PingFederate flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Engine node role

The PingFederate server role that processes runtime protocol traffic such as SAML assertions, OIDC tokens, and STS requests, as opposed to serving the administrative console.

Admin console node role

The PingFederate server role that hosts the browser-based configuration interface and, in a cluster, is typically the node from which configuration changes propagate to engines.

External datastore requirement

Clustered PingFederate deployments must use a supported external database for configuration storage; the bundled H2 database is intended for single-node or evaluation use only.

Configuration replication

The mechanism by which a configuration change made on the admin node is pushed to other cluster members so all engines serve identical settings.

Admin API client credentials

An OAuth grant type used to obtain an access token for PingFederate's administrative API, configured by registering an Admin API application with a client ID and secret.

SP connection

A PingFederate configuration object that defines how this server acts as a service provider or relying party toward a partner, including endpoints, bindings, and signing certificates.

IdP connection

A configuration object describing a federation partner that acts as identity provider, including the partner's SSO endpoints, signing certificate, and attribute contract.

IdP adapter

A pluggable authentication component on the identity provider side that collects credentials or attributes, such as HTML Form, Kerberos, or composite adapters, before policy evaluation.

Authentication policy contract

A defined set of attributes that an authentication policy promises to deliver; downstream mappings and connections depend on every required attribute being populated.

Authentication selector

A policy element that chooses among multiple authentication paths based on request attributes, such as client IP, user agent, or a previously set attribute value.

Signing certificate usage

A certificate assigned the signing usage is used to sign protocol messages and assertions; partners must trust the corresponding public certificate to validate signatures.

Encryption certificate usage

A certificate assigned the encryption usage allows partners to encrypt assertions or tokens to PingFederate, which then decrypts them using the matching private key.

SSL certificate usage

A certificate assigned the SSL server usage secures HTTPS listeners on the runtime and admin ports; clients must trust its issuing chain.

Metadata exchange

The import and export of SAML or OIDC metadata documents that carry entity IDs, endpoints, bindings, and certificates, reducing manual entry and mismatched configuration.

Attribute contract

The list of attributes a connection or adapter exposes to downstream processing; mappings must satisfy it or the transaction fails with a missing-attribute error.

Attribute mapping

The configuration that translates source attributes from an adapter or incoming assertion into the target contract's attribute names and values.

Session idle timeout

The period of inactivity after which PingFederate expires a user's SSO session and requires re-authentication on the next protected request.

Maximum session lifetime

The absolute cap on how long an SSO session may persist regardless of activity, after which the user must authenticate again.

Session revocation

An administrative action that terminates active sessions for a user or tracking ID, invalidating the SSO cookie so subsequent requests force fresh authentication.

OAuth client registration

Configuration of a client ID, secret, redirect URIs, grant types, and scopes that allows an application to obtain tokens from PingFederate acting as authorization server.

Access token manager

The PingFederate component that issues and validates OAuth access tokens, with configurable token type, lifetime, and attribute persistence.

Persistent grants

Storage of OAuth grant and token data in the datastore so tokens survive restarts and are shared across clustered nodes.

Connection template

A reusable set of connection settings applied when creating new SP or IdP connections, keeping protocol options and certificate choices consistent across partners.

Virtual host

A named host entry that binds a hostname and port to connection behavior, letting one PingFederate instance serve multiple entity IDs and endpoints.

Runtime versus admin ports

PingFederate listens on a runtime port for protocol traffic and a separate admin port for the console and Admin API; firewall rules should expose only what each audience needs.

Cluster node status

The administrative view showing whether each node is running, its version, and whether its configuration is in sync with the admin node.

Configuration archive export

A downloadable package of PingFederate settings used for backup or migration; restoring requires a compatible product version and re-establishing cluster membership.

Log settings and levels

Per-component log configuration (server, protocol, audit) with adjustable severity levels; raising a level to debug increases verbosity and should be reverted after troubleshooting.

Audit logging

Records of administrative and authentication events such as configuration changes and SSO transactions, retained for compliance review and forensic investigation.

Connection signing verification

Validation of inbound assertions using the partner's trusted certificate; a mismatch in certificate or entity ID produces signature validation failures at runtime.

Identity provider discovery

The process of determining which IdP should authenticate a user, implemented in PingFederate via an IdP discovery adapter or external discovery service.

Composite adapter

An IdP adapter that chains multiple adapters, using success or failure outcomes from one to decide which adapter runs next, enabling step-up or fallback flows.