Regular channel changelog archive

OPENDJ-11576^[1]: Empty user attribute values are no longer considered when evaluating password policies.

AME-31153: Consent request data can now be pushed via backchannel.

AME-31429: A new field on the remote consent agent lets you include properties from the resource owner’s session as part of the consent request.

AME-31846: Next-generation Config Provider Node scripts can now access the following additional scripted node bindings:

AME-32064: The SAML2 Authentication node includes a new configuration option,Validate IdP Entity ID. When enabled, the node validates that the IdP entity ID from the SAML assertion is the same as the IdP entity ID configured on the node.

AME-32970: You can now access the application context for all OAuth 2.0 / OIDC flows through the oauthApplication binding by setting Enable Application Context in the OAuth 2.0 provider or at the client level. Previously, you could only use this binding when using an application journey.

IAM-8244: Adds support for bidirectional mappings in synchronization configuration.

IAM-8497: Added a brand administrator role to the Advanced Identity Cloud admin console. Brand administrators only have access to change hosted pages themes.

IAM-9484: Added ability to provide translation overrides for the Waiting Message field in the Polling Wait node and the Email Suspend Message field in the Email Suspend node. This lets you provide translations when the PollingWaitCallback or the SuspendedTextOutputCallback callbacks are added using scripts.

OPENAM-23711: Adds a Detect Connection Time Out option to the Social Provider Handler node. When enabled, connection timeouts from social identity providers result in the journey following the Timeout outcome.

OPENAM-24059: Adds support for the android-key WebAuthn attestation format.

OPENAM-24130: The PingOne Protect Evaluation node now lets you set the flow subtype that’s sent to PingOne Protect.

OPENAM-24137: You can now configure the PingOne Verify Evaluation node to obtain biographic matching data from the node state.

OPENAM-24350: Cryptographic keys can now be derived in next-generation scripts using the PBKDF2 algorithm.

OPENAM-24548: The PingOne Protect Initialize node now lets you obtain PingID Device Trust Agent attributes when going through a PingOne Protect flow.

OPENAM-24552: The PingOne Protect Evaluation node now lets you send a target application name in addition to the existing target application ID, in the PingOne Protect evaluation request

OPENAM-24554: The PingOne Protect Evaluation node now lets you use targeted PingOne policies.

OPENAM-24560: Removed the User Type and User Name fields from the PingOne Protect Evaluation node. The user type is always EXTERNAL and the user name is not applicable to external user types. Only the User ID is sent in the PingOne Protect evaluation request.

OPENAM-24587: You can now override the default Google Secret Manager key ID (kid) values with human-readable values. Find more information in Override default kid values.

OPENAM-25327: Next-generation OAuth 2.0 scripts can now access the redirectUris property on the clientProperties binding.

OPENAM-25417: You can now configure the SameSite attribute for cookies in the Set Persistent Cookie node and the Persistent Cookie Decision node.

OPENAM-25418: The attestation fmt type is now included in the transient state data of the WebAuthn nodes.

OPENAM-24309: The PingOne Verify Evaluation node now supports biographic matching using multiple user attributes.

AME-32307: Fixed an issue where end users weren’t able to continue a PingOne Verify journey that requested a QR code if they didn’t have a separate device to scan the code.

AME-32513: Added the suspend action to Custom nodes.

AME-32979: The Core Token Service (CTS) now stores AUTHENTICATION_WHITELIST tokens with millisecond-level precision for the expiry timestamp. This minimizes contention in indexes.

IAM-8766: Fixed an issue with mustRun journeys and query parameters such as forceAuth=true, where end users were authenticated then immediately unauthenticated.

IAM-9430: A warning is now displayed in the Advanced Identity Cloud admin console when a promotion would cause a deferred release tenant to be upgraded at the same time.

OPENAM-20582: Lets you configure a list of accepted JWT issuers for OAuth 2.0 clients. These are now accepted in addition to the OAuth 2.0 client ID for private key JWT authentication.

OPENAM-23929: Fixed a performance issue related to schema caching.

OPENAM-24297: Fixed an issue where the PingOne Verify Evaluation node incorrectly returned a failure outcome when the PingOne environment timed out during the identity verification process. This could happen if an end user didn’t engage with the QR code or selfie capture. The update correctly detects the TRANSACTION_TIMED_OUT status in PingOne responses and returns the timeout outcome, letting journeys handle timeouts distinctly from failures.

OPENIDM-21664: Fixed a provisioning issue where application assignment was failing to create local accounts when the user count exceeded 1000.

IGA-4071^[2][1]: Fixed an issue with dataflow job failures.

IAM-9663^[1]: The admin console now displays the useInPlaceholders and encoding attributes for existing ESV secrets.

IAM-9664^[1]: The admin console now defaults the useInPlaceholders attribute to true when creating new ESV secrets.

IAM-9395: Table columns are now resized uniformly across the Advanced Identity Cloud admin console.

IAM-9429: If your production environment is configured for deferred release, you can use the new /environment/promotion/promote endpoint to check if running a promotion will trigger a release upgrade.

IAM-9516: The tenant administrator profile page now prompts for re-authentication when adding or removing an MFA device.

OPENIDM-19400: New Prometheus metric for the availability of connector servers, for example:

OPENIDM-20341: Identity management scripts now natively support Base64 encoding using the btoa (encode) and atob (decode) global script bindings.

OPENIDM-20790: The openidm/sync/mappings endpoint now supports paging using either offsets or cookies.

OPENIDM-20933: Improved task scanner exception handling. If the task scanner encounters a task that results in an exception, it now aborts only that task and continues processing the remaining tasks. Previously, the scanner would abort the entire process when any task caused an exception.

OPENIDM-20937: New provisioner metric idm_icf_pending. Includes all the same tags as idm_icf*.

OPENIDM-21170: Metrics for router filters now use router_filter for the metric name and include a name tag to identify the specific filter.

OPENIDM-21171: Metrics for managed identity script hooks now use managed-script-hook for the metric name, object to tag the identity object, and script-hook to tag the script hook.

OPENIDM-21172: Metrics for custom endpoints now use the new custom_endpoint metric name and include a name tag based on the custom endpoint configuration name after the hyphen. For example, a custom endpoint configuration endpoint-onboardCustomer.json will generate metrics with a name tag/label of "onboardCustomer". The policy service makes use of an internal scripted endpoint based on the file policy.js, and its metric name is policy-js.

OPENIDM-21233: The openidm/health/ready endpoint has been enhanced to include the number of waiting requests. A new set of metrics have been added to provide a historical accounting of IDM health.

FRAAS-28885^[1]: ESV secret useInPlaceholders attribute is now taken into account by promotion integrity checks.

IAM-9466: Annotation comments added to sub-nodes are now saved correctly.

IAM-9496: The tooltip in journey comments now correctly displays the creator’s name without overflow.

IAM-9527: The hosted account pages logo now correctly uses the height specified in the theme.

OPENICF-3277: The SaaS REST connector no longer throws a NullPointerException when attributes are missing in the request payload.

OPENIDM-20525: The cn and telephoneNumber schema for alpha_user and bravo_user are now scope: public and searchable: true. This schema change applies to tenants created on or after December 3, 2025. Existing tenants are unchanged.

OPENIDM-20863: Default values for multivalue mappings are now copied by value to prevent unintended mutations during runtime.

OPENIDM-21421: Updating the configuration of an inactive provisioner no longer throws an IllegalStateException.

OPENIDM-21454: Every failed record from a live sync is now stored in the dead-letter queue with a unique entry ID.

FRAAS-28370: Fixed an issue where requests to the /monitoring/prometheus/am and /monitoring/prometheus/idm endpoints occasionally didn’t return timely responses.

IAM-1709: Exposed useInPlaceholders and encoding attributes when creating ESV secrets in the admin console.

IAM-9312: Table columns are now resized uniformly across the following Advanced Identity Cloud admin console pages:

IAM-9323: Added Metadata tab to user resource page to display properties such as createDate and loginCount.

IAM-9217: Fixed cron schedule validation for new jobs.

AME-30984 and AME-30609: Enhanced authentication audit logging to include the SAML Identity Provider (IdP) and Service Provider (SP) entity IDs during SAML flows. This information lets you report on the SAML applications users are accessing, supporting analytics and dashboarding efforts.

AME-30985: In SAML v2.0 single sign-on (SSO) flows, the JSON web token (JWT) created in the browser’s session storage no longer expires.

AME-31082 and SDKS-3681: Added support for device token refreshing to the Push Notification Service endpoint, enabling the reception of new tokens from mobile devices.

AME-31351 and AME-31471: Improvements to the Device Code flow mean that end users are now prompted to reauthenticate even when there’s an existing session for must-run and app journeys.

AME-31398: The PingOne Protect Evaluation node has been enhanced to support custom attributes. To specify custom attributes to be used in PingOne Protect for custom predictors, set the Node State Attribute For Custom Attributes in the node configuration. The node retrieves a map of custom attributes from the node state to be used in the evaluation request to PingOne Protect.

AME-31656 and AME-31468: The PingOne Protect Evaluation node has been enhanced to support dynamic risk policy IDs and target app IDs. To set the risk policy set ID dynamically, enable Use Node State Attribute For Risk Policy Set ID in the node configuration. To set the target app ID dynamically, enable Use Node State Attribute For Target App ID in the node configuration. This instructs the node to obtain these IDs from the node state.

AME-31487: Improvements to SAML v2.0 standalone mode include replacing legacy JSPs with URL endpoints.

OPENAM-23051 and AME-31918: A new ESV, esv.oauth2.request.object.restrictions.enforced lets you enforce stricter adherence to the PAR and JAR specifications.

IAM-8236: The ability to edit journeys from the AM native admin console has been removed. Use the Advanced Identity Cloud admin console to edit journeys.

IAM-9000, IAM-9001: Add annotations and sticky notes to journeys to assist learning and collaboration.

IAM-9237: Allow ESVs to be embedded in URL fields for federation IdPs. This lets you set up federation IdPs with fewer ESVs because you can define a single ESV containing a UUID shared by multiple URL fields.

IAM-9246: Table columns are now resized uniformly across all table views.

OPENAM-20776: A new OIDC client configuration option, Private Key JWT Audience, lets you configure and override the audience (aud) claim of a Private Key JWT.

OPENAM-21783: Improved token management for OAuth 2.0 client applications.

OPENAM-23669: Full scopes (scopes ending in *) can now be used by service accounts in all cases where more specific scopes (for example, :read) are used.

OPENAM-23710: The httpClient binding is now available to legacy SAML 2.0 IdP adapter scripts.

OPENAM-23850: Enhanced the PingOne Verify Evaluation node with an Allow same device verification option that lets end users continue verification on their current device.

OPENAM-23867: The LDAP Decision node no longer logs credential failures as errors. It now logs them at the info level.

OPENAM-24062: Added support for the ECDSA algorithm to the utils.crypto.subtle next-generation binding. This algorithm is supported for key generation, signing, and verification.

AME-31351 and AME-31471: Improvements to the Device Code flow mean that end users are now prompted to reauthenticate even when there’s an existing session for must-run and app journeys.

AME-31481: Validation around policy creation has been improved. If you’re using the legacy "Policy" environment condition (or a custom environment condition), you’ll need to add that to the list of allowed environment conditions for your policy set to create or update policies that use that condition type.

IAM-9153: Password validation now works correctly when pasting a value that matches the existing value.

OPENAM-20749: A new ESV, esv-enable-oauth2-sync-refresh-token-issuer causes a stateful OAuth 2.0 introspect response to overwrite the iss claim of the introspectable token. To enable this behavior, set this ESV to false.

OPENAM-23770: Canceling a WebAuthn flow now results in a Client Error outcome, rather than an internal failure.

OPENAM-24159: Fixed an issue that prevented multiple Identity Assertion nodes from being used in a single journey.

OPENAM-24486: Improved performance when creating large numbers of OAuth 2.0 clients simultaneously.

OPENDJ-11486: Fixed an exception caused when identity management queries for users with a filter containing wildcards and specific object classes.

RCS 1.5.20.32 is now available to download. Learn more in ICF release notes.

IAM-9374: Fixed an issue where managed identity searches were querying all properties, causing slow performance.

ANALYTICS-582^[5][6]: Custom objects can now be used as data sources for reporting. The system uses an object’s configured title for the data source name, makes its properties available as attributes, and represents all object relationships.

ANALYTICS-1165^[5]: Added the capability to change a report name.

ANALYTICS-1195^[5]: Added the ability to import and export report templates using reports API endpoints.

FRAAS-25919: You can now use the API to configure custom domains for the Advanced Identity Cloud admin console.

IAM-8922: The Advanced Identity Cloud admin console now accepts ESV placeholders for the following federation fields:

IAM-8982^[2]: Add event function for setting the query filter/select options of a select field.

IAM-9066: Added Tenant Auditor option to Advanced Identity Cloud admin console federation groups claim.

IAM-9099, IAM-9146, IAM-9167: Many table views now support column resizing and customization.

IAM-5488: Terms and Conditions now respects target attribute in anchor tags.

IAM-6588: The Advanced Identity Cloud admin console now correctly displays journey status for journeys disabled and enabled using ESVs.

IAM-8887: Prevent browsers auto-filling passwords in user registration journeys.

IAM-8940: Managed identity number property now accepts float values.

IAM-8956: Deselecting the Personal Information option now disables the section containing the user avatar in hosted account pages.

IAM-9169: Fixed styling for responsive table layouts with sticky action column in Identities table views.

OPENIDM-21372: Advanced Identity Cloud now prevents access to the identity repository endpoint, /openidm/repo. This prevents uncontrolled and potentially incompatible schema changes.

Best practices for naming and arranging PingOne environments.

Best practices for configuring PingOne workers and Advanced Identity Cloud worker services when integrating with PingOne products.

How to configure, test, and optimize PingOne Protect.

OPENAM-24476^[7]: Added java.util.zip.Deflater, java.util.zip.Inflater, java.util.zip.DeflaterOutputStream, and java.util.zip.InflaterInputStream to the allowlist for Scripted Decision nodes.

FRAAS-24857: CNAME verification is no longer required when creating a custom domain.

FRAAS-25547: The sender address for emails sent to Advanced Identity Cloud tenant administrators is now saas@pingidentity.com.

FRAAS-26063: You can now override the samlErrorPageUrl. To do so, configure an ESV variable named esv-global-saml-error-page-url and set its value to your SAML error page URL. If you don’t set this variable, Advanced Identity Cloud uses the default value of /saml2/jsp/saml2error.jsp.

FRAAS-25734: Exception stacktraces in access management and identity management logs are now truncated to approximately 300-400 lines.

FRAAS-25821^[8]: Fixed an issue that prevented IP rules in Proxy Connect from being disabled.

AME-32756: Fixed an issue with policy evaluation returning results from a stale policy index cache.

OPENDJ-11634: Advanced Identity Cloud now prevents searches with many results and no applicable index from overloading the system.

OPENAM-24384: Added javax.crypto.SecretKeyFactory, javax.crypto.spec.PBEKeySpec, and com.sun.crypto.provider.PBKDF2KeyImpl classes to the allowlist for the OAUTH2_ACCESS_TOKEN_MODIFICATION scripting context.

OPENAM-24393^[7]: Fixed an issue where the InnerTreeEvaluator node failed for authentication journeys initially accessed using REST without an authId.

AME-31372^[1]: An Agent journey is now available by default in both Alpha and Bravo realms. The Agent journey makes it easier to integrate with Ping Identity agents and gateways. It validates the agent credentials with an Agent Data Store Decision node.

AME-30050: You can now enable a next-generation script in the AM native admin console native console to run after a Dynamic Client Registration request is processed.

AME-30716: Removed Failed to create SSO Token from logs at warning level. To observe these warnings, increase the log level to debug.

AME-30801: The Inner Tree Evaluator node now has an optional Error Outcome that lets you capture exception details if an exception occurs during the evaluation of the child journey.

FRAAS-25818: The built-in SMTP server in new tenants now has a limit of 10 emails per minute and a fixed email sender address with the format noreply@<tenant-fqdn>.

IAM-7581: Text wrapping in table views has been improved for readability.

IAM-8573: IDM now includes an endpoint to retrieve individual themes from the /themerealm configuration using either an ID or a _queryFilter by name. This improves performance and ensures reliable theme loading, even on slow networks.

IAM-8610: When you create an SSO application for Microsoft 365, the application now generates a signing certificate, which you can download or rotate as needed.

IAM-8633: You can now add, remove, and rearrange table columns for managed identities and application provisioning tables.

IAM-8925^[10]: In Identity Governance, you can now configure actions that trigger automatically when a form first loads or when a user changes the value of a specific field.

OPENAM-22467: Customers can now provide any value in the typ header in JWTs.

Greater control over journey session duration and authenticated session timeouts:

OPENAM-23438: Following WebAuthn registration and authentication, new information is added to the transient state.

OPENAM-20709: On successful authentication, the WebAuthn Authentication node now adds the UUID of the device (webauthnDeviceUuid) and the name of the device (webauthnDeviceName) to the shared state. This lets you track the use of biometric authentication and the device used to authenticate.

AME-30969: If the OIDC Claims Plugin Type in the OAuth 2.0 provider is set to SCRIPTED but no script is selected, the userinfo endpoint now returns the sub claim, in compliance with the OIDC specification. Previously, the userinfo endpoint returned an empty JSON object. If you still require this behavior, set the esv-scripting-legacynulloidcclaimsscriptbehaviour ESV to true.

IAM-4397: Fixed an issue in the hosted journey pages where the prompt text for the Choice Collector node wasn’t fully visible and the default option wasn’t visible at all.

IAM-8632: Fixed an issue where validation errors were incorrectly displayed for pre-populated fields.

IAM-8789: Managed identity modals now correctly handle both single-value and array-based enum types.

IAM-8871: The hosted account pages no longer freeze and throw an error when editing details if there are empty custom enum array values.

IAM-8902: The application username field in SAML 2.0 NameID flows is now correctly set to uid instead of username.

IAM-8933: Fixed an issue in the Advanced Identity Cloud admin console when creating or modifying identity objects with a required boolean property. You can now set the value of the required boolean property to false.

IAM-9062: Hosted pages themes no longer continuously refresh when trying to set up or confirm two-factor authentication (2FA).

OPENAM-20749: For server-side OAuth 2.0 tokens, the /oauth2/introspect response can now overwrite the iss claim of the introspectable token. To enable this behavior, set the esv-enable-oauth2-sync-refresh-token-issuer ESV to false.

OPENAM-22928: When agents authenticate to Advanced Identity Cloud, the session created no longer expires.

OPENAM-23303^[1]: Fixed an issue where access management scripts were failing to load because they contained strings that resembled configuration placeholders. The code that parses these scripts now correctly ignores configuration placeholders and any strings that resemble them.

OPENAM-23334: You can now use the mergeShared and mergeTransient methods to add nested objects to ObjectAttributes.

OPENAM-23519: Improved error handling during WebAuthn registration when the Android lock screen isn’t enabled.

OPENAM-24159: Fixed an issue with Identity Assertion nodes failing if there are more than one in a journey.

AME-31379: Setting the new ESV esv-oauth2-provider-request-object-processing-enforced to true now lets admins enforce which validation rules are applied when processing OAuth 2.0 request objects.

FRAAS-25437: Tenant administrators with the tenant-auditor role can now use federated access to authenticate to Advanced Identity Cloud.

IAM-3441: Added pagination to all list views.

IAM-7265: You can now right-click a node in the journey editor to access a context menu.

IAM-7266: Added an action bar to the journey editor that lets you deselect or delete currently selected nodes.

IAM-7580: Pages now span the full width of the screen, improving navigation and usability.

IAM-8260: Advanced Identity Cloud now supports multiple WS-Fed^[4] applications.

IAM-8640: The Release Notes link in Tenant Settings now opens the release notes for the tenant’s specific version.

IAM-8714^[2]: You can now configure columns in the Identity Governance access review page.

OPENIDM-21206: Usernames and application names must now be unique, as enforced by the datastore.

IAM-7413: The reCAPTCHA Enterprise node is now fully supported.

IAM-8489: Fixed an issue with the display of application logos in the hosted account pages.

IAM-8770: Fixed an issue with the calendar icon position in date fields.

IAM-8773: Fixed an issue where key actions such as realm login were blocked in older tenants with an unmodified original theme.

The RCS 1.5.20.30 release is now available to download. Learn more in ICF release notes.

The PingGateway 2025.6.1 release is now available to download. Learn more in PingGateway 2025.6.1.

IAM-8314^[7]: Fixed an issue where setting ESVs in connector or provisioner configuration stops the Advanced Identity Cloud admin console from being able to update connectors or run a liveSync operation.

FRAAS-25155: Increased log batching size to avoid truncation of large JSON log entries.

ANALYTICS-868: The Tenant Admin Activity report has been changed to the Tenant Admin Initiated Entity Type Changes report. The new report provides more detailed and business-friendly insights into changes made by tenant administrators:

IAM-8405: You can now duplicate out-of-the-box reports.

IAM-8591: Dynamic sorting for report results. You can now sort report results directly in the Advanced Identity Cloud admin console after running a report.

FRAAS-25142: Fixed a memory issue in the ESV service.

FRAAS-25434: Fix issue causing source to sometimes be defined as unknown in /monitoring/logs/* endpoints.

FRAAS-25226: Allow a higher threshold for large JSON log entries before splitting them into smaller plaintext log entries.

FRAAS-23329: Access to ESV REST API endpoints using the fr:idm:* scope is now deprecated.

FRAAS-23330: Access to ESV REST API endpoints using resource version 1.0 is now deprecated.

FRAAS-25269: The IDC.CLI OAuth 2.0 client is now deprecated in existing tenants and no longer provisioned in new tenants.

FRAAS-25205: Consolidated End User UI, Login UI, Administrator Registration UI, and Administrator UI status page components into a single Administrator UI component as they were all reporting the same service.

IAM-2453^[1]: Hosted pages themes now show the loading spinner until they are fully loaded.

IAM-4769^[1]: Hosted journey pages now fall back to the default theme if a journey is configured with a deleted theme.

IAM-6781^[1]: Password policy hints now show all policy conditions when creating a new user identity in the Advanced Identity Cloud admin console.

IAM-7615^[1]: The Certificate Collector node now validates the value set in the HTTP Header Name for Client Certificate field based on the value selected in the Certificate Choice Method field.

IAM-8358^[1][2]: Hosted account pages now display a New User button in the Users list view for delegated administrators.

OPENIDM-15771: You can now set locales in identity management scripts with the _locale parameter.

OPENIDM-17680: Advanced Identity Cloud now supports enumerations in string and number attributes of its identity schema. To make an attribute an enumeration, add "enum" : [ "one", "two", "three" ] to the attribute. Advanced Identity Cloud requires create and update privileges to use one of the enumerated values.

OPENIDM-19918: You can now choose whether synchronization detects identity array changes using ordered or unordered comparisons. Set the comparison configuration property in the schema. Unordered JSON array comparison ignores the order of elements and can negate the need for certain custom scripts within mappings. Relationship and virtual property array fields default to unordered comparisons. All other fields default to ordered comparisons.

OPENIDM-20023: RCS communication with Advanced Identity Cloud can now use stricter authorization. Learn more in Secure RCS access and Migration dependent features.

FRAAS-25256: Fixed an issue that was causing missing data in analytics dashboards.

IAM-1479^[1]: Email field validation in the Advanced Identity Cloud admin console now runs only when typing stops or the field is unfocused.

IAM-7858^[1]: Hosted account pages now use the access management maxIdleExpirationTime value to prompt the You will be signed out soon modal.

IAM-8382^[1]: Fixed an issue in the bookmark app where the URL field validation stopped the Create Application button working the first time it was clicked.

IAM-8383^[1]: Fixed an issue in the bookmark app where the URL field accepted ESV secrets.

IAM-8398^[1]: Field labels positioned above a field now remain left aligned when autofill is triggered.

IAM-8441^[1]: Fixed a display issue in the Advanced Identity Cloud admin console where connector servers and connector server clusters with long names went off the edge of the screen.

OPENAM-21783: Improved token management for OAuth 2.0 clients that override the Use Client-Side Access & Refresh Tokens setting. The OAuth 2.0 applications endpoint now correctly shows all tokens issued to these clients. Additionally, administrators can now successfully revoke any of the tokens issued to these clients.

OPENDJ-11486^[1]: Fixed an exception caused by identity management user queries with a filter containing wildcards and specific object classes.

ANALYTICS-1004^[6]: Support for custom attributes and relationships in the organization entity for advanced reports.

OPENAM-23218: Legacy SAML 2.0 IDP attribute mapper scripts now have access to the httpClient binding.

OPENAM-23710: Legacy SAML 2.0 IDP adapter scripts now have access to the httpClient binding.

OPENIDM-20995: Fixed an issue that prevented error reports during certain operations on groups or users. For example, trying to remove a non-existing attribute or null value now correctly results in an exception message to the client if these operations are not supported by the target system.

IAM-987: Added support for enums (drop-down lists) to hosted account pages.

IAM-1116: Added support for enums (drop-down lists) to the Advanced Identity Cloud admin console.

IAM-2103: Added support for enums (drop-down lists) to hosted journey pages.

IAM-6822: Added the ability to manage cookie domains in the Advanced Identity Cloud admin console.

IAM-7412: Updated the password policy feature in the Advanced Identity Cloud admin console. Added the ability to specify a minimum substring length between 3 - 64 to use when validating passwords against user attribute values. The default is still 5 characters, but can now be reduced to as few as 3 characters to catch shorter string matches.

IAM-7794^[2]: Added support for using custom identity objects in the form builder.

IAM-7919: Improved color contrast ratio of the Delete Account button text when focused.

IAM-7934: Improved color contrast ratio of date fields when focused.

IAM-7957: Improved color contrast ratio of the Deselect button text when focused.

IAM-7966: Improved color contrast ratio of In Progress text.

IAM-8016^[2]: Allow form authors to specify a user filter when dynamic enums are selected.

IAM-8085: Updated the Add a Parameter reports modal to use entity attributes for input.

FRAAS-15518: Fixed issue that prevented localization of Session timed out message in certain locales.

FRAAS-24449: Enhanced the reliability of metrics collection under high-load conditions.

FRAAS-24990: Fixed an issue where requests to the /monitoring/logs and /monitoring/logs/tail endpoints timed out after 15 seconds rather than the expected 60 seconds.

IAM-5834: Fixed a double-encoding issue in the SAML app that affected IdP-initiated sign on.

IAM-6796: Jobs are now prevented from being scheduled with frequencies that cause invalid date errors.

IAM-7855: Fixed a typo in the help text returned when there are no results to display.

IAM-8237: Corrected floating labels in the date picker in the hosted journey pages.

IAM-8361: The Save button in the Edit Bookmark application is now inactive while checking if the ESV exists.

IAM-8364: Fixed issues in SAML end-to-end scenarios.

IAM-8378: Fixed an issue that stripped HTML elements from email templates.

IAM-8403: Fixed border focus location and floating label issues in Tag fields.

IAM-8434: Fixed an issue that prevented duplication of new themes that contain special characters.

AME-31141: Multiple Java libraries added to SAML SP Adapter scripting allowlist.

OPENDJ-11175: The password validation mechanism has been enhanced to include checks for attribute values shorter than the min-substring-length (the default is 5).

ANALYTICS-846: You can now select the attribute type and value for report entity attributes.

ANALYTICS-983^[6]: You can now use regular expression operators in Advanced Reporting.

OPENAM-23718: Added additional Java classes to the SAML 2.0 SP adapter scripting allowlist.

FRAAS-24631: Fixed a promotions issue where ESVs mapped to secret labels aren’t identified as available in the upper environment.

FRAAS-24648: Fixed an issue with loading ESVs with values containing leading blank spaces.

IAM-7202: In the custom application modal, the native apps link now correctly points to the SDKs documentation.

FRAAS-24646^[7]: Fixed an issue where ESVs mapped to AM secret labels could block configuration promotions.

AME-27705: Extend the utils binding for all next-generation scripts to support low-level cryptographic operations. These operations include encryption, decryption, hashing, signing, verification, and key generation.

AME-28780: Added an IDM policy condition that can assert conditions against an IDM resource type such as user identities.

AME-28954: Modified the import metadata endpoint to support updating signing and encryption certificates for existing SAML service providers (SPs) without requiring the deletion or recreation of SP configurations.

AME-28954: Modified the import metadata endpoint to support updating signing and encryption certificates for existing SAML service providers (SPs) without requiring the deletion or recreation of SP configurations.

AME-29307: You can now use DER-encoded certificates for OAuth 2.0 client authentication.

AME-29810: The realm default authentication service can no longer be a journey with mustRun enabled. Also, mustRun can no longer be enabled on journeys that are set as the realm default authentication service.

AME-29835: Configuration Provider Node scripts can now use the next-generation scripting engine, which gives them access to common bindings such as openidm and httpClient.

AME-30076: New getApplicationId() method provides a consistent way to retrieve the application ID from both SAML and OAuth 2.0 applications.

IAM-7967^[2]: Added an image description for the approvals Low Priority icon.

OPENIDM-20139: Applications can now use postAction scripts for the ONBOARD action.

FRAAS-24020^[1]: Consolidated End User UI, Login UI, Administrator Registration UI, and Administrator UI status page components into a single Administrator UI component as they were all reporting the same service.

IAM-7229^[1]: Added none as a client authentication method when configuring an OIDC federation IdP.

IAM-8419^[1]: Added icons to all nodes in the journey editor. The icons are applied based on the node category, improving consistency and visual clarity in the editor.

SDKS-3774^[1]: Added script input configuration for the PingOne Verify Completion Decision node. This can be used to specify the node state required by a script within the node.

FRAAS-24371^[1]: New ESVs now load into AM and IDM only when the restart is initiated using the ESV restart API endpoint or the ESV update banner in the admin console. Other restarts (for example, after a promotion) won’t load the ESVs. This makes it easier to identify issues caused by ESV changes.

IAM-6996: Added the ability to create a specific OAuth 2.0 client when creating a connector server, rather than relying on the default RCSClient.

IAM-7109: You can now use an ESV to set the From Address in the email provider configuration.

IAM-7827/ANALYTICS-835^[6]: In the analytics report editor in Advanced Reporting, you can now reorder columns by dragging and dropping them.

IAM-7841/ANALYTICS-840^[6]: The reports page in Advanced Reporting is now a list view with pagination and search.

IAM-8321: In the journey editor, the node titles now wrap within the left nodes panel.

AME-29504: The scriptName and logger bindings in library scripts referenced the same default script name and ID. Their previous behavior has now been restored by inheriting values from the referencing script.

AME-29965: The Configuration Provider node now works with the Inner Tree Evaluator for nested inner journeys.

AME-30377: The following two warning level log messages have been reduced to debug level because they’re rarely useful and appear frequently, drowning out more useful log entries:

IAM-7719^[2]: Users are now redirected back to the compliance Policy Rules tab after creating or editing a policy rule.

IAM-7977: Improved the font color contrast ratio of the email address displayed in Advanced Identity Cloud admin console user profiles.

IAM-8053: The Advanced Identity Cloud end-user UI can now use defaultText value as a fallback value when the actual value of a field returns empty.

OPENAM-22120: Back-channel logout tokens now include the exp claim.

OPENAM-23077: The access_token endpoint now responds with the correct error code when the code_verifier isn’t supplied (for example, invalid_grant).

FRAAS-24042^[1]: Fixed an issue where Proxy Connect could be unintentionally deactivated.

FRAAS-24058^[1]: Increased max HTTP header size accepted by access management endpoints.

IAM-1504: User no longer needs to click the cancel button twice in some journey dialogs.

IAM-8111: Schedules can no longer be disabled when running.

18 Mar 2025

AME-27705: Extend the utils binding for all next-generation scripts to support low-level cryptographic operations. These operations include encryption, decryption, hashing, signing, verification, and key generation.

AME-28780: Added an IDM policy condition that can assert conditions against an IDM resource type such as user identities.

AME-28954: Modified the import metadata endpoint to support updating signing and encryption certificates for existing SAML service providers (SPs) without requiring the deletion or recreation of SP configurations.

AME-28954: Modified the import metadata endpoint to support updating signing and encryption certificates for existing SAML service providers (SPs) without requiring the deletion or recreation of SP configurations.

AME-29307: You can now use DER-encoded certificates for OAuth 2.0 client authentication.

AME-29810: The realm default authentication service can no longer be a journey with mustRun enabled. Also, mustRun can no longer be enabled on journeys that are set as the realm default authentication service.

AME-29835: Configuration Provider Node scripts can now use the next-generation scripting engine, which gives them access to common bindings such as openidm and httpClient.

AME-30076: New getApplicationId() method provides a consistent way to retrieve the application ID from both SAML and OAuth 2.0 applications.

IAM-7967^[2]: Added an image description for the approvals Low Priority icon.

OPENIDM-20139: Applications can now use postAction scripts for the ONBOARD action.

FRAAS-24020^[1]: Consolidated End User UI, Login UI, Administrator Registration UI, and Administrator UI status page components into a single Administrator UI component as they were all reporting the same service.

IAM-7229^[1]: Added none as a client authentication method when configuring an OIDC federation IdP.

IAM-8419^[1]: Added icons to all nodes in the journey editor. The icons are applied based on the node category, improving consistency and visual clarity in the editor.

SDKS-3774^[1]: Added script input configuration for the PingOne Verify Completion Decision node. This can be used to specify the node state required by a script within the node.

AME-29504: The scriptName and logger bindings in library scripts referenced the same default script name and ID. Their previous behavior has now been restored by inheriting values from the referencing script.

AME-29965: The Configuration Provider node now works with the Inner Tree Evaluator for nested inner journeys.

AME-30377: The following two warning level log messages have been reduced to debug level because they’re rarely useful and appear frequently, drowning out more useful log entries:

IAM-7719^[2]: Users are now redirected back to the compliance Policy Rules tab after creating or editing a policy rule.

IAM-7977: Improved the font color contrast ratio of the email address displayed in Advanced Identity Cloud admin console user profiles.

IAM-8053: The Advanced Identity Cloud end-user UI can now use defaultText value as a fallback value when the actual value of a field returns empty.

OPENAM-22120: Back-channel logout tokens now include the exp claim.

OPENAM-23077: The access_token endpoint now responds with the correct error code when the code_verifier isn’t supplied (for example, invalid_grant).

FRAAS-24042^[1]: Fixed an issue where Proxy Connect could be unintentionally deactivated.

FRAAS-24058^[1]: Increased max HTTP header size accepted by access management endpoints.

FRAAS-23002: Improvements to OATH support for MFA authenticators

IAM-4692: Managed identity boolean fields now use a checkbox instead of a toggle.

IAM-6581: SAML 2.0 application journeys can now be configured in the Advanced Identity Cloud admin console.

IAM-7248^[2]: In IGA sources, the displayName and logo can now be obtained from the CDN.

IAM-7874^[2]: The Governance > Requests > Settings tab now lets you activate or deactivate Governance LCM.

IAM-1262: Clicking the Toggle Sidebar button now collapses the sidebar.

IAM-5801: For applications that mandate a minimum page size, the page size selector on the Data tab and the Reconciliation Results tab has been removed.

IAM-5813: UI support for managing certificates was released on January 9, 2025 (Version 16100.4) but inadvertently excluded from the changelog.

FRAAS-24058 ^[1]: Increased the maximum HTTP header size accepted by access management endpoints.

18 Feb 2025

FRAAS-23002: Improvements to OATH support for MFA authenticators

IAM-4692: Managed identity boolean fields now use a checkbox instead of a toggle.

IAM-6581: SAML 2.0 application journeys can now be configured in the Advanced Identity Cloud admin console.

IAM-7248^[2]: In IGA sources, the displayName and logo can now be obtained from the CDN.

IAM-7874^[2]: The Governance > Requests > Settings tab now lets you activate or deactivate Governance LCM.

IAM-1262: Clicking the Toggle Sidebar button now collapses the sidebar.

IAM-5801: For applications that mandate a minimum page size, the page size selector on the Data tab and the Reconciliation Results tab has been removed.

FRAAS-23812: You can now deactivate the header ruleset after deactivating the IP ruleset when configuring Proxy Connect.

FRAAS-23375: You can now obtain the HTTP client location from the X-Client-City & X-Client-City-Lat-Long HTTP headers in Advanced Identity Cloud scripts and journeys.

IAM-6833 : Made existing synchronization tokens editable for incremental reconciliations.

IAM-7223^[2]: Added the ability to set user, role, organization, application, or entitlement objects to provide predefined values for select and multiselect fields in request forms.

IAM-7454: The inbound mapping for all application templates and scripted application templates has now been configured to make fewer connector requests.

FRAAS-23780^[7]: Optimized network utilization to distribute workloads more effectively.

IAM-5242: The Previous link in the New Script modal now always shows the previous step.

IAM-5482: Password policy no longer allows Password length to be set as an empty string.

IAM-7799: Identity attributes with Time and DateTime format now trigger change events only when a change occurs.

ANALYTICS-459: Report query data is now retained for 30 days for customers using OOTB reports and 90 days for customers with Advanced Reporting^[13].

ANALYTICS-495: Replace email with username in User Last Login report.

ANALYTICS-817^[6]: Report authors can now query on "Password Last Changed Time" for user entity.

ANALYTICS-818^[6]: Report authors can now query on "Password Expiration Time" for user entity.

AME-26050: You can now create Next-generation Policy Condition scripts that have access to all common bindings, such as openidm and httpClient. Additionally, some existing bindings have been wrapped to improve usability in scripts.

AME-28228: OAuth 2.0 audit logs now include the OAuth 2.0 client ID and any journey associated with the client.

AME-29009: When using the new FIDO Metadata Service, if you link to the FIDO metadata using a URL, Advanced Identity Cloud periodically downloads and updates the latest FIDO metadata based on the nextUpdate date specified in the downloaded data.

AME-29093: Added configuration for integration with WebAuthn Metadata Services (such as the FIDO Metadata Service). This includes a realm-level WebAuthn Metadata service and a new FIDO Certification Level configuration attribute in the WebAuthn Registration Node.

FRAAS-22321: You can now obtain the HTTP client location from the X-Client-Region HTTP header within your scripts and journeys. The X-Client-Region header contains the country (or region) associated with the client’s IP address in the form of a Unicode CLDR region code, such as US or FR. For most countries, these codes correspond directly to ISO-3166-2 codes.

FRAAS-23073: The SAML scripting adapter now lets scripts access org.forgerock.http.protocol.*.

IAM-3323: You can now use XPath transformation functions with additional Workday application template attributes.

IAM-4540: You can now change the border color of a selected input field in journey and end-user pages.

IAM-6397: The Advanced Identity Cloud admin console now lets you page through the list of OAuth 2.0 client profiles.

OPENAM-20314: Added the ability to indicate whether an OIDC provider doesn’t return a unique value for the sub claim.

OPENAM-22966: Social IDPs now support NONE as a client authentication method. This option should be used if the provider doesn’t require client authentication at the token endpoint.

OPENAM-23109: During a WebAuthn registration flow, if Store data in transient state is enabled, the Authenticator Attestation Global Unique Identifier (AAGUID) is now added to the node state under the webauthnData key.

OPENIDM-20542: Added a feature service named am/2fa/profiles to expose certain multi-factor attributes on alpha and bravo users.

ANALYTICS-474: The User Journey Stats report now provides aggregates by outcome in the report result when more than one outcome is selected.

ANALYTICS-837: The User Count by Status report now provides aggregates by status in the report result when more than one outcome is selected

ANALYTICS-585^[6]: Remove Report Admin and Report Owner group selection when creating a new report.

AME-28016: When an invalid redirect URI is provided to the /par endpoint, the URI mismatch error is now redirect_uri_mismatch instead of invalid_request.

AME-28017: Advanced Identity Cloud now accepts the requested OAuth 2.0 endpoint as a valid JWT audience claim, as per RFC 7519 and RFC 9126.

AME-28906: The stack trace of an authentication exception generated on login failure is now logged only when debug level logging is enabled.

AME-29170: On LDAP Decision node login failure, stack traces are now logged at debug level.

AME-29504: Fixed issue with script names not displaying in next-generation script logs.

AME-29965: The Configuration Provider node now works with the Inner Tree Evaluator node for nested inner journeys.

IAM-1782: Long gateway and agent IDs no longer overflow in the Advanced Identity Cloud admin console.

IAM-7523^[2]: A user receiving a forwarded fulfillment task now has permission to approve or reject the task.

IAM-7537^[2]: Governance functionality is now only shown for the alpha realm.

IAM-7689^[2]: The Advanced Identity Cloud admin console now displays the Assigned To value in the task list for a user assigned to a role who receives a forwarded fulfillment task.

OPENAM-18252: Journeys acting on multiple identities now successfully update universalId in the journey context during the authentication flow.

OPENDJ-9287: The password validation mechanism has been enhanced to include checks for portions of attribute values within passwords. This improvement ensures that even partial matches between portions of passwords and portions of attribute values are identified and restricted, thereby enhancing security.

AME-29769: The Social Provider Handler node has a new configuration option, Store Tokens, that allows access and refresh tokens to be stored in the transient state.

AME-27074: Added a new configProviderScript action to each authentication node endpoint to generate a configuration provider template script For example, authentication/authenticationtrees/nodes/MessageNode?_action=configProviderScript.

AME-28258: Added a new "webAuthnExtensions" input to the WebAuthn Registration and Authentication nodes. This can be set via a Scripted Decision node. It is expected to contain a map of extension name to input. Output is currently not available.

AME-28384: The outcome of a Scripted Decision node can now also be a CharSequence type.

AME-28777: The refresh token grace period now applies to both client-side refresh tokens and server-side refresh tokens.

AME-29157: Authentication nodes with limited possible outcomes are now available to the Configuration Provider node, including:

OPENAM-22601: You can now use the next-generation script binding, utils, to generate secure random numbers.

OPENAM-22811: NodeState has two new methods: mergeShared(Map<String, Object>) and mergeTransient(Map<String, Object>). Use them to merge keys into the shared/transient state, including objectAttributes keys.

OPENDJ-11012: Added support for Microsoft Identity Cloud PBKDF2-SHA512 password scheme in Advanced Identity Cloud.

AME-25491: The Configuration Provider node script now correctly reads node state after an inner tree callback.

AME-28786: Removed several unused UI properties from default social identity provider profiles.

AME-29027: WebAuthN attestations containing a self-signed root CA are now rejected instead of silently removed.

OPENAM-22465: Fixed error to return invalid_resource_uri when request_uri client doesn’t match request parameter client in PAR authorize request.

OPENAM-22675: In next-generation scripting, you can now set a default name correctly when creating a NameCallback.

OPENAM-22688: Page node localization now defaults to correct locale when the incoming accepted-language header doesn’t match the node’s language configuration.

IAM-6388: Added the ability to specify that inner journeys can’t be accessed directly. Learn more in Custom journeys.

IAM-7185: The mapping tab for application provisioning now shows the inbound or outbound application type without needing to inspect a drop-down.

OPENIDM-19810^[1]: The _refProperties of the last relationship field leading to a vertex, whose state is harvested to constitute the RDVP state, can now be included in this RDVP state.

OPENIDM-19847^[1]: The accountType for application grants is now configured in the object mapping under "accountTypes".

OPENIDM-20371^[1]: IDM now allows up to 20 indexed string attributes per user in both Alpha and Bravo realms.

OPENIDM-20372^[1]: IDM now supports up to ten custom relationships per managed object, except for one-to-many relationships.

IAM-7415: When creating an assignment, the _id is now automatically generated instead of using the name specified.

IAM-7187: Integration of SAP app template with IDM scripts.

IAM-7243^[2]: Added text field to utilities category in IGA access request forms.

IAM-7385: Unable to create user when required boolean property is set to false.

FRAAS-21728: Updated the cookie domain API to add default values for GET requests where cookie domain values haven’t been overridden by a PUT request. The default values are derived from the existing tenant cookie domain configuration, so are backward compatible.

AME-26594: Added secrets API binding to all next-generation script contexts.

AME-27129: Added option to exclude client certificate from SAML hosted SP metadata.

AME-27792: Added AM-TREE-LOGIN-COMPLETED audit log event that outputs a result of FAILED.

AME-27839: Added the ability to specify connection and response timeouts for Http Client service instances.

AME-28008: You can now disable certificate revocation checks, or all certificate checks entirely, on your Http Client service instances.

IAM-4753: Added a toggle to the application catalog to hide deprecated templates.

OPENIDM-19698: Added ability to use wildcards in the watchedFields property.

OPENAM-22666: The well-known endpoint is no longer required when configuring a social identity provider service. If it is not provided, AM uses the client secret for signature verification.

SDKS-1752^[1]: Enhance WebAuthn Authentication node, OATH Token Verifier node, and Push Result Verifier node to store creation date and last sign-on date.

FRAAS-16228: Promotions are now halted if the AM CORS service is disabled; the service is essential to the correct functioning of promotions.

FRAAS-21715: Environments can now be unlocked if configuration rollback fails because there are no promotions to roll back.

OPENAM-15410: Fixed an issue that prevented customization of claims if profile and openid scopes are requested.

OPENAM-20609: Fixed inconsistent error message when generating access token using refresh token after changing username.

OPENAM-21974: Adds an OAuth 2.0 client configuration for the new version of the LinkedIn provider.

OPENAM-22298: Log unretrieved SP and IdP descriptors in SAML2 Authentication node.

OPENIDM-19336: Fixed an issue where delegated administrators couldn’t add new users to their organization.

OPENIDM-20238: Fixed an issue where clustered reconciliation can fail with "Expecting a Map or List" under specific circumstances.

IAM-6493: The PingOne application template now supports specifying an LDAP gateway.

IAM-6868: Added screen reader label to end-user access approval button.

IAM-6870: Added screen reader label to end-user access request button.

IAM-6880: Added a toggle in the hosted pages journey settings to disable the error heading fallback that displays if there is no heading in the page content. (FORGEROCK-1582)

FRAAS-21713: The promotion process now retries getting an access token from the lower environment, preventing promotion failures.

IAM-7033: Unable to save user filter in AD/LDAP app template.

IAM-7011: Older app templates are no longer marked "deprecated".

IAM-5233: Update SAP SuccessFactors app template to support connector version 1.5.20.22.

IAM-6874: Update journey analytics to use hourly data.

FRAAS-21318: Promotion report now categorizes AM session service changes correctly.

AME-26135^[1]: The Advanced Identity Cloud admin console now lets you configure a secret from a secret store for these features:

IAM-4279: Display available ESV placeholders in Decision Node script editor.

IAM-4654: Enable creation of all script types in Advanced Identity Cloud admin console.

FRAAS-20397: The promotion process now retries tagging the lower environment after a network interruption, preventing blocking promotion failures.

IAM-5356: Session logout warning not displaying when maximum idle time set to a higher value than maximum session time.

IAM-6628: New draft option shouldn’t exist for out-of-the-box workflows.

IAM-6779: Pagination for list of apps not working when there are over 4000 apps.

FRAAS-20970: The /monitoring/logs endpoint now returns an X-Ratelimit-Limit header with a fixed value of 60. Previously, the value was misleading due to the way it was calculated when scaling an environment’s resources. The X-Ratelimit-Remaining header continues to report the number of requests that may be sent before receiving a rate limited response.

FRAAS-20983: Promotion reports now list changes to the default OAuth 2.0 provider.

OPENIDM-20142: Resolved a communication failure between Advanced Identity Cloud and RCS instances that could result in a prolonged failure to activate remote connectors.

OPENIDM-20178: You can’t use scope private fields in query filters. For more information, refer to Security Advisory #202402.

IAM-4785: Synchronize only the modified properties on a target source during reconciliation of applications.

IAM-5487: Correlation rules moved to the top of the reconciliation settings page.

IAM-6231: Scripted Decision Node now updates the list of scripts when a script is added or edited.

IAM-6544: Add reviewer column to administrator list view of compliance violations.

FRAAS-20604: Removed superfluous AM metrics related to token store internals:

IAM-6135: ESV values containing accents get corrupted by encoding process.

IAM-6562: Label duplicated for OAuth 2.0 access token and ID token endpoints.

IAM-6669^[2]: Badge count of violations in end-user navigation doesn’t update when an action is performed.

OPENIDM-18495^[7]: Disable sorting in the connector data tab in the IDM native admin console. (FORGEROCK-1582)

AME-26199: Added the ability to set additional claims, including non-registered claims, during JWT assertion and generation, as per the specification.

AME-26820: Provided library scripts with access to all common script bindings.

AME-26993: Enhanced secret mapping for agents. Updating a secret label identifier value now causes any corresponding secret mapping for the previous identifier to also be updated, provided no other agent shares that secret mapping. If another agent shares the secret mapping, Advanced Identity Cloud creates a new secret mapping for the updated identifier and copies its aliases from the previously shared secret mapping.

AME-27346: Renamed Secret ID Identifier to Secret Label Identifier in the SAML remote entity provider configuration.

AME-27478: Renamed Client ID Token Public Encryption Key property to ID Token Encryption Public Key in the OAuth 2.0 client configuration.

AME-27775: Added scripting thread pool metrics per script context.

OPENAM-16564: Enabled next-generation scripts to access the cookies in incoming requests.

OPENAM-21800: Added page node functionality to next-generation scripts.

OPENAM-21933: Enabled auto-encoding of the httpClient form body in next-generation scripts.

FRAAS-20786: Fixed the case where a promotion attempts to delete the same application more than once.

FRAAS-19461: Fixed an issue where large audit logs could be missing from IGA events and processing.

FRAAS-20154: ESVs with special characters are now correctly encoded. The workaround of double-encoding ESVs is no longer required.

OPENAM-21748: Restored the missing get wrapper function for HiddenValueCallback in next-generation scripting.

OPENAM-21830^[1]: Unable to get entitlement info hashmap values in SAML IdPAdapter script

OPENAM-21864: Fixed an issue that prevented setting the tracking cookie to resume a journey after returning from a redirect flow.

OPENAM-21897: Corrected inconsistent results from the policy evaluateTree endpoint.

OPENAM-21951: Enabled setting of the selectedIndex property in a ChoiceCallback in next-generation scripts.

OPENAM-22181: Corrected an issue with UMA approve and approveAll requests failing.

TNTP-166:

FRAAS-15404: When updating ESV secrets, the API saves a new secret version only when it differs from the previous value.

FRAAS-19982: Configuration promotion now fails if Advanced Identity Cloud services do not restart successfully with the new configuration.

IAM-6376: In the applications rules tab, you can now configure custom logic to perform specific actions, such as sending an email, when an account is successfully created or updated.

IAM-6380: In the applications rules tab, you can now use the provisioning failure rule to configure custom logic to perform specific actions when provisioning fails.

FRAAS-11180: Authentication session whitelisting is now enabled by default for new tenants

IAM-5593: Adding roles to certain objects no longer breaks readable titles

IAM-6537: Journey import now alerts users if they try to import a file containing missing references

IAM-6548^[1]: Advanced Identity Cloud admin console now loads Identity Gateway profile properties

IAM-2653: Configure object properties with user-friendly display names.

IAM-3857: Application list view displays enabled/disabled status of enterprise apps.

IAM-5913^[2]: Create custom access request workflows.

IAM-6264: Approval actions display in the UI even when they are not available due to permissions.

IAM-6296: UI doesn’t display paginated results on application data and recon tabs.

IAM-6409: Logging out of UI generates malformed redirect realm URLs.

OPENAM-21575: Add org.forgerock.json.jose.jwe.JweHeader to the allowlist for the Scripted Decision node

IAM-3199: HTML styling in the Message node journey editor allows you to left justify text.

FRAAS-19334: Failure to look up service account names following changes applied through the ESV API.

IAM-5079^[2]: End-user roles page sometimes shows role grants as conditional even when the grants are direct.

IAM-5363^[2]: Show the total number of approvals and access reviews in the inbox.

IAM-5858^[2]: Missing support for access request global configuration options.

IAM-6138^[2]: The governance events filter builder incorrectly validates before and after properties in the user created state.

IAM-6176^[2]: The end-user access request rejection is missing a justification message.

IAM-6203^[2]: The governance events filter doesn’t use after temporal values for user created flows.

IAM-6209: The Advanced Identity Cloud admin console navigation panel text appears when the panel is collapsed.

OPENIDM-19879: Identity management reconciliation service processes additional source query pages whenever a query returns a pagedResultsCookie.

OPENIDM-19924: Unnecessary quotes not being removed from email addresses.

TNTP-166:

FRAAS-19593: The promotion API incorrectly reports as ready, resulting in a blocking promotion failure when trying to promote (FORGEROCK-1319)

AME-26085: SAML 2.0 NameID mapping can be configured per SP

AME-27126: A SAML SP can now authenticate to IDPs using mutual TLS (mTLS) when making an artifact resolution request.

AME-27133: "Secret ID" has been renamed to "Secret Label" for secret mappings

The following services now support configuration using the Secrets API:

The following services now support rotation of secrets using secret versions:

OPENAM-21031: The performance of Google KMS has been improved by the introduction of caching.

FRAAS-19596: Promotion report should include changes to realm authentication settings.

OPENAM-21473: If you set the collection method of a Certificate Collector node to REQUEST, HEADER, or EITHER, and the certificate is not provided in the request or in the header, the node now returns a status of Not collected.

OPENIDM-19921: The following connectors included with Advanced Identity Cloud were upgraded to 1.5.20.21:

FRAAS-19414: You can now configure custom domains directly in all environments without needing to create ESVs or promote configurations. Existing custom domains will be migrated automatically.

FRAAS-19566: Add _sortKeys query parameter to ESV API

IAM-4585^[2]: Request and approvals page now shows the current and past approvers, their decisions, and the dates

IAM-4968: Expose additional top-level parameters in the advanced section of mapping pages

IAM-5674: Target application can use ONBOARD action for FOUND situation

IAM-5769: Add grouping logic to journey node items

IAM-3927^[2]: Identity Governance now enforces mandatory comments (if configured) for revoke and allow exceptions

IAM-4309^[2]: Access reviews no longer display the internal lastSync user attribute

IAM-4762: Authoritative apps are now requestable

IAM-4986: Platform UI can now determine whether to use a pagedResultsCookie or offset for paging results

IAM-5076^[2]: "Abstain from action" option no longer displays when a campaign has expired

IAM-5362: Marking a property as an authoritative app entitlement no longer causes target app config to be generated

IAM-5413: Account deprovisioning now works in AD/LDAP after deleting a user identity

IAM-5794: Border color of sign-in input fields in hosted pages can now be overridden in themes

IAM-5810: Add option for email configuration to specify UTF-8 address support

IAM-5814: Allow fixed application usernames to be chosen for custom SAML apps

IAM-5875: Journey editor no longer orphans deleted nodes

FRAAS-19341: ESV support for AES keys through the base64aes encoding type

IAM-5602: Add functionality for viewing and deleting user’s trusted devices in Advanced Identity Cloud admin console

FRAAS-15371: Added ability to prevent search engines from indexing end user login pages

IAM-4257: Updated Azure AD app template to accommodate the latest changes

IAM-4342: Updated MSGraphAPI Connector with a new configuration property

IAM-4892: Updated Salesforce app template to accommodate the latest changes

IAM-4900: Added build number and next release cycle date range to user interface

IAM-5334: Exposed guarded string as an object type property in scripted template

IAM-5459: KBA answer field should contain question context

IAM-5461: Custom login error not read with priority

IAM-5503: Rename "Orchestrations" to "Workflows"

IAM-5563: Updated Google Apps app template to accommodate the latest changes

IAM-5603: Added ability to view device details for managed user identities

IAM-5606: Added "POWERED BY" metadata to journey nodes

IAM-5748: Made 'PingOne' a special case on the federation providers page

IAM-4918: Check that user has correct permissions when requesting access for other users

IAM-5287: Make username, password, and KBA fields H3 elements

IAM-5598: Prevent styled terms and conditions included in a journey from making authenticate call fail

IAM-5611: Correct ability to revoke custom apps from roles, or edit them from the role view

IAM-5641: Custom Endpoints search returned endpoints created by other areas of the UI

IAM-5692: Remove console errors when opening the "Add Bravo user" modal

IAM-5767: SAML SSO was not remembered when app is saved from another tab after SSO setup

IAM-5873: Fix .getTranslation call in Vue

OPENIDM-19405: Special non-ascii characters in emails sent from Advanced Identity Cloud would fail

FRAAS-19288: Autonomous Access and Identity Governance are now available in the Jakarta (asia-southeast2) region

FRAAS-18788: Add AWS, GCP, and SAP S/4HANA connectors to Advanced Identity Cloud

FRAAS-18693: Validation bug prevents use of the base64encodedinlined and keyvaluelist ESV expression types

FRAAS-18414: Changes to an out-of-the-box journey can be incorrectly displayed against both realms in a promotion report

OPENIDM-17878: Allow access to operational attributes in the Advanced Identity Cloud data store

OPENIDM-19674: The relationship-defined virtual property (RDVP) schema editor allows you to edit the flattenProperties property. The anaged object schema editor allows you to edit the notifyRelationships property.

FRAAS-18398: Allow the HTTP OPTIONS method on calls to /openidm/config/* endpoints for CORS preflight checks

FRAAS-18526: Script library functionality can’t be used in the UI in certain environments

IAM-5656: Fix alignment of text, buttons, and links in Message nodes

IAM-5660: Hosted pages not displaying list of themes

OPENIDM-18743: Attempts to use connectors fail with null pointer exceptions when operationOptions is defined in the provisioner configuration

OPENIDM-18957: The scheduler now attempts to release any triggers it attempted to acquire during a timeout due to an unresponsive repository

OPENIDM-19141: Workflow engine queries now properly honor tablePrefix and tablePrefixIsSchema configuration options

OPENIDM-19279: Resource collection is required to create a relationship

FRAAS-7382: Add ability to include JavaScript snippets in login and end-user UIs

IAM-4514^[2]: Allow reviewers to add user, entitlement, and role columns to an access review

IAM-4739: Add read schema option to SCIM application template to discover custom schemas/attributes

IAM-5138^[1]: Add ability to view reports to end-user UI

IAM-5201: Focus on first input field or button automatically upon page load

IAM-5268: Add source-missing situation rule to authoritative applications

IAM-4810: Custom endpoint UI missing context option

IAM-5072: Inbound mapping tab shows in target applications

IAM-5171: Azure Active Directory application template doesn’t return a user’s role membership

IAM-5187: LDAP v2.1 application template doesn’t clear dc=example,dc=com base DN

IAM-5238: LDAP application template is missing the group object classes property

IAM-5422^[2]: Entitlement owner doesn’t show in the entitlement list

OPENAM-21856: Introspecting stateless token with IG/Web agents will cause OAuth2ChfException

AME-22326: The httpClient available in scripts now automatically adds the current transactionId as an HTTP header. This lets you correlate caller and receiver logs to make requests to other ForgeRock products and services.

AME-25392: Add org.forgerock.openam.scripting.api.PrefixedScriptPropertyResolver, used for accessing ESVs from scripts, to the allowlist for SAML2_SP_ADAPTER and SAML2_IDP_ADAPTER script types

AME-25433: Add com.sun.crypto.provider.PBKDF2KeyImpl, javax.crypto.SecretKeyFactory, and javax.crypto.spec.PBEKeySpec to the allowlists for Scripted Decision nodes and Configuration Provider nodes

AME-25608: Add auditing for opening and closing connections for the LDAP decision node, ID Repo service, and Policy Configuration service

AME-25630: Add java.security.spec.InvalidKeySpecException to the allowlist for the Scripted Decision and Configuration Provider nodes

FRAAS-17939: Some connectors included with Advanced Identity Cloud were upgraded to the following versions:

IAM-4511: Hide fields in the Users & Roles tab when editing and creating unreadable properties

IAM-4615: Add a "Skip to main content" link to page headers

OPENAM-16897: The OAuth 2.0 Device grant flow can now return either JSON or HTML

OPENIDM-19037: Update property value substitution to reflect boolean value in the UI

COMMONS-1397: Audit event log entries not logged due to thread contention

FRAAS-17686: Add org.forgerock.json.jose.jwe.JweHeader to the allowlists for the AUTHENTICATION_TREE_DECISION_NODE and CONFIG_PROVIDER_NODE script types

IAM-4401: Disabling Clear-Site-Data header breaks realm login

IAM-4991: When a suspendedId is in use, redirect to failureUrl fails

IAM-5075: Login messages are read twice by screen readers

IAM-5186: User identity related values aren’t saved after removal

OPENAM-17331: Disabled SNS endpoints can now be re-enabled

OPENAM-17816: OAuth 2.0 requests without a Content-Type header fail with a 500 error

OPENAM-19282: Recovery Code Display node only works immediately after a registration node

OPENAM-19889: Policy evaluation fails when subject is agent access token JWT

OPENAM-20026: Social IDP with trailing whitespace in the name can’t be deleted using the UI

OPENAM-20329: Issuer missing from OAuth 2.0 JARM response

OPENAM-21053: Missing userId from access audit log when org.forgerock.security.oauth2.enforce.sub.claim.uniqueness=false in JWT client authentication flow

OPENAM-21421: Scripting logger name isn’t based on logging hierarchy convention

OPENAM-21476: Persistent cookie is not created when using Configuration Provider node

OPENAM-21484: Introspection of a stateful refresh token for claims field for known OAuth2 fields is now a string and not nested in a list

OPENIDM-19328: Fix queued sync to recover following node restart

IAM-5275: Advanced Identity Cloud admin console doesn’t add query parameters to the logout URL

IAM-5289: Fix warning message when maxidletime is greater than 24.8 days

FRAAS-3841: Activate and deactivate journeys in the Advanced Identity Cloud admin console. Refer to Deactivate journeys.

IAM-4191: Allow tenant session cookie name to be configured. Refer to Session cookie name.

IAM-4735: Add support for schema discovery in application templates

IAM-4806: Show outbound tenant IP addresses in Advanced Identity Cloud admin console. Refer to Access global settings.

IAM-4853: Add AS400 application template. Refer to the AS400 section in Provision an application.

FRAAS-16785: Incorrect positioning of reCAPTCHA v2 elements

FRAAS-17883: Tenant administrators cannot save edits to their personal information

IAM-2936: Journeys hang indefinitely when using a State Metadata node within a Page node

IAM-4521: Screen readers announce field labels twice

IAM-4956: Advanced Identity Cloud admin console doesn’t use the current realm when logging out

IAM-5113: Unable to remove an NAO assignment from a user in Advanced Identity Cloud admin console

IAM-5226: Tenant administrator security questions should not be shown when editing personal information

IAM-5240: No error message displays when a tenant administrator fails to save edits to their personal information

FRAAS-17373^[18]: The following connectors included with Advanced Identity Cloud were upgraded from 1.5.20.15 to 1.5.20.17:

IAM-4211: Display disaster recovery region in the Advanced Identity Cloud admin console

IAM-4369: Remove AM applications from application list view

IAM-5045: Display pop-up warning when an end user is about to be logged out of an Advanced Identity Cloud hosted page

ANALYTICS-311: The USER-LAST-LOGIN report doesn’t show results if the last journey failed

FRAAS-17413: Improve IDM service reliability during upgrades and routine maintenance

IAM-4698: Fix accessibility issues with messages in page nodes

IAM-4812: Correctly save array ESVs containing newline characters

IAM-4863: Display ESV buttons properly when the user gives them focus

IAM-4877: Display ESV selection button properly while user is modifying a script associated with a Scripted Decision node

IAM-3648: ESV placeholders can now be entered from a drop-down list

IAM-3651: ESV placeholders can now be entered from key-value input fields

IAM-4236: Improve layout of the applications reconciliation tab

IAM-4367: Separate the connection status of OAuth 2.0 client applications into a dedicated list

IAM-4662: ESV placeholders can now be entered from tag input fields

IAM-4717: Added date, datetime, and time fields to the login UI

IAM-4789: Grant roles now show temporal constraints

OPENAM-20847: Sanitized HTML can now be added into messages for the Email Suspend node

FRAAS-17235: Validate ESV values correctly when they are wrapped in white space

FRAAS-17283: Tenant status pages not automatically updated during downtime

IAM-4235: Passthrough authentication using AD connector fails if set up in UI and user DN includes a space

IAM-4418: Fix accessibility issues with multi-select input fields

IAM-4489: Align checkbox color with other form elements

IAM-4491: Correctly label sidebar buttons when expanded or collapsed

IAM-4492: Make navigation bars in end-user UI accessible for screen readers

IAM-4528: Outbound reconciliation mapping preview shows generated password value

IAM-4798: The aria-label is now correctly displayed for all component types on sidebar buttons

OPENIDM-19192: Personal information is still editable by end users when User Editable is set to false

IAM-3650: Add a drop-down menu to checkbox inputs for selecting ESV placeholders

IAM-3826: Add the ability to specify a source and transformation script when mapping application properties.

IAM-4515: Include autocomplete attribute with login form fields

IAM-4525: Update profile picture modal with accessibility improvements for screen readers

IAM-4567: Add a warning when running reconciliations and selecting the persistAssociations option. For details, refer to View a report about the last reconciliation.

IAM-4576: Increase time on screen for loading spinner so that screen readers can announce it

IAM-4616: Include contextual information with the show/hide buttons for improved accessibility

OPENAM-21073: Request headers are now accessible in OAuth 2.0/OIDC scripts for OIDC_CLAIMS, OAUTH2_ACCESS_TOKEN_MODIFICATION, and OAUTH2_MAY_ACT script contexts using the requestProperties binding

OPENAM-21346: Add classes java.util.concurrent.TimeUnit, java.util.concurrent.ExecutionException, and java.util.concurrent.TimeoutException to the scripting allowlist

OPENAM-21355: Jakarta AWS region (ap-southeast-3) enabled for the PingAM push notification service

OPENAM-21416: Canada Central AWS region (ca-central-1) enabled for the PingAM push notification service

IAM-4366: Provide browser-specific logic to handle alternative CSS for accessibility

IAM-4409: Require at least three characters before running identity searches when there are more than 1000 identities of that type

IAM-4460: Screen readers read show/hide buttons for security questions as show/hide password

IAM-4478: Only allow certain combinations of properties in a mapping transformation script

IAM-4493: Fix the heading hierarchy in the UI

IAM-4523: Screen readers read avatar alt text when tabbing to action menu

IAM-4524: Two buttons with different labels open the same dialog

IAM-4568: Do not enable the option to change a user association in the UI

IAM-4584: Drop-down boxes fail ADA compliance

IAM-4639: String/password field button is highlighted in the UI

IAM-4703: Fix display of password fields in some themes

IAM-4710: Fix rounded border of password fields in hosted pages

IAM-4829: Eye icon displays over the password field highlight box in the UI

OPENAM-18599: Allow customization of the error message that displays to end users when their account is locked or inactive using .withErrorMessage() in a Scripted Decision node

OPENAM-18685: Use the OAuth2 Provider service in the AM native admin console to specify if tokens issued should contain the subname claim

OPENAM-19261: Errors are incorrectly logged when triggered by introspection of tokens using OAuth 2.0 client credentials grant

OPENAM-20451: The WebAuthn Registration node now displays an end user’s userName when registering a device when the identity’s name isn’t human-readable

OPENAM-21158: Add support for trusted platform module (TPM) attestation using elliptic curve cryptography (ECC) unique parameter validation starting with Windows 11 version 22H2

OPENAM-21304: The request_uris field does not populate when OAuth 2.0 clients register using dynamic client registration

AME-25061: Provide additional context information in Marketplace authentication nodes to enable UI improvements

IAM-3502: Add the ability to set and reset a sync token for identity management account object type. For details, refer to Reset the last reconciliation job.

IAM-3678: Update error messages and labels in login and signup pages

IAM-3962: Improve design of push number challenge page for Push Wait node

IAM-4248: Add three additional non-account objects to ServiceNow page

IAM-4326: Improve onLink script to handle mapped properties of type array and object

IAM-4334: Update SuccessFactors application templates to support Advanced Identity Cloud built-in SuccessFactors connector

IAM-3877: UI loader spins indefinitely when realm is deactivated

IAM-4093: Replace Google Fonts in the login UI to meet GDPR compliancy requirements

IAM-4176: Advanced setting query filter does not show all available properties

IAM-4240: Accessibility issues in Page node when NVDA readers are used

IAM-4261: Accessing end-user UI with query parameter "code" displays empty page

IAM-4371: Unable to create applications due to userpassword property set

IAM-4384: Platform UI does not resume journeys with custom redirect logic

IAM-4427: Platform UI does not show assignments for tenants running deprecated application management

IAM-4475: Platform UI does not load after tenant administrator signs into an upper tenant during promotion

IAM-4533: Journeys do not resume correctly when returning from a social identity provider without a realm identifier

IAM-4534: Redirect callbacks for journeys not working correctly

OPENAM-18004: Audit logging does not specify transaction IDs correctly for internal requests to certain APIs

OPENAM-18709: Calls to the nodeState.get() method in Scripted Decision nodes do not return values in shared state when a variable is stored in both shared state and secure state

OPENAM-20230: Calls to classes in the allowlist fail occasionally with access prohibited messages

OPENAM-20682: Unable to encrypt id_token error when there are multiple JWKs with the same key ID but different encryption algorithms

OPENAM-20691: Session quota reached when oldest session is not destroyed due to race condition

OPENAM-20783: Logging is incorrect when the authorization code grant flow is used successfully

OPENAM-20920: Null pointer exceptions when a SAML 2.0 binding is null and the SSO endpoint list contains non-SAML 2.0 entries

OPENAM-20953: Policy evaluation with a subject type JwtClaim returns HTTP response code 500

OPENAM-21001: Custom scripted SAML 2.0 IDP account mappers are determined incorrectly

OPENAM-21004: Invalid session ID error when session management is disabled in an OIDC provider

OPENAM-21046: The Create Object and Patch Object nodes do not log exception stack traces when they can’t retrieve the object schema

OPENAM-21164: XML string formatted incorrectly when using a custom adapter to get the assertion from a SAML 2.0 response

FRAAS-16471: ESV variables and secrets API endpoints slow for large result sets

FRAAS-16271: ESV secrets could be incorrectly marked as "not loaded" when tenant has many ESVs

OPENIDM-19245^[1]: Fix IDM version qualifier to prevent ForgeRock REST proxy error

FRAAS-15974: Unable to promote empty configuration to reset staging environment

FRAAS-16041: Support Basic Authentication for Identity Cloud logging endpoints

OPENIDM-19240^[1]: Fix the "internal server error" message when configuring reconciliation mappings

IAM-2826: Filter the "Assignments" tab for identities so that it does not show overrides, entitlements, or resources

IAM-3408: Let provisioners use a range of connector versions

IAM-3677: Remove increment/decrement arrows from numeric input fields

IAM-3678^[1]: Improved ADA accessibility for error messages associated with input fields

IAM-3982: Let users filter risk activity using distributed attack as a risk reason

IAM-3983: Show distributed attack as a risk reason in the risk dashboard

IAM-4051: Improved ADA accessibility for drop-down boxes

IAM-4053: Improved ADA accessibility when NVDA readers are used on pages that use the Page node

IAM-4074: Add a loading animation to the pie chart component

IAM-4136: Use the tab key to move focus and remove tags in multi-select components

FRAAS-5756^[1]: Journeys don’t resume after authentication in downstream identity provider

FRAAS-9230: Sanitize aria-hidden fields

FRAAS-14214: Changing an existing ESV type is now denied by the API and new ESVs always require an explicit type

FRAAS-14262: Include changes to group privileges in the configuration promotions report

FRAAS-14706: Improve the detection of changes to complex configuration files and IDM script hooks in promotion reports

FRAAS-14897: Improve the rate limiting behavior of the /monitoring/logs endpoint

IAM-2026: Support versioning of the application and connector templates

IAM-2713: Prohibit editing of managed application objects

IAM-2972: Route users to the correct realm after granting Salesforce permissions

IAM-3089: Unable to exit a social provider and select a different social provider in a journey

IAM-3594: Correctly redirect control to the End User UI after authenticating with itsme

IAM-3719: Modals not showing display access review comments and activity

IAM-3939: Let end users switch to a different authentication journey

IAM-4013: When using a custom domain, originalLoginRealm is set incorrectly

IAM-4116: Don’t let access review users add reviewers with greater privileges than they themselves have

IAM-4134: User pop-up is visible in "Entitlement" tab

IAM-4200: Last certified date, decision, and actor displaying incorrectly in Governance account details

IAM-4242: Add "Conflicting changes" category to reconciliation summary

IAM-4289: Unable to assign non-account object properties to roles

IAM-4293: Access reviews and line items not shown for staged campaigns

IAM-4295: Reviewer not redirected back to pending reviews after access review sign off

OPENIDM-17481: Managed object schema can now describe a field as a nullable array and specify a default value for this field if not provided in a create request

OPENIDM-17771: Processing of a large number of scheduled jobs no longer causes all scheduled tasks to continuously misfire

OPENIDM-18192: Updating a relationship-defined virtual property (RDVP) on a managed object by signal receipt no longer causes other RDVP state within that object to be lost

OPENIDM-18292^[1]: Add support for the _fields request parameter to the sync getTargetPreview endpoint.

OPENIDM-18360: Use the full object state when validating requests made by a delegated administrator to modify a relationship

OPENIDM-18613: Provide the ability to remove the userPassword attribute

OPENIDM-18644: Correctly determine whether it’s possible to configure clustered reconciliation

OPENIDM-18807^[1]: Update user provisioning workflow sample to check for empty manager strings

OPENIDM-18895: Fixes support for multi-version concurrency control on managed object patches and updates

OPENIDM-18898^[1]: Add support for the _countOnly parameter in identity management scripts

OPENIDM-18980^[1]: Add a new metric to measure the duration of a LiveSync event

OPENIDM-19098^[1]: Enable ES6 support for identity management scripts

AME-24073: Expose the prompt_values_supported parameter of the provider configuration at the OIDC .well-known endpoint

AME-24175: Provide additional classes in the allowlist that scripts used in the Scripted Decision node

FRAAS-13293: Provide more accurate and granular information in promotion reports

FRAAS-14063: Remove orphaned unused scripts during promotion

FRAAS-15022: Improve promotion reports

IAM-2561: Allow adding applications to a user or role from the Identities > Manage page

IAM-3666: Add alternative text to QR code image

IAM-3676: Add keyboard controls to UI to select multiple values in multivalued lists

IAM-4030: Improve handling of identity provider and groups claims

IAM-4031: Generic OIDC configuration returns HTTP 400 Bad Request

OPENAM-18692: Set the minimum value for the Default Max Age property to 0

OPENAM-19745: Add support for EdDSA signing algorithm to WebAuthn Registration node

OPENAM-20541: Add additional inner classes to scripting allowlist to support RSA key pair generation

AME-24026: Allow specifying inputs required by the provider scripts in the Configuration Provider node

IAM-3550: When attempting to validate Office 365 applications, a blank screen appears

IAM-3580: Improve service accounts UI including error handling

IAM-4032: Federation enforcement is missing from the UI

FRAAS-10816: Include thread ID and remove control characters from some Identity Cloud log files for easier log correlation

FRAAS-14956: Promotion preview and report not showing all configuration changes

FRAAS-15188: Ensure environments can be recreated after deletion

OPENAM-12030: Authentication node instances are deleted when journeys containing them are deleted

OPENAM-13329: Display journeys with spaces in their name in the Authentication Configuration drop-down menu

OPENAM-13766: Route user session based on whether policy evaluation is requested or not

OPENAM-17179: Correctly delete a script if its referring journey is deleted

OPENAM-17566: Display account name instead of UUID in the ForgeRock Authenticator when using MFA

OPENAM-18488: Support certificate-based attestation in certificate chains terminating at an intermediate CA

OPENAM-20082: Show correct error message to locked out users

OPENAM-20104: Fix the fragment response mode for the OAuth 2.0 authorize endpoint

OPENAM-20187: Fix the "waiting for response" page so that it fails authentication as configured in the authentication journey

OPENAM-20230: Prevent class allowlist from failing for classes already on the allowlist

OPENAM-20318: Allow a restricted set of HTML tags to be rendered in page node headers and descriptions

OPENAM-20360: Fix default URL encoding to ensure ampersand characters are not double encoded in a SAML assertion

OPENAM-20386: Fix authentication node state reconciliation in some complex journeys

OPENAM-20451: Fix WebAuthn registration node to return a human-readable username

OPENAM-20457: Device Location Match node routes to "Unknown Device" outcome instead of failing the authentication journey when the previously stored location of the device is not provided

OPENAM-20479: Enhance OIDC authentication to handle unsecured JWS requests