Previous PingOne SSO for SaaS Apps releases - PingOne for Enterprise

Manual Connection IdPID

Removed the ability to change the idpid value for an existing manual customer connection.

The idpid value acts as the identifier for an IdP connection, and changing it can cause unexpected behavior.

If you need to change the idpid value, you can create a new manual connection.

For more information, see What is an idpId?.

SSO/SLO

Increased the max-age parameter of the strict-transport-security header for the https://sso.connect.pingidentity.com/sso/ endpoint.

The previous max-age was 1 year. The new max-age is 2 years.

Custom Entity ID

Added the ability to define a custom entity ID for applications that are enabled through PingOne.

If a custom entity ID is in use by a non-multiplexed connection, it cannot be changed.

For more information, see Add or update other applications.

SSO Summary Report

Added a new SSO User Count report type.

The SSO User Count report counts the total number of unique users for a customer during the specified period. You can run the report either by customer name or IdP ID.

For more information, see PingOne for Enterprise report types.

Customer Connection API

Added a feature allowing you to delete customer connections and application connections using the customer connection API.

For more information, see PingOne SSO for SaaS Apps Customer Connection API.

Admin Portal Banner

Added a feature allowing you to display a banner message in the administrative portal.

For more information, see Assign branding and design.

Read-Only Administrative Roles

Added a feature allowing you to assign user groups to read-only versions of administrative roles.

Read-only roles allow administrators to access the areas of the admin portal normally allowed by that role, but not to change settings.

For more information, see Configure SSO to the admin portal.

Verbose Reporting

Added a feature allowing more detailed reports and subscriptions for partner accounts with OIDC identity providers.

For more information, see Creating and administering a partner account.

Account ID

Added a feature allowing administrative users to look up their unique account ID.

To find your account ID, go to Account > Properties.

Invited Connection Contact Email

Added a feature allowing administrators to change the contact email for invited accounts.

For more information, see Edit an invited customer connection.

Customer Connections REST API

Added request parameters to the Customer Connection Rest API. These optional parameters give you the same control over application connections using the API that you would have using the admin console.

For more information, see PingOne SSO for SaaS Apps Customer Connection API

OAuth Access Token

Increased the allowed number of trusted origins for OAuth access token Cross-Origin Resource Sharing. The previous limit was 10. The current limit is 100.

For more information, see Configuring your OAuth settings.

Admin Console SSO

Added the ability to configure your IdP connection to allow administrative users to SSO into the admin console.

See Known issues and limitations below for important limitations to this feature.

For more information, see Configure SSO to the admin portal

PingOne Token Lifetime

Reduced the lifetime of the PingOne user token from ten minutes to five minutes.

For more information, see Process the PingOne SSO for SaaS Apps token exchange.

Single Logout

PingOne's single logout (SLO) implementation relies on the ability to send cookies within an iframe. Some browsers now block this ability by default, which causes problems with SLO.

SLO does not function on browsers where third-party cookies are disabled.

IdP-initiated SLO does not terminate the admin portal session in browsers that enforce SameSite.

We are working to accommodate this new behavior.

Administrator Settings

Added a feature that allows you to change the certificate expiration notification settings for Global and SaaS administrators.

For more information, see Editing administrative roles, permissions, and notifications and Manage your user profile.

Added a feature that allows you to filter the list of existing customer connections by status or type.

For more information, see Edit an invited customer connection and Edit a managed customer connection.

• Create new signing certificates
• View usage of configured certificates
• Migrate individual applications and identity providers to different signing certificates, or change the configured verification certificate
• Automatically receives email notifications when certificates are expiring or have expired

For PingOne for Enterprise, you can make PingOne OIDC applications available on the PingOne dock. The applications are also selectable in access and authentication policies.

See Add or update a SAML-enabled application for more information.

We've also updated the IdP Discovery popup window to display the application logo and your corporate logo (if you've configured this).

• Support for approximately 150 additional user attributes.

• Support for Salesforce REST v37.0 API.

• Support for OAuth Authentication with the OAuth Configuration Service (OCS).

• Support for custom subdomains.

• You now have the option to freeze user accounts, rather than deactivating them.

• Improved exception handling and reporting.

• Support for Salesforce disabling TLS 1.0.