New, Oct 22. Every Oracle Cloud and DigitalOcean service and release note, with their equivalents on the other clouds.
Identity & Security•Official page ↗
Compare all →
Rate Limits for MFA Factor Enrollment and Sign-In Notifications
The following daily limits apply to each user within a region:
Updated Certified Components for IAM E-Business Suite Asserter
Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM) has updated the certified components for E-Business Suite Asserter single sign-on (SSO) integration.
ID-JAG token exchange across trust domains
Identity and Access Management now supports Identity Assertion JWT Authorization Grant (ID-JAG) token exchange. An ID-JAG is a short-lived, signed JSON Web Token (JWT) that enables identity handoff across trust domains.
Use OAuth resource indicators with identity domains
Identity domains now support OAuth resource indicators. In a token request, an OAuth client can use the resource parameter to identify the target resource server and the required scope parameter to request permissions.
Managing One-Click Sign-In with Passkeys
IAM now supports One-Click Sign-In for supported applications.
New 26.3.2.xxx Release for App Gateway Docker, OVA, and Patch Releases
New App Gateway releases and a patch provide feature enhancements, bug fixes, and an updated NGINX version.
Changes to OTP Messages for Spain Phone Numbers
Starting September 15, 2026, OTP messages sent to Spain phone numbers with the country code +34 no longer include customer-friendly names.
Client ID Metadata Document Support for OAuth Clients
IAM with identity domains now supports Client ID Metadata Documents (CIMD). An OAuth client can publish its metadata at a stable HTTPS URL and use that URL as its client_id, reducing the need to maintain a persistent client registration in every identity domain.
JWT-to-RPST Token Exchange for Workload Identity Federation
IAM now supports exchanging JSON Web Tokens (JWTs) issued by trusted workload identity providers for Resource Principal Session Tokens (RPSTs) by using the Token Exchange grant type.
Legacy Local User "DefaultLocalUser" Is Being Retired
To strengthen the security posture of Oracle Cloud Infrastructure tenancies, Oracle is retiring a legacy local user named DefaultLocalUser from affected customer tenancies.
Standardized Authentication Error Responses and New Error Code AUTH-3001
Context
Client Secrets for Oracle-Provisioned Applications Are No Longer Visible
To strengthen security, the OCI Console will no longer display the client secret for Oracle‑provisioned Oracle Cloud Services apps.
User Email Notifications for MFA Resets and Bypass Code Generation
End-user email notifications for MFA resets and Bypass code generation:
Managing IDCS Federated Resources in the OCI Console Is Being Deprecated
Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM) support for managing Identity Cloud Service (IDCS) federated resources through the OCI Console is ending.
Deny Policies in IAM: Explicit Access Control
Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM) introduces deny policies, an opt-in feature that lets administrators explicitly block specific actions and tighten access control.
New Social Identity Provider: Apple Now Supported
Administrators can now configure Apple as a social identity provider (IdP). This enables users to sign in to an identity domain in IAM using their Apple social credentials.
