PingOne Advanced Identity Cloud

Regular channel changelog

This is a changelog entry for version 23604.12. You can review the changelog for all versions in Regular channel changelog.

29 Sep 2026

Version 23604.12

Key features

Support for OAuth 2.0 Client ID Metadata Documents (CIMD) (AME-33561)

Advanced Identity Cloud now supports CIMD. This allows AI agents and other external clients to identify themselves through a hosted metadata document instead of requiring prior registration or dynamic client registration.

Enhancements

  • OPENAM-23858: A new Store Software Statement in OAuth2 Client setting on the OAuth 2.0 provider stores the software statement provided during dynamic client registration (DCR) in the client configuration. When stored, the software statement is returned in DCR read responses.

  • OPENAM-27412: The v2.0 OATH Registration node adds the ability to use any profile attribute as the username in the authenticator app. Select Custom in the Account Name configuration option to display Custom Account Name Attribute where you enter the required profile attribute.

  • OPENAM-26474: Access tokens can now be issued with authorization_details through the authorization code and refresh token grants, if the details were granted during authorization.

  • OPENAM-27658: A new Allow audience members to introspect tokens setting on the OAuth 2.0 provider lets any client whose client_id appears in a token’s aud claim introspect that token, not just the issuing client. This lets resource servers that receive tokens through token exchange validate them without a special scope.

  • OPENAM-27945: You can now customize the redirect URI returned by the backchannel transaction initialize endpoint using the redirectUrlType and customRedirectUrl parameters, aligning its behavior with the Backchannel Initialize node.

  • OPENAM-27947: Backchannel transactions now record the authenticated subject on completion, even when no session is created. A subject declared before authentication is preserved.

  • OPENAM-28147: New versions (v2.0) of the LDAP Decision node and the Identity Store Decision node are available. These versions improve username handling.

  • OPENAM-28247: The new Authentication Request Storage option on the hosted IdP lets you configure where to store SAML authentication requests so that concurrent SAML SSO attempts in multiple browser tabs or browsers can complete independently.

  • TNTP-278: The ThreatMetrix nodes have been renamed to LexisNexis Dynamic Decision Platform (DDP) nodes. The LexisNexis InstantID Question and Answer (IIDQA) nodes have been updated to store the decision API responses in shared state.

  • TNTP-284: You can now configure the LexisNexis DDP Profiler node to inject scripts in the head element or in an iframe.

Fixes

  • OPENAM-26135: EC key attestation is now supported for Android device binding, resolving key attestation failures with newer Google hardware attestation root certificates.

  • OPENAM-26285, OPENAM-28428: Fixed an issue where CIBA backchannel authentication requests were rejected for omitting the optional acr_values claim. Advanced Identity Cloud now falls back to the client’s or provider’s default ACR values, and then to the realm’s default authentication journey. When a client has multiple default ACR values, Advanced Identity Cloud now uses them in preference order.

  • OPENAM-28099: v2.0 of the Configuration Provider node fixes an issue where the Retry Limit Decision node’s retry count was not cleared from the user profile on successful journey completion.

  • OPENAM-28317: The reCAPTCHA Enterprise node now logs errors when its Google project, site key, or API key secret is misconfigured, making failures easier to diagnose.

  • OPENAM-28364: v1.0 of the Page node is now deprecated. Use the latest version instead.

  • OPENAM-28699: Fixed an issue where systemEnv.getProperty() returned null for ESVs in next-generation SAML 2.0 IdP attribute mapper scripts.