PingAccess 6.2 - December 2020 - PingAccess - 6.2

Enhancements

Added virtual resources

You can configure virtual resources which do not correspond to a literal resource in an application. When an end user attempts to access a virtual resource, PingAccess generates a response that you configure. You can use virtual resources to create redirects or to support single-page applications. See Adding application resources for more information.

Added customized authentication challenge responses

You can configure customized authentication challenge responses to provide better support for single-page applications. See Authentication and Configuring authentication challenge policies for more information.

Added an integration with Splunk

You can integrate PingAccess with Splunk, making monitoring and reporting data available through Splunk. See Writing audit logs for Splunk for more information.

Added an administrative mode where Admin Authentication configuration is read-only

You can configure users with a new role, which gives administrative users full access to almost every feature except for changing the authorization configuration. This lets you give administrators broad access but prevents accidental lockout. See Configuring API authentication and Configuring admin UI SSO authentication for more information.

Added ability to specify HTTP methods for resources

You can include HTTP methods when defining an application resource. See Adding application resources for more information.

Added ability to map identity JWT as bearer token

Within a JWT identity mapping, you can now include the JWT in the authorization request header field as a bearer token. See Creating JWT identity mappings for more information.

Added local access token validation for Admin API access

You can configure the Admin API to validate JWT access tokens issued by the admin token provider, letting you use an admin token provider that does not support token introspection. See Configuring API authentication for more information.

Added RS256 as a JWT signing algorithm

You can now use RS256 with a 2048-bit key size as a signing algorithm for JSON web tokens. This option is now the default for auth tokens.

Added ability to configure username attribute for Admin SSO

When you configure Admin SSO, you can now select the attribute to use as the username. See Configuring admin UI SSO authentication for more information.

Added environment name

You can configure a name for your PingAccess environment, which is displayed in the menu bar. See Changing the Environment Name for more information.

Added server-side wildcard support for cross-origin request rules

When you configure a cross-origin request rule to use a wildcard, you can replace the Access-Control-Allow-Origin response header with the value in the request's Origin header. See Adding a cross-origin request rule for more information.

Added proxied PingFederate configuration option

You can configure PingAccess to proxy a PingFederate runtime that's being used as a token provider, making configuration of PingFederate less error-prone when PingAccess is proxying to PingFederate. See Configuring a proxied PingFederate runtime for more information.

Added exclusion list capability for header identity mappings

You can configure an identity mapping to include all attributes as headers except for those you specify, reducing the number of steps it takes to add new attributes to identity mappings - just add the attribute at the token provider. See Creating header identity mappings for more information.

Added administrative token provider option

You can use a separate token provider for accessing the PingAccess UI and Admin API, letting you provide for account segregation. See Configuring an admin token provider for more information.

Added OAuth client rule

You can create rules that grant or deny access based on one or more OAuth Client IDs, making it easier to restrict access based on the Client ID without resorting to Groovy. See Adding OAuth client rules for more information.

Added scopes to one-time authorization rules

You can include standard or custom scopes in the OIDC backchannel authentication request to more clearly communicate the details of the request to the end-user through the CIBA request. See Adding one-time authorization rules for more information.

Improved metadata usage in identity mappings

The attribute name fields in identity mappings now expose information from the transaction's metadata, letting you select from known attributes such as pi.sri. See Creating header identity mappings and Creating JWT identity mappings for more information.

Added support for client certificate authentication with self-signed certificates

PingAccess now supports client certificate authentication with self-signed certificates, providing additional flexibility in certificate handling. See Defining engine listeners and Configuring virtual host trusted certificate groups for more information.

Resolved issues