Regular channel changelog

OPENAM-27493^[1]: You can now configure OAuth2 Provider settings, including scripted JWT issuers, in the Advanced Identity Cloud admin console under Authorization > OAuth2 Provider.

OPENAM-26180: Fixed an issue where ETag assertion was causing noisy CTS session assertion failures.

OPENAM-27975: Fixed redirect failures caused by long OAuth 2.0 authorization request URLs. Same-server redirect URLs now support up to 8192 characters. Cross-origin redirect URLs remain limited to 2000 characters.

OPENAM-28931: Fixed an issue where OAuth 2.0 authorization requests using Pushed Authorization Requests (PAR) could fail with an HTTP 400 error after a user successfully authenticated.

AME-33978: The Enable Connection via Credential toggle for the PingOne Worker service now automatically enables or disables the relevant connection fields based on your selection.

AME-35088: You can now use a new validate action on the secrets endpoint to validate whether a secret mapping resolves to a valid secret in the configured secret store.

FRAAS-33591: The promotions API now returns report metadata ordered by creation date, with the most recent first.

IAM-3954, IAM-10782: Improved accessibility of numeric input fields and list fields throughout the admin console.

IAM-10610: You can now mark parameters in custom reports as optional, giving you more flexibility when running reports.

IAM-10764: Journey annotation notes now display multi-line formatting in view mode, matching how they appear when editing.

IAM-10917: The deferred release environment message displayed in a modal during promotions now uses clearer language and explains that updating your production release version during promotion is standard practice.

IGA-4435^[3][1]: Added an Object Types tab to the unmanaged application edit view, enabling administrators to define, manage, and reorder object type properties and import schemas.

IGA-4453^[3][1]: Added an Activity tab to the account detail view, giving administrators visibility into activity history for individual accounts.

IGA-4461^[3][1]: Improved the My Requests list view to display approval status, fulfillment status, and errors for each request.

IGA-4510^[3][1]: Improved the approval task view to display the name of the approver when the task was assigned to a role and has been completed.

OPENAM-26326, OPENAM-26452^[4]: A new realm-level OAuth2 Provider setting, Enable Rich Authorization Requests with RCS, lets Advanced Identity Cloud process authorization_details requests when an RCS is configured. This setting also controls whether authorization_details_types_supported is advertised on Advanced Identity Cloud’s well-known endpoint.

OPENAM-26458^[4]: You can now configure Authorization Detail Type(s) on individual OAuth 2.0 clients to control which authorization detail types, as defined in RFC 9396 Rich Authorization Requests, each client can request.

OPENAM-26470^[4]: Dynamic client registration requests can now include authorization_details_types to register the authorization detail types an OAuth 2.0 client supports.

OPENAM-26721: You can now skip signature verification when importing SAML metadata.

OPENAM-26073: Advanced Identity Cloud now includes v2.0 of the Patch Object node. This new version removes the Patch as Object configuration option and always updates the managed identity object as Advanced Identity Cloud. The v1.0 node is deprecated but continues to work in existing journeys.

OPENAM-27493^[1]: You can now configure OAuth2 Provider settings, including scripted JWT issuers, in the Advanced Identity Cloud admin console under Authorization > OAuth2 Provider.

OPENAM-27494^[1]: You can now configure Android Key Attestation, Jumio, and OneSpan identity verification settings in the Advanced Identity Cloud admin console.

OPENAM-27495^[1]: You can now configure push authentication, push notification delivery, TOTP, WebAuthn, and device binding settings in the Advanced Identity Cloud admin console under Authentication > Authentication Methods.

OPENAM-27496^[1]: You can now configure the Remote Consent Service in the Advanced Identity Cloud admin console under Authorization > Remote Consent Service.

AME-34781: Fixed an issue where the Add AI Agent button in the AM native admin console caused an error for Advanced Identity Cloud tenants. This button is now hidden but you can still add agents through the Advanced Identity Cloud admin console.

AME-34898: Fixed an issue where SAML SSO flows could use a circle of trust set to Inactive.

ANALYTICS-1557^[5]: Optimised analytics query execution to resolve a processing issue affecting dashboards and internal metrics.

FRAAS-32040: Fixed a deadlock where the /environment/startup endpoint became unresponsive when Advanced Identity Cloud services failed to start because of bad configuration.

IAM-6882: Fixed an issue where the admin console displayed the incorrect product name.

IAM-7788: Fixed an issue where the Next Generation scripts editor displayed unpublished environment secrets and variables.

IAM-8343: Fixed an issue where the delete button for ESVs was not disabled for tenant auditors.

IGA-3972^[3][1]: Fixed an issue where the selected filter value in the requests view reset to the default when navigating to a record or switching tabs.

IGA-4363^[3][1]: Fixed an issue where applying a date or text multivalued glossary field filter in the hosted account pages returned an error instead of filtered results.

IGA-4393^[3][1]: Fixed an issue where a boolean glossary attribute set to false was omitted from the entitlement API response instead of returning the correct value.

IGA-4598^[3][1]: Fixed an error in the Approval Task workflow node that caused the task to fail when an expiration notification was configured.

IGA-4651^[3][1]: Fixed an issue where account create, update, and delete events from connected applications were missing from IGA audit data.

IGA-4654^[3][1]: Fixed a form validation error in the new certification template wizard that prevented users from navigating past the first section.

IGA-4662^[3]: Fixed an issue where entitlement mappings used application display names instead of stable connector IDs, which could cause incorrect behavior if application names changed or contained special characters.

IAM-10686: Fixed an issue where navigation labels in the hosted pages editor wrapped inconsistently compared to the hosted account pages.

IAM-10728: Fixed a pagination issue where organization administrators with a limited user scope saw a no users found error after navigating past the last page of the user list.

IAM-10780: Fixed an issue where exporting a journey containing a Device Profile node with a custom matching script did not include the script, causing import failures.

IAM-10812: Fixed an issue where the edit icon in the Inner Tree Node and Scripted Decision Node opened an intermediate list instead of navigating directly to the linked resource.

OPENAM-23079^[1]: Fixed an issue where the Apple social provider failed on Android devices. During native authentication flows, Advanced Identity Cloud was not including the code_verifier in requests to Apple’s token endpoint, which caused an invalid_grant error.

OPENAM-25429: The default Minimum Secret Key Length on the OATH Registration and Combined MFA Registration nodes has increased from 32 to 40 characters, for compatibility with Google Authenticator.

OPENAM-25556^[1]: Advanced Identity Cloud now honors the pubKeyCredParams sequence in WebAuthn credential creation requests.

OPENAM-25801: Fixed an issue where the SAML SP adapter returned the wrong failure code when it couldn’t map an assertion to a user profile.

OPENAM-26086: Advanced Identity Cloud no longer relies on an oversized browser cookie to carry the full OAuth 2.0 /authorize request through the login flow. Instead, it stores that request state securely in CTS (Core Token Service) and restores it after authentication. This prevents large requests, such as ones with a big id_token_hint, from failing with missing client_id after the user successfully sign on.

OPENAM-26106: Resolved an issue where the IdP account mapper could return the NameID value from the wrong SAML entity when a remote SP was used in multiple circles of trust with different NameID value mappings.

OPENAM-26180: Fixed an issue where ETag assertion was causing noisy CTS session assertion failures.

OPENAM-26834^[1]: Hardened realm path handling for API requests to prevent potential security bypass.

OPENAM-28330^[1]: Fixed an issue where CDNs cached transient 404 errors for static assets during rolling deployments for up to 30 days, instead of treating them as non-cacheable.

OPENDJ-12269^[1]: Fixed an issue where the password substring check rejected passwords containing attribute values shorter than the minimum substring length, such as a two-character surname. Attribute values shorter than the minimum substring length are no longer checked for substrings by default.

ANALYTICS-1557^[5]: Optimised analytics query execution to resolve a processing issue affecting dashboards and internal metrics.

AME-34566: The Evaluator Version selector is now available in the Advanced Identity Cloud admin console for all remaining next-generation script types, including OIDC node, Social Provider Handler node, OAuth2 scripts, and Policy Condition scripts.

FRAAS-33086: You can now migrate user accounts from the deprecated PKCS5S2 password hashing scheme to a more secure algorithm.

IAM-2333: The Identities page now includes an Account Status column that shows whether each user account is Active or Inactive. This column is display-only and is not intended for search or sort operations.

IAM-3671, IAM-9388, IAM-10148, IAM-10174, IAM-10548: Improved accessibility across hosted journey pages and the admin console, including context-sensitive page titles, form field labels, and aria-describedby attributes for the Attribute Collector node.

IAM-8200: You can now use an environment secret or variable (ESV) to configure the from address for email providers.

IAM-9953: The Advanced Identity Cloud admin console now supports light and dark display themes. You can switch between themes to match your preference or your system’s display settings.

IAM-10069: Hosted journey pages now display hCaptcha text and challenges in the end user’s configured locale.

IAM-10536, IAM-10553, IAM-10558, IAM-10559: Improved color contrast for active UI components across multiple areas of the admin console to meet accessibility standards.

IAM-10595: Updated the column picker component for consistent behavior across data tables in the admin console and hosted account pages.

IAM-10596, IAM-10597, IAM-10598: Column visibility preferences for data tables in the admin console and hosted account pages are now customizable and saved between sessions.

IAM-10796: Super administrators can now configure the redirect URI field to use a custom domain when setting up federated administrator access.

IAM-10952: The Identities page now displays a loading spinner while identity data is being fetched.

IGA-3141^[3]: Added a configurable option to control which user attributes are displayed in the user information panel, with all attributes shown by default when none are configured.

IGA-3267, IGA-4140^[3]: Improved certification management with configurable expiration and escalation settings that enable automatic reassignment, and a new access filter in the certification items table to help reviewers narrow results more efficiently.

IGA-4215^[3]: Improved the manual fulfillment task view to display user, account, and entitlement details and added the ability to mark a fulfillment task as complete.

IGA-4224^[3]: Added the ability to design custom lifecycle management forms for entitlements, enabling administrators to configure fields from glossary and schema attributes for create and modify operations.

IGA-4293^[3]: Added support for granting and revoking roles, entitlements, and app access to AI agents from the agent console and custodian view.

IGA-4295^[3]: Added the ability to update an AI agent’s custodians, including adding or removing custodians as needed.

IGA-4299^[3]: Added an Activity tab for AI agents.

IGA-4333^[3]: Added a sidebar filter to requests to make it easier to find and work with specific requests.

IGA-4381^[3]:Improved the request type filter to dynamically retrieve available request types, so new and custom request types appear as filter options.

IGA-4382^[3]: Improved the display of account and entitlement properties to use friendly labels from the object type schema instead of raw property keys.

IGA-4417, IGA-4418^[3]: Added column customization to LCM table views. The entitlement LCM view now supports glossary attributes as selectable column options, and the user LCM table includes a column selector based on available schema fields and user permissions.

IGA-4433, IGA-4434^[3]: Added support for unmanaged applications, including an Unmanaged Applications tab on the Applications page, create and edit flows, glossary management, and CSV import with upload history.

IGA-4438^[3]: Improved access catalog role search so users can find roles by more than just role name, including role descriptions and related application or entitlement details.

OPENAM-27489: You can now create and edit social identity providers in the Advanced Identity Cloud admin console.

OPENAM-27492: You can now configure self-service journey mappings directly in the Advanced Identity Cloud admin console.

FRAAS-31319: Fixed an issue where the log-streaming service relied on the source field for the original log source, which can conflict with Splunk’s reserved source field. Splunk log streaming now includes stream_source to preserve the original Advanced Identity Cloud log source.

IAM-4875: Fixed an issue where ESV values couldn’t be entered as the well-known endpoint URL when setting up Microsoft Entra ID as a federation IdP.

IAM-5457: Fixed an issue where using an ESV in the Password Policy page caused the page to freeze.

IAM-6374: Fixed an issue where journeys could be imported even when their referenced ESVs were not published.

IAM-8313: Fixed an issue where setting a managed object property to nullable caused it to disappear from the Password Policy attribute validation list.

IAM-10593: Fixed a layout issue on the Journeys page where journey counts for category tags were obscured for locales with longer words.

IAM-10776: Fixed an issue where the stored username was overwritten with an OTP value when Remember Me was enabled during MFA sign-on.

IAM-10833: Fixed an issue where the admin console incorrectly displayed "Rollback in progress" during a standard environment promotion.

IAM-10836: Fixed a regression where TextOutputCallback messages containing custom HTML were rendered with unexpected line breaks.

IGA-4304^[3]: Fixed several disconnected application UI issues, including improvements to entitlement visibility, request handling, and error behavior in related views.

IGA-4388^[3]: Fixed an error in the default LCM modify user form that prevented changes from being saved when a custom integer field contained a value of zero.

IGA-4426^[3]: Fixed an issue where the Direct Reports and Delegates tables displayed an inflated record count and showed empty pages at the end of the list.

IGA-4441^[3]: Fixed an issue where the Add button from the certification filters sidebar incorrectly appeared in other views that use the dynamic filter.

IGA-4452^[3]: Fixed an issue where the export items action did not work for certification access reviews.

IGA-4516^[3]: Fixed an issue where a glossary attribute update applied to an entitlement was not propagated to all accounts that held the entitlement.

OPENIDM-22404^[1]: Fixed a user enumeration vulnerability in the managed object ?_action=patch endpoint that didn’t enforce authorization before evaluating query filters. Query authorization on the target resource collection is now required and is granted through access rules or delegated admin rules. This change can affect custom integrations (like password plugins) that patch resource collections by query.

PF-39499^[6]: Microsoft 365 SSO applications now use the selected UPN Attribute Name setting for WS-Trust username authentication. Existing applications must be resaved for this change to take effect. Find more information in Configure WS-Trust.

OPENAM-28291: Fixed an issue where Page nodes using both a CAPTCHA node and live password validation could fail because the CAPTCHA token was reused on repeated validation requests. The fix is now available Page node v3, which ensures that nodes with validation enabled generate a new CAPTCHA token for each validation request.

OPENAM-28030^[5]: Journey name validation rules in the access management backend are now consistent with those in the access management native console and the Advanced Identity Cloud admin console.

AME-28187: You can now set a Metadata URL in your remote consent agent. Advanced Identity Cloud retrieves the remote consent server’s (RCS) metadata from this URL. When configured, the OIDC .well-known endpoint includes the authorization_details_types_supported field, populated from the authorization detail types advertised by the RCS.

AME-33781: Advanced Identity Cloud now supports the WebAuthn conditional UI, also known as passkey autofill. This lets your end users sign in with a passkey if they’ve previously saved one in their browser.

AME-34458: Enhanced the output when you test the connection in the PingOne Worker service to display the values used in the connection test to make them easier to verify. These details are extracted from the credential JWT or derived from the worker service configuration.

AME-34513: Added support for the _queryFilter parameter on the realm-config/services/pingOneWorkerService/workers endpoint. Use this to query the configured worker services. For example, you can filter by credential type or by a property value such as the API URL.

IAM-1478: Autofill is now disabled for fields on pages where you add identities.

IAM-4646: Tenant administrators registered through federation no longer have the option to update their username and password on the sign-on screen.

IAM-8699: Advanced Identity Cloud now supports node versioning. When we make changes to a node in the future, we’ll create a new version of the node.

IAM-9002: The Journeys page now has an Add journey button that opens a modal for creating or importing a journey. This makes the available journey options easier to find.

IAM-9608: You can now assign an authorization policy to a SAML or OIDC application. This lets you restrict who can access an application to a subset of end users who have authenticated through a specific journey. Find more information in Configure an application authorization policy.

IAM-9937: The SaaS REST and SaaS REST (connector server) applications now let you add filter policies to object types when you configure provisioning. Adding filters at the API level reduces network overhead, boosts synchronization performance, and prevents unwanted data from entering your identity pipeline.

IAM-10132: The Advanced Identity Cloud admin console is now fully accessible using keyboard controls.

IAM-10625: The Custom WS-Fed application now includes logout mode, always authenticate user, and multi-valued claim support for SSO. Find more information in Configure the custom WS-Fed application.

IAM-10626: The Microsoft 365 application now includes logout mode and always authenticate user settings for WS-Trust SSO. Find more information in Microsoft 365 Sign On settings.

IAM-10810: The PingOne worker service now lets you configure the connection to PingOne using a credential JWT.

OPENAM-25759: The jwtValidator script binding now supports configurable clock skew for expirationTime and issuedAt claim validation.

OPENAM-25910: The OAuth 2.0 introspection endpoint now supports an RFC 9701-compliant JWT response format. When enabled, token introspection claims are nested under a top-level token_introspection claim, which separates the aud claim of the introspection response from the aud claim of the token itself. The token’s aud claim is also now correctly included for all token types, including stateless tokens.

OPENAM-25936: Next-generation scripts now support the utils.crypto.checkBcrypt(bcryptHash, password) method for bcrypt hash verification.

OPENAM-25957: All next-generation OAuth 2.0 scripts now have access to the identity, session, clientProperties, and requestProperties bindings.

OPENAM-27540: You can now configure a trusted CA certificate for each OAuth 2.0 client using the tls_client_auth authentication method, instead of relying only on realm-wide CAs.

AME-34254: Added support for next-generation SAML SP account mapper scripts to the Advanced Identity Cloud admin console.

FRAAS-29198: Fixed an issue where promotions that failed due to the encrypted secrets verification check were not listing the configuration paths that needed updating.

IAM-5003: Fixed an issue where changing the locale on the terms and conditions creation page didn’t change the text in the editor.

IAM-9751: Fixed an accessibility issue where the VoiceOver screen reader was not vocalizing UI text correctly.

IAM-10040: Fixed an issue where the browser was incorrectly using autofill if a KBA Definition Node was within a Page node. The issue prevented use of tab and arrow functionality for that node.

IAM-10087: Fixed an issue where the password policy on a hosted pages sign-on screen disappeared on a window refresh when the Access Management > Authentication > Settings > Trees > Enable Allowlisting setting was enabled.

IGA-4139^[3]: Updated the access filter component in the IGA access graph to accept dynamic filter options. This lets you use different UI components to customize the available filter options, based on context.

IGA-4275^[3]: Fixed a pagination issue in the Direct Reports view by removing sortable columns and default sort from the Direct Reports and Delegates pages.

OPENAM-25543: Allowing a SAML authentication flow to continue when a circle of trust (CoT) is inactive is now deprecated. Review your SAML configurations and ensure that any CoTs used for authentication are active before Advanced Identity Cloud begins enforcing CoT status after the end-of-life date.

OPENAM-26359: Added a new configuration option, Enable Rich Authorization Requests with RCS, to the OAuth2 Provider service. This resolves an issue with remote consent where authorize requests with authorization_details would fail with an invalid_request error if an RCS was not configured.

FRAAS-32554: Addressed a security issue.

OPENAM-26335^[5]: The PingOne Verify Evaluation node now lets you suppress the display of the verification code in the PingOne Verify web UI.

OPENAM-26326^[5]: Added a new configuration option, Enable Rich Authorization Requests with RCS, to the OAuth2 Provider service. This resolves an issue with remote consent where authorize requests with authorization_details would fail with an invalid_request error if an RCS was not configured.

IAM-1715: Improve messaging on back button for 404 pages in the Advanced Identity Cloud admin console.

IAM-3829: You can now perform dry-run promotions in the Advanced Identity Cloud admin console.

IAM-3834: Distinguish between dry-run and actual promotions in the promotion report in the Advanced Identity Cloud admin console.

IAM-8149, IAM-8275, IAM-8988: Added the following configuration options to the Advanced Identity Cloud admin console when you create or edit a journey:

IAM-8972: You can now configure managed objects and relationships in the Advanced Identity Cloud admin console.

IAM-9819^[7]: Added the ability to export custom reports.

IAM-9822: You can now perform promotion rollbacks in the Advanced Identity Cloud admin console.

IAM-9903^[7]: Added the ability to import custom reports.

IAM-9960: Added a wider scope to the monitoring search feature by being able to search on /payload/message and just /payload in cases where the monitoring record’s payload is a string.

OPENIDM-22009: All connectors included with Advanced Identity Cloud were upgraded. Learn more in 1.5.20.34 Connector changes.

IGA-4036: Added the ability to add and remove members of an entitlement directly from the entitlement LCM users tab.

FRAAS-31613: Fixed an issue where password policy updates weren’t properly replicating to the datastore in mutable environments.

IAM-1907: Fixed an issue where custom endpoint search showed an incorrect message.

IAM-2537: Fixed an issue where non-dashboard URLs didn’t show a 404 page.

IAM-2615: Fixed an issue where border radius settings affected the hosted pages editor preview.

IAM-3453: Fixed styling issues with the back button.

IAM-5439: Fixed an issue where an ESV couldn’t be updated after its last value was deleted.

IAM-7502: Fixed an issue where the color in the Card Input Border Focus Color hosted pages setting wasn’t applied to the search field in the My Applications hosted account page.

IAM-9475: Fixed an issue in the hosted journey pages where a journey was allowed to continue in the event of a password mismatch when a message node was on the same page.

IAM-9752: Fixed an issue where VoiceOver gestures didn’t work on drop-down lists.

IAM-9842: Fixed an issue where VoiceOver didn’t announce text for some page elements.

IAM-9936: Fixed an issue with the query operation in the SaaS REST application where setting the type select field prevented the method select field from being cleared, and the other way around.

IAM-9952: Fixed an issue where the table header for the action column was empty on several pages in the hosted account pages.

IAM-9958: Fixed an issue where the table header for the action column was empty on several pages in the Advanced Identity Cloud admin console.

IAM-10056: Fixed an issue on the Auth Scripts page where the modal body failed to load after clicking add New Script.

AME-33573: Next-generation scripts now include utils.base64url.encode() and utils.base64url.decodeToBytes() for Base64URL encoding and decoding.

AME-33971: Added a new Save and Test Connection button to the PingOne worker configuration screen allowing you to validate the connection.

AME-33973: You can now configure the PingOne Worker Service connection using a credential JWT.

AME-34248: You can now use next-generation scripts in the Social Provider Handler node to transform normalized profile data into identities or managed users.

AME-34249: You can now use next-generation scripts in the OIDC ID Token Validator node. The jwtClaims binding now behaves as a native JavaScript object.

AME-34540: You can now specify autocomplete attributes for username nodes.

OPENAM-21474: A new Minimum max_age for Authorize Requests property is now available in the advanced OIDC settings of the OAuth 2.0 provider service.

OPENAM-24523: You can now dynamically modify the scopes of a refresh token during the refresh flow with the new next-generation scope validation script binding, scopeValidatorHelper, and its method, inheritAccessTokenScopesOnRefresh(). This is useful when scope validation scripts alter access token scopes and you need the refresh token to inherit those changes.

OPENAM-25901: Next-generation OAuth 2.0 scope validation scripts now have access to the availableScopes binding, which lists all scopes configured for the client. A new throwInvalidScope() method is also available to simplify error handling.

AME-34216, AME-34398: When using an SSO token as the subject for a policy with an IDM user environment condition, it now correctly resolves to the IDM _id instead of the user’s AM universal ID.

AME-34329: By default, parallel updates can no longer be made for CTS sessions. You can revert this behavior by setting the ESV esv.cts.use.etag.assertion.on.updates to false.

FRAAS-31318: Fixed an issue where setting certain special characters in an ESV prevented the ESV from being interpreted correctly.

FRAAS-28387: Invites for Advanced Identity Cloud tenant registration now use a one-time passcode (OTP) instead of a magic link. This change prevents email scanners from accidentally invalidating single-use links.

AME-29745: Improved the certificate validation process in the Certificate Collector and Certificate Validation nodes. By default, Advanced Identity Cloud collects the first certificate in a certificate chain (the user certificate). You can now create an ESV named esv-am-nodes-certificatechain-validation-enforced and set its value to true to collect the chain of certificates.

AME-33851: You can now use next-generation scripts for social identity provider transformation scripts.

OPENAM-23610: The default value for the Return challenge as JavaScript (Legacy) property on the WebAuthn Authentication and WebAuthn Registration nodes is now not enabled. Ping Identity recommends that you keep this setting.

OPENAM-25329: The PingOne Protect Initialize node now includes an Additional Signals SDK Initialization Options attribute. This allows you to configure options that aren’t already defined in the node. The PingOneProtectInitializeCallback has been updated with new fields to support this.

OPENAM-25677: The PingOneProtectInitializeCallback now includes a universalDeviceIdentification field, which replaces the deprecated enableTrust field. The enableTrust field is still returned for backward compatibility.

IGA-4186^[3]: Fixed an issue for user LCM in the hosted account pages where large user populations weren’t correctly sorted and paginated.

OPENAM-22698: Fixed a bug that caused duplicate URIs in WS-Federation responses.

The following OAuth 2.0 scripts can now use the next-generation scripting engine, which gives them access to common bindings such as utils and openidm:

The following SAML 2.0 scripts can now use the next-generation scripting engine, which gives them access to common bindings such as utils and openidm:

AME-32969: You can now make sure the samlApplication binding is available for all SAML flows by enabling the application context in the hosted IdP or remote SP entity configuration. Previously this was only added in certain situations such as when using an application journey or IdP-initiated integrated mode.

AME-32997: Added an Allow Retry option to the Backchannel Initialize node that lets end users retry a failed backchannel authentication journey.

AME-33430: You can now include remote consent agent credentials in a Basic Authentication header for pushed consent requests.

AME-33930: A new testConnection action on the realm-config/services/pingOneWorkerService/workers/pingone-worker-service-name endpoint lets you test the connection from Advanced Identity Cloud to PingOne.

AME-33939: A new listLatestNodeDefinitions action on the realm-config/authentication/authenticationtrees/nodes endpoint provides a list of node definitions for the latest version of each node.

ANALYTICS-1383^[7]: The new historical change report feature provides a complete audit trail of changes to your managed identities. It tracks all modifications to user profiles, roles, accounts, and applications. You can easily generate reports to see what changed, who made the change, and when it happened, which gives you clear insights for compliance and security monitoring.

FRAAS-29084: Custom domains are now restricted to a maximum of 63 characters in the Advanced Identity Cloud admin console. This restriction has always existed on the system backend.

OPENAM-22125: A new Proxy Configuration tab in the Http Client Service configuration lets you use separate proxy configurations per HTTP Client instance.

OPENAM-24476: Added java.util.zip classes to the allowlist for the Scripted Decision node scripting context.

The following enhancements have been made to the nodes provided with Advanced Identity Cloud:

OPENAM-25371: Added a configuration property to the PingOne Verify Evaluation node to enable automatic redirection to the journey after an end user completes verification (when using the Redirect delivery mode).

OPENAM-25618: The new locales binding lets you return the localized version of a string from a translation map. It is available to next-generation Configuration Provider node, Journey Decision node, and Device Match node scripts.

OPENIDM-21493: You can now cancel a clustered reconciliation even when a route associated with the source or target system is unavailable.

AME-34191: You can now override the HTTP binding used to redirect users to the SAML error page. To do this, configure an ESV variable named esv-global-saml-error-page-http-binding and set its value to HTTP-POST or HTTP-Redirect. If you don’t set this variable, Advanced Identity Cloud uses the default value of HTTP-POST.

IAM-6546: End users now have more options to manage their devices in the hosted account pages. For each device, they can view when it was last used for sign on, view when it was added, edit its name, and delete it.

IAM-9672: In the advanced sync Mapping tab, if no properties have been mapped, it now shows a more accurate description of the target and source identity objects whose properties can be mapped.

AME-33653: Custom nodes now work with the Configuration Provider node.

AME-33808: If Node State Attribute For User ID is provided in the PingOne Protect Evaluation node, but the corresponding attribute is missing from the node state, the node triggers the failure outcome rather than using the user ID associated with the AM identity.

AME-34217: Added a version setting to the Configuration Provider node. This update provides the underlying infrastructure for a node versioning feature in an upcoming release.

AME-34034: Fixed an issue where omitting a shared secret label in the RADIUS Decision node caused Prometheus metrics to become unavailable.

ANALYTICS-1326^[7]: Fixed an issue in custom reports caused by relationships between custom identities that contain multiple underscores.

ANALYTICS-1367^[7]: Fixed an issue in custom reports caused by IP addresses in journey events.

OPENAM-23918: Resolved a race condition in the OATH Registration node and OATH Device Storage node where recovery codes could potentially be lost.

OPENAM-24065: Improved consistency for error responses across realms when processing illegal arguments. The /authenticate call now correctly returns a 400 (Bad Request) instead of a 500 (Internal Server Error) for invalid arguments.

OPENAM-25406: Added an identity.exists() method to next-generation objects returned by idRepository.getIdentity(). This lets scripts verify an identity’s existence in the identity store before further processing.

OPENAM-25646: For backward compatibility, we’ve restored the following deprecated fields sent to PingOne Protect by the PingOne Protect Initialize node (in the PingOneProtectInitializeCallback):

OPENAM-25779: Deletion of the samlApplication object is now deferred for unsuccessful authentication journeys so that the object is still available for subsequent sign-on attempts in the same session.

IAM-6640: Fixed an issue in the hosted pages theme preview where clicking Edit Personal Info opened two instances of the modal.

IAM-8221: Fixed an issue in the terms & conditions live preview where interactive elements weren’t disabled.

IAM-9620^[3]: Fixed an Identity Governance issue where clicking Save in the certification template creation wizard didn’t disable the button after submission, which could result in the creation of unintended duplicate templates.

IAM-9786: Fixed an issue where ESV placeholders manually entered into a field were always treated as strings, regardless of whether they were an array, list, or string.

IAM-9886: Fixed a display issue on the Reports Run History tab where the pop-up menu items weren’t displayed correctly.

FRAAS-29855^[1]: Fixed an issue where OTLP log streaming reported all Advanced Identity Cloud logs with am-core or idm-core as the source and omitted custom IDM event-hook logs. Logs streamed via OTLP now preserve their correct source (for example, am-authentication, am-access, idm-access) and include custom IDM event-hook messages.

OPENIDM-21718: The maxQueueSize for queued synchronization now defaults to 1000 and can’t be configured to a value higher than 1000 or lower than 100. The previous default was 20000.

RCS 1.5.20.34 is now available to download. To take advantage of these updates, you must manually upgrade your RCS implementation. Learn more in ICF release notes.

RCS 1.5.20.33 is now available to download. To take advantage of these updates, you must manually upgrade your RCS implementation. Learn more in ICF release notes.

Support for using older versions of the web agent with Advanced Identity Cloud is now deprecated. If you have web agents in your deployment, you should upgrade to 2024.11.2 or 2025.9 and later to ensure you remain compatible in the future. Learn more in Incompatible changes.

FRAAS-23284: RCS connections to Advanced Identity Cloud now have a default timeout value of 10000 (10 seconds) for new tenants. Existing tenants retain the default timeout value of -1 (no timeout).

FRAAS-29829: Removed a reference to "PingOne Advanced Identity Cloud" from the 404 Not Found error page.

IAM-4464: Next-generation configuration provider scripts created through the journey editor now contain the default config for the selected node type.

IAM-9709: Updated the journey editor to make fewer network calls when saving a journey that contains page nodes.

IAM-4345: Fixed an issue where vertical tabs were missing a hover state.

IAM-8033: Journey name field did not have a length check in place.

IAM-8226: When importing a journey, if you skip the download backup option but then return to it using the Previous link, it now completes the backup before offering the download.

IAM-9590: The message shown in the hosted pages for an unauthorized access attempt is now correctly centered on a single page.

IAM-9687: When you enter a valid ESV placeholder in the URL field of a bookmark application, the field is now immediately disabled and shows a delete icon to remove the placeholder.

IGA-4085^[3][1]: Fixed an Identity Governance access request issue where glossary schema properties displayed an extra space for nonexistent icons.

IGA-3980^[3][1]: Fixed an Identity Governance certification issue where the certification count on the Summary page didn’t include the certificationType query parameter.

OPENAM-25702: The PingOne Protect Evaluation node again supports a Node State Attribute For Username setting. PingOne Protect risk evaluation calls can depend on the username.

OPENIDM-21776: The Advanced Identity Cloud identity management service now uses synchronous HTTP client requests to connect to external identity management, REST, and token introspection services. This change prevents connection closure exceptions from terminating reconciliation.

FRAAS-13233: AM script validation now ignores ESV placeholders in commented-out code.

IAM-9803: The link to the access management native console from the Advanced Identity Cloud admin console now always correctly links to the Alpha or Bravo realm.

OPENAM-25707: Fixed PingOneProtectInitializeCallback processing to prevent unwarranted HTTP 4xx and 5xx errors.