Microsoft Internet Explorer 11

Ping Identity commits to deliver the best experience for our administrators and users. As we continue to improve our products, we encourage our customers to migrate off of Microsoft Internet Explorer 11. We intend to remove Internet Explorer 11 from our qualification process in December 2021.

Groovy changes

If you created Groovy scripts in PingAccess 4.3 or earlier, your Groovy scripts might use undocumented capabilities that don't work in PingAccess 5.0 or later. To check your scripts, review your scripts with the current Groovy Development Reference Guide, or use a test environment to evaluate the scripts.

To use a test environment:

  1. Install PingAccess 5.0 or later. This installation is only used for script evaluation purposes.
  2. Import your existing groovy scripts to the new environment. Script this process using the Admin APIs.
  3. Review the logs and the JSON error message from the Admin API. If a script is not compatible with PingAccess 5.0 or later, the import fails, and the log or message indicates the cause of the failure.
  4. Review the scripts that failed to import into PingAccess 5.0. Evaluate scripts that are not compatible with PingAccess 5.0 or later and update or replace them.

Zero downtime upgrade version support

The zero downtime upgrade procedure is not supported for initial versions earlier than 4.2.3. If you are using an earlier version, you must upgrade using the standard upgrade process.

Performing a zero downtime upgrade from 6.0, 6.0.1, 6.0.2, or 6.0.3 to a later version

If you are using PingAccess 6.0, 6.0.1, 6.0.2, or 6.0.3, zero downtime upgrades to later versions can fail due to PKCE changes.

To prevent this issue, edit your existing web sessions and enable PKCE support.

  1. Click Access and then click Web Sessions > Web Sessions.
  2. Expand the web session and click Pencil icon.
  3. Click Show Advanced.
  4. Click Enable PKCE.
  5. Edit the web session. Click Save.
  6. Repeat these steps for each web session.

New templates for error and logout pages

PingAccess 6.1 updated several error and logout page template files to modernize their appearance and remove Ping branding:


For more information about the templates, see User-facing page customization reference. If you have previously customized the template files, you can re-customize them using the new files.

Using a proxied PingFederate deployment

PingAccess 6.2 Beta introduced the ability to configure a proxied PingFederate deployment through PingAccess. If you have manually configured a similar deployment in an earlier version of PingAccess, you can continue to use it. If you plan to switch, review the configuration options in the proxied PingFederate deployment UI to verify that it can manage the use cases of your current configuration, and remove any PingFederate-related applications before migrating the configuration.

6.3.2 incremental maintenance package unavailable

Upgrades from PingAccess 6.3 versions prior to 6.3.2 do not support the incremental upgrade package and must use the Upgrade Utility to perform the upgrade.

SPA support

The SPA support check box was removed from the Admin UI for web type applications in PingAccess 6.2. As a result, all web type applications created in the admin UI in PingAccess 6.2 and later have SPA support enabled by default. The SPA support check box is still available for API type applications and Web + API type applications. For more information, see Application field descriptions.


If the default settings for SPA support with web type applications aren't compatible with your environment or with a specific application, create an authentication challenge policy to replace these settings and achieve the desired behavior. For more information, see Configuring authentication challenge policies.