PingFederate study plan
PingFederate · Give each week a clear focus.
8 weeks · About 6 hours per week
PingFederate Administration
Map the PingFederate administrative console layout: identify where server configuration, authentication policies, adapters, and IdP/SP connections live
Install a single-node PingFederate instance in a lab VM and complete first-boot setup including admin account and license
Explain the difference between runtime and administrative access, and identify the default admin ports and console URLs
Configure administrative account roles and describe how role assignment maps to delegated administration
Your checkpoint
A one-page annotated console map plus a running lab PingFederate node with a documented admin login and role assignment
PingFederate Administration
Describe the SAML 2.0 and WS-Federation use cases PingFederate supports and when each is chosen
Configure a basic IdP-initiated SAML connection between two lab PingFederate nodes
Trace a SAML assertion through the administrative console using the transaction and audit logs
List the certificate types PingFederate uses (signing, encryption, SSL) and explain which connection settings reference each
Your checkpoint
A working IdP-to-SP SAML SSO flow between two lab nodes, with a captured assertion and a written explanation of each certificate in the trust chain
PingFederate Administration
Configure an SP-initiated SAML connection and compare it with IdP-initiated behavior
Set up OAuth 2.0 and OpenID Connect client registration in the lab and complete an authorization code flow
Configure an identity provider adapter or IdP connection to an external identity source and validate attribute mapping
Explain how attribute contracts and attribute sources feed assertion and token issuance
Your checkpoint
A lab configuration supporting one SAML SP connection and one OIDC client, with a table mapping each attribute source to its contract output
PingFederate Administration
Configure authentication policies with multiple rules, selectors, and fall-through behavior
Implement multi-factor authentication using an adapter in an authentication policy
Explain session management settings including idle timeout, maximum session lifetime, and SSO session behavior
Use the administrative console to inspect and revoke active sessions
Your checkpoint
An authentication policy with at least two rules and one MFA adapter, demonstrated by a login that triggers each rule, plus a session revocation walkthrough
PingFederate Administration
Configure connection-level and global signing and encryption certificate settings and rotate a signing certificate without breaking SSO
Describe metadata exchange: importing and exporting partner metadata and publishing local metadata
Explain how PingFederate validates assertions and what settings control audience, recipient, and signature validation
Configure logging levels and identify which log files capture authentication and connection errors
Your checkpoint
A certificate rotation runbook validated in the lab: rotate a signing cert, re-exchange metadata, and show a successful SSO after rotation
PingFederate Administration
Configure an outbound provisioning connection and describe SCIM-based user provisioning behavior
Explain how PingFederate handles access token issuance, validation, and introspection for API protection
Configure an access token manager and describe the difference between reference tokens and self-contained tokens
Set up a policy for token revocation and describe the administrative steps to invalidate issued tokens
Your checkpoint
A lab configuration issuing an access token through an access token manager, with a written comparison of reference versus self-contained tokens and a tested revocation step
PingFederate Administration
Perform a backup of PingFederate configuration and restore it to a second lab node
Configure cluster settings and explain how configuration replication works across nodes
Describe how to upgrade a PingFederate instance and identify pre-upgrade checks for configuration and certificates
Troubleshoot a deliberately broken connection using logs, transaction IDs, and console diagnostics
Your checkpoint
A documented backup-and-restore procedure executed against a second node, plus a troubleshooting write-up for one intentionally broken connection
PingFederate Administration
Review all lab configurations and consolidate notes into a single administration reference
Complete timed practice covering SAML, OIDC, authentication policies, and certificate management
Re-run the two weakest lab tasks from earlier weeks without notes
Identify remaining knowledge gaps and schedule follow-up study after the exam date
Your checkpoint
A consolidated administration reference document and a timed practice score with a written gap analysis listing the top three areas for further review
Milestones
Week 2: Can complete an IdP-initiated SAML SSO between two lab nodes and explain the role of each signing and encryption certificate from memory
Week 4: Can build an authentication policy with multiple rules and one MFA adapter, and demonstrate session revocation, without consulting notes
Week 6: Can configure an OIDC client and an access token manager, and articulate the difference between reference and self-contained tokens
Week 8: Can perform a certificate rotation, a configuration backup and restore, and a broken-connection troubleshooting exercise end to end within a single lab session