Release Updates

Administrators can now publish the Identity Platform Dashboard as a standalone internal application. Users such as  SOC analysts, auditors, and help desk agents can log in to the Dashboard directly and view reports on logins, user  profiles, authentications, and deployments without access to the SA Idp admin console. Administrators control which reports  are visible and can scope access by data store, policy, and user group.

For more information, see Dashboard application.

A new Session Validation rule type is available on the Authentication Rules tab in policies. This rule checks  whether a user has a valid session from another realm, allowing you to skip re-authentication when appropriate.

Use this to disable Zero Trust continuous authentication in environments where repeated MFA prompts create  unnecessary friction. For example, when Transparent SSO enforces continuous authentication, users are prompted for a  second factor on every login. With the Session Validation rule, you can configure the policy to skip MFA when a valid  session already exists.

For more information, see Policy configuration - Authentication rules.

You can now add an OpenLDAP data store in the New Experience. This dedicated connection type provides native support for OpenLDAP directories, including password reset and other identity operations that did not work reliably through the Generic LDAP connection type

OpenLDAP data store support is available for hybrid deployments only.

For more information, see Add OpenLDAP data store.

The Policy configuration - Authentication rules tab in policy configuration now includes a Service Disruption Handling section for managing IPv6 connectivity issues and service unavailability. Previously available only as global realm-level settings in the classic experience, these options are now part of the new experience policy configuration. Administrators can select from the following actions for each scenario: no action, continue adaptive authentication, refuse authentication request, skip to post-authentication, or require two-factor authentication.Policy configuration - Authentication rules

The air-gapped installer now installs and configures PostgreSQL automatically as part of the deployment process. You no longer need to set up PostgreSQL on a separate server or prepare database connection strings. See Air-gapped deployment overview.

The SecureAuth Connector installer now includes a cache configuration step. During installation or upgrade, you can select a caching mode for the connector service:

Caching reduces the number of queries to Active Directory and other data stores during authentication, which helps with performance under high authentication loads.

For installation instructions, see SecureAuth Connector installation. For upgrade instructions, see SecureAuth Connector update.

On-premises deployments no longer require SecureStorage for datastore configuration. The Identity Platform stores datastore settings directly, reducing infrastructure complexity. Existing encrypted passwords are decrypted automatically during initialization, so no manual migration is required.

You can now use username and password login workflows with Microsoft Entra ID data stores that are federated to Microsoft applications like Office 365. A new Validate user password check box in the Entra ID data store connection settings sends user credentials directly to Microsoft for verification, instead of redirecting the user to the Microsoft sign-in page. This option uses the connection credentials already configured in the data store. For more information, see Add Microsoft Entra ID data store.

You can now control how applications open from the SSO Portal page. A new Open application behavior setting on the SSO Portal Page configuration page provides two options: New tab (default), which opens the application in a new browser tab, and Same tab, which opens the application in the current tab. Previously, applications always opened in a new tab with no way to change this behavior. See SSO Portal configuration.

Continues to support air-gapped deployments for strict network isolation introduced in release 24.5.0. For implementation details, see Air-gapped deployment overview.

Help Desk users can verify end user identity using codes from the SecureAuth Authenticate app. This option is available only in Help Desk pages using the SA IdP theme. See Help Desk user verification process.

Administrators can now show or hide the following settings on the Account Management and User Portal pages, allowing help desk staff and end users to view or clear them as needed:

Added support for creating LDAP users under a specific Distinguished Name (DN) for Active Directory datastores.