Regular channel changelog

OPENIDM-20142: Resolved a communication failure between Advanced Identity Cloud and RCS instances that could result in a prolonged failure to activate remote connectors.

OPENIDM-20178: You can’t use scope private fields in query filters.

IAM-4785: Synchronize only the modified properties on a target source during reconciliation of applications.

IAM-5487: Correlation rules moved to the top of the reconciliation settings page.

IAM-6231: Scripted Decision Node now updates the list of scripts when a script is added or edited.

IAM-6544: Add reviewer column to administrator list view of compliance violations.

FRAAS-20604: Removed superfluous AM metrics related to token store internals:

IAM-6135: ESV values containing accents get corrupted by encoding process.

IAM-6562: Label duplicated for OAuth 2.0 access token and ID token endpoints.

IAM-6669: Badge count of violations in end-user navigation doesn’t update when an action is performed^[1].

OPENIDM-18495^[2]: Disable sorting in the connector data tab in the IDM admin UI (native console). (FORGEROCK-1582)

AME-26199: Added the ability to set additional claims, including non-registered claims, during JWT assertion and generation, as per the specification.

AME-26820: Provided library scripts with access to all common script bindings.

AME-26993: Enhanced secret mapping for agents. Updating a secret label identifier value now causes any corresponding secret mapping for the previous identifier to also be updated, provided no other agent shares that secret mapping. If another agent shares the secret mapping, PingOne Advanced Identity Cloud creates a new secret mapping for the updated identifier and copies its aliases from the previously shared secret mapping.

AME-27346: Renamed Secret ID Identifier to Secret Label Identifier in the SAML remote entity provider configuration.

AME-27478: Renamed Client ID Token Public Encryption Key property to ID Token Encryption Public Key in the OAuth 2.0 client configuration.

AME-27775: Added scripting thread pool metrics per script context.

OPENAM-16564: Enabled next-generation scripts to access the cookies in incoming requests.

OPENAM-21800: Added page node functionality to next-generation scripts.

OPENAM-21933: Enabled auto-encoding of the httpClient form body in next-generation scripts.

FRAAS-20786: Fixed the case where a promotion attempts to delete the same application more than once.

FRAAS-19461: Fixed an issue where large audit logs could be missing from IGA events and processing.

FRAAS-20154: ESVs with special characters are now correctly encoded. The workaround of double-encoding ESVs is no longer required.

OPENAM-21748: Restored the missing get wrapper function for HiddenValueCallback in next-generation scripting.

OPENAM-21830^[4]: Unable to get entitlement info hashmap values in SAML IdPAdapter script

OPENAM-21864: Fixed an issue that prevented setting the tracking cookie to resume a journey after returning from a redirect flow.

OPENAM-21897: Corrected inconsistent results from the policy evaluateTree endpoint.

OPENAM-21951: Enabled setting of the selectedIndex property in a ChoiceCallback in next-generation scripts.

OPENAM-22181: Corrected an issue with UMA approve and approveAll requests failing.

TNTP-166:

FRAAS-15404: When updating ESV secrets, the API saves a new secret version only when it differs from the previous value.

FRAAS-19982: Configuration promotion now fails if Advanced Identity Cloud services do not restart successfully with the new configuration.

IAM-6376: In the applications rules tab, you can now configure custom logic to perform specific actions, such as sending an email, when an account is successfully created or updated.

IAM-6380: In the applications rules tab, you can now use the provisioning failure rule to configure custom logic to perform specific actions when provisioning fails.

FRAAS-11180: Authentication session whitelisting is now enabled by default for new tenants

IAM-5593: Adding roles to certain objects no longer breaks readable titles

IAM-6537: Journey import now alerts users if they try to import a file containing missing references

IAM-6548^[4]: Advanced Identity Cloud admin UI now loads Identity Gateway profile properties

IAM-2653: Configure object properties with user-friendly display names

IAM-3857: Application list view displays enabled/disabled status of enterprise apps

IAM-5913: Create custom access request workflows^[1]

IAM-6264: Approval actions display in the UI even when they are not available due to permissions

IAM-6296: UI doesn’t display paginated results on application data and recon tabs

IAM-6409: Logging out of UI generates malformed redirect realm URLs

OPENAM-21575: Add org.forgerock.json.jose.jwe.JweHeader to the allowlist for the Scripted Decision node

IAM-3199: HTML styling in the Message node journey editor allows you to left justify text.

FRAAS-19334: Failure to look up service account names following changes applied through the ESV API.

IAM-5079: End-user roles page sometimes shows role grants as conditional even when the grants are direct.^[1]

IAM-5363: Show the total number of approvals and access reviews in the inbox.^[1]

IAM-5858: Missing support for access request global configuration options.^[1]

IAM-6138: The governance events filter builder incorrectly validates before and after properties in the user created state.^[1]

IAM-6176: The end-user access request rejection is missing a justification message.^[1]

IAM-6203: The governance events filter doesn’t use after temporal values for user created flows.^[1]

IAM-6209: The Advanced Identity Cloud admin UI navigation panel text appears when the panel is collapsed.

OPENIDM-19879: Identity management reconciliation service processes additional source query pages whenever a query returns a pagedResultsCookie.

OPENIDM-19924: Unnecessary quotes not being removed from email addresses.

TNTP-166:

FRAAS-19593: The promotion API incorrectly reports as ready, resulting in a blocking promotion failure when trying to promote (FORGEROCK-1319)

AME-26085: SAML v2.0 NameID mapping can be configured per SP

AME-27126: A SAML SP can now authenticate to IDPs using mutual TLS (mTLS) when making an artifact resolution request.

AME-27133: "Secret ID" has been renamed to "Secret Label" for secret mappings

The following services now support configuration using the Secrets API:

The following services now support rotation of secrets using secret versions:

OPENAM-21031: The performance of Google KMS has been improved by the introduction of caching.

FRAAS-19596: Promotion report should include changes to realm authentication settings.

OPENAM-21473: If you set the collection method of a Certificate Collector node to REQUEST, HEADER, or EITHER, and the certificate is not provided in the request or in the header, the node now returns a status of Not collected.

OPENIDM-19921: The following connectors included with Advanced Identity Cloud were upgraded to 1.5.20.21:

FRAAS-19414: You can now configure custom domains directly in all environments without needing to create ESVs or promote configurations. Existing custom domains will be migrated automatically.

FRAAS-19566: Add _sortKeys query parameter to ESV API

IAM-4585^[1]: Request and approvals page now shows the current and past approvers, their decisions, and the dates

IAM-4968: Expose additional top-level parameters in the advanced section of mapping pages

IAM-5674: Target application can use ONBOARD action for FOUND situation

IAM-5769: Add grouping logic to journey node items

IAM-3927^[1]: Identity Governance now enforces mandatory comments (if configured) for revoke and allow exceptions

IAM-4309^[1]: Access reviews no longer display the internal lastSync user attribute

IAM-4762: Authoritative apps are now requestable

IAM-4986: Platform UI can now determine whether to use a pagedResultsCookie or offset for paging results

IAM-5076^[1]: "Abstain from action" option no longer displays when a campaign has expired

IAM-5362: Marking a property as an authoritative app entitlement no longer causes target app config to be generated

IAM-5413: Account deprovisioning now works in AD/LDAP after deleting a user identity

IAM-5794: Border color of sign-in input fields in hosted pages can now be overridden in themes

IAM-5810: Add option for email configuration to specify UTF-8 address support

IAM-5814: Allow fixed application usernames to be chosen for custom SAML apps

IAM-5875: Journey editor no longer orphans deleted nodes

FRAAS-19341: ESV support for AES keys through the base64aes encoding type

IAM-5602: Add functionality for viewing and deleting user’s trusted devices in Advanced Identity Cloud admin UI

FRAAS-15371: Added ability to prevent search engines from indexing end user login pages

IAM-4257: Updated Azure AD app template to accommodate the latest changes

IAM-4342: Updated MSGraphAPI Connector with a new configuration property

IAM-4892: Updated Salesforce app template to accommodate the latest changes

IAM-4900: Added build number and next release cycle date range to user interface

IAM-5334: Exposed guarded string as an object type property in scripted template

IAM-5459: KBA answer field should contain question context

IAM-5461: Custom login error not read with priority

IAM-5503: Rename "Orchestrations" to "Workflows"

IAM-5563: Updated Google Apps app template to accommodate the latest changes

IAM-5603: Added ability to view device details for managed user identities

IAM-5606: Added "POWERED BY" metadata to journey nodes

IAM-5748: Made 'PingOne' a special case on the federation providers page

IAM-4918: Check that user has correct permissions when requesting access for other users

IAM-5287: Make username, password, and KBA fields H3 elements

IAM-5598: Prevent styled terms and conditions included in a journey from making authenticate call fail

IAM-5611: Correct ability to revoke custom apps from roles, or edit them from the role view

IAM-5641: Custom Endpoints search returned endpoints created by other areas of the UI

IAM-5692: Remove console errors when opening the "Add Bravo user" modal

IAM-5767: SAML SSO was not remembered when app is saved from another tab after SSO setup

IAM-5873: Fix .getTranslation call in Vue

OPENIDM-19405: Special non-ascii characters in emails sent from Advanced Identity Cloud would fail

FRAAS-19288: Autonomous Access and Identity Governance are now available in the Jakarta (asia-southeast2) region

FRAAS-18788: Add AWS, GCP, and SAP S/4HANA connectors to Advanced Identity Cloud

FRAAS-18693: Validation bug prevents use of the base64encodedinlined and keyvaluelist ESV expression types

FRAAS-18414: Changes to an out-of-the-box journey can be incorrectly displayed against both realms in a promotion report

OPENIDM-17878: Allow access to operational attributes in the Advanced Identity Cloud data store

OPENIDM-19674: The relationship-defined virtual property (RDVP) schema editor allows you to edit the flattenProperties property. The anaged object schema editor allows you to edit the notifyRelationships property.

FRAAS-18398: Allow the HTTP OPTIONS method on calls to /openidm/config/* endpoints for CORS preflight checks

FRAAS-18526: Script library functionality can’t be used in the UI in certain environments

IAM-5656: Fix alignment of text, buttons, and links in Message nodes

IAM-5660: Hosted pages not displaying list of themes

OPENIDM-18743: Attempts to use connectors fail with null pointer exceptions when operationOptions is defined in the provisioner configuration

OPENIDM-18957: The scheduler now attempts to release any triggers it attempted to acquire during a timeout due to an unresponsive repository

OPENIDM-19141: Workflow engine queries now properly honor tablePrefix and tablePrefixIsSchema configuration options

OPENIDM-19279: Resource collection is required to create a relationship

FRAAS-7382: Add ability to include JavaScript snippets in login and end-user UIs

IAM-4514^[1]: Allow reviewers to add user, entitlement, and role columns to an access review

IAM-4739: Add read schema option to SCIM application template to discover custom schemas/attributes

IAM-5138^[4]: Add ability to view reports to end-user UI

IAM-5201: Focus on first input field or button automatically upon page load

IAM-5268: Add source-missing situation rule to authoritative applications

IAM-4810: Custom endpoint UI missing context option

IAM-5072: Inbound mapping tab shows in target applications

IAM-5171: Azure Active Directory application template doesn’t return a user’s role membership

IAM-5187: LDAP v2.1 application template doesn’t clear dc=example,dc=com base DN

IAM-5238: LDAP application template is missing the group object classes property

IAM-5422^[1]: Entitlement owner doesn’t show in the entitlement list

OPENAM-21856: Introspecting stateless token with IG/Web agents will cause OAuth2ChfException

AME-22326: The httpClient available in scripts now automatically adds the current transactionId as an HTTP header. This lets you correlate caller and receiver logs to make requests to other ForgeRock products and services.

AME-25392: Add org.forgerock.openam.scripting.api.PrefixedScriptPropertyResolver, used for accessing ESVs from scripts, to the allowlist for SAML2_SP_ADAPTER and SAML2_IDP_ADAPTER script types

AME-25433: Add com.sun.crypto.provider.PBKDF2KeyImpl, javax.crypto.SecretKeyFactory, and javax.crypto.spec.PBEKeySpec to the allowlists for Scripted Decision nodes and Configuration Provider nodes

AME-25608: Add auditing for opening and closing connections for the LDAP decision node, ID Repo service, and Policy Configuration service

AME-25630: Add java.security.spec.InvalidKeySpecException to the allowlist for the Scripted Decision and Configuration Provider nodes

FRAAS-17939: Some connectors included with Advanced Identity Cloud were upgraded to the following versions:

IAM-4511: Hide fields in the Users & Roles tab when editing and creating unreadable properties

IAM-4615: Add a "Skip to main content" link to page headers

OPENAM-16897: The OAuth 2.0 Device grant flow can now return either JSON or HTML

OPENIDM-19037: Update property value substitution to reflect boolean value in the UI

COMMONS-1397: Audit event log entries not logged due to thread contention

FRAAS-17686: Add org.forgerock.json.jose.jwe.JweHeader to the allowlists for the AUTHENTICATION_TREE_DECISION_NODE and CONFIG_PROVIDER_NODE script types

IAM-4401: Disabling Clear-Site-Data header breaks realm login

IAM-4991: When a suspendedId is in use, redirect to failureUrl fails

IAM-5075: Login messages are read twice by screen readers

IAM-5186: User identity related values aren’t saved after removal

OPENAM-17331: Disabled SNS endpoints can now be re-enabled

OPENAM-17816: OAuth 2.0 requests without a Content-Type header fail with a 500 error

OPENAM-19282: Recovery Code Display node only works immediately after a registration node

OPENAM-19889: Policy evaluation fails when subject is agent access token JWT

OPENAM-20026: Social IDP with trailing whitespace in the name can’t be deleted using the UI

OPENAM-20329: Issuer missing from OAuth 2.0 JARM response

OPENAM-21053: Missing userId from access audit log when org.forgerock.security.oauth2.enforce.sub.claim.uniqueness=false in JWT client authentication flow

OPENAM-21421: Scripting logger name isn’t based on logging hierarchy convention

OPENAM-21476: Persistent cookie is not created when using Configuration Provider node

OPENAM-21484: Introspection of a stateful refresh token for claims field for known OAuth2 fields is now a string and not nested in a list

OPENIDM-19328: Fix queued sync to recover following node restart

IAM-5275: Advanced Identity Cloud admin UI doesn’t add query parameters to the logout URL

IAM-5289: Fix warning message when maxidletime is greater than 24.8 days

FRAAS-3841: Activate and deactivate journeys in the Advanced Identity Cloud admin UI. Refer to Deactivate journeys.

IAM-4191: Allow tenant session cookie name to be configured. Refer to Session cookie name.

IAM-4735: Add support for schema discovery in application templates

IAM-4806: Show outbound tenant IP addresses in Advanced Identity Cloud admin UI. Refer to Access global settings.

IAM-4853: Add AS400 application template. Refer to the AS400 section in Provision an application.

FRAAS-16785: Incorrect positioning of reCAPTCHA v2 elements

FRAAS-17883: Tenant administrators cannot save edits to their personal information

IAM-2936: Journeys hang indefinitely when using a State Metadata node within a Page node

IAM-4521: Screen readers announce field labels twice

IAM-4956: Advanced Identity Cloud admin UI doesn’t use the current realm when logging out

IAM-5113: Unable to remove an NAO assignment from a user in Advanced Identity Cloud admin UI

IAM-5226: Tenant administrator security questions should not be shown when editing personal information

IAM-5240: No error message displays when a tenant administrator fails to save edits to their personal information

FRAAS-17373^[8]: The following connectors included with Advanced Identity Cloud were upgraded from 1.5.20.15 to 1.5.20.17:

IAM-4211: Display disaster recovery region in the Advanced Identity Cloud admin UI

IAM-4369: Remove AM applications from application list view

IAM-5045: Display pop-up warning when an end user is about to be logged out of an Advanced Identity Cloud hosted page

ANALYTICS-311: The USER-LAST-LOGIN report doesn’t show results if the last journey failed

FRAAS-17413: Improve IDM service reliability during upgrades and routine maintenance

IAM-4698: Fix accessibility issues with messages in page nodes

IAM-4812: Correctly save array ESVs containing newline characters

IAM-4863: Display ESV buttons properly when the user gives them focus

IAM-4877: Display ESV selection button properly while user is modifying a script associated with a Scripted Decision node

IAM-3648: ESV placeholders can now be entered from a drop-down list

IAM-3651: ESV placeholders can now be entered from key-value input fields

IAM-4236: Improve layout of the applications reconciliation tab

IAM-4367: Separate the connection status of OAuth 2.0 client applications into a dedicated list

IAM-4662: ESV placeholders can now be entered from tag input fields

IAM-4717: Added date, datetime, and time fields to the login UI

IAM-4789: Grant roles now show temporal constraints

OPENAM-20847: Sanitized HTML can now be added into messages for the Email Suspend node

FRAAS-17235: Validate ESV values correctly when they are wrapped in white space

FRAAS-17283: Tenant status pages not automatically updated during downtime

IAM-4235: Passthrough authentication using AD connector fails if set up in UI and user DN includes a space

IAM-4418: Fix accessibility issues with multi-select input fields

IAM-4489: Align checkbox color with other form elements

IAM-4491: Correctly label sidebar buttons when expanded or collapsed

IAM-4492: Make navigation bars in end-user UI accessible for screen readers

IAM-4528: Outbound reconciliation mapping preview shows generated password value

IAM-4798: The aria-label is now correctly displayed for all component types on sidebar buttons

OPENIDM-19192: Personal information is still editable by end users when User Editable is set to false

IAM-3650: Add a drop-down menu to checkbox inputs for selecting ESV placeholders

IAM-3826: Add the ability to specify a source and transformation script when mapping application properties.

IAM-4515: Include autocomplete attribute with login form fields

IAM-4525: Update profile picture modal with accessibility improvements for screen readers

IAM-4567: Add a warning when running reconciliations and selecting the persistAssociations option. For details, refer to View a report about the last reconciliation.

IAM-4576: Increase time on screen for loading spinner so that screen readers can announce it

IAM-4616: Include contextual information with the show/hide buttons for improved accessibility

OPENAM-21073: Request headers are now accessible in OAuth 2.0/OIDC scripts for OIDC_CLAIMS, OAUTH2_ACCESS_TOKEN_MODIFICATION, and OAUTH2_MAY_ACT script contexts using the requestProperties binding

OPENAM-21346: Add classes java.util.concurrent.TimeUnit, java.util.concurrent.ExecutionException, and java.util.concurrent.TimeoutException to the scripting allowlist

OPENAM-21355: Jakarta AWS region (ap-southeast-3) enabled for the Access Management push notification service

OPENAM-21416: Canada Central AWS region (ca-central-1) enabled for the Access Management push notification service

IAM-4366: Provide browser-specific logic to handle alternative CSS for accessibility

IAM-4409: Require at least three characters before running identity searches when there are more than 1000 identities of that type

IAM-4460: Screen readers read show/hide buttons for security questions as show/hide password

IAM-4478: Only allow certain combinations of properties in a mapping transformation script

IAM-4493: Fix the heading hierarchy in the UI

IAM-4523: Screen readers read avatar alt text when tabbing to action menu

IAM-4524: Two buttons with different labels open the same dialog

IAM-4568: Do not enable the option to change a user association in the UI

IAM-4584: Drop-down boxes fail ADA compliance

IAM-4639: String/password field button is highlighted in the UI

IAM-4703: Fix display of password fields in some themes

IAM-4710: Fix rounded border of password fields in hosted pages

IAM-4829: Eye icon displays over the password field highlight box in the UI

OPENAM-18599: Allow customization of the error message that displays to end users when their account is locked or inactive using .withErrorMessage() in a Scripted Decision node

OPENAM-18685: Use the OAuth2 Provider service in the AM admin UI to specify if tokens issued should contain the subname claim

OPENAM-19261: Errors are incorrectly logged when triggered by introspection of tokens using OAuth 2.0 client credentials grant

OPENAM-20451: The WebAuthn Registration node now displays an end user’s userName when registering a device when the identity’s name isn’t human-readable

OPENAM-21158: Add support for trusted platform module (TPM) attestation using elliptic curve cryptography (ECC) unique parameter validation starting with Windows 11 version 22H2

OPENAM-21304: The request_uris field does not populate when OAuth 2.0 clients register using dynamic client registration

AME-25061: Provide additional context information in Marketplace authentication nodes to enable UI improvements

IAM-3502: Add the ability to set and reset a sync token for identity management account object type. For details, refer to Reset the last reconciliation job.

IAM-3678: Update error messages and labels in login and signup pages

IAM-3962: Improve design of push number challenge page for Push Wait node

IAM-4248: Add three additional non-account objects to ServiceNow page

IAM-4326: Improve onLink script to handle mapped properties of type array and object

IAM-4334: Update SuccessFactors application templates to support Advanced Identity Cloud built-in SuccessFactors connector

IAM-3877: UI loader spins indefinitely when realm is deactivated

IAM-4093: Replace Google Fonts in the login UI to meet GDPR compliancy requirements

IAM-4176: Advanced setting query filter does not show all available properties

IAM-4240: Accessibility issues in Page node when NVDA readers are used

IAM-4261: Accessing end-user UI with query parameter "code" displays empty page

IAM-4371: Unable to create applications due to userpassword property set

IAM-4384: Platform UI does not resume journeys with custom redirect logic

IAM-4427: Platform UI does not show assignments for tenants running deprecated application management

IAM-4475: Platform UI does not load after tenant administrator signs into an upper tenant during promotion

IAM-4533: Journeys do not resume correctly when returning from a social identity provider without a realm identifier

IAM-4534: Redirect callbacks for journeys not working correctly

OPENAM-18004: Audit logging does not specify transaction IDs correctly for internal requests to certain APIs

OPENAM-18709: Calls to the nodeState.get() method in Scripted Decision nodes do not return values in shared state when a variable is stored in both shared state and secure state

OPENAM-20230: Calls to classes in the allowlist fail occasionally with access prohibited messages

OPENAM-20682: Unable to encrypt id_token error when there are multiple JWKs with the same key ID but different encryption algorithms

OPENAM-20691: Session quota reached when oldest session is not destroyed due to race condition

OPENAM-20783: Logging is incorrect when the authorization code grant flow is used successfully

OPENAM-20920: Null pointer exceptions when a SAML v2.0 binding is null and the SSO endpoint list contains non-SAML v2.0 entries

OPENAM-20953: Policy evaluation with a subject type JwtClaim returns HTTP response code 500

OPENAM-21001: Custom scripted SAML v2.0 IDP account mappers are determined incorrectly

OPENAM-21004: Invalid session ID error when session management is disabled in an OIDC provider

OPENAM-21046: The Create Object and Patch Object nodes do not log exception stack traces when they can’t retrieve the object schema

OPENAM-21164: XML string formatted incorrectly when using a custom adapter to get the assertion from a SAML v2.0 response

FRAAS-16471: ESV variables and secrets API endpoints slow for large result sets

FRAAS-16271: ESV secrets could be incorrectly marked as "not loaded" when tenant has many ESVs