Regular channel changelog

AME-33978: The Enable Connection via Credential toggle for the PingOne Worker service now automatically enables or disables the relevant connection fields based on your selection.

AME-35088: You can now use a new validate action on the secrets endpoint to validate whether a secret mapping resolves to a valid secret in the configured secret store.

FRAAS-33591: The promotions API now returns report metadata ordered by creation date, with the most recent first.

IAM-3954, IAM-10782: Improved accessibility of numeric input fields and list fields throughout the admin console.

IAM-10610: You can now mark parameters in custom reports as optional, giving you more flexibility when running reports.

IAM-10764: Journey annotation notes now display multi-line formatting in view mode, matching how they appear when editing.

IAM-10917: The deferred release environment message displayed in a modal during promotions now uses clearer language and explains that updating your production release version during promotion is standard practice.

IGA-4435^[1][2]: Added an Object Types tab to the unmanaged application edit view, enabling administrators to define, manage, and reorder object type properties and import schemas.

IGA-4453^[1][2]: Added an Activity tab to the account detail view, giving administrators visibility into activity history for individual accounts.

IGA-4461^[1][2]: Improved the My Requests list view to display approval status, fulfillment status, and errors for each request.

IGA-4510^[1][2]: Improved the approval task view to display the name of the approver when the task was assigned to a role and has been completed.

OPENAM-26326, OPENAM-26452^[3]: A new realm-level OAuth2 Provider setting, Enable Rich Authorization Requests with RCS, lets Advanced Identity Cloud process authorization_details requests when an RCS is configured. This setting also controls whether authorization_details_types_supported is advertised on Advanced Identity Cloud’s well-known endpoint.

OPENAM-26458^[3]: You can now configure Authorization Detail Type(s) on individual OAuth 2.0 clients to control which authorization detail types, as defined in RFC 9396 Rich Authorization Requests, each client can request.

OPENAM-26470^[3]: Dynamic client registration requests can now include authorization_details_types to register the authorization detail types an OAuth 2.0 client supports.

OPENAM-26721: You can now skip signature verification when importing SAML metadata.

OPENAM-26073: Advanced Identity Cloud now includes v2.0 of the Patch Object node. This new version removes the Patch as Object configuration option and always updates the managed identity object as Advanced Identity Cloud. The v1.0 node is deprecated but continues to work in existing journeys.

OPENAM-27493^[2]: You can now configure OAuth2 Provider settings, including scripted JWT issuers, in the Advanced Identity Cloud admin console under Authorization > OAuth2 Provider.

OPENAM-27494^[2]: You can now configure Android Key Attestation, Jumio, and OneSpan identity verification settings in the Advanced Identity Cloud admin console.

OPENAM-27495^[2]: You can now configure push authentication, push notification delivery, TOTP, WebAuthn, and device binding settings in the Advanced Identity Cloud admin console under Authentication > Authentication Methods.

OPENAM-27496^[2]: You can now configure the Remote Consent Service in the Advanced Identity Cloud admin console under Authorization > Remote Consent Service.

AME-34781: Fixed an issue where the Add AI Agent button in the AM native admin console caused an error for Advanced Identity Cloud tenants. This button is now hidden but you can still add agents through the Advanced Identity Cloud admin console.

AME-34898: Fixed an issue where SAML SSO flows could use a circle of trust set to Inactive.

ANALYTICS-1557^[4]: Optimised analytics query execution to resolve a processing issue affecting dashboards and internal metrics.

FRAAS-32040: Fixed a deadlock where the /environment/startup endpoint became unresponsive when Advanced Identity Cloud services failed to start because of bad configuration.

IAM-6882: Fixed an issue where the admin console displayed the incorrect product name.

IAM-7788: Fixed an issue where the Next Generation scripts editor displayed unpublished environment secrets and variables.

IAM-8343: Fixed an issue where the delete button for ESVs was not disabled for tenant auditors.

IGA-3972^[1][2]: Fixed an issue where the selected filter value in the requests view reset to the default when navigating to a record or switching tabs.

IGA-4363^[1][2]: Fixed an issue where applying a date or text multivalued glossary field filter in the hosted account pages returned an error instead of filtered results.

IGA-4393^[1][2]: Fixed an issue where a boolean glossary attribute set to false was omitted from the entitlement API response instead of returning the correct value.

IGA-4598^[1][2]: Fixed an error in the Approval Task workflow node that caused the task to fail when an expiration notification was configured.

IGA-4651^[1][2]: Fixed an issue where account create, update, and delete events from connected applications were missing from IGA audit data.

IGA-4654^[1][2]: Fixed a form validation error in the new certification template wizard that prevented users from navigating past the first section.

IGA-4662^[1]: Fixed an issue where entitlement mappings used application display names instead of stable connector IDs, which could cause incorrect behavior if application names changed or contained special characters.

IAM-10686: Fixed an issue where navigation labels in the hosted pages editor wrapped inconsistently compared to the hosted account pages.

IAM-10728: Fixed a pagination issue where organization administrators with a limited user scope saw a no users found error after navigating past the last page of the user list.

IAM-10780: Fixed an issue where exporting a journey containing a Device Profile node with a custom matching script did not include the script, causing import failures.

IAM-10812: Fixed an issue where the edit icon in the Inner Tree Node and Scripted Decision Node opened an intermediate list instead of navigating directly to the linked resource.

OPENAM-23079^[2]: Fixed an issue where the Apple social provider failed on Android devices. During native authentication flows, Advanced Identity Cloud was not including the code_verifier in requests to Apple’s token endpoint, which caused an invalid_grant error.

OPENAM-25429: The default Minimum Secret Key Length on the OATH Registration and Combined MFA Registration nodes has increased from 32 to 40 characters, for compatibility with Google Authenticator.

OPENAM-25556^[2]: Advanced Identity Cloud now honors the pubKeyCredParams sequence in WebAuthn credential creation requests.

OPENAM-25801: Fixed an issue where the SAML SP adapter returned the wrong failure code when it couldn’t map an assertion to a user profile.

OPENAM-26086: Advanced Identity Cloud no longer relies on an oversized browser cookie to carry the full OAuth 2.0 /authorize request through the login flow. Instead, it stores that request state securely in CTS (Core Token Service) and restores it after authentication. This prevents large requests, such as ones with a big id_token_hint, from failing with missing client_id after the user successfully sign on.

OPENAM-26106: Resolved an issue where the IdP account mapper could return the NameID value from the wrong SAML entity when a remote SP was used in multiple circles of trust with different NameID value mappings.

OPENAM-26180: Fixed an issue where ETag assertion was causing noisy CTS session assertion failures.

OPENAM-26834^[2]: Hardened realm path handling for API requests to prevent potential security bypass.

OPENAM-28330^[2]: Fixed an issue where CDNs cached transient 404 errors for static assets during rolling deployments for up to 30 days, instead of treating them as non-cacheable.

OPENDJ-12269^[2]: Fixed an issue where the password substring check rejected passwords containing attribute values shorter than the minimum substring length, such as a two-character surname. Attribute values shorter than the minimum substring length are no longer checked for substrings by default.