Release Notes
These release notes summarize the changes in current and previous PingCentral product updates.
PingCentral 1.11 (March 2023)
For the best possible experience, review these notes before using PingCentral 1.11.
Updated client secret generation to produce client secrets compatible with PingFederate
New
When creating a new client, PingCentral now generates OAuth client secrets compatible with PingFederate. For more information, see Promoting OAuth and OIDC applications.
Multiple ACS URLs
New
You can now configure multiple Assertion Consumer Service (ACS) URLs during SAML application creation. This new feature simplifies application development since the same application can use different URLs simultaneously. For more information, see Using SAML 2.0 templates.
Set application name
New
When promoting an application between environments, you can now configure an application name for OAuth and OpenID Connect (OIDC) clients, SAML connections, and PingAccess applications. For more information, see Promoting applications.
Deleting an application in PingCentral also deletes it in other environments
Improved
You can now choose to delete applications from PingFederate or PingAccess in addition to PingCentral. This feature is flexible because you can select which environments to delete the application from. For more information, see Managing applications.
Configure OAuth credentials for use instead of username and password to connect to PingFederate or PingAccess
Improved
Instead of using administrator credentials for basic authentication, you can now configure PingCentral to use OAuth client credentials to connect to PingFederate or PingAccess. PingCentral will request an access_token
to use whenever it connects to PingFederate or PingAccess. For more information, see Configuring PingFederate and PingAccess for SSO.
Upgraded from v1 H2 database to v2
Security
Along with other dependencies (libraries), we’ve upgraded the H2 database from v1 to v2. For more information, see Upgrading PingCentral.
Configure APC mappings for OIDC applications in PingFederate
Issue PASS-3613 PingFederate
PingCentral promotes access token mappings and authentication policy contracts (APCs) with OIDC applications, but the APC mappings that link the APCs to the access token managers are not currently promoted with them. If the APC mappings do not already exist in the target PingFederate environments, applications do not function as expected.
When new APCs are promoted in PingCentral, access token mapping referencing the APC is created, but persistent grant mapping is not established, so the configurations are invalid.
To resolve these issues, configure the APC mappings within PingFederate.
Promoting applications with authentication challenge policies
Issue PASS-4948 PingAccess
Customized authentication challenge responses, which support single-page applications, are available in PingAccess 6.2 or later. Applications with this type of policy can be added to PingCentral but cannot be promoted to another environment unless the authentication challenge policy, with the same UUID, also exists in the target environment.
SP certificates and assertion encryption certificates must be different
Issue PASS-5663 PingAccess
When promoting SAML applications, PingFederate does not allow you to use the same certificate as both a service provider (SP) certificate and an assertion encryption certificate. Instead of preventing the promotion to continue, you receive a message similar to the following:
Environment’staging': PingFederate. This certificate either has the same ID or the same content as the certificate with index 0.
To continue the promotion, ensure that the SP certificate and the assertion encryption certificate are different.
Update truststore path if PingCentral fails to start
Issue PASS-5977 PASS-6466
After upgrading to 1.8, 1.9, 1.10, or 1.11, PingCentral fails to start if $\{pingcentral.home}
is used in the trust store path. To prevent this from happening, change the home path to be the absolute trust store path and delete the Certificates table in the database.
PingCentral 1.10 (June 2022)
For the best possible experience, review these notes before using PingCentral 1.10.
Update OAuth and OIDC template grant types, scopes, and policy contracts and revert to previous versions
New PASS-2017
If you are an administrator, you can now update the grant types, scopes, and policy contracts in OAuth and OpenID Connect (OIDC) templates to further customize them to meet your needs.The history of these templates is also available to review and compare with previous versions. You can see which administrator modified the template configuration or policy contract, when it was modified, and details regarding these modifications. You can also revert templates to previous versions, if necessary. See OAuth and OIDC templates for details.
Update applications with the latest template version available
New PASS-6007
If an application is based on an outdated template, an Outdated Template icon now displays next to its name in the applications list. Edit the template and click the Update Template button. See Updating applications for details.
Use SSO to access PingFederate and PingAccess from PingCentral
New PASS-5202 and PASS-6018
You can now use SSO to access PingFederate and PingAccess from PingCentral. For details, see Configuring PingFederate and PingAccess for SSO.
Account lockout mechanisms added to mitigate password guessing
Improved PASS-6388
Account lockout mechanisms that prevent users from accessing the application or API after a specified number of failed sign-on attempts were added to this release. Specify the number of failed attempts that are allowed before users are locked out and the lockout period in the application.yaml
file.
Cannot update or revert templates created in version 1.2 or earlier
Issue PASS-6466
Templates created in version 1.2 or earlier do not store the environment ID, so you cannot update their grant types, scopes, or policy contracts, nor can you revert them to previous versions.
Resolved a potential security vulnerability
Security PASS-6387 and PASS-6378
Resolved a potential security vulnerability that is described in security bulletin SECBL022 (requires sign-on).
Configure APC mappings for OIDC applications in PingFederate
Issue PASS-3613 PingFederate
PingCentralpromotes access token mappings and authentication policy contracts (APCs) with OIDC applications, but the APC mappings that link the APCs to the access token managers are not currently promoted with them. If the APC mappings do not already exist in the target PingFederate environments, applications do not function as expected.When new APCs are promoted in PingCentral, access token mapping referencing the APC is created, but persistent grant mapping is not established, so the configurations are invalid.To resolve these issues, configure the APC mappings within PingFederate.
SP certificates and assertion encryption certificates must be different
Issue PASS-5663 PingFederate
When promoting SAML applications, PingFederate does not allow you to use the same certificate as both a service provider (SP) certificate and an assertion encryption certificate. Instead of preventing the promotion to continue, you receive a message similar to the following:Environment’staging': PingFederate. This certificate either has the same ID or the same content as the certificate with index 0.
To continue the promotion, ensure that the SP certificate and the assertion encryption certificate are different.
Promoting applications with authentication challenge policies
Issue PASS-4948 PingAccess
Customized authentication challenge responses, which support single-page applications, are available in PingAccess 6.2 or later. Applications with this type of policy can be added to PingCentral, but cannot be promoted to another environment unless the authentication challenge policy, with the same UUID, also exists in the target environment.
Update truststore path if PingCentral fails to start
Issue PASS-5977
After upgrading to 1.8, 1.9, or 1.10, PingCentral fails to start if $\{pingcentral.home}
is used in the trust store path. To prevent this from happening, change the home path to be the absolute trust store path and delete the Certificates table in the database.
Adding SAML applications through the API
Issue PASS-5009
If you attempt to add a SAML application to PingCentral from an existing application through the API, and the connection JSON contains identity attribute names and placeholders, you receive an error message advising you to nullify the Names field. However, even if you nullify this field, you still receive an error message because the JSON contains placeholders. Remove these placeholders before you proceed.
Managing environments through the API
Issue PASS-5001 and PASS-5002
When creating, updating, or validating an environment through the API, you receive a server error message if the environment Name or Password fields are null or missing. API requests cannot be processed without this information, so ensure that these fields contain valid values.You will also receive a misleading error message if the PingAccess Password field is null. Rather than informing you that the information in this field is invalid, it informs you that you cannot connect to the PingFederateadministrative console, which is misleading.Requests to connect PingAccess to a PingCentral environment cannot be processed without this information, so ensure that this field contains a valid value.