New in v2026.7.2
OpenIAM version 2026.7.2 deepens the identity risk intelligence introduced in 2026.7.1 and adds new operational capabilities to the SoD Rule Set Catalog.
This release brings live, explainable risk scores into in-flight certification campaigns — reviewers now see per-item risk that updates as access changes during a campaign, together with a factor-by-factor breakdown. A new User Risk page in the Webconsole gives security administrators a self-contained view of any user's full access risk with a full grant-path explanation. On the SoD side, a new Scheduled Detection tab automates regular violation sweeps with an email digest, and a Compare tool lets administrators preview how a candidate rule set would change enforcement before activating it. The release also introduces a dedicated Policy-Based Access Control microservice and delivers significant certification performance improvements. Security hardening includes TLS for Redis in the RPM cluster deployment and signed RPM packages and container images.
New features
Identity risk management
OE-4629 – Live, explainable risk during an in-flight certification
Certification campaigns now keep per-item risk up to date after launch and explain how each score was reached. Each user's risk is snapshotted at campaign launch as a drift baseline; if a user's risk changes while the campaign is running, review items are updated live and a drift arrow appears next to the risk shield in SelfService. A factor-breakdown popover shows the individual factors and their live drift for any user or review item. See Risk factors configuration, Risk driven certification, and Risk score recomputation at scale.
OE-4632 – User Risk page in the Webconsole
A new User Risk page is available from the user menu on any user record, restricted to the Super Security Admin role. It shows the user's identity and membership risk built from their real entitlement tree — including access not attached to a specific resource — with the numeric score, the scoring scale, and the grant path for every access row (which role, rule, or direct assignment produced the access). See Risk factors configuration and Behavioural risk score.
OE-4421 – Risk Score Configuration admin screen
A dedicated administrator screen for configuring the risk factors that drive access-review scoring is now available in the Webconsole. Every scoring value the platform uses can be reviewed and edited in one place, wired directly to the risk-manager service, and each built-in risk factor has an enable toggle that persists immediately. See Risk factors configuration.
Segregation of Duties
OE-4431 – Scheduled SoD detection with email digest
A new Scheduled Detection tab in the SoD Rule Set Catalog lets administrators configure the schedule and target audience for regular SoD detection runs. Detection runs as a background task and emails a styled digest of the findings; the underlying task is created automatically the first time it is configured and rebuilt if it is ever deleted. Configuration changes and manual runs are recorded in the audit log. See Rule Set Catalog.
OE-4433 – SoD rule set comparison
A Compare dialog in the SoD Rule Set Catalog shows the differences between two rule sets, or between a rule set and the currently active policies, before activating. A matching endpoint on the SoD rule set service returns the comparison result for integrations. See Rule Set Catalog.
OE-4434 – Managed system name on the SoD violation page
The managed system that the conflicting entitlements belong to is now shown on the SoD violation page alongside the users and conflicting roles. Investigators can tell at a glance which application a violation applies to without cross-referencing another screen.
Access certification
OE-4525 – Review-status filter in the manager view
Managers can now filter their review-item list in User Access Review campaigns by All, Pending, or Certified. The filtered view remains responsive on large campaigns thanks to a supporting database index. See Campaign dashboard.
Platform
OE-4445 – Policy-Based Access Control microservice
A new microservice dedicated to policy-based access evaluation is now available as a separately deployable component of the OpenIAM platform. It runs as its own service, can be scaled independently, and provides a dedicated evaluation endpoint that other OpenIAM services call for access decisions.
Enhancements and tasks
Identity risk management
OE-4423 – Membership origin as a risk-scoring factor
The way a user acquired an entitlement — direct assignment, role, or rule — is now captured and available as a configurable risk factor in the Risk Manager. Each built-in factor has its own plain-English explanation, and per-tag score editors let administrators tune scoring granularly, with scrollable score lists for large tag catalogs. See Risk factors configuration and Membership tags.
OE-4453 – Rebuilt Risk Score Configuration screen
The risk score configuration screen has been rebuilt against the new Risk Manager model, with a visual band editor, per-factor explanation banners, and a two-column layout. Live validation prevents saving impossible configurations — band scores can no longer be dragged past their neighbours. See Risk factors configuration.
OE-4594 – Reliable nightly risk sweep at enterprise scale
The nightly job that recomputes risk across the user population (delivered together with OE-4595 data-path batching and OE-4596 entitlement recompute isolation) has been overhauled. Enumeration of users and entitlements is now paged, enumeration errors fail loudly instead of silently truncating the result set, the data path is batched with bulk projections and bulk writes, and cascading entitlement recomputes run on their own queue so they do not stall unrelated work. See Risk score recomputation at scale.
OE-4643 – Explainable risk arithmetic on the User Risk page
The User Risk page now shows the actual factor levels and uplift cap that produced each score, and renders the arithmetic that got there. Every incremental risk recompute is written to the audit log.
Access certification
OE-3986 – Distributed certification report generation
Report generation is now distributed across cluster nodes instead of running on a single node. Large certification reports complete faster and no longer concentrate load on one server. See Certification reporting.
OE-4569 – Certification performance improvements
New indexes on review items make list and filter operations faster on large campaigns. Certification entities now use lazy loading and JDBC batching where they did not before.
OE-4573 – Bulk reviewer decisions no longer block each other
Large bulk approve/revoke decisions are broken into per-user chunks and processed on a dedicated queue, so one reviewer's large submission no longer holds up other reviewer actions. Completion detection uses a single grouped query instead of per-item lookups.
Security and compliance
OE-3477 – TLS for Redis in the RPM cluster
Redis client and Redis Sentinel connections in the RPM cluster deployment now use TLS, using the deployment's own keystore and truststore. Traffic between OpenIAM and Redis is encrypted in transit.
OE-4176 – Signed RPM packages and container images
Container images and RPMs are now signed with Cosign as part of the release pipeline. Customers can verify the authenticity and integrity of every OpenIAM artifact they deploy, supporting supply-chain security requirements.
Bug fixes
Access certification
OE-4572 – Campaign metadata preserved on state transition
Fixed an issue where transitioning a certification campaign from Started to In Progress wiped the campaign's core metadata including its name, causing the save to fail. Campaign metadata is now preserved across the transition.
OE-4576 – Reliable audit logging for large certification campaigns
Fixed an issue where per-user certification audit entries embedded the entire campaign scope in the request body, making entries too large for downstream audit-log consumers on large campaigns. The campaign scope is now trimmed out of per-user audit entries.
OE-4577 – Accurate campaign launch progress
Fixed two issues with the campaign launch experience: the campaign was marked "launched" before participant and review-item creation had finished, redirecting administrators prematurely; and the progress bar offered no explanation for the wait. The launch signal is now deferred until population is truly complete, progress steps are numbered clearly (1/2–2/2 or 1/3–3/3 depending on the flow), every message is localized, and administrators are told they can safely leave the page while it runs. See Campaign dashboard.
Segregation of Duties
OE-4574 – SoD detection stability after activating a new rule set
Fixed an issue where certain policies created by activating a rule set could cause the next SoD detection run to fail before it completed. SoD detection now handles rule-set-created policies safely.
OE-4575 – Deleted SoD policies clear from the Violations tab
Fixed an issue where deleting an SoD policy left the violations it produced behind on affected users' Violations tabs. Violations tied to a deleted policy are now removed at the same time the policy is deleted.
Authentication
OE-4567 – Last-login timestamp updates for SSO logins
Fixed an issue where logins that skipped the OpenIAM password check — SSO and other single-sign-on flows — did not update the user's last-login timestamps. The timestamps now update on every successful login, including SSO.
Minor updates
- Live per-item risk scores in in-flight campaigns, with factor-breakdown popovers and drift indicators when risk changes after launch.
- New User Risk page in the Webconsole shows any user's full access risk with grant-path explanation (Super Security Admin only).
- SoD Rule Set Catalog gains Scheduled Detection with email digest and a rule set Compare tool.
- Policy-Based Access Control introduced as an independently scalable microservice.
- Certification performance improvements: distributed report generation, new database indexes, and batched bulk-decision processing.
- TLS for Redis in the RPM cluster; signed RPM packages and container images for supply-chain verification.
- Stability fixes across certification campaigns, SoD detection, and SSO login tracking.