Ping Identity — The Cyber Toolchain

Ping Identity changelog-20261029-07d5f16d

Thu, 29 Oct 2026 07:54:57 GMT

Ping Identity adds a remote MCP server for AI-agent access, QR code callbacks in scripted nodes, and multi-alias SAML IdP import⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Ping Identity adds the AIC Remote MCP Server, an opt-in, centrally hosted HTTP-based Model Context Protocol server that lets AI agents and development assistants administer Advanced Identity Cloud via natural-language prompts over OAuth 2.0 authentication — available now in sandbox environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Ping Identity adds a callbacksBuilder.qrCodeCallback() binding for scripted nodes, letting them generate QR codes that render in hosted pages or apps built with the Ping SDKs. • Ping Identity now lets you import multiple remote identity providers sharing the same entity ID by specifying an alias, with uniqueness enforced per circle of trust — aliased providers do not support single logout or Enhanced Client or Proxy (ECP), and hosted service-provider assertion consumer service URLs require a manual `cot` parameter. • Custom WS-Fed applications now support user-defined name formats for service provider attributes, letting you specify custom namespaces to meet the attribute requirements of specific relying parties. • The OpenID Connect discovery endpoint now always returns `authorization_response_iss_parameter_supported: true`, and authorization responses (including error responses) now include the `iss` parameter so clients can verify the response issuer. • Identity Governance now accepts workflow definitions up to 1 MiB. • Managed object enum-typed properties are now matched and rewritten without regard to case, normalizing submitted values to the exact case defined in the schema. • Reports have been improved: several parameters in built-in reports are now optional, allowing reports to run with broader criteria, and in custom reports the `Completed By` field in the `Entitlement Review Item` entity now returns the `userName` value. • The underlying datastore now enforces unique usernames and application names. • Delegated administrators can now view their own relationship properties in the hosted account pages. Breaking changes: • Managed object enum values are now normalized to schema-defined case on write — scripts or dashboards that compare `accountStatus` or other enum property values against non-canonical cases (e.g. 'Active' instead of 'active') must be updated to expect the exact case defined in the schema. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 22 Oct 2026 (2026-10-23)

Fri, 23 Oct 2026 06:46:39 GMT

Ping Identity AIC adds QR-code scripted nodes, multi-provider SAML import by alias, and case-normalized managed object enums.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds callbacksBuilder.qrCodeCallback() binding to scripted nodes, enabling QR codes to render in the Advanced Identity Cloud admin console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for importing multiple remote identity providers sharing the same entity ID by specifying an alias; uniqueness is enforced per circle of trust. • Enables omission of the `scope` parameter in authorization code requests (including PAR) when `authorization_details` are requested and Rich Authorization Requests with RCS is enabled. • The OpenID Connect discovery endpoint now always returns `authorization_response_iss_parameter_supported: true`, and authorization responses (including error responses) that redirect to the client now include the `iss` parameter, enabling issuer verification. • Custom WS-Fed applications now support user-defined name formats for service provider attributes, allowing custom namespaces for relying party compatibility. • Custom reports: the Completed By field in the Entitlement Review Item entity now returns the `userName` value, and several parameters in built-in reports are now optional, allowing reports to be run with broader criteria. • The underlying datastore now enforces unique usernames and application names. • Version 2 of the Certificate Collector and Certificate Validation nodes includes security hardening improvements. Breaking changes: • Managed object enum values are now rewritten to the exact schema-defined case on create, update, or patch (e.g. 'Active' becomes 'active' if the schema defines 'active'). Scripts or dashboards that compare enum property values using non-schema case will need to be updated to expect the schema-defined case. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 20 Oct 2026 (2026-10-21)

Wed, 21 Oct 2026 13:00:00 GMT

Ping Identity launches an opt-in Remote MCP Server in sandbox, letting AI agents administer Advanced Identity Cloud via natural-language prompts over OAuth 2.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exposes tenant-scoped MCP tools covering journey and script configuration, application and identity provider management, user administration, policy settings, and audit log analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20261020-b3fc67d8

Tue, 20 Oct 2026 07:54:46 GMT

Ping Identity adds multi-value node properties, telephone user fields, Entra ID/SMTP email config, navigation profiles, and SAML metadata import controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for skipping XML signature verification when importing remote SAML 2.0 provider metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `telephone number` as a user property format with optional server-side validation, providing separate country code and phone number fields in hosted pages and the admin console. • Adds ability to configure Microsoft Entra ID or custom SMTP email providers and send test emails from the Advanced Identity Cloud admin console. • Adds customizable hosted account pages navigation menu via navigation profiles, enabling different menus for different groups of users. • Adds multi-value selection from predefined options when configuring custom node properties in the node designer. • Makes the next-generation scripting engine the default when creating scripts in the Advanced Identity Cloud admin console. • Adds search and sort capabilities for the list of AI agent identities. • Improves journey canvas interactions by adding the ability to select multiple journey nodes by holding Shift and clicking each node, and to pan the canvas by holding the space bar and dragging with the left mouse button. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 15 Oct 2026 (2026-10-15)

Thu, 15 Oct 2026 12:59:45 GMT

Advanced Reporting gains optional parameters and human-readable usernames in entitlement review items.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • In Advanced Reporting, parameters such as status, journeys, and roles are now optional in several out-of-the-box reports, so you can run them without selecting values you don't need.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • In Advanced Reporting, the `Completed By` field in entitlement review items now returns usernames instead of GUIDs. Breaking changes: • The `Completed By` field in entitlement review items now returns usernames instead of GUIDs — saved reports or integrations that expect GUIDs must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20261005-42bd0c0b

Mon, 05 Oct 2026 07:55:40 GMT

Breaking changes: • ThreatMetrix nodes are renamed to LexisNexis Dynamic Decision Platform (DDP) nodes — any journeys or configurations referencing the old ThreatMetrix node names will need to be updated. • v1.0 of the Page node is now deprecated; the latest version should be used instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20261004-42bd0c0b

Sun, 04 Oct 2026 07:49:10 GMT

Ping Identity adds multi-value node properties, Entra ID/SMTP email config, SAML metadata signature skip, and v2.0 LDAP Decision nodes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `runTargetPhase` selection in the Advanced Identity Cloud admin console when running reconciliations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for configuring Microsoft Entra ID or custom SMTP email providers in the Advanced Identity Cloud admin console, with the ability to send test emails. • Adds option to skip XML signature verification when importing remote SAML 2.0 provider metadata. • Adds v2.0 of the LDAP Decision node and the Identity Store Decision node with improvements over prior versions. • Adds EC key attestation support for Android device binding, enabling compatibility with newer Google hardware attestation root certificates. • Adds the ability to select multiple values from predefined options when configuring custom node properties in the node designer. • Adds telephone number as a user property format, with optional server-side validation and separate country code and phone number fields in hosted pages and the admin console. • Adds navigation profiles to customize the hosted account pages navigation menu for different groups of users. • Adds search and sort capabilities for the list of AI agent identities. • Makes the next-generation scripting engine the default and recommended option when creating scripts in the Advanced Identity Cloud admin console. • Adds pan support for journey canvases by holding the space bar and dragging with the left mouse button. • Adds multi-node selection on journey canvases by holding Shift and clicking each node. • Adds configuration option to the LexisNexis DDP Profiler node to inject scripts in the `head` element or in an iframe. • Renames ThreatMetrix nodes to LexisNexis Dynamic Decision Platform (DDP) nodes; updates LexisNexis InstantID Question and Answer (IIDQA) nodes to store decision API responses in shared state. • Adds logging of errors in the reCAPTCHA Enterprise node when its Google project, site key, or API key secret is misconfigured. • Backchannel transactions now record the authenticated subject on completion even when no session is created, preserving a subject declared before authentication. Breaking changes: • ThreatMetrix nodes have been renamed to LexisNexis Dynamic Decision Platform (DDP) nodes — any configuration or documentation referencing the old ThreatMetrix node names will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 28 Sep 2026 (2026-09-29)

Tue, 29 Sep 2026 07:14:10 GMT

Ping Identity adds multi-value node properties, telephone format, Entra ID/SMTP email config, SAML signature skip, and more in Sep 2026 release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `runTargetPhase` selection in the Advanced Identity Cloud admin console when running reconciliations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds ability to skip XML signature verification when importing remote SAML 2.0 provider metadata. • Enables configuration of Microsoft Entra ID or custom SMTP email providers and test-email sending from the Advanced Identity Cloud admin console. • Supports telephone number as a user property format, with optional server-side validation and separate country code and phone number fields in journeys. • Allows selection of multiple values from predefined options when configuring custom node properties in the node designer. • Enables customization of the hosted account pages navigation menu for different user groups using navigation profiles. • Adds search and sort capabilities for the list of AI agent identities. • Makes the next-generation scripting engine the default and recommended option when creating scripts in the Advanced Identity Cloud admin console. • Allows configuring the LexisNexis DDP Profiler node to inject scripts in the `head` element or in an iframe. • Enables panning journey canvases by holding the space bar and dragging with the left mouse button. • Enables selecting multiple journey nodes by holding Shift and clicking each node. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20260926-fb4a2526

Sat, 26 Sep 2026 07:48:20 GMT

Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20260925-fb4a2526

Fri, 25 Sep 2026 07:51:18 GMT

Breaking changes: • The ThreatMetrix nodes are renamed to LexisNexis Dynamic Decision Platform (DDP) nodes — any journeys or configurations referencing ThreatMetrix node names will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20260924-fb4a2526

Thu, 24 Sep 2026 07:51:52 GMT

Ping Identity adds Friendly Captcha support, JavaScript-free QR codes, dynamic radio-button choices, and a configurable `userAgent` for external REST calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `userAgent` property to external REST service configuration, defaulting to `PingIdentity` for outbound requests, overridable per-request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Friendly Captcha support to the v2.0 CAPTCHA node as a privacy-focused CAPTCHA provider alternative. • Adds an option to the Combined MFA Registration, OATH Registration, and Push Registration nodes to render QR codes without using JavaScript. • Adds the ability in the v2.0 Choice Collector node to make choice callbacks with dynamically generated options that render as radio-button groups instead of drop-down lists. • Renames ThreatMetrix nodes to LexisNexis Dynamic Decision Platform (DDP) nodes, and updates LexisNexis InstantID Question and Answer (IIDQA) nodes to store decision API responses in shared state. • Enables updating a managed user even when the change conflicts with generated attribute values, propagating updates to all associated workforce application accounts during queued synchronization. • Reorganizes the admin console left menu into logical, collapsible groups with updated labels. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20260916-0043515d

Wed, 16 Sep 2026 12:59:14 GMT

Ping Identity: Supports EC key attestation for Android device binding, including compatibility with newer Google hardware attestation root certificates. • Adds error logging to the reCAPTCHA Enterprise node when its Google project, site key, or API key secret is misconfigured. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20260915-040cebe6

Tue, 15 Sep 2026 13:01:16 GMT

Ping Identity adds ESV support for connector server names, inline script error visibility, and streamlined identity/job management UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports using an ESV (environment secret/variable) for the connector server name in connector configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Shows errors in the script editor when scripts use environment ESVs incorrectly. • Allows creating another identity immediately after creating one, without closing the modal. • Allows editing a scheduled job to start sooner than its originally configured future start time. • Allows closing modals with the Escape key. • Forms now clearly identify fields that contain errors after submission. • All connectors upgraded to version 1.5.20.36. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 14 Sep 2026 (2026-09-15)

Tue, 15 Sep 2026 06:45:17 GMT

Ping Identity Advanced Identity Cloud adds OAuth 2.0 CIMD support, Rich Authorization Details, and new LDAP/Identity Store Decision node versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `redirectUrlType` and `customRedirectUrl` parameters to the backchannel transaction initialize endpoint, enabling customization of the redirect URI returned.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Store Software Statement` setting on the OAuth 2.0 provider to persist the software statement provided during dynamic client registration (DCR) in the client configuration and return it in DCR read responses. • Adds `Allow audience members to introspect tokens` setting on the OAuth 2.0 provider, permitting any client whose `client_id` appears in a token's `aud` claim to introspect that token without a special scope. • Adds `Authentication Request Storage` option on the hosted IdP to configure where SAML authentication requests are stored, enabling concurrent SAML SSO attempts across multiple browser tabs or browsers to complete independently. • Supports OAuth 2.0 Client ID Metadata Documents (CIMD), allowing AI agents and external clients to identify themselves via a hosted metadata document without prior or dynamic client registration. • Enables issuance of access tokens with `authorization_details` through the authorization code and refresh token grants when details were granted during authorization. • Adds v2.0 of the LDAP Decision node and the Identity Store Decision node with improved username handling. • Backchannel transactions now record the authenticated subject on completion even when no session is created, preserving any subject declared before authentication. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20260908-74d79c95

Tue, 08 Sep 2026 07:44:29 GMT

Ping Identity adds Friendly Captcha support, no-JS QR codes for MFA registration, IGA identity/role certification, and correlation rules for unmanaged apps. • Adds `esv.am.secrets.gsm.stableid.version.only` environment variable to retain legacy Google Secret Manager JWK `kid` behavior when ESV secrets would otherwise use the new unique name-and-version identifier. • Adds support for Friendly Captcha to the v2 CAPTCHA node as a privacy-focused CAPTCHA provider alternative. • Adds an option to the Combined MFA Registration, OATH Registration, and Push Registration nodes to render QR codes without requiring JavaScript. • Adds IGA identity profile certification, enabling reviewers to certify identity records including external users and AI agents — not just access. • Adds IGA role composition certification, enabling reviewers to certify role definitions including attributes, glossary data, entitlements, applications, and membership rules. • Adds dedicated IGA certification review task views for identity-profile and role-composition items, letting reviewers examine and decide on each item type separately. • Adds IGA correlation rules for unmanaged applications, letting administrators link aggregated accounts to identities during account aggregation. • Adds IGA activity and notification monitoring as generally available, with event type filtering and audit log presentation. • Adds the ability to delete certificate templates via the IGA UI. • Adds the ability to change campaign title and owner after a campaign has been launched. • Adds creation of approval tasks when expiration is configured with a workflow variable. • IGA role request forms now display current role membership as read-only, and each member addition or removal in the role lifecycle management screen is submitted as an individual grant or removal request. • IGA now enforces the required request justification setting consistently across lifecycle management, request extension, and entitlement-grant requests. • Enables updating a managed user even when the change conflicts with generated attribute values, propagating the update to all associated workforce application accounts during queued synchronization. Breaking changes: • Advanced Identity Cloud now rejects relationship creation requests that use a property that does not accept the referenced object type, instead of silently creating the relationship through a different valid property — existing integrations relying on the silent fallback behavior will now receive errors. • ESV secrets are now stored in Google Secret Manager using a unique name-and-version identifier as the default JWK `kid`; deployments where multiple secrets shared the same GSM version must set `esv.am.secrets.gsm.stableid.version.only` to retain the legacy `kid` value. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 02 Sep 2026 (2026-09-03)

Thu, 03 Sep 2026 07:23:08 GMT

Ping Identity adds Friendly Captcha support, no-JS QR codes for MFA registration, IGA identity/role certification, and activity monitoring GA. • Adds Friendly Captcha support to the v2 CAPTCHA node as a privacy-focused CAPTCHA provider alternative. • Combined MFA Registration, OATH Registration, and Push Registration nodes now include an option to render QR codes without JavaScript. • IGA activity and notification monitoring is now generally available, with improved event type filtering and audit log presentation. • IGA identity profile certification enables reviewers to certify identity records — including external users and AI agents — rather than access alone. • IGA role composition certification enables reviewers to certify role definitions, including attributes, glossary data, entitlements, applications, and membership rules. • IGA certification review views let reviewers examine identity-profile and role-composition items in dedicated task views. • IGA correlation rules for unmanaged applications let administrators link aggregated accounts to identities during account aggregation. • IGA now lets you delete certificate templates via the UI. • IGA now lets you change the campaign title and owner after a campaign is launched. • IGA role request forms display current role membership as read-only; each member addition or removal in the role lifecycle management screen is submitted as an individual grant or removal request. • Approval tasks can now be created when expiration is configured with a workflow variable. • Managed user updates that conflict with generated attribute values are now accepted and propagate to all associated workforce application accounts during queued synchronization. • Advanced Identity Cloud now rejects relationship creation requests that reference a property not accepting the given object type, rather than silently routing through a different property. Breaking changes: • ESV secrets in Google Secret Manager now default to a unique name-and-version identifier as the JWK `kid`; installations relying on the legacy GSM-version-only `kid` must set the `esv.am.secrets.gsm.stableid.version.only` environment variable to `true` to preserve prior behavior. • Advanced Identity Cloud now rejects relationship creation requests that use a property not accepting the referenced object type; previously these were silently created via a different valid property. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20260824-6e6a101a

Mon, 24 Aug 2026 14:30:44 GMT

Ping Identity adds ESV support for connector server names, inline script error visibility, and streamlined identity/job editing workflows. • Enables use of an ESV (Environment Secret/Variable) for the connector server name in the 'New Connector Server' modal. • Surfaces script errors directly in the script editor when scripts reference environment ESVs incorrectly. • Allows creating another identity immediately after creating one, without closing the modal. • Supports editing a future-scheduled job to start sooner. • Moves the 'Identity Verification' page under 'Integrations', 'Android Key Attestation' under 'Authentication Methods', and 'Security Questions' under 'Authentication'. • Adds Escape key support for closing modals. • Form submissions now clearly highlight fields containing errors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 18 Aug 2026 (2026-08-19)

Wed, 19 Aug 2026 07:39:33 GMT

Ping Identity adds continuous identity creation, ESV support in connector server config, and script editor ESV error visibility. • Enables use of an ESV for the connector server name in the New Connector Server modal. • Surfaces errors in the script editor when scripts reference environment ESVs incorrectly. • Allows creating another identity immediately after creating one, without closing the modal. • Enables editing a future-scheduled job to start sooner. • Moves the Identity Verification page under Integrations; Android Key Attestation under Authentication Methods; Security Questions under Authentication. • Supports closing modals with the Escape key. • Improves keyboard navigation and accessibility information across interactive controls. • Forms now clearly identify fields containing errors after submission. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20260809-d279054c

Sun, 09 Aug 2026 09:28:55 GMT

Ping Identity adds AI agent identities, SAML metadata import options, PKCS5S2 migration, and optional custom report parameters. • Adds the ability to skip signature verification when importing SAML metadata (OPENAM-26721). • Adds support for migrating user accounts from the deprecated PKCS5S2 password hashing scheme to a more secure algorithm (FRAAS-33086). • Adds the ability to mark parameters in custom reports as optional, giving more flexibility when running reports (IAM-10610). • Adds v2.0 of the Patch Object node in Advanced Identity Cloud journey flows (OPENAM-26073). • Introduces AI agent identities to secure AI-driven solutions. • Adds the ability to send email from next-generation scripts. • The promotions API now returns report metadata ordered by creation date, most recent first (FRAAS-33591). • Advanced Identity Cloud now honors the `pubKeyCredParams` sequence in WebAuthn credential creation requests (OPENAM-25556). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity changelog-20260724-fe405323

Fri, 24 Jul 2026 16:07:33 GMT

Ping Identity AIC adds email scripting, secrets in nodes, Rich Authorization Requests, SAML metadata import options, and a new validate-secrets endpoint. • Adds `emailService` binding for next-generation scripts, enabling email delivery directly from journey scripts. • New realm-level OAuth2 Provider setting enables Rich Authorization Requests (RFC 9396) processing when an RCS is configured, and controls advertisement of `authorization_details_types_supported` on the well-known endpoint. • Individual OAuth 2.0 clients can now be configured with `Authorization Detail Type(s)` to restrict which authorization detail types each client may request. • Dynamic client registration requests now support `authorization_details_types` to declare the authorization detail types a client supports at registration time. • SAML metadata import now supports skipping signature verification. • Introduces Patch Object node v2.0, which always updates managed identity objects as Advanced Identity Cloud (v1.0 deprecated but still functional). • OAuth 2.0 request state is now stored in CTS (Core Token Service) instead of an oversized browser cookie, preventing large requests (e.g., with big `id_token_hint`) from failing after authentication. • Custom report parameters can now be marked as optional, providing more flexibility when running reports. • Proxy Connect enabled tenants can now manage Proxy Connect configuration directly in the Advanced Identity Cloud admin console without using the API. • Hosted journey pages now display hCaptcha text and challenges in the end user's configured locale. • Column visibility preferences for data tables in the admin console and hosted account pages are now customizable and saved between sessions. • Super administrators can now configure the redirect URI to use a custom domain when setting up federated administrator access. • Social identity providers can now be created and edited directly in the Advanced Identity Cloud admin console. • Self-service journey mappings can now be configured directly in the Advanced Identity Cloud admin console. • The promotions API now returns report metadata ordered by creation date, most recent first. • Journey annotation notes now display multi-line formatting in view mode. • Page node v3 is now available, generating a new CAPTCHA token for each validation request when both CAPTCHA and live password validation are used together. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 21 Jul 2026 (2026-07-22)

Wed, 22 Jul 2026 07:18:51 GMT

Advanced Identity Cloud adds emailService binding for next-gen scripts, managed secret references in custom nodes, and a new secret validation endpoint. • Custom scripted nodes can now reference managed secrets from a secret store using a `SECRET` property type, keeping API keys and passwords out of script code. • Custom scripted nodes now support combining `multivalued: true` with `options` to create multi-select list properties in the journey designer. • New `validate` action on the secrets endpoint lets operators confirm whether a secret mapping resolves to a valid secret in the configured secret store. • The Enable Connection via Credential toggle for the PingOne Worker service now automatically enables or disables relevant connection fields based on selection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 20 Jul 2026 (2026-07-21)

Tue, 21 Jul 2026 06:52:11 GMT

Ping Identity adds Rich Authorization Requests (RFC 9396) support, per-client authorization detail types, and a new Patch Object node v2.0. • New realm-level OAuth2 Provider setting 'Enable Rich Authorization Requests with RCS' enables processing of `authorization_details` requests when an RCS is configured and controls advertisement of `authorization_details_types_supported` on the well-known endpoint. • Supports configuring Authorization Detail Type(s) on individual OAuth 2.0 clients to control which RFC 9396 Rich Authorization Request detail types each client can request. • Dynamic client registration requests can now include `authorization_details_types` to declare the authorization detail types a client supports. • Adds the ability to skip signature verification when importing SAML metadata. • New v2.0 of the Patch Object node always updates the managed identity object as Advanced Identity Cloud, removing the 'Patch as Object' configuration option (v1.0 is deprecated but remains functional in existing journeys). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 16 Jul 2026 (2026-07-17)

Fri, 17 Jul 2026 10:48:54 GMT

Ping Identity AIC adds optional custom report parameters, ordered promotions API results, and multi-line journey annotations. • Supports marking parameters in custom reports as optional, enabling more flexible report execution. • Promotions API now returns report metadata ordered by creation date, most recent first. • Journey annotation notes now render multi-line formatting in view mode, consistent with edit mode. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 08 Jul 2026 (2026-07-09)

Thu, 09 Jul 2026 12:52:04 GMT

Ping Identity AIC adds social IdP management, self-service journey mapping, PKCS5S2 migration, and expanded ESV support in the admin console. • Extends the Evaluator Version selector in the admin console to all remaining next-generation script types: OIDC node, Social Provider Handler node, OAuth2 scripts, and Policy Condition scripts. • Enables migration of user accounts from the deprecated PKCS5S2 password hashing scheme to a more secure algorithm. • Adds an Account Status column (Active/Inactive) to the Identities page. • Supports using an environment secret or variable (ESV) to configure the 'from' address for email providers. • Allows Proxy Connect–enabled tenants to manage Proxy Connect configuration directly in the admin console without using the API. • Localizes hCaptcha text and challenges on hosted journey pages to match the end user's configured locale. • Makes column visibility preferences for data tables in the admin console and hosted account pages customizable and persistent across sessions. • Adds an Enable AI Agents button on the AI Agents page when the feature has not yet been activated. • Allows super administrators to configure a custom-domain redirect URI when setting up federated administrator access. • Enables creation and editing of social identity providers directly in the Advanced Identity Cloud admin console. • Supports configuring self-service journey mappings directly in the Advanced Identity Cloud admin console. • Microsoft 365 SSO applications now use the selected UPN Attribute Name setting for WS-Trust username authentication (existing applications must be resaved). Breaking changes: • Microsoft 365 SSO applications now use the selected UPN Attribute Name setting for WS-Trust username authentication; existing applications must be resaved for this change to take effect. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 04 Jun 2026 (2026-06-05)

Fri, 05 Jun 2026 18:30:00 GMT

PingOne adds Agent Governance for AI identities and node versioning for Auth Trees • Identity Governance role LCM (IGA-4265): Allows designated end users to create, update, and delete roles on behalf of others via workflow-driven requests without full admin access. • Identity Governance for AI agents (IGA-4223): Detects, onboards, and governs AI agents alongside human identities using Agent Governance. • Advanced Identity Cloud now supports the WebAuthn conditional UI (passkey autofill) in authentication nodes. • You can now assign an authorization policy to a SAML or OIDC application via IAM-4646 to restrict access to specific authenticated subsets. • SaaS REST and SaaS REST (connector server) applications now let you add filter policies to object types when configuring provisioning to reduce network overhead. • The PingOne worker service now lets you configure the connection to PingOne using a credential JWT. • You can now configure a trusted CA certificate for each OAuth 2.0 client using the tls_client_auth authentication method via OPENAM-27540. • Advanced Identity Cloud supports node versioning with new versions for Page, Username, WebAuthn Authentication, and WebAuthn Registration nodes. • Adds Resource version 3.0 to the realm-config/authentication/authenticationtrees endpoint requiring Accept-API-Version: protocol=2.1,resource=3.0. • The realm-config/authentication/authenticationtrees/nodes endpoint is now versioned; specify the node version in the URL (e.g., .../nodes/UsernameCollectorNode/2.0). Breaking changes: • Resource versions 1.0 and 2.0 for the authenticationtrees REST endpoint are deprecated. • Versionless node endpoints are deprecated; you must specify the node version in the request URL (e.g., .../nodes/UsernameCollectorNode/2.0). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 04 Jun 2026

Thu, 04 Jun 2026 00:00:00 GMT

PingOne adds AI agent governance, role LCM, WebAuthn conditional UI, and node versioning to Identity Governance and IAM • Adds `Agent Governance` capabilities to detect, onboard, and govern AI agents alongside human identities. • Introduces role lifecycle management (LCM) allowing end users to create, update, and delete roles via workflow-driven requests. • Adds support for WebAuthn conditional UI (passkey autofill) in the authentication journey nodes. • Adds node versioning support for `Username`, `WebAuthn Authentication`, and `WebAuthn Registration` nodes with version-aware API endpoints. • Enables assigning authorization policies to SAML or OIDC applications via the `IAM-9608` enhancement. Breaking changes: • Resource versions 1.0 and 2.0 for authenticationtrees REST endpoint are deprecated; clients must set `Accept-API-Version: protocol=2.1,resource=3.0`. • Versionless node endpoints are deprecated; the `realm-config/authentication/authenticationtrees/nodes` URL must specify the node version (e.g., `/nodes/UsernameCollectorNode/2.0`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 17 Apr 2026

Fri, 17 Apr 2026 00:00:00 GMT

Adds `authnRequestHelper` binding to next-gen SP adapter scripts for AuthnRequest manipulation • Adds `authnRequestHelper` binding for next-generation SP adapter scripts to retrieve and modify the destination property of the AuthnRequest Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 14 Apr 2026

Tue, 14 Apr 2026 00:00:00 GMT

New Snowflake connector for Identity Cloud, Access Modeling role mining, UI-driven session/config options, and report import/export • Bundled `Snowflake` connector allows managing users, roles, and data sync between Advanced Identity Cloud and Snowflake. • Added `Access Modeling` (role mining) feature in Identity Governance to discover potential access roles using machine learning. • Added UI options `Override authenticated session timeout`, `Maximum Session Time`, and `Maximum Idle Time` in the admin console journey editor (previously REST-only). • Added `promotion rollbacks` capability in the Advanced Identity Cloud admin console. • Added ability to import custom reports via the admin console. • Added ability to export custom reports via the admin console. • Expanded monitoring search feature to include `/payload/message` and `/payload` fields. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 09 Apr 2026

Thu, 09 Apr 2026 00:00:00 GMT

New API endpoint for enabling AI Agents and two new Identity Governance log sources • Adds `/environment/aiagent?_action=enable` endpoint to simplify enabling AI Agents in sandbox environments • Adds `iga-api` log source for monitoring Identity Governance API events, certifications, SOD, glossary, and LCM • Adds `jas` log source for monitoring Java API Service (JAS) identity management audit messages Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 30 Mar 2026

Mon, 30 Mar 2026 00:00:00 GMT

New AI agent identity support enables OAuth 2.0 client onboarding for secure AI-driven solutions. • Adds `Identity for AI` (IAM-9357) capability allowing AI agents to be onboarded as specialized OAuth 2.0 clients with distinct identities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 24 Mar 2026

Tue, 24 Mar 2026 00:00:00 GMT

PingOne adds Rich Authorization Requests support, App Policy Decision node, and next-gen script bindings. • `/authorize` and `/par` endpoints now accept the `authorization_details` parameter for fine-grained authorization via RAR (RFC 9396) • New App Policy Decision node enables enforcing OIDC and SAML application access policies in journeys with filtering by group, organization, etc. • OAuth 2.0 Token Exchange now supports specifying audience parameters that are allowlisted and included in the resulting token's `aud` claim • `jwtValidator` and `jwtAssertion` bindings are available in all next-generation scripts for scripted JWT operations • Next-generation scripts include utils.base64url.encode() and utils.base64url.decodeToBytes() for Base64URL encoding/decoding • PingOne Worker Service connection can now be configured using a credential JWT (AME-33973) • New `scopeValidatorHelper` binding with inheritAccessTokenScopesOnRefresh() method in next-generation OAuth 2.0 scope validation scripts • Next-generation OAuth 2.0 scope validation scripts gain access to the `availableScopes` binding and throwInvalidScope() method Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 18 Mar 2026

Wed, 18 Mar 2026 00:00:00 GMT

New Policy Decision and Backchannel Notification nodes; improved cert collection via new ESV. • `Policy Decision` node evaluates authorization policies against resources within an authentication journey • `Backchannel Notification` node sends real-time status updates from a backchannel journey to the main auth journey • New ESV `esv-am-nodes-certificatechain-validation-enforced` enables collecting the full certificate chain in Certificate Collector/Validation nodes • PingOne Protect Initialize node gains `Additional Signals SDK Initialization Options` attribute for extended configuration • PingOneProtectInitializeCallback introduces `universalDeviceIdentification` field replacing deprecated `enableTrust` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 18 Feb 2026

Wed, 18 Feb 2026 00:00:00 GMT

Adds `esv-global-saml-error-page-http-binding` ESV variable and device management options in hosted pages. • Adds the `esv-global-saml-error-page-http-binding` environment variable to override the HTTP binding (HTTP-POST or HTTP-Redirect) used for SAML error page redirects • Adds new device management capabilities in hosted account pages, allowing users to view last sign-on time, add date, edit device name, and delete devices Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 13 Feb 2026

Fri, 13 Feb 2026 00:00:00 GMT

Next-gen scripting engine for OAuth/SAML scripts; new REST actions and nodes for Identity Cloud • OAuth 2.0 AME scripts (OIDC claims, Scripted JWT validator, Scope validation, Authorize endpoint data provider, Scope evaluation, May act) can now use the next-generation scripting engine with `utils` and `openidm` bindings • SAML 2.0 SP adapter, IDP adapter, and IDP attribute mapper scripts can now use the next-generation scripting engine with `utils` and `openidm` bindings • Adds `application context` configuration to hosted IdP or remote SP entity config to make `samlApplication` binding available for all SAML flows • Backchannel Initialize node gains an `Allow Retry` option for end users to retry failed backchannel authentication journeys • Pushed consent requests can now include remote consent agent credentials in a Basic Authentication header • New `testConnection` action on `/realm-config/services/pingOneWorkerService/workers/` endpoint tests connectivity from Advanced Identity Cloud to PingOne • New `listLatestNodeDefinitions` action on `/realm-config/authentication/authenticationtrees/nodes` returns combined node definitions for the latest version of each node • RADIUS Decision node captures Vendor-Specific Attributes (VSA) returned by the RADIUS server during authentication • PingOne Protect Evaluation node adds configuration properties to specify a custom session ID, custom browser cookie, and external `deviceId` • PingOne Verify Evaluation node gains a property to enable automatic redirection after verification in Redirect delivery mode • New RSA SecurID node replaces the deprecated Marketplace RSA SecurID node • New JWT Password Replay node secures the user’s password within an encrypted JWT for PingGateway • Device Binding and Device Signing Verifier nodes allow specifying clock skew between client device and AIC • Set Success Details, Set Failure Details, and Set Error Details nodes now support setting custom headers on journey outcomes • New `locales` binding returns localized strings from a translation map in Configuration Provider, Journey Decision, and Device Match node scripts • Added identity.exists() method to next-generation objects returned by idRepository.getIdentity() Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity

Ping Identity 06 Feb 2026

Fri, 06 Feb 2026 00:00:00 GMT

PingOne adds support for canceling clustered reconciliation via unavailable routes and restores PingOne Protect Username Node State setting • Adds ability to cancel a clustered reconciliation even when a route associated with the source or target system is unavailable (OPENIDM-21493) • Switches Advanced Identity Cloud identity management service to use synchronous HTTP client requests for external connections, preventing connection closure exceptions from terminating reconciliation Breaking changes: • The pageSize can no longer be configured outside the range of 10 to 100 (defaults remain 100, but values > maxQueueSize / 10 are automatically adjusted). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ping-identity