I85PREP
⌘ K
PingFederate study materials
PingFederate study resources

PingFederate: PingFederate Administration

PingFederate · Work through your exam, one topic at a time.

All guide sections

PingFederate Administration

PingFederate Administration

This domain tests the control plane of PingFederate: administrative accounts and roles, the admin console and Administrative API, cluster topology, certificate lifecycle, and connection metadata. It tests whether you can change a running deployment safely, not federation protocol theory.

Administrative access

  • Administrative accounts are local and role-based. Administrator has full configuration rights; Crypto Administrator manages keys and certificates; User Administrator manages admin accounts; Auditor is read-only for logs and audit. Use separate least-privilege accounts.
  • The Administrative API sits under /pf-admin-api/v1 and uses an OAuth 2.0 access token from a configured admin API client, not a console session cookie.

Cluster rules

  • One admin node runs the console; engine nodes run the runtime. Configuration changes are made on the admin node and replicated to engines. Runtime session state is node-local and is not configuration-replicated.
  • Admin failover requires a healthy node list and replication; promote only after verifying the target is synchronized.

Certificates and connections

  • The connection signing certificate, runtime SSL certificate, and admin console certificate are separate objects. Create key pairs/CSRs in Certificate Management and import partner certs as trust anchors.
  • For rollover, publish the new signing cert in metadata while the old cert remains active, then activate the new cert after partners refresh.

Worked example

An SP connection must rotate its IdP signing certificate without an outage. Create or import the new key pair, add its certificate as the connection's secondary signing certificate, send updated metadata to the SP, wait for import, then make the new certificate active and keep the old as secondary until all partners refresh. Reasoning: metadata is cached; replacing the active certificate immediately causes signature validation failures.

Traps

  • Using the admin console certificate as the connection signing cert.
  • Trying to open the console on an engine node.
  • Giving Auditor the Administrator role for convenience.
  • Automating the API with an admin password instead of an OAuth client.