The Philadelphia release introduces major platform capabilities for inbound connections and account lifecycle management, along with improved token exchange visibility and customer self-service.

This release includes changes that may impact your Strivacity deployment.

See Important notes for details.

New features and enhancements

Inbound connection

You can now synchronize accounts from external data sources into Strivacity using configurable inbound connections.

The synchronization process supports scheduled and on-demand synchronization, configurable attribute mappings, change detection, and account lifecycle updates while maintaining account links through configurable correlation identifiers.

Key capabilities include:

Synchronize accounts from external relational databases
Configure attribute mappings between external data and Strivacity accounts
Schedule full and incremental synchronization jobs
Trigger manual synchronization for individual accounts or full data sets
Detect account updates and deletions
View synchronization activity through account events

Token exchange event visibility

Account events have been enhanced to provide better visibility into Token exchange impersonation and delegation scenarios.

The updated event view displays the subject and actor involved in the exchange, helping administrators understand how tokens were exchanged and identify the identities participating in each request.

View subject and actor information for Token exchange events
Distinguish between impersonation and delegation requests using event labels
Navigate directly to related accounts and applications when identities can be resolved
View third-party token identities when external tokens are used

Customer notification preferences

Customers can now manage which account notifications they receive through My Account.

Brand administrators can enable or disable this capability through the self-service policy. When enabled, customers can choose whether to receive supported account notifications, while notifications disabled by the brand remain unavailable, and mandatory security notifications continue to be delivered.

Allow customers to manage supported email notification preferences in My Account
Enable or disable customer notification management through the self-service policy
View and manage customer notification preferences in the Admin Console and Organization Portal
Continue delivering mandatory security notifications that cannot be disabled

Password change reminders

Administrators can now configure password change reminders separately from password age enforcement.

Password change reminders encourage customers to update their passwords during login without requiring them to complete the change immediately. Customers can choose to change their password or be reminded again later, based on the configured reminder frequency.

Configure when password change reminders begin based on password age
Define how often reminders are shown after a customer selects Remind me later
Keep password change reminders separate from required password age enforcement
Continue requiring password changes only when password age enforcement is enabled

Organization metadata (Build 1)

Organizations can now store custom metadata to associate additional business information with each organization.

Organization metadata can be managed through the Admin Console or Admin API and is available in lifecycle hook payloads, making it easier to integrate organization data with external systems and custom workflows.

Store custom key-value pairs on organizations
Manage organization metadata through the Admin Console and Admin API
Retrieve organization metadata through the Admin API
Access organization metadata in lifecycle hooks that include organization context

Language selection from external login providers (Build 1)

External login providers can now supply a customer's preferred display language during authentication.

Brand administrators can configure SAML identity providers and OIDC providers to extract a language value from assertion attributes or token claims. When a valid language is received, it overrides the current journey language for the remainder of the authentication flow.

Configure language extraction separately for each external login provider
Extract language preferences from SAML assertion attributes or OIDC token claims
Apply the selected language to the remaining steps of the current journey
Continue the authentication flow if the configured language cannot be resolved or is unavailable

Enhanced account activity tracking (Build 1)

Account records now track authenticated customer activity separately from explicit login events.

In addition to existing login timestamps, Strivacity records the most recent authenticated activity, including refresh token usage. This provides a more accurate view of account activity for lifecycle management, operational visibility, and troubleshooting.

Track authenticated activity separately from explicit login events
Update account activity timestamps when authentication is established or renewed
Continue tracking explicit login timestamps independently
Filter and sort accounts based on the latest authenticated activity

Other enhancements

Token exchange now supports additional subject token types, including JWTs and ID tokens, enabling broader third-party token exchange scenarios.
Improved handling of default translations to preserve localized text for existing configurations after upgrading.
Username reminder flows now follow the same Adaptive Access account recovery policies as password recovery, providing consistent validation across supported email and phone recovery methods.
Added support for custom API-based email providers, allowing organizations to integrate outbound email delivery with external email services alongside the built-in Strivacity and SMTP providers.
At failed authentication hooks now run in SAML2 flows, bringing SAML2 behavior in line with other supported authentication flows. (Build 1)
Added support for permanently locking customer accounts through the Admin API. (Build 1)
Added the Directory connector job statistics dashboard widget for monitoring inbound synchronization jobs and processing metrics. (Build 1)
Added a configurable cooldown period for passkey promotion at login, allowing customers without a registered passkey to be prompted again after a specified number of days. (Build 2)

Bug fixes

We fixed issues where:

Event streaming retry attempts could affect instance stability.
MFA enrollment SMS messages were not properly translated in some cases.
Device biometrics and passkey enrollment could fail.
Disabled languages could still appear in customer-facing applications.
Account activation emails were not sent automatically for newly synchronized LDAP accounts.
Consent versions were reported incorrectly in account details and statistics.
Organization policy overrides displayed incorrect login providers.
Changing an account password could make the Organization Portal unresponsive.
JWT token requests could fail with legacy Before ID token generation hooks.
Mobile login could fail when using hostless redirect URIs.
Manual identity verification could fail in the Organization Portal.
Phone identifiers could not be configured as mandatory in some cases.
Account management performance degraded for accounts with many active sessions.
Password lockout was not applied to accounts without passwords.

In Build 1, we fixed issues where:

SAML 2.0 single logout requests using HTTP-Redirect binding did not process request signatures correctly.
SAML 2.0 single logout responses could be incorrectly URL-encoded, causing logout failures with some identity providers.
Notification history could incorrectly show SMS notifications as sent when no enabled SMS provider was configured.
External login providers could fail to complete authentication in embedded login journeys.
Authentication could fail with an unexpected error when both the After external login and Before multi-stage registration lifecycle hooks were used together.
Branding policies could fail to save when certain valid external logo URLs were used.
Branding policies could fail to save when logo or favicon resources were inaccessible from the administrator's location.
Administrators with the default Helpdesk role could not create customer invitations.
Notifications could be sent for disabled applications.
Dashboard widgets added by drag and drop could be displayed incorrectly and could not be moved or resized.
Organization policy overrides could display incorrect branding policy labels after being saved.

In Build 2, we fixed issues where:

Disabled account sessions could display the default branding instead of the application’s configured branding when the session expired.
Outbound provisioning was not triggered when an account was locked or unlocked.
Embedded login flows could remove query parameters from the page URL.
Account event filtering by identity store could return incorrect results.
Identity stores could allow more than five searchable attributes to be created before enforcing the configured limit.

Important notes

This release contains potential breaking changes for some customers.

These include:

The Forgotten username feature now respects Adaptive access/Attribute-based account recovery settings.
If a customer is configuring custom email providers via API, they must change their implementation and use the new Email configuration API.
At failed authentication hooks are now invoked during SAML2 flows. Existing hook implementations may now affect SAML2 authentication where they previously did not. Review custom hook logic before upgrading. (Build 1)

Deprecations

All CSS classes that were deprecated in the Geneva release have now been removed.