages in the Advanced Identity Cloud admin console.

IAM-10056: Fixed an issue on the Auth Scripts page where the modal body failed to load after clicking add New Script.

FRAAS-31357: You can now use the /environment/aiagent?_action=enable endpoint to simplify the process of enabling the AI Agents feature in your sandbox environments. Learn more in Enable the AI agents feature.

IGA-4247^[2]: Added two new log sources, iga-api and jas, to improve Identity Governance monitoring:

FRAAS-31613: Fixed an issue where password policy updates weren’t properly replicating to the datastore in mutable environments.

FRAAS-31318: Fixed an issue where setting certain special characters in an ESV prevented the ESV from being interpreted correctly.

AME-33573: Next-generation scripts now include utils.base64url.encode() and utils.base64url.decodeToBytes() for Base64URL encoding and decoding.

AME-33971: Added a new Save and Test Connection button to the PingOne worker configuration screen allowing you to validate the connection.

AME-33973: You can now configure the PingOne Worker Service connection using a credential JWT.

AME-34248: You can now use next-generation scripts in the Social Provider Handler node to transform normalized profile data into identities or managed users.

AME-34249: You can now use next-generation scripts in the OIDC ID Token Validator node. The jwtClaims binding now behaves as a native JavaScript object.

AME-34540: You can now specify autocomplete attributes for username nodes.

OPENAM-21474: A new Minimum max_age for Authorize Requests property is now available in the advanced OIDC settings of the OAuth 2.0 provider service.

OPENAM-23610: The default value for the Return challenge as JavaScript (Legacy) property on the WebAuthn Authentication and WebAuthn Registration nodes is now not enabled. Ping Identity recommends that you keep this setting.

OPENAM-24523: You can now dynamically modify the scopes of a refresh token during the refresh flow with the new next-generation scope validation script binding, scopeValidatorHelper, and its method, inheritAccessTokenScopesOnRefresh(). This is useful when scope validation scripts alter access token scopes and you need the refresh token to inherit those changes.

OPENAM-25901: Next-generation OAuth 2.0 scope validation scripts now have access to the availableScopes binding, which lists all scopes configured for the client. A new throwInvalidScope() method is also available to simplify error handling.

AME-34216, AME-34398: When using an SSO token as the subject for a policy with an IDM user environment condition, it now correctly resolves to the IDM _id instead of the user’s AM universal ID.

AME-34329: By default, parallel updates can no longer be made for CTS sessions. You can revert this behavior by setting the ESV esv.cts.use.etag.assertion.on.updates to false.

FRAAS-28387: Invites for Advanced Identity Cloud tenant registration now use a one-time passcode (OTP) instead of a magic link. This change prevents email scanners from accidentally invalidating single-use links.

AME-29745: Improved the certificate validation process in the Certificate Collector and Certificate Validation nodes. By default, Advanced Identity Cloud collects the _first certificate in a certificate chain (the user certificate). You can now create an ESV named esv-am-nodes-certificatechain-validation-enforced and set its value to true to collect the chain of certificates.

AME-33851: You can now use next-generation scripts for social identity provider transformation scripts.

OPENAM-25329: The PingOne Protect Initialize node now includes an Additional Signals SDK Initialization Options attribute. This allows you to configure options that aren’t already defined in the node. The PingOneProtectInitializeCallback has been updated with new fields to support this.

OPENAM-25677: The PingOneProtectInitializeCallback now includes a universalDeviceIdentification field, which replaces the deprecated enableTrust field. The enableTrust field is still returned for backward compatibility.

IGA-4186^[2]: Fixed an Identity Governance issue where the end-user UI did not correctly sort and paginate large user populations, improving responsiveness for large datasets.

OPENAM-22698: Fixed a bug that caused duplicate URIs in WS-Federation responses.

OPENIDM-21493: You can now cancel a clustered reconciliation even when a route associated with the source or target system is unavailable.

OPENIDM-21718: The maxQueueSize for queued synchronization now defaults to 1000 and can’t be configured to a value higher than 1000 or lower than 100. The previous default was 20000.

AME-34191: You can now override the HTTP binding used to redirect users to the SAML error page. To do this, configure an ESV variable named esv-global-saml-error-page-http-binding and set its value to HTTP-POST or HTTP-Redirect. If you don’t set this variable, Advanced Identity Cloud uses the default value of HTTP-POST.

IAM-6546: End users now have more options to manage their devices in the hosted account pages. For each device, they can view when it was last used for sign on, view when it was added, edit its name, and delete it.

IAM-9672: In the advanced sync Mapping tab, if no properties have been mapped, it now shows a more accurate description of the target and source identity objects whose properties can be mapped.

IAM-6640: Fixed an issue in the hosted pages theme preview where clicking Edit Personal Info opened two instances of the modal.

IAM-8221: Fixed an issue in the terms & conditions live preview where interactive elements weren’t disabled.

IAM-9620^[2]: Fixed an Identity Governance issue where clicking Save in the certification template creation wizard didn’t disable the button after submission, which could result in the creation of unintended duplicate templates.

IAM-9786: Fixed an issue where ESV placeholders manually entered into a field were always treated as strings, regardless of whether they were an array, list, or string.

IAM-9886: Fixed a display issue on the Reports Run History tab where the pop-up menu items weren’t displayed correctly.

06 Feb 2025

OPENAM-25779: Deletion of the samlApplication object is now deferred for unsuccessful authentication journeys so that the object is still available for subsequent sign-on attempts in the same session.

The following OAuth 2.0 scripts can now use the next-generation scripting engine, which gives them access to common bindings such as utils and openidm:

The following SAML 2.0 scripts can now use the next-generation scripting engine, which gives them access to common bindings such as utils and openidm:

AME-32969: You can now make sure the samlApplication binding is available for all SAML flows by enabling the application context in the hosted IdP or remote SP entity configuration. Previously this was only added in certain situations such as when using an application journey or IdP-initiated integrated mode.

AME-32997: Added an Allow Retry option to the Backchannel Initialize node that lets end users retry a failed backchannel authentication journey.

AME-33430: You can now include remote consent agent credentials in a Basic Authentication header for pushed consent requests.

AME-33930: A new testConnection action on the realm-config/services/pingOneWorkerService/workers/pingone-worker-service-name endpoint lets you test the connection from Advanced Identity Cloud to PingOne.

AME-33939: A new listLatestNodeDefinitions action on the realm-config/authentication/authenticationtrees/nodes endpoint provides a list of node definitions for the latest version of each node.

FRAAS-29084: Custom domains are now restricted to a maximum of 63 characters in the Advanced Identity Cloud admin console. This restriction has always existed on the system backend.

OPENAM-22125: A new Proxy Configuration tab in the Http Client Service configuration lets you use separate proxy configurations per HTTP Client instance.

OPENAM-24476: Added java.util.zip classes to the allowlist for the Scripted Decision node scripting context.

The following enhancements have been made to the nodes provided with Advanced Identity Cloud:

OPENAM-25371: Added a configuration property to the PingOne Verify Evaluation node to enable automatic redirection to the journey after an end user completes verification (when using the Redirect delivery mode).

OPENAM-25618: The new locales binding lets you return the localized version of a string from a translation map. It is available to next-generation Configuration Provider node, Journey Decision node, and Device Match node scripts.

AME-33653: Custom nodes now work with the Configuration Provider node.

AME-33808: If Node State Attribute For User ID is provided in the PingOne Protect Evaluation node, but the corresponding attribute is missing from the node state, the node triggers the failure outcome rather than using the user ID associated with the AM identity.

AME-34217: Added a version setting to the Configuration Provider node. This update provides the underlying infrastructure for a node versioning feature in an upcoming release.

OPENAM-21881: Updated the Page node to remove pageNodeCallbacks from the shared state after the node completes.

OPENAM-23918: Resolved a race condition in the OATH Registration node and OATH Device Storage node where recovery codes could potentially be lost.

OPENAM-24065: Improved consistency for error responses across realms when processing illegal arguments. The /authenticate call now correctly returns a 400 (Bad Request) instead of a 500 (Internal Server Error) for invalid arguments.

OPENAM-25406: Added an identity.exists() method to next-generation objects returned by idRepository.getIdentity(). This lets scripts verify an identity’s existence in the identity store before further processing.

ANALYTICS-1383^[4]: The new historical change report feature provides a complete audit trail of changes to your managed identities. It tracks all modifications to user profiles, roles, accounts, and applications. You can easily generate reports to see what changed, who made the change, and when it happened, which gives you clear insights for compliance and security monitoring.

ANALYTICS-1326^[4]: Fixed an issue in custom reports caused by relationships between custom identities that contain multiple underscores.

ANALYTICS-1367^[4]: Fixed an issue in custom reports caused by IP addresses in journey events.

OPENIDM-21472: When provisioning applications and using queued synchronization, changes to a user account now propagate to all associated accounts.

OPENAM-25702: The PingOne Protect Evaluation node again supports a Node State Attribute For Username setting. PingOne Protect risk evaluation calls can depend on the username.

OPENIDM-21493: You can now cancel a clustered reconciliation even when a route associated with the source or target system is unavailable.

OPENIDM-21776: The Advanced Identity Cloud identity management service now uses synchronous HTTP client requests to connect to external identity management, REST, and token introspection services. This change prevents connection closure exceptions from terminating reconciliation.

OPENIDM-21718: The maxQueueSize for queued synchronization now defaults to 1000 and can’t be configured to a value higher than 1000 or lower than 100. The previous default was 20000.

FRAAS-29829: Removed a reference to "PingOne Advanced Identity Cloud" from the 404 Not Found error page.

AME-34034: Fixed an issue where omitting a shared secret label in the RADIUS Decision node caused Prometheus metrics to become unavailable.