PingFederate key terms

A server-side integration component that connects PingFederate to an identity store or IdP so it can collect user attributes and authenticate users during SSO transactions.

An adapter instance configured on the identity provider side that performs user authentication and supplies attribute values for the assertion issued to a service provider.

An adapter instance configured on the service provider side that receives and validates incoming assertions or attribute statements and maps them to local application identity.

The configuration object that defines a trust relationship between PingFederate and a partner, including protocol settings, endpoints, credentials, and attribute mapping for that partner.

A connection configured on PingFederate acting as identity provider, describing which partner service provider receives assertions and how those assertions are built and signed.

A connection configured on PingFederate acting as service provider, describing which partner identity provider is trusted and how incoming assertions are validated and consumed.

A signed XML statement issued by an identity provider about a subject, carrying authentication context and attributes that a service provider validates before granting access.

Security Assertion Markup Language, the XML-based federation standard PingFederate uses to exchange authentication and attribute assertions between identity providers and service providers.

A defined pattern for using SAML, such as Web Browser SSO or Single Logout, that specifies message flows, bindings, and requirements for a particular federation use case.

The transport mechanism by which SAML protocol messages travel between parties, for example HTTP Redirect, HTTP POST, or SOAP, each with different encoding and security characteristics.

A structured XML document describing an entity's endpoints, signing certificates, and supported bindings, exchanged between partners so each side can configure trust without manual entry.

A unique identifier string assigned to an identity provider or service provider in federation metadata and protocol messages, used to distinguish entities and prevent misdirected assertions.

The intended recipient value inside an assertion, which the service provider compares against its own identifier to reject assertions meant for a different party.

The defined list of user attributes a connection or adapter will supply, including each attribute's name, purpose, and whether it is required, optional, or subject to pseudonymization.

The portion of an assertion that carries user attribute name-value pairs from the identity provider to the service provider for use in authorization and account linking.

Configuration that translates source attributes from an adapter, policy contract, or incoming assertion into the target attribute contract expected downstream.

A reusable contract that decouples authentication from attribute delivery, letting multiple adapters satisfy a shared policy that connections then consume as an attribute source.

The binding of an authentication policy contract to one or more authentication sources, determining which adapters or chains will satisfy the contract during a transaction.

A rule set that evaluates request context and decides which authentication sources must succeed, and in what order, before a user is allowed to proceed.

The key pair and certificate used to digitally sign protocol messages or assertions, allowing partners to verify origin and integrity through the corresponding public certificate.

The partner's public certificate used to encrypt assertion content so that only the intended recipient, holding the matching private key, can decrypt and read it.

A SAML profile that propagates a logout event across federated sessions so that signing out at one party also terminates sessions at participating partners.

The tracked authenticated state PingFederate maintains for a user, referenced by a cookie and subject to idle and maximum lifetime settings that govern reauthentication.

A registered application entry in PingFederate that defines client credentials, allowed grant types, redirect URIs, scopes, and token settings for OAuth or OpenID Connect flows.

A credential issued to an OAuth client that authorizes API calls on behalf of a resource owner, carrying scopes and an expiration enforced by the resource server.

A named permission string requested by an OAuth client and granted by policy, limiting which resources or actions an access token may be used for.

A PingFederate configuration object that defines token format, lifetime, and issuance behavior for a class of tokens, referenced by OAuth clients and resource endpoints.

A stored record representing a user's authorization to a client, enabling refresh tokens and long-lived consent to survive server restarts and session expiration.

An identity layer built on OAuth 2.0 that adds an ID token and user info endpoint, letting clients verify end-user identity and obtain profile claims.

The configuration that links a federated subject identifier from a partner to a local user account, so the service provider knows which local identity to act as.

A capability that creates or updates a local user account automatically the first time a federated user arrives, based on attributes in the incoming assertion.

A policy behavior that requires a stronger authentication method for sensitive resources, often triggered by request context or by a partner requesting a higher assurance level.

The web-based management interface used to configure connections, adapters, policies, certificates, and server settings, with role-based access for delegated administration.

A deployment mode in which multiple PingFederate nodes share configuration and state so that sessions and administrative changes remain consistent across the cluster.

A reusable configuration pattern that pre-populates settings and attribute contracts so administrators can create many similar partner connections consistently.

A policy component that inspects incoming request details and routes the transaction to the appropriate authentication policy or adapter chain.