Rapid channel changelog

FRAAS-21728: Updated the cookie domain API to add default values for GET requests where cookie domain values haven’t been overridden by a PUT request. The default values are derived from the existing tenant cookie domain configuration, so are backward compatible.

AME-26594: Added secrets API binding to all next-generation script contexts.

AME-27129: Added option to exclude client certificate from SAML hosted SP metadata.

AME-27792: Added AM-TREE-LOGIN-COMPLETED audit log event that outputs a result of FAILED when a journey ends with an error.

AME-27839: Added the ability to specify connection and response timeouts for Http Client Service instances.

AME-27848: Added a new setting for journeys to always run to completion regardless of the existing user sessions.

AME-28008: You can now disable certificate revocation checks, or all certificate checks entirely, on your Http Client Service instances.

OPENAM-15410: Fixed an issue that prevented customization of claims if profile and openid scopes are requested.

OPENAM-20609: Fixed inconsistent error message when generating access token using refresh token after changing username.

OPENAM-21974: Adds an OAuth 2.0 client configuration for the new version of the LinkedIn provider.

OPENAM-22298: Log unretrieved SP and IdP descriptors in SAML2 Authentication node.

FRAAS-21713: The promotion process now retries getting an access token from the lower environment, preventing promotion failures.

IAM-6493: The PingOne application template now supports specifying an LDAP gateway.

IAM-6860: For journey pages, the fallback error heading that displays if there is no heading in the page content now includes a toggle in hosted pages to disable it.

IAM-6868: Added screen reader labels to action buttons that only had icons to them.

IAM-6870: Added screen reader labels to buttons that only had icons to them.

IAM-7033: Unable to save user filter in AD/LDAP app template.

IAM-7011: Older app templates are no longer marked "deprecated".

IAM-5233: Update SAP SuccessFactors app template to support connector version 1.5.20.22.

IAM-6874: Update journey analytics to use hourly data.

FRAAS-21318: Promotion report now categorizes AM session service changes correctly.

IAM-4279: Display available ESV placeholders in Decision Node script editor.

IAM-4654: Enable creation of all script types in Advanced Identity Cloud admin UI.

IAM-5356: Session logout warning not displaying when maximum idle time set to a higher value than maximum session time.

IAM-6628: New draft option shouldn’t exist for out-of-the-box workflows.

IAM-6779: Pagination for list of apps not working when there are over 4000 apps.

FRAAS-20397: The promotion process now retries tagging the lower environment after a network interruption, preventing blocking promotion failures.

FRAAS-20983: Promotion reports now list changes to the default OAuth 2.0 provider.

FRAAS-20970: The /monitoring/logs endpoint now returns an X-Ratelimit-Limit header with a fixed value of 60. Previously, the value was misleading due to the way it was calculated when scaling an environment’s resources. The X-Ratelimit-Remaining header continues to report the number of requests that may be sent before receiving a rate limited response.

OPENIDM-18495: Disable sorting in the connector data tab in the IDM admin UI (native console).

OPENIDM-20142: Resolved a communication failure between Advanced Identity Cloud and RCS instances that could result in a prolonged failure to activate remote connectors.

OPENIDM-20178: You can’t use scope private fields in query filters. For more information, refer to Security Advisory #202402.

IAM-4785: Synchronize only the modified properties on a target source during reconciliation of applications.

IAM-5237: Add ability for B2B business partners to certify access for their users using organizational-based certification^[2].

IAM-5487: Correlation rules moved to the top of the reconciliation settings page.

IAM-5629: Add ability to create scoping rules in Identity Governance^[2].

IAM-6231: Scripted Decision Node now updates the list of scripts when a script is added or edited.

IAM-6544: Add reviewer column to administrator list view of compliance violations^[2].

IAM-6135: ESV values containing accents get corrupted by encoding process.

IAM-6562: Label duplicated for OAuth 2.0 access token and ID token endpoints.

IAM-6669: Badge count of violations in end-user navigation doesn’t update when an action is performed^[2].

FRAAS-20604: Removed superfluous AM metrics related to token store internals:

FRAAS-20786: Fix promotion issue where an attempt was made to delete an already deleted application.

AME-26199: Added the ability to set additional claims, including non-registered claims, during JWT assertion and generation, as per the specification.

AME-26820: Provided library scripts with access to all common script bindings.

AME-26993: Enhanced secret mapping for agents. Updating a secret label identifier value now causes any corresponding secret mapping for the previous identifier to also be updated, provided no other agent shares that secret mapping. If another agent shares the secret mapping, PingOne Advanced Identity Cloud creates a new secret mapping for the updated identifier and copies its aliases from the previously shared secret mapping.

AME-27346: Renamed Secret ID Identifier to Secret Label Identifier in the SAML remote entity provider configuration.

AME-27478: Renamed Client ID Token Public Encryption Key property to ID Token Encryption Public Key in the OAuth 2.0 client configuration.

AME-27775: Added scripting thread pool metrics per script context.

OPENAM-16564: Enabled next-generation scripts to access the cookies in incoming requests.

OPENAM-21800: Added page node functionality to next-generation scripts.

OPENAM-21933: Enabled auto-encoding of the httpClient form body in next-generation scripts.

FRAAS-19461: Fixed an issue where large audit logs could be missing from IGA events and processing.

OPENAM-21748: Restored the missing get wrapper function for HiddenValueCallback in next-generation scripting.

OPENAM-21864: Fixed an issue that prevented setting the tracking cookie to resume a journey after returning from a redirect flow.

OPENAM-21897: Corrected inconsistent results from the policy evaluateTree endpoint.

OPENAM-21951: Enabled setting of the selectedIndex property in a ChoiceCallback in next-generation scripts.

OPENAM-22181: Corrected an issue with UMA approve and approveAll requests failing.

FRAAS-20048: Configuration promotions can now be rolled back using the API. An environment can be rolled back successively to revert as many previous promotion changes as needed.

FRAAS-20154: ESVs with special characters are now correctly encoded. The workaround of double-encoding ESVs is no longer required.

FRAAS-11180: Authentication session whitelisting is now enabled by default for new tenants^[5]

IAM-5593: Adding roles to certain objects no longer breaks readable titles^[5]

IAM-6537: Journey import now alerts users if they try to import a file containing missing references^[5]

IAM-6376: In the applications rules tab, you can now configure custom logic to perform specific actions, such as sending an email, when an account is successfully created or updated.

IAM-6380: In the applications rules tab, you can now use the provisioning failure rule to configure custom logic to perform specific actions when provisioning fails.

FRAAS-15404: When updating ESV secrets, the API saves a new secret version only when it differs from the previous value.

FRAAS-19982: Configuration promotion now fails if Advanced Identity Cloud services do not restart successfully with the new configuration.

IAM-2653: Configure object properties with user-friendly display names

IAM-3857: Application list view displays enabled/disabled status of enterprise apps

IAM-5913: Create custom access request workflows^[2]

IAM-6264: Approval actions display in the UI even when they are not available due to permissions

IAM-6296: UI doesn’t display paginated results on application data and recon tabs

IAM-6409: Logging out of UI generates malformed redirect realm URLs

AME-26130^[7]: Updated the PUSH Notification service to store access keys as a secret

AME-25906^[7]: Updated Identity Gateway agents to store credentials as a secret

IAM-4585: Request and approvals page now shows the current and past approvers, their decisions, and the dates

IAM-4968: Expose additional top-level parameters in the advanced section of mapping pages

IAM-5769: Add grouping logic to journey node items

IAM-5674: Target application can use ONBOARD action for FOUND situation

IAM-5814: Allow fixed application usernames to be chosen for custom SAML apps

OPENAM-21575^[7]: Added org.forgerock.json.jose.jwe.JweHeader to the allowlist for Scripted Decision nodes

AME-25915^[7]: Assertion consumer processing fails if NameID format not present in the assertion response

IAM-3927^[2]: Identity Governance now enforces mandatory comments (if configured) for revoke and allow exceptions

IAM-4309: Access reviews no longer display the internal lastSync user attribute

IAM-4762: Authoritative apps are now requestable

IAM-4986: Platform UI can now determine whether to use a pagedResultsCookie or offset for paging results

IAM-5076: "Abstain from action" option no longer displays when a campaign has expired

IAM-5362: Marking a property as an authoritative app entitlement no longer causes target app config to be generated

IAM-5413: Account deprovisioning now works in AD/LDAP after deleting a user identity

IAM-5794: Border color of sign-in input fields in hosted pages can now be overridden in themes

IAM-5875: Journey editor no longer orphans deleted nodes

FRAAS-19414: You can now configure custom domains directly in all environments without needing to create ESVs or promote configurations. Existing custom domains will be migrated automatically.

OPENIDM-19921: The following connectors included with Advanced Identity Cloud were upgraded to 1.5.20.21:

FRAAS-19341: ESV support for AES keys through the base64aes encoding type

IAM-5602: Add functionality for viewing and deleting user’s trusted devices in Advanced Identity Cloud admin UI

The following services now support setting secrets using the secrets API rather than setting secrets in the service configuration:

The following nodes now support setting their secrets using the secrets API rather than setting secrets in the node configuration:

AME-26041: Enhanced handling of agents secret mappings – if you update or delete a secret label identifier, any corresponding secret mapping for the previous identifier is updated or deleted, provided no other agent shares that secret mapping

AME-25434: New Request Header node lets you inject values into shared state based on request header values

AME-26039: Added LDAP Affinity Level configuration option to the LDAP Decision node, to enable affinity-based load balancing for BIND requests

OPENAM-21768: Added org.forgerock.opendj.ldap.Rdn and org.forgerock.opendj.ldap.Dn classes to the allowlist for all script contexts

AME-24760: Inner nodes of a PageNode don’t independently audit node-login-complete events

AME-26158: Exception thrown when generating a Signed JWT with no encryption within a next-gen script called by a Scripted Journey node

OPENAM-17315: Scripts used to call 'response.getEntity()' in the past should now use 'response.getEntity().getString()' instead

OPENAM-21856: Introspecting stateless token with IG/Web agents causes OAuth2ChfException

IAM-4257: Azure AD app template updates

IAM-4342: MSGraphAPI connector includes a new optional licenseCacheExpiryTime configuration property

IAM-4892: Salesforce app template updates

IAM-4900: UI has been updated to show the Advanced Identity Cloud build number

IAM-5033: Added new "Remember my username" checkbox to authentication trees

IAM-5287: Updated username, password, and KBA heading size on the profile page to improve accessibility

IAM-5334: Expose "Guarded String" as an object type property for Scripted Groovy, ScriptedREST, ScriptedSQL, CSV, Database table, and SCIM connectors

IAM-5459: KBA answer field now contains question context

IAM-5461: Custom errors sent as TextOutputCallback.ERROR are now rendered as primary login errors, improving screen reader accessibility feature

IAM-5503: Rename Orchestrations to Workflows

IAM-5563: Google Apps app template updates

IAM-5603: Create device details modal for managed user identities

IAM-5606: Add "POWERED BY" metadata to marketplace nodes

IAM-5748: Make "PingOne" a special case on the federation providers page

IAM-5598: Styled terms and conditions included in a journey causes authenticate calls to fail

IAM-5611: Can’t revoke custom apps from roles or edit them from the role view

IAM-5641: Custom endpoints search returns endpoints created by other areas of the UI

IAM-5692: Console errors when opening the Add user modal for Bravo realm

IAM-5767: SAML SSO is not used when an application is saved from another tab after SSO setup

IAM-5873: Hosted page may fail to match user locale

OPENIDM-19405: Allow email addresses to contain non-ASCII characters for supported SMTP providers

FRAAS-18455: Prevent the latest version of a secret from being deleted

FRAAS-18788: Add AWS, GCP, and SAP S/4HANA connectors to Advanced Identity Cloud

FRAAS-18693: Validation bug prevents use of the base64encodedinlined and keyvaluelist ESV expression types

FRAAS-18414: Changes to an out-of-the-box journey can be incorrectly reported against both realms

FRAAS-18526: Script library functionality can’t be used in the UI in certain environments

OPENIDM-17878^[8]: Allow access to operational attributes in the Advanced Identity Cloud data store

OPENIDM-18645^[8]: Add ESV support to oauthProxy script

OPENIDM-18743^[8]: Attempts to use connectors fail with null pointer exceptions when operationOptions is defined in the provisioner configuration

AME-25906: Add the ability to configure the password for authenticating to an Identity Gateway agent as an ESV secret

AME-26130: Add the ability to configure the SNS access key secret for the push notification service to use an ESV secret

OPENAM-21575: Add org.forgerock.json.jose.jwe.JweHeader to the class allowlist for Scripted Decision node

AME-25915: SAML flow fails if a NameIDFormat element is not present in an assertion response

FRAAS-18464: Sandbox debug logging level set to WARN instead of DEBUG

IAM-5656: Fix alignment of text, buttons, and links in Message nodes

IAM-5660: Hosted pages not displaying list of themes

OPENAM-20924: Social Provider Handler node does not let end user switch to a different IdP

AME-26117: Updated nodes relating to one-time passwords to use secret labels for passwords. Refer to OTP Email Sender node and OTP SMS Sender node.

FRAAS-18271: Added the org.forgerock.opendj.ldap.Dn and org.forgerock.opendj.ldap.Rdn classes to all script contexts

OPENIDM-19674: The relationship-defined virtual property (RDVP) schema editor allows you to edit the flattenProperties property. The managed object schema editor allows you to edit the notifyRelationships property.

OPENIDM-18957: The scheduler now attempts to release any triggers it attempted to acquire during a timeout due to an unresponsive repository

OPENIDM-19141: Workflow engine queries now properly honor tablePrefix and tablePrefixIsSchema configuration options

OPENIDM-19279: Resource collection is required to create a relationship

OPENIDM-19565: The default apiVersion configuration has been updated with additional resource paths

FRAAS-18398: Allow the HTTP OPTIONS method on calls to /openidm/config/* endpoints for CORS preflight checks

OPENAM-21856: Introspecting stateless token with IG/Web agents will cause OAuth2ChfException

FRAAS-7382: Add ability to include JavaScript snippets in login and end-user UIs

IAM-4514^[2]: Allow reviewers to add user, entitlement, and role columns to an access review

IAM-4739: Add read schema option to SCIM application template to discover custom schemas/attributes

IAM-5201: Focus on first input field or button automatically upon page load

IAM-5268: Add source-missing situation rule to authoritative applications

FRAAS-16659: ESV mapping updates aren’t captured in promotions report

IAM-4810: Custom endpoint UI missing context option

IAM-5072: Inbound mapping tab shows in target applications

IAM-5171: Azure Active Directory application template doesn’t return a user’s role membership

IAM-5187: LDAP v2.1 application template doesn’t clear dc=example,dc=com base DN

IAM-5238: LDAP application template is missing the group object classes property

IAM-5422^[2]: Entitlement owner doesn’t show in the entitlement list

FRAAS-18108: Add warning to the Set up 2-step verification screen to indicate that 2-step verification will be enforced as of March 1, 2024

IAM-5275^[9]: Advanced Identity Cloud admin UI doesn’t add query parameters to the logout URL

IAM-4511: Hide fields in the Users & Roles tab when editing and creating unreadable properties

IAM-4615: Add a "Skip to main content" link to page headers

IAM-4991: When a suspendedId is in use, redirect to failureUrl fails

IAM-5075: Login messages are read twice by screen readers

IAM-5186: User identity related values aren’t saved after removal

FRAAS-17883: Tenant administrators cannot save edits to their personal information

IAM-5226: Tenant administrator security questions should not be shown when editing personal information

IAM-5240: No error message displays when a tenant administrator fails to save edits to their personal information

FRAAS-3841: Activate and deactivate journeys in the Advanced Identity Cloud admin UI. Refer to Deactivate journeys.

IAM-4191: Allow tenant session cookie name to be configured. Refer to Session cookie name.

IAM-4735: Add support for schema discovery in application templates

IAM-4806: Show outbound tenant IP addresses in Advanced Identity Cloud admin UI. Refer to Access global settings.

IAM-4853: Add AS400 application template. Refer to the AS400 section in Provision an application.

FRAAS-16785: Incorrect positioning of reCAPTCHA v2 elements

IAM-2936: Journeys hang indefinitely when using a State Metadata node within a Page node

IAM-4521: Screen readers announce field labels twice

IAM-4956: Advanced Identity Cloud admin UI doesn’t use the current realm when logging out

IAM-5113: Unable to remove an NAO assignment from a user in Advanced Identity Cloud admin UI

IAM-4211: Display disaster recovery region in the Advanced Identity Cloud admin UI

IAM-4369: Remove AM applications from application list view

IAM-5045: Display pop-up warning when an end user is about to be logged out of an Advanced Identity Cloud hosted page

IAM-4812: Correctly save array ESVs containing newline characters

IAM-4863: Display ESV buttons properly when the user gives them focus

IAM-4877: Display ESV selection button properly while user is modifying a script associated with a Scripted Decision node

IAM-4698: Fix accessibility issues with messages in page nodes

FRAAS-17373^[13]: The following connectors included with Advanced Identity Cloud were upgraded from 1.5.20.15 to 1.5.20.17:

ANALYTICS-311: The USER-LAST-LOGIN report doesn’t show results if the last journey failed

FRAAS-17413: Improve IDM service reliability during upgrades and routine maintenance

OPENICF-1723: Salesforce connector: Clarify usage of proxyUri configuration property

OPENICF-2297: SCIM connector: Roles attribute should be a list of Strings, not a list of Objects

OPENICF-2482: SCIM connector: Dynamic schema doesn’t default to static schema on all exceptions

OPENICF-2483: SCIM connector: Creating a user with special attributes fails with dynamically generated schema

OPENICF-2484: SCIM connector: PUT with schemas attribute fails for providers that support PATCH

OPENICF-2448: SCIM connector: HTTP client fails to handle OAuth 2.0 errors

IAM-4515^[14]: Include autocomplete attribute with login form fields

IAM-4525^[14]: Update profile picture modal with accessibility improvements for screen readers

IAM-4576^[14]: Increase time on screen for loading spinner so that screen readers can announce it

IAM-4616^[14]: Include contextual information with the show/hide buttons for improved accessibility

FRAAS-17278: Health status reports for AM, IDM, and platform-admin services incorrectly reported as available in some situations

IAM-4460^[14]: Screen readers read show/hide buttons for security questions as show/hide password

IAM-4523^[14]: Screen readers read avatar alt text when tabbing to action menu

IAM-4524^[14]: Two buttons with different labels open the same dialog

IAM-3648: ESV placeholders can now be entered from a drop-down list

IAM-3651: ESV placeholders can now be entered from key-value input fields

IAM-4236: Improve layout of the applications reconciliation tab

IAM-4367: Separate the connection status of OAuth 2.0 client applications into a dedicated list

IAM-4662: ESV placeholders can now be entered from tag input fields

IAM-4717: Added date, datetime, and time fields to the login UI

IAM-4789: Grant roles now show temporal constraints

OPENAM-20847: Sanitized HTML can now be added into messages for the Email Suspend node

IAM-4418: Fix accessibility issues with multi-select input fields

IAM-4489: Align checkbox color with other form elements

IAM-4491: Correctly label sidebar buttons when expanded or collapsed

IAM-4492: Make navigation bars in end-user UI accessible for screen readers

IAM-4798: The aria-label is now correctly displayed for all component types on sidebar buttons

IAM-4843: The user column in the certification task list now shows a user’s full name instead of only the first name

IAM-4528: Outbound reconciliation mapping preview shows generated password value

OPENAM-21416: Canada Central AWS region (ca-central-1) enabled for the PingAM push notification service

IAM-3650: Add a drop-down menu to checkbox inputs for selecting ESV placeholders

IAM-3826: Add the ability to specify a source and transformation script when mapping application properties. For details, refer to app-management:provision-an-application.adoc#apply-a-transformation-script-to-a-mapping.

IAM-4567: Add a warning when running reconciliations and selecting the persistAssociations option. For details, refer to View a report about the last reconciliation.

IAM-4366: Provide browser-specific logic to handle alternative CSS for accessibility

IAM-4409: Require at least three characters before running identity searches when there are more than 1000 identities of that type

IAM-4478: Only allow certain combinations of properties in a mapping transformation script

IAM-4493: Fix the heading hierarchy in the UI

IAM-4568: Do not enable the option to change a user association in the UI

IAM-4703: Fix display of password fields in some themes

IAM-4710: Fix rounded border of password fields in hosted pages

OPENAM-21346: Add classes java.util.concurrent.TimeUnit, java.util.concurrent.ExecutionException, and java.util.concurrent.TimeoutException to the scripting allowlist

IAM-4533: Journeys do not resume correctly when returning from a social identity provider without a realm identifier

IAM-4534: Redirect callbacks for journeys not working correctly

AME-25061^[15]: Provide additional context information in Marketplace authentication nodes to enable UI improvements

OPENAM-20772^[15]: Add new option to the CAPTCHA node to let the submit button be disabled until CAPTCHA verification is successful

OPENAM-18004^[15]: Audit logging does not specify transaction IDs correctly for internal requests to certain APIs

OPENAM-18709^[15]: Calls to the nodeState.get() method in Scripted Decision nodes do not return values in shared state when a variable is stored in both shared state and secure state

OPENAM-20230^[15]: Calls to classes in the allowlist fail occasionally with access prohibited messages

OPENAM-20682^[15]: Unable to encrypt id_token error when there are multiple JWKs with the same key ID but different encryption algorithms

OPENAM-20691^[15]: Session quota reached when oldest session is not destroyed due to race condition

OPENAM-20783^[15]: Logging is incorrect when the authorization code grant flow is used successfully

OPENAM-20920^[15]: Null pointer exceptions when a SAML v2.0 binding is null and the SSO endpoint list contains non-SAML v2.0 entries

OPENAM-20953^[15]: Policy evaluation with a subject type JwtClaim returns HTTP response code 500

OPENAM-20980^[15]: The OIDC social provider is unable to use an issuer’s comparison check regex

OPENAM-21001^[15]: Custom scripted SAML v2.0 IDP account mappers are determined incorrectly

OPENAM-21004^[15]: Invalid session ID error when session management is disabled in an OIDC provider

OPENAM-21046^[15]: The Create Object and Patch Object nodes do not log exception stack traces when they can’t retrieve the object schema

OPENAM-21164^[15]: XML string formatted incorrectly when using a custom adapter to get the assertion from a SAML v2.0 response