AME-28187: You can now set a Metadata URL in your remote consent agent. Advanced Identity Cloud retrieves the remote consent server’s (RCS) metadata from this URL. When configured, the OIDC .well-known endpoint includes the authorization_details_types_supported field, populated from the authorization detail types advertised by the RCS.

AME-33781: Advanced Identity Cloud now supports the WebAuthn conditional UI, also known as passkey autofill. This lets your end users sign in with a passkey if they’ve previously saved one in their browser.

AME-34458: Enhanced the output when you test the connection in the PingOne Worker service to display the values used in the connection test to make them easier to verify. These details are extracted from the credential JWT or derived from the worker service configuration.

AME-34513: Added support for the _queryFilter parameter on the realm-config/services/pingOneWorkerService/workers endpoint. Use this to query the configured worker services. For example, you can filter by credential type or by a property value such as the API URL.

IAM-1478: Autofill is now disabled for fields on pages where you add identities.

IAM-4646: Tenant administrators registered through federation no longer have the option to update their username and password on the sign-on screen.

IAM-8699: Advanced Identity Cloud now supports node versioning. When we make changes to a node in the future, we’ll create a new version of the node.

IAM-9002: The Journeys page now has an Add journey button that opens a modal for creating or importing a journey. This makes the available journey options easier to find.

IAM-9608: You can now assign an authorization policy to a SAML or OIDC application. This lets you restrict who can access an application to a subset of end users who have authenticated through a specific journey. Find more information in Configure an application authorization policy.

IAM-9937: The SaaS REST and SaaS REST (connector server) applications now let you add filter policies to object types when you configure provisioning. Adding filters at the API level reduces network overhead, boosts synchronization performance, and prevents unwanted data from entering your identity pipeline.

IAM-10132: The Advanced Identity Cloud admin console is now fully accessible using keyboard controls.

IAM-10625: The Custom WS-Fed application now includes logout mode, always authenticate user, and multi-valued claim support for SSO. Find more information in Configure the custom WS-Fed application.

IAM-10626: The Microsoft 365 application now includes logout mode and always authenticate user settings for WS-Trust SSO. Find more information in Microsoft 365 Sign On settings.

IAM-10810: The PingOne worker service now lets you configure the connection to PingOne using a credential JWT.

OPENAM-25759: The jwtValidator script binding now supports configurable clock skew for expirationTime and issuedAt claim validation.

OPENAM-25910: The OAuth 2.0 introspection endpoint now supports an RFC 9701-compliant JWT response format. When enabled, token introspection claims are nested under a top-level token_introspection claim, which separates the aud claim of the introspection response from the aud claim of the token itself. The token’s aud claim is also now correctly included for all token types, including stateless tokens.

OPENAM-25936: Next-generation scripts now support the utils.crypto.checkBcrypt(bcryptHash, password) method for bcrypt hash verification.

OPENAM-25957: All next-generation OAuth 2.0 scripts now have access to the identity, session, clientProperties, and requestProperties bindings.

OPENAM-27540: You can now configure a trusted CA certificate for each OAuth 2.0 client using the tls_client_auth authentication method, instead of relying only on realm-wide CAs.

AME-34254: Added support for next-generation SAML SP account mapper scripts to the Advanced Identity Cloud admin console.

FRAAS-29198: Fixed an issue where promotions that failed due to the encrypted secrets verification check were not listing the configuration paths that needed updating.

IAM-5003: Fixed an issue where changing the locale on the terms and conditions creation page didn’t change the text in the editor.

IAM-9751: Fixed an accessibility issue where the VoiceOver screen reader was not vocalizing UI text correctly.

IAM-10040: Fixed an issue where the browser was incorrectly using autofill if a KBA Definition Node was within a Page node. The issue prevented use of tab and arrow functionality for that node.

IAM-10087: Fixed an issue where the password policy on a hosted pages sign-on screen disappeared on a window refresh when the Access Management > Authentication > Settings > Trees > Enable Allowlisting setting was enabled.

IGA-4139^[2]: Updated the access filter component in the IGA access graph to accept dynamic filter options. This lets you use different UI components to customize the available filter options, based on context.

IGA-4275^[2]: Fixed a pagination issue in the Direct Reports view by removing sortable columns and default sort from the Direct Reports and Delegates pages.

OPENAM-25543: Allowing a SAML authentication flow to continue when a circle of trust (CoT) is inactive is now deprecated. Review your SAML configurations and ensure that any CoTs used for authentication are active before Advanced Identity Cloud begins enforcing CoT status after the end-of-life date.

OPENAM-26359: Added a new configuration option, Enable Rich Authorization Requests with RCS, to the OAuth2 Provider service. This resolves an issue with remote consent where authorize requests with authorization_details would fail with an invalid_request error if an RCS was not configured.

FRAAS-32554: Addressed a security issue.

OPENAM-26335^[3]: The PingOne Verify Evaluation node now lets you suppress the display of the verification code in the PingOne Verify web UI.

OPENAM-26326^[3]: Added a new configuration option, Enable Rich Authorization Requests with RCS, to the OAuth2 Provider service. This resolves an issue with remote consent where authorize requests with authorization_details would fail with an invalid_request error if an RCS was not configured.

IAM-1715: Improve messaging on back button for 404 pages in the Advanced Identity Cloud admin console.

IAM-3829: You can now perform dry-run promotions in the Advanced Identity Cloud admin console.

IAM-3834: Distinguish between dry-run and actual promotions in the promotion report in the Advanced Identity Cloud admin console.

IAM-8149, IAM-8275, IAM-8988: Added the following configuration options to the Advanced Identity Cloud admin console when you create or edit a journey:

IAM-8972: You can now configure managed objects and relationships in the Advanced Identity Cloud admin console.

IAM-9819^[4]: Added the ability to export custom reports.

IAM-9822: You can now perform promotion rollbacks in the Advanced Identity Cloud admin console.

IAM-9903^[4]: Added the ability to import custom reports.

IAM-9960: Added a wider scope to the monitoring search feature by being able to search on /payload/message and just /payload in cases where the monitoring record’s payload is a string.

OPENIDM-22009: All connectors included with Advanced Identity Cloud were upgraded. Learn more in 1.5.20.34 Connector changes.

IGA-4036: Added the ability to add and remove members of an entitlement directly from the entitlement LCM users tab.

FRAAS-31613: Fixed an issue where password policy updates weren’t properly replicating to the datastore in mutable environments.

IAM-1907: Fixed an issue where custom endpoint search showed an incorrect message.

IAM-2537: Fixed an issue where non-dashboard URLs didn’t show a 404 page.

IAM-2615: Fixed an issue where border radius settings affected the hosted pages editor preview.

IAM-3453: Fixed styling issues with the back button.

IAM-5439: Fixed an issue where an ESV couldn’t be updated after its last value was deleted.

IAM-7502: Fixed an issue where the color in the Card Input Border Focus Color hosted pages setting wasn’t applied to the search field in the My Applications hosted account page.

IAM-9475: Fixed an issue in the hosted journey pages where a journey was allowed to continue in the event of a password mismatch when a message node was on the same page.

IAM-9752: Fixed an issue where VoiceOver gestures didn’t work on drop-down lists.

IAM-9842: Fixed an issue where VoiceOver didn’t announce text for some page elements.

IAM-9936: Fixed an issue with the query operation in the SaaS REST application where setting the type select field prevented the method select field from being cleared, and the other way around.

IAM-9952: Fixed an issue where the table header for the action column was empty on several pages in the hosted account pages.

IAM-9958: Fixed an issue where the table header for the action column was empty on several pages in the Advanced Identity Cloud admin console.

IAM-10056: Fixed an issue on the Auth Scripts page where the modal body failed to load after clicking add New Script.

AME-33573: Next-generation scripts now include utils.base64url.encode() and utils.base64url.decodeToBytes() for Base64URL encoding and decoding.

AME-33971: Added a new Save and Test Connection button to the PingOne worker configuration screen allowing you to validate the connection.

AME-33973: You can now configure the PingOne Worker Service connection using a credential JWT.

AME-34248: You can now use next-generation scripts in the Social Provider Handler node to transform normalized profile data into identities or managed users.

AME-34249: You can now use next-generation scripts in the OIDC ID Token Validator node. The jwtClaims binding now behaves as a native JavaScript object.

AME-34540: You can now specify autocomplete attributes for username nodes.

OPENAM-21474: A new Minimum max_age for Authorize Requests property is now available in the advanced OIDC settings of the OAuth 2.0 provider service.

OPENAM-24523: You can now dynamically modify the scopes of a refresh token during the refresh flow with the new next-generation scope validation script binding, scopeValidatorHelper, and its method, inheritAccessTokenScopesOnRefresh(). This is useful when scope validation scripts alter access token scopes and you need the refresh token to inherit those changes.

OPENAM-25901: Next-generation OAuth 2.0 scope validation scripts now have access to the availableScopes binding, which lists all scopes configured for the client. A new throwInvalidScope() method is also available to simplify error handling.

AME-34216, AME-34398: When using an SSO token as the subject for a policy with an IDM user environment condition, it now correctly resolves to the IDM _id instead of the user’s AM universal ID.

AME-34329: By default, parallel updates can no longer be made for CTS sessions. You can revert this behavior by setting the ESV esv.cts.use.etag.assertion.on.updates to false.

FRAAS-31318: Fixed an issue where setting certain special characters in an ESV prevented the ESV from being interpreted correctly.

FRAAS-28387: Invites for Advanced Identity Cloud tenant registration now use a one-time passcode (OTP) instead of a magic link. This change prevents email scanners from accidentally invalidating single-use links.

AME-29745: Improved the certificate validation process in the Certificate Collector and Certificate Validation nodes. By default, Advanced Identity Cloud collects the first certificate in a certificate chain (the user certificate). You can now create an ESV named esv-am-nodes-certificatechain-validation-enforced and set its value to true to collect the chain of certificates.

AME-33851: You can now use next-generation scripts for social identity provider transformation scripts.

OPENAM-23610: The default value for the Return challenge as JavaScript (Legacy) property on the WebAuthn Authentication and WebAuthn Registration nodes is now not enabled. Ping Identity recommends that you keep this setting.

OPENAM-25329: The PingOne Protect Initialize node now includes an Additional Signals SDK Initialization Options attribute. This allows you to configure options that aren’t already defined in the node. The PingOneProtectInitializeCallback has been updated with new fields to support this.

OPENAM-25677: The PingOneProtectInitializeCallback now includes a universalDeviceIdentification field, which replaces the deprecated enableTrust field. The enableTrust field is still returned for backward compatibility.

IGA-4186^[2]: Fixed an issue for user LCM in the hosted account pages where large user populations weren’t correctly sorted and paginated.

OPENAM-22698: Fixed a bug that caused duplicate URIs in WS-Federation responses.

The following OAuth 2.0 scripts can now use the next-generation scripting engine, which gives them access to common bindings such as utils and openidm:

The following SAML 2.0 scripts can now use the next-generation scripting engine, which gives them access to common bindings such as utils and openidm:

AME-32969: You can now make sure the samlApplication binding is available for all SAML flows by enabling the application context in the hosted IdP or remote SP entity configuration. Previously this was only added in certain situations such as when using an application journey or IdP-initiated integrated mode.

AME-32997: Added an Allow Retry option to the Backchannel Initialize node that lets end users retry a failed backchannel authentication journey.

AME-33430: You can now include remote consent agent credentials in a Basic Authentication header for pushed consent requests.

AME-33930: A new testConnection action on the realm-config/services/pingOneWorkerService/workers/pingone-worker-service-name endpoint lets you test the connection from Advanced Identity Cloud to PingOne.

AME-33939: A new listLatestNodeDefinitions action on the realm-config/authentication/authenticationtrees/nodes endpoint provides a list of node definitions for the latest version of each node.

ANALYTICS-1383^[4]: The new historical change report feature provides a complete audit trail of changes to your managed identities. It tracks all modifications to user profiles, roles, accounts, and applications. You can easily generate reports to see what changed, who made the change, and when it happened, which gives you clear insights for compliance and security monitoring.

FRAAS-29084: Custom domains are now restricted to a maximum of 63 characters in the Advanced Identity Cloud admin console. This restriction has always existed on the system backend.

OPENAM-22125: A new Proxy Configuration tab in the Http Client Service configuration lets you use separate proxy configurations per HTTP Client instance.

OPENAM-24476: Added java.util.zip classes to the allowlist for the Scripted Decision node scripting context.

The following enhancements have been made to the nodes provided with Advanced Identity Cloud:

OPENAM-25371: Added a configuration property to the PingOne Verify Evaluation node to enable automatic redirection to the journey after an end user completes verification (when using the Redirect delivery mode).

OPENAM-25618: The new locales binding lets you return the localized version of a string from a translation map. It is available to next-generation Configuration Provider node, Journey Decision node, and Device Match node scripts.

OPENIDM-21493: You can now cancel a clustered reconciliation even when a route associated with the source or target system is unavailable.

AME-34191: You can now override the HTTP binding used to redirect users to the SAML error page. To do this, configure an ESV variable named esv-global-saml-error-page-http-binding and set its value to HTTP-POST or HTTP-Redirect. If you don’t set this variable, Advanced Identity Cloud uses the default value of HTTP-POST.

IAM-6546: End users now have more options to manage their devices in the hosted account pages. For each device, they can view when it was last used for sign on, view when it was added, edit its name, and delete it.

IAM-9672: In the advanced sync Mapping tab, if no properties have been mapped, it now shows a more accurate description of the target and source identity objects whose properties can be mapped.

AME-33653: Custom nodes now work with the Configuration Provider node.

AME-33808: If Node State Attribute For User ID is provided in the PingOne Protect Evaluation node, but the corresponding attribute is missing from the node state, the node triggers the failure outcome rather than using the user ID associated with the AM identity.

AME-34217: Added a version setting to the Configuration Provider node. This update provides the underlying infrastructure for a node versioning feature in an upcoming release.

AME-34034: Fixed an issue where omitting a shared secret label in the RADIUS Decision node caused Prometheus metrics to become unavailable.

ANALYTICS-1326^[4]: Fixed an issue in custom reports caused by relationships between custom identities that contain multiple underscores.

ANALYTICS-1367^[4]: Fixed an issue in custom reports caused by IP addresses in journey events.

OPENAM-23918: Resolved a race condition in the OATH Registration node and OATH Device Storage node where recovery codes could potentially be lost.

OPENAM-24065: Improved consistency for error responses across realms when processing illegal arguments. The /authenticate call now correctly returns a 400 (Bad Request) instead of a 500 (Internal Server Error) for invalid arguments.

OPENAM-25406: Added an identity.exists() method to next-generation objects returned by idRepository.getIdentity(). This lets scripts verify an identity’s existence in the identity store before further processing.

OPENAM-25646: For backward compatibility, we’ve restored the following deprecated fields sent to PingOne Protect by the PingOne Protect Initialize node (in the PingOneProtectInitializeCallback):

OPENAM-25779: Deletion of the samlApplication object is now deferred for unsuccessful authentication journeys so that the object is still available for subsequent sign-on attempts in the same session.

IAM-6640: Fixed an issue in the hosted pages theme preview where clicking Edit Personal Info opened two instances of the modal.

IAM-8221: Fixed an issue in the terms & conditions live preview where interactive elements weren’t disabled.

IAM-9620^[2]: Fixed an Identity Governance issue where clicking Save in the certification template creation wizard didn’t disable the button after submission, which could result in the creation of unintended duplicate templates.

IAM-9786: Fixed an issue where ESV placeholders manually entered into a field were always treated as strings, regardless of whether they were an array, list, or string.

IAM-9886: Fixed a display issue on the Reports Run History tab where the pop-up menu items weren’t displayed correctly.

FRAAS-29855^[5]: Fixed an issue where OTLP log streaming reported all Advanced Identity Cloud logs with am-core or idm-core as the source and omitted custom IDM event-hook logs. Logs streamed via OTLP now preserve their correct source (for example, am-authentication, am-access, idm-access) and include custom IDM event-hook messages.

OPENIDM-21718: The maxQueueSize for queued synchronization now defaults to 1000 and can’t be configured to a value higher than 1000 or lower than 100. The previous default was 20000.

RCS 1.5.20.34 is now available to download. To take advantage of these updates, you must manually upgrade your RCS implementation. Learn more in ICF release notes.

RCS 1.5.20.33 is now available to download. To take advantage of these updates, you must manually upgrade your RCS implementation. Learn more in ICF release notes.

Support for using older versions of the web agent with Advanced Identity Cloud is now deprecated. If you have web agents in your deployment, you should upgrade to 2024.11.2 or 2025.9 and later to ensure you remain compatible in the future. Learn more in Incompatible changes.

FRAAS-23284: RCS connections to Advanced Identity Cloud now have a default timeout value of 10000 (10 seconds) for new tenants. Existing tenants retain the default timeout value of -1 (no timeout).

FRAAS-29829: Removed a reference to "PingOne Advanced Identity Cloud" from the 404 Not Found error page.

IAM-4464: Next-generation configuration provider scripts created through the journey editor now contain the default config for the selected node type.

IAM-9709: Updated the journey editor to make fewer network calls when saving a journey that contains page nodes.

IAM-4345: Fixed an issue where vertical tabs were missing a hover state.

IAM-8033: Journey name field did not have a length check in place.

IAM-8226: When importing a journey, if you skip the download backup option but then return to it using the Previous link, it now completes the backup before offering the download.

IAM-9590: The message shown in the hosted pages for an unauthorized access attempt is now correctly centered on a single page.

IAM-9687: When you enter a valid ESV placeholder in the URL field of a bookmark application, the field is now immediately disabled and shows a delete icon to remove the placeholder.

IGA-4085^[2][5]: Fixed an Identity Governance access request issue where glossary schema properties displayed an extra space for nonexistent icons.

IGA-3980^[2][5]: Fixed an Identity Governance certification issue where the certification count on the Summary page didn’t include the certificationType query parameter.

OPENAM-25702: The PingOne Protect Evaluation node again supports a Node State Attribute For Username setting. PingOne Protect risk evaluation calls can depend on the username.

OPENIDM-21776: The Advanced Identity Cloud identity management service now uses synchronous HTTP client requests to connect to external identity management, REST, and token introspection services. This change prevents connection closure exceptions from terminating reconciliation.

FRAAS-13233: AM script validation now ignores ESV placeholders in commented-out code.

IAM-9803: The link to the access management native console from the Advanced Identity Cloud admin console now always correctly links to the Alpha or Bravo realm.

OPENAM-25707: Fixed PingOneProtectInitializeCallback processing to prevent unwarranted HTTP 4xx and 5xx errors.

OPENDJ-11576^[5]: Empty user attribute values are no longer considered when evaluating password policies.

AME-31153: Consent request data can now be pushed via backchannel.

AME-31429: A new field on the remote consent agent lets you include properties from the resource owner’s session as part of the consent request.

AME-31846: Next-generation Config Provider Node scripts can now access the following additional scripted node bindings:

AME-32064: The SAML2 Authentication node includes a new configuration option,Validate IdP Entity ID. When enabled, the node validates that the IdP entity ID from the SAML assertion is the same as the IdP entity ID configured on the node.

AME-32970: You can now access the application context for all OAuth 2.0 / OIDC flows through the oauthApplication binding by setting Enable Application Context in the OAuth 2.0 provider or at the client level. Previously, you could only use this binding when using an application journey.

IAM-8244: Adds support for bidirectional mappings in synchronization configuration.

IAM-8497: Added a brand administrator role to the Advanced Identity Cloud admin console. Brand administrators only have access to change hosted pages themes.

IAM-9484: Added ability to provide translation overrides for the Waiting Message field in the Polling Wait node and the Email Suspend Message field in the Email Suspend node. This lets you provide translations when the PollingWaitCallback or the SuspendedTextOutputCallback callbacks are added using scripts.

OPENAM-23711: Adds a Detect Connection Time Out option to the Social Provider Handler node. When enabled, connection timeouts from social identity providers result in the journey following the Timeout outcome.

OPENAM-24059: Adds support for the android-key WebAuthn attestation format.

OPENAM-24130: The PingOne Protect Evaluation node now lets you set the flow subtype that’s sent to PingOne Protect.

OPENAM-24137: You can now configure the PingOne Verify Evaluation node to obtain biographic matching data from the node state.

OPENAM-24350: Cryptographic keys can now be derived in next-generation scripts using the PBKDF2 algorithm.

OPENAM-24548: The PingOne Protect Initialize node now lets you obtain PingID Device Trust Agent attributes when going through a PingOne Protect flow.

OPENAM-24552: The PingOne Protect Evaluation node now lets you send a target application name in addition to the existing target application ID, in the PingOne Protect evaluation request

OPENAM-24554: The PingOne Protect Evaluation node now lets you use targeted PingOne policies.

OPENAM-24560: Removed the User Type and User Name fields from the PingOne Protect Evaluation node. The user type is always EXTERNAL and the user name is not applicable to external user types. Only the User ID is sent in the PingOne Protect evaluation request.

OPENAM-24587: You can now override the default Google Secret Manager key ID (kid) values with human-readable values. Find more information in Override default kid values.

OPENAM-25327: Next-generation OAuth 2.0 scripts can now access the redirectUris property on the clientProperties binding.

OPENAM-25417: You can now configure the SameSite attribute for cookies in the Set Persistent Cookie node and the Persistent Cookie Decision node.

OPENAM-25418: The attestation fmt type is now included in the transient state data of the WebAuthn nodes.

OPENAM-24309: The PingOne Verify Evaluation node now supports biographic matching using multiple user attributes.

AME-32307: Fixed an issue where end users weren’t able to continue a PingOne Verify journey that requested a QR code if they didn’t have a separate device to scan the code.

AME-32513: Added the suspend action to Custom nodes.

AME-32979: The Core Token Service (CTS) now stores AUTHENTICATION_WHITELIST tokens with millisecond-level precision for the expiry timestamp. This minimizes contention in indexes.

IAM-8766: Fixed an issue with mustRun journeys and query parameters such as forceAuth=true, where end users were authenticated then immediately unauthenticated.

IAM-9430: A warning is now displayed in the Advanced Identity Cloud admin console when a promotion would cause a deferred release tenant to be upgraded at the same time.

OPENAM-20582: Lets you configure a list of accepted JWT issuers for OAuth 2.0 clients. These are now accepted in addition to the OAuth 2.0 client ID for private key JWT authentication.

OPENAM-23929: Fixed a performance issue related to schema caching.

OPENAM-24297: Fixed an issue where the PingOne Verify Evaluation node incorrectly returned a failure outcome when the PingOne environment timed out during the identity verification process. This could happen if an end user didn’t engage with the QR code or selfie capture. The update correctly detects the TRANSACTION_TIMED_OUT status in PingOne responses and returns the timeout outcome, letting journeys handle timeouts distinctly from failures.

OPENIDM-21664: Fixed a provisioning issue where application assignment was failing to create local accounts when the user count exceeded 1000.

IGA-4071^[2][5]: Fixed an issue with dataflow job failures.

IAM-9663^[5]: The admin console now displays the useInPlaceholders and encoding attributes for existing ESV secrets.

IAM-9664^[5]: The admin console now defaults the useInPlaceholders attribute to true when creating new ESV secrets.

IAM-9395: Table columns are now resized uniformly across the Advanced Identity Cloud admin console.

IAM-9429: If your production environment is configured for deferred release, you can use the new /environment/promotion/promote endpoint to check if running a promotion will trigger a release upgrade.

IAM-9516: The tenant administrator profile page now prompts for re-authentication when adding or removing an MFA device.

OPENIDM-19400: New Prometheus metric for the availability of connector servers, for example:

OPENIDM-20341: Identity management scripts now natively support Base64 encoding using the btoa (encode) and atob (decode) global script bindings.

OPENIDM-20790: The openidm/sync/mappings endpoint now supports paging using either offsets or cookies.

OPENIDM-20933: Improved task scanner exception handling. If the task scanner encounters a task that results in an exception, it now aborts only that task and continues processing the remaining tasks. Previously, the scanner would abort the entire process when any task caused an exception.

OPENIDM-20937: New provisioner metric idm_icf_pending. Includes all the same tags as idm_icf*.

OPENIDM-21170: Metrics for router filters now use router_filter for the metric name and include a name tag to identify the specific filter.

OPENIDM-21171: Metrics for managed identity script hooks now use managed-script-hook for the metric name, object to tag the identity object, and script-hook to tag the script hook.

OPENIDM-21172: Metrics for custom endpoints now use the new custom_endpoint metric name and include a name tag based on the custom endpoint configuration name after the hyphen. For example, a custom endpoint configuration endpoint-onboardCustomer.json will generate metrics with a name tag/label of "onboardCustomer". The policy service makes use of an internal scripted endpoint based on the file policy.js, and its metric name is policy-js.

OPENIDM-21233: The openidm/health/ready endpoint has been enhanced to include the number of waiting requests. A new set of metrics have been added to provide a historical accounting of IDM health.

FRAAS-28885^[5]: ESV secret useInPlaceholders attribute is now taken into account by promotion integrity checks.

IAM-9466: Annotation comments added to sub-nodes are now saved correctly.

IAM-9496: The tooltip in journey comments now correctly displays the creator’s name without overflow.

IAM-9527: The hosted account pages logo now correctly uses the height specified in the theme.

OPENICF-3277: The SaaS REST connector no longer throws a NullPointerException when attributes are missing in the request payload.

OPENIDM-20525: The cn and telephoneNumber schema for alpha_user and bravo_user are now scope: public and searchable: true. This schema change applies to tenants created on or after December 3, 2025. Existing tenants are unchanged.

OPENIDM-20863: Default values for multivalue mappings are now copied by value to prevent unintended mutations during runtime.

OPENIDM-21421: Updating the configuration of an inactive provisioner no longer throws an IllegalStateException.

OPENIDM-21454: Every failed record from a live sync is now stored in the dead-letter queue with a unique entry ID.

FRAAS-28370: Fixed an issue where requests to the /monitoring/prometheus/am and /monitoring/prometheus/idm endpoints occasionally didn’t return timely responses.

IAM-1709: Exposed useInPlaceholders and encoding attributes when creating ESV secrets in the admin console.

IAM-9312: Table columns are now resized uniformly across the following Advanced Identity Cloud admin console pages:

IAM-9323: Added Metadata tab to user resource page to display properties such as createDate and loginCount.

IAM-9217: Fixed cron schedule validation for new jobs.

AME-30984 and AME-30609: Enhanced authentication audit logging to include the SAML Identity Provider (IdP) and Service Provider (SP) entity IDs during SAML flows. This information lets you report on the SAML applications users are accessing, supporting analytics and dashboarding efforts.

AME-30985: In SAML v2.0 single sign-on (SSO) flows, the JSON web token (JWT) created in the browser’s session storage no longer expires.

AME-31082 and SDKS-3681: Added support for device token refreshing to the Push Notification Service endpoint, enabling the reception of new tokens from mobile devices.

AME-31351 and AME-31471: Improvements to the Device Code flow mean that end users are now prompted to reauthenticate even when there’s an existing session for must-run and app journeys.

AME-31398: The PingOne Protect Evaluation node has been enhanced to support custom attributes. To specify custom attributes to be used in PingOne Protect for custom predictors, set the Node State Attribute For Custom Attributes in the node configuration. The node retrieves a map of custom attributes from the node state to be used in the evaluation request to PingOne Protect.

AME-31656 and AME-31468: The PingOne Protect Evaluation node has been enhanced to support dynamic risk policy IDs and target app IDs. To set the risk policy set ID dynamically, enable Use Node State Attribute For Risk Policy Set ID in the node configuration. To set the target app ID dynamically, enable Use Node State Attribute For Target App ID in the node configuration. This instructs the node to obtain these IDs from the node state.

AME-31487: Improvements to SAML v2.0 standalone mode include replacing legacy JSPs with URL endpoints.

OPENAM-23051 and AME-31918: A new ESV, esv.oauth2.request.object.restrictions.enforced lets you enforce stricter adherence to the PAR and JAR specifications.

IAM-8236: The ability to edit journeys from the AM native admin console has been removed. Use the Advanced Identity Cloud admin console to edit journeys.

IAM-9000, IAM-9001: Add annotations and sticky notes to journeys to assist learning and collaboration.

IAM-9237: Allow ESVs to be embedded in URL fields for federation IdPs. This lets you set up federation IdPs with fewer ESVs because you can define a single ESV containing a UUID shared by multiple URL fields.

IAM-9246: Table columns are now resized uniformly across all table views.

OPENAM-20776: A new OIDC client configuration option, Private Key JWT Audience, lets you configure and override the audience (aud) claim of a Private Key JWT.

OPENAM-21783: Improved token management for OAuth 2.0 client applications.

OPENAM-23669: Full scopes (scopes ending in *) can now be used by service accounts in all cases where more specific scopes (for example, :read) are used.

OPENAM-23710: The httpClient binding is now available to legacy SAML 2.0 IdP adapter scripts.

OPENAM-23850: Enhanced the PingOne Verify Evaluation node with an Allow same device verification option that lets end users continue verification on their current device.

OPENAM-23867: The LDAP Decision node no longer logs credential failures as errors. It now logs them at the info level.

OPENAM-24062: Added support for the ECDSA algorithm to the utils.crypto.subtle next-generation binding. This algorithm is supported for key generation, signing, and verification.

AME-31351 and AME-31471: Improvements to the Device Code flow mean that end users are now prompted to reauthenticate even when there’s an existing session for must-run and app journeys.

AME-31481: Validation around policy creation has been improved. If you’re using the legacy "Policy" environment condition (or a custom environment condition), you’ll need to add that to the list of allowed environment conditions for your policy set to create or update policies that use that condition type.

IAM-9153: Password validation now works correctly when pasting a value that matches the existing value.

OPENAM-20749: A new ESV, esv-enable-oauth2-sync-refresh-token-issuer causes a stateful OAuth 2.0 introspect response to overwrite the iss claim of the introspectable token. To enable this behavior, set this ESV to false.

OPENAM-23770: Canceling a WebAuthn flow now results in a Client Error outcome, rather than an internal failure.

OPENAM-24159: Fixed an issue that prevented multiple Identity Assertion nodes from being used in a single journey.

OPENAM-24486: Improved performance when creating large numbers of OAuth 2.0 clients simultaneously.

OPENDJ-11486: Fixed an exception caused when identity management queries for users with a filter containing wildcards and specific object classes.

RCS 1.5.20.32 is now available to download. Learn more in ICF release notes.

IAM-9374: Fixed an issue where managed identity searches were querying all properties, causing slow performance.

ANALYTICS-582^[8][4]: Custom objects can now be used as data sources for reporting. The system uses an object’s configured title for the data source name, makes its properties available as attributes, and represents all object relationships.

ANALYTICS-1165^[8]: Added the capability to change a report name.

ANALYTICS-1195^[8]: Added the ability to import and export report templates using reports API endpoints.

FRAAS-25919: You can now use the API to configure custom domains for the Advanced Identity Cloud admin console.

IAM-8922: The Advanced Identity Cloud admin console now accepts ESV placeholders for the following federation fields:

IAM-8982^[2]: Add event function for setting the query filter/select options of a select field.

IAM-9066: Added Tenant Auditor option to Advanced Identity Cloud admin console federation groups claim.

IAM-9099, IAM-9146, IAM-9167: Many table views now support column resizing and customization.

IAM-5488: Terms and Conditions now respects target attribute in anchor tags.

IAM-6588: The Advanced Identity Cloud admin console now correctly displays journey status for journeys disabled and enabled using ESVs.

IAM-8887: Prevent browsers auto-filling passwords in user registration journeys.

IAM-8940: Managed identity number property now accepts float values.

IAM-8956: Deselecting the Personal Information option now disables the section containing the user avatar in hosted account pages.

IAM-9169: Fixed styling for responsive table layouts with sticky action column in Identities table views.

OPENIDM-21372: Advanced Identity Cloud now prevents access to the identity repository endpoint, /openidm/repo. This prevents uncontrolled and potentially incompatible schema changes.

Best practices for naming and arranging PingOne environments.

Best practices for configuring PingOne workers and Advanced Identity Cloud worker services when integrating with PingOne products.

How to configure, test, and optimize PingOne Protect.

OPENAM-24476^[3]: Added java.util.zip.Deflater, java.util.zip.Inflater, java.util.zip.DeflaterOutputStream, and java.util.zip.InflaterInputStream to the allowlist for Scripted Decision nodes.

FRAAS-24857: CNAME verification is no longer required when creating a custom domain.

FRAAS-25547: The sender address for emails sent to Advanced Identity Cloud tenant administrators is now saas@pingidentity.com.

FRAAS-26063: You can now override the samlErrorPageUrl. To do so, configure an ESV variable named esv-global-saml-error-page-url and set its value to your SAML error page URL. If you don’t set this variable, Advanced Identity Cloud uses the default value of /saml2/jsp/saml2error.jsp.

FRAAS-25734: Exception stacktraces in access management and identity management logs are now truncated to approximately 300-400 lines.

FRAAS-25821^[9]: Fixed an issue that prevented IP rules in Proxy Connect from being disabled.

AME-32756: Fixed an issue with policy evaluation returning results from a stale policy index cache.

OPENDJ-11634: Advanced Identity Cloud now prevents searches with many results and no applicable index from overloading the system.

OPENAM-24384: Added javax.crypto.SecretKeyFactory, javax.crypto.spec.PBEKeySpec, and com.sun.crypto.provider.PBKDF2KeyImpl classes to the allowlist for the OAUTH2_ACCESS_TOKEN_MODIFICATION scripting context.

OPENAM-24393^[3]: Fixed an issue where the InnerTreeEvaluator node failed for authentication journeys initially accessed using REST without an authId.

AME-31372^[5]: An Agent journey is now available by default in both Alpha and Bravo realms. The Agent journey makes it easier to integrate with Ping Identity agents and gateways. It validates the agent credentials with an Agent Data Store Decision node.

AME-30050: You can now enable a next-generation script in the AM native admin console native console to run after a Dynamic Client Registration request is processed.

AME-30716: Removed Failed to create SSO Token from logs at warning level. To observe these warnings, increase the log level to debug.

AME-30801: The Inner Tree Evaluator node now has an optional Error Outcome that lets you capture exception details if an exception occurs during the evaluation of the child journey.

FRAAS-25818: The built-in SMTP server in new tenants now has a limit of 10 emails per minute and a fixed email sender address with the format noreply@<tenant-fqdn>.

IAM-7581: Text wrapping in table views has been improved for readability.

IAM-8573: IDM now includes an endpoint to retrieve individual themes from the /themerealm configuration using either an ID or a _queryFilter by name. This improves performance and ensures reliable theme loading, even on slow networks.

IAM-8610: When you create an SSO application for Microsoft 365, the application now generates a signing certificate, which you can download or rotate as needed.

IAM-8633: You can now add, remove, and rearrange table columns for managed identities and application provisioning tables.

IAM-8925^[11]: In Identity Governance, you can now configure actions that trigger automatically when a form first loads or when a user changes the value of a specific field.

OPENAM-22467: Customers can now provide any value in the typ header in JWTs.

Greater control over journey session duration and authenticated session timeouts:

OPENAM-23438: Following WebAuthn registration and authentication, new information is added to the transient state.

OPENAM-20709: On successful authentication, the WebAuthn Authentication node now adds the UUID of the device (webauthnDeviceUuid) and the name of the device (webauthnDeviceName) to the shared state. This lets you track the use of biometric authentication and the device used to authenticate.

AME-30969: If the OIDC Claims Plugin Type in the OAuth 2.0 provider is set to SCRIPTED but no script is selected, the userinfo endpoint now returns the sub claim, in compliance with the OIDC specification. Previously, the userinfo endpoint returned an empty JSON object. If you still require this behavior, set the esv-scripting-legacynulloidcclaimsscriptbehaviour ESV to true.

IAM-4397: Fixed an issue in the hosted journey pages where the prompt text for the Choice Collector node wasn’t fully visible and the default option wasn’t visible at all.

IAM-8632: Fixed an issue where validation errors were incorrectly displayed for pre-populated fields.

IAM-8789: Managed identity modals now correctly handle both single-value and array-based enum types.

IAM-8871: The hosted account pages no longer freeze and throw an error when editing details if there are empty custom enum array values.

IAM-8902: The application username field in SAML 2.0 NameID flows is now correctly set to uid instead of username.

IAM-8933: Fixed an issue in the Advanced Identity Cloud admin console when creating or modifying identity objects with a required boolean property. You can now set the value of the required boolean property to false.

IAM-9062: Hosted pages themes no longer continuously refresh when trying to set up or confirm two-factor authentication (2FA).

OPENAM-20749: For server-side OAuth 2.0 tokens, the /oauth2/introspect response can now overwrite the iss claim of the introspectable token. To enable this behavior, set the esv-enable-oauth2-sync-refresh-token-issuer ESV to false.

OPENAM-22928: When agents authenticate to Advanced Identity Cloud, the session created no longer expires.

OPENAM-23303^[5]: Fixed an issue where access management scripts were failing to load because they contained strings that resembled configuration placeholders. The code that parses these scripts now correctly ignores configuration placeholders and any strings that resemble them.

OPENAM-23334: You can now use the mergeShared and mergeTransient methods to add nested objects to ObjectAttributes.

OPENAM-23519: Improved error handling during WebAuthn registration when the Android lock screen isn’t enabled.

OPENAM-24159: Fixed an issue with Identity Assertion nodes failing if there are more than one in a journey.

AME-31379: Setting the new ESV esv-oauth2-provider-request-object-processing-enforced to true now lets admins enforce which validation rules are applied when processing OAuth 2.0 request objects.

FRAAS-25437: Tenant administrators with the tenant-auditor role can now use federated access to authenticate to Advanced Identity Cloud.

IAM-3441: Added pagination to all list views.

IAM-7265: You can now right-click a node in the journey editor to access a context menu.

IAM-7266: Added an action bar to the journey editor that lets you deselect or delete currently selected nodes.

IAM-7580: Pages now span the full width of the screen, improving navigation and usability.

IAM-8260: Advanced Identity Cloud now supports multiple WS-Fed^[7] applications.

IAM-8640: The Release Notes link in Tenant Settings now opens the release notes for the tenant’s specific version.

IAM-8714^[2]: You can now configure columns in the Identity Governance access review page.

OPENIDM-21206: Usernames and application names must now be unique, as enforced by the datastore.

IAM-7413: The reCAPTCHA Enterprise node is now fully supported.

IAM-8489: Fixed an issue with the display of application logos in the hosted account pages.

IAM-8770: Fixed an issue with the calendar icon position in date fields.

IAM-8773: Fixed an issue where key actions such as realm login were blocked in older tenants with an unmodified original theme.

The RCS 1.5.20.30 release is now available to download. Learn more in ICF release notes.

The PingGateway 2025.6.1 release is now available to download. Learn more in PingGateway 2025.6.1.

IAM-8314^[3]: Fixed an issue where setting ESVs in connector or provisioner configuration stops the Advanced Identity Cloud admin console from being able to update connectors or run a liveSync operation.

FRAAS-25155: Increased log batching size to avoid truncation of large JSON log entries.

ANALYTICS-868: The Tenant Admin Activity report has been changed to the Tenant Admin Initiated Entity Type Changes report. The new report provides more detailed and business-friendly insights into changes made by tenant administrators:

IAM-8405: You can now duplicate out-of-the-box reports.

IAM-8591: Dynamic sorting for report results. You can now sort report results directly in the Advanced Identity Cloud admin console after running a report.

FRAAS-25142: Fixed a memory issue in the ESV service.

FRAAS-25434: Fix issue causing source to sometimes be defined as unknown in /monitoring/logs/* endpoints.

FRAAS-25226: Allow a higher threshold for large JSON log entries before splitting them into smaller plaintext log entries.

FRAAS-23329: Access to ESV REST API endpoints using the fr:idm:* scope is now deprecated.

FRAAS-23330: Access to ESV REST API endpoints using resource version 1.0 is now deprecated.

FRAAS-25269: The IDC.CLI OAuth 2.0 client is now deprecated in existing tenants and no longer provisioned in new tenants.

FRAAS-25205: Consolidated End User UI, Login UI, Administrator Registration UI, and Administrator UI status page components into a single Administrator UI component as they were all reporting the same service.

IAM-2453^[5]: Hosted pages themes now show the loading spinner until they are fully loaded.

IAM-4769^[5]: Hosted journey pages now fall back to the default theme if a journey is configured with a deleted theme.

IAM-6781^[5]: Password policy hints now show all policy conditions when creating a new user identity in the Advanced Identity Cloud admin console.

IAM-7615^[5]: The Certificate Collector node now validates the value set in the HTTP Header Name for Client Certificate field based on the value selected in the Certificate Choice Method field.

IAM-8358^[5][2]: Hosted account pages now display a New User button in the Users list view for delegated administrators.

OPENIDM-15771: You can now set locales in identity management scripts with the _locale parameter.

OPENIDM-17680: Advanced Identity Cloud now supports enumerations in string and number attributes of its identity schema. To make an attribute an enumeration, add "enum" : [ "one", "two", "three" ] to the attribute. Advanced Identity Cloud requires create and update privileges to use one of the enumerated values.

OPENIDM-19918: You can now choose whether synchronization detects identity array changes using ordered or unordered comparisons. Set the comparison configuration property in the schema. Unordered JSON array comparison ignores the order of elements and can negate the need for certain custom scripts within mappings. Relationship and virtual property array fields default to unordered comparisons. All other fields default to ordered comparisons.

OPENIDM-20023: RCS communication with Advanced Identity Cloud can now use stricter authorization. Learn more in Secure RCS access and Migration dependent features.

FRAAS-25256: Fixed an issue that was causing missing data in analytics dashboards.

IAM-1479^[5]: Email field validation in the Advanced Identity Cloud admin console now runs only when typing stops or the field is unfocused.

IAM-7858^[5]: Hosted account pages now use the access management maxIdleExpirationTime value to prompt the You will be signed out soon modal.

IAM-8382^[5]: Fixed an issue in the bookmark app where the URL field validation stopped the Create Application button working the first time it was clicked.

IAM-8383^[5]: Fixed an issue in the bookmark app where the URL field accepted ESV secrets.

IAM-8398^[5]: Field labels positioned above a field now remain left aligned when autofill is triggered.

IAM-8441^[5]: Fixed a display issue in the Advanced Identity Cloud admin console where connector servers and connector server clusters with long names went off the edge of the screen.

OPENAM-21783: Improved token management for OAuth 2.0 clients that override the Use Client-Side Access & Refresh Tokens setting. The OAuth 2.0 applications endpoint now correctly shows all tokens issued to these clients. Additionally, administrators can now successfully revoke any of the tokens issued to these clients.

OPENDJ-11486^[5]: Fixed an exception caused by identity management user queries with a filter containing wildcards and specific object classes.

ANALYTICS-1004^[4]: Support for custom attributes and relationships in the organization entity for advanced reports.

OPENAM-23218: Legacy SAML 2.0 IDP attribute mapper scripts now have access to the httpClient binding.

OPENAM-23710: Legacy SAML 2.0 IDP adapter scripts now have access to the httpClient binding.

OPENIDM-20995: Fixed an issue that prevented error reports during certain operations on groups or users. For example, trying to remove a non-existing attribute or null value now correctly results in an exception message to the client if these operations are not supported by the target system.

IAM-987: Added support for enums (drop-down lists) to hosted account pages.

IAM-1116: Added support for enums (drop-down lists) to the Advanced Identity Cloud admin console.

IAM-2103: Added support for enums (drop-down lists) to hosted journey pages.

IAM-6822: Added the ability to manage cookie domains in the Advanced Identity Cloud admin console.

IAM-7412: Updated the password policy feature in the Advanced Identity Cloud admin console. Added the ability to specify a minimum substring length between 3 - 64 to use when validating passwords against user attribute values. The default is still 5 characters, but can now be reduced to as few as 3 characters to catch shorter string matches.

IAM-7794^[2]: Added support for using custom identity objects in the form builder.

IAM-7919: Improved color contrast ratio of the Delete Account button text when focused.

IAM-7934: Improved color contrast ratio of date fields when focused.

IAM-7957: Improved color contrast ratio of the Deselect button text when focused.

IAM-7966: Improved color contrast ratio of In Progress text.

IAM-8016^[2]: Allow form authors to specify a user filter when dynamic enums are selected.

IAM-8085: Updated the Add a Parameter reports modal to use entity attributes for input.

FRAAS-15518: Fixed issue that prevented localization of Session timed out message in certain locales.

FRAAS-24449: Enhanced the reliability of metrics collection under high-load conditions.

FRAAS-24990: Fixed an issue where requests to the /monitoring/logs and /monitoring/logs/tail endpoints timed out after 15 seconds rather than the expected 60 seconds.

IAM-5834: Fixed a double-encoding issue in the SAML app that affected IdP-initiated sign on.

IAM-6796: Jobs are now prevented from being scheduled with frequencies that cause invalid date errors.

IAM-7855: Fixed a typo in the help text returned when there are no results to display.

IAM-8237: Corrected floating labels in the date picker in the hosted journey pages.

IAM-8361: The Save button in the Edit Bookmark application is now inactive while checking if the ESV exists.

IAM-8364: Fixed issues in SAML end-to-end scenarios.

IAM-8378: Fixed an issue that stripped HTML elements from email templates.

IAM-8403: Fixed border focus location and floating label issues in Tag fields.

IAM-8434: Fixed an issue that prevented duplication of new themes that contain special characters.