PingCentral

Release Notes

These release notes summarize the changes in current and previous PingCentral product updates. Updated June 17, 2024.

PingCentral 2.0.2 (April 2024)

Upgrade processes now work as expected

Fixed PASS-6905

Previously, if PingCentral had at least one SP connection or one PingAccess template, upgrades from version 1.14 to 2.0 would fail. This issue has been resolved and upgrades now work as expected.

Expressions can now be added or updated in SAML applications

Fixed PASS-6906

Previously, if applications were created from SAML templates that contained at least 1 OGNL expression, the expressions could not be updated, nor could new expressions be added for attribute mapping. This issue has been resolved and expressions can now be added and updated as needed.

SAML application templates can now be updated

Fixed PASS-6907

Previously, when administrators tried to change the templates associated with SAML applications, the change would not be saved. This issue has been resolved and SAML applications can now be updated with new templates.

Database errors no longer occur during upgrade

Fixed PASS-6940

Previously, if PingCentral had a SAML template with expressions or PingAccess templates, database errors would occur when upgrading from version 1.14 to 2.0. The issue has been resolved and upgrade processes now work as expected.

PingCentral 2.0.1 (January 2024)

Approval window now displays most recently promoted version

Fixed PASS-6865

Previously, when administrators reviewed application promotion requests and compared the submitted JSON to the most recently promoted version, the original version was displayed instead of the most recently promoted version. This issue has been resolved and the most recently promoted version now displays in the approval window.

Updated JSON for OIDC applications now displays in PingFederate after promotion

Fixed PASS-6900

Previously, if application owners updated the underlying application JSON in their OIDC applications, and administrator approval was required to promote them, the updated JSON was not reflected in PingFederate. This issue has been resolved and the updated JSON now displays in PingFederate as expected.

Application synchronization now works as expected for OIDC applications

Fixed PASS-6901

Previously, when OIDC applications were synchronized to the most up-to-date configurations available, they were saved as OAuth applications. This issue has been resolved and the synchronization process now works as expected.

PingCentral 2.0 (December 2023)

New features and improvements in PingCentral 2.0.

Template synchronization now available for SAML and PingAccess applications

New PASS-6730

Administrators can now synchronize OAuth, OIDC, SAML, and PingAccess templates to ensure that their templates are based on the most up-to-date configurations available. Applications based on out-of-date templates have Outdated Template icons displayed next to them, which inform application owners that newer versions of the templates are available.

Administrators can also now revert SAML SP connections and PingAccess application templates to previous versions. See the Reverting templates to previous versions tab on the SAML 2.0 and PingAccess templates page for details.

Note that when you upgrade to PingCentral 2.0, SAML and PingAccess application templates will have base revisions created for them. OAuth and OIDC templates created prior to version 2.0 cannot be synced with the most recent configurations available. Recreate the template in version 2.0 to use the sync feature going forward.

Application owners can now edit application JSON themselves

New PASS-6670

To accommodate a wide variety of promotion needs, application owners can now edit the application JSON for their applications when they promote them.

Note that providing application owners with this ability can be risky, so it’s highly recommended that approvals are enabled for the environment. Administrators can review the submitted application JSON and compare it to the original application JSON before approving the promotion request.

Also note that:

  • This functionality is not yet available for PingAccess applications.

  • Applications cannot be reverted to a promotion that uses JSON editing.

  • Be aware that the JSON review window compares against the original application JSON and not the most recently promoted JSON.

Prevent application owners from deleting applications

New PASS-6731

To prevent application owners from accidentally deleting applications from PingFederate (and PingAccess, when applicable) environments, you can enable a new option that allows only administrators to delete applications from the environment.

Hide inactive promotion approvals

Improved PASS-6733

To help manage promotion approvals, both administrators and application owners can now hide promotion approvals that are in a canceled, promoted, or rejected status that display on the Promotion Approvals page when the Visible filter is used, which is enabled by default.

Approval expressions drag and drop enhancement

Improved PASS-6732

Administrators can add multiple approval expressions for an environment, which are evaluated sequentially from top to bottom in an IF/ELSE chain. Now, administrators can change the order in which these expressions display in the list by dragging and dropping them into different locations within the list instead of copying and pasting them between fields.

Multi-APC connection synchronization

Issue PASS-6705

Previously, PingCentral was unable to handle a service provider (SP) connection with multiple Authentication Policy Contracts (APC) mapped within it. The PingCentral 1.14 release enables users to select from multiple mapped contracts when adding an application as a managed application or a template.

However, due to a known synchronization limitation, if you update an existing single APC SP connection already managed by PingCentral to include a second APC and subsequently synchronize the application, you won’t find an option to specify your preferred APC.

To simplify your workflow and mitigate potential challenges, we recommend refraining from using synchronization to modify multi-APC connections. Instead, consider creating a new SP connection that aligns with your desired APC configuration. This approach grants you control over APC selection, ensuring a smoother and more efficient process.

Configure APC mappings for OIDC applications in PingFederate

Issue PASS-3613 PingFederate

PingCentral promotes access token mappings and authentication policy contracts (APCs) with OIDC applications, but the APC mappings that link the APCs to the access token managers are not currently promoted with them. If the APC mappings do not already exist in the target PingFederate environments, applications do not function as expected.

When new APCs are promoted in PingCentral, access token mapping referencing the APC is created, but persistent grant mapping is not established, so the configurations are invalid.

To resolve these issues, configure the APC mappings within PingFederate.

Promoting applications with authentication challenge policies

Issue PASS-4948 PingAccess

Customized authentication challenge responses, which support single-page applications, are available in PingAccess 6.2 or later. Applications with this type of policy can be added to PingCentral but cannot be promoted to another environment unless the authentication challenge policy, with the same UUID, also exists in the target environment.

SP certificates and assertion encryption certificates must be different

Issue PASS-5663 PingAccess

When promoting SAML applications, PingFederate does not allow you to use the same certificate as both a service provider (SP) certificate and an assertion encryption certificate. Instead of preventing the promotion to continue, you receive a message similar to the following:

Environment'staging':  {pingfed}. This certificate either has the same ID or the same content as the certificate with index 0.

To continue the promotion, ensure that the SP certificate and the assertion encryption certificate are different.

Update truststore path if PingCentral fails to start

Issue PASS-5977

After upgrading to 1.8, 1.9, 1.10, or 1.11, PingCentral fails to start if $\{pingcentral.home} is used in the trust store path. To prevent this from happening, change the home path to be the absolute trust store path and delete the Certificates table in the database.

Cannot update or revert templates created in 1.2 or earlier

Issue PASS-6466

Templates created in 1.2 or earlier do not store the environment ID, so you cannot update their grant types, scopes, or policy contracts, nor can you revert them to previous versions.

PingCentral 1.14.1 (November 2023)

Enhancements and resolved issues in PingCentral 1.14.1.

Forbidden error when loading API documentation

Fixed PASS-6820

We fixed an error that prevented API documentation from loading when using OIDC single sign-on (SSO) with PingCentral.

PingCentral 1.14 (September 2023)

New features and improvements in PingCentral 1.14.

Disable environments when down for maintenance or offline

New PASS-6666/PASS-6683

PingCentral administrators can now disable referenced PingFederate environments for any reason, such as PingFederate being unavailable due to maintenance tasks. Additionally, we added a new environment status bar that indicates if an environment is offline. In such cases, application owners will receive a notification indicating that the environment is disabled or offline rather than encountering a UI error. For more information, see step 1 of the Updating environments tab in Managing environments.

Import SAML Connection to PingCentral from PingFederate with attributes mapped to data source

New PASS-6667

All attributes defined in a SAML SP connection are now integrated into the PingCentral application. This enhancement eliminates a limitation and is expected to enhance usability significantly. For more information, see step 3 in Using SAML 2.0 templates.

Additional synchronization capabilities

New PASS-6696

We added the ability to effortlessly initiate an application synchronization in PingCentral. Now, when you make external modifications to an application configuration, you can seamlessly update the application information within PingCentral. This removes the need to manually update application information and introduces a more streamlined and efficient process. For more information, see step 2 in Updating applications.

Other improvements

New

We also updated the following bundled components and third-party dependencies:

  • Apache Commons Text 1.10

H2 database migration when the installation path has any spaces

Fixed PASS-6591

We resolved an issue where H2 database migration fails during an upgrade if there are spaces in the installation path for the existing or new instance.

SSO inactivity sign off

Fixed PASS-6690

We fixed an issue where utilizing single sign-on (SSO) to access the PingCentral console incorrectly triggered a timeout based on an ID token’s lifetime.

Multi-APC connection synchronization

Issue PASS-6705

Previously, PingCentral was unable to handle a service provider (SP) connection with multiple Authentication Policy Contracts (APC) mapped within it. The PingCentral 1.14 release enables users to select from multiple mapped contracts when adding an application as a managed application or a template.

However, due to a known synchronization limitation, if you update an existing single APC SP connection already managed by PingCentral to include a second APC and subsequently synchronize the application, you won’t find an option to specify your preferred APC.

To simplify your workflow and mitigate potential challenges, we recommend refraining from using synchronization to modify multi-APC connections. Instead, consider creating a new SP connection that aligns with your desired APC configuration. This approach grants you control over APC selection, ensuring a smoother and more efficient process.

Configure APC mappings for OIDC applications in PingFederate

Issue PASS-3613 PingFederate

PingCentral promotes access token mappings and authentication policy contracts (APCs) with OIDC applications, but the APC mappings that link the APCs to the access token managers are not currently promoted with them. If the APC mappings do not already exist in the target PingFederate environments, applications do not function as expected.

When new APCs are promoted in PingCentral, access token mapping referencing the APC is created, but persistent grant mapping is not established, so the configurations are invalid.

To resolve these issues, configure the APC mappings within PingFederate.

Promoting applications with authentication challenge policies

Issue PASS-4948 PingAccess

Customized authentication challenge responses, which support single-page applications, are available in PingAccess 6.2 or later. Applications with this type of policy can be added to PingCentral but cannot be promoted to another environment unless the authentication challenge policy, with the same UUID, also exists in the target environment.

SP certificates and assertion encryption certificates must be different

Issue PASS-5663 PingAccess

When promoting SAML applications, PingFederate does not allow you to use the same certificate as both a service provider (SP) certificate and an assertion encryption certificate. Instead of preventing the promotion to continue, you receive a message similar to the following:

Environment'staging':  {pingfed}. This certificate either has the same ID or the same content as the certificate with index 0.

To continue the promotion, ensure that the SP certificate and the assertion encryption certificate are different.

Update truststore path if PingCentral fails to start

Issue PASS-5977

After upgrading to 1.8, 1.9, 1.10, or 1.11, PingCentral fails to start if $\{pingcentral.home} is used in the trust store path. To prevent this from happening, change the home path to be the absolute trust store path and delete the Certificates table in the database.

Cannot update or revert templates created in 1.2 or earlier

Issue PASS-6466

Templates created in 1.2 or earlier do not store the environment ID, so you cannot update their grant types, scopes, or policy contracts, nor can you revert them to previous versions.

PingCentral 1.13

PingCentral 1.13 was skipped.

PingCentral 1.12 (June 2023)

New features and improvements in PingCentral 1.12.

Approval workflow

New PASS-6479

Previously, PingCentral did not allow an administrator to require approval for a non-administrator to promote an application to an environment. As of now, administrators can use Spring Expression Language (SpEL) based rules to trigger an approval requirement if an expression is or isn’t met. Administrators will find a bell icon indicating active approval requests, and developers are informed when their requests are approved. For more information, see Managing approvals (administrators).

Client secret management enhancements

Improved PASS-6500

Administrators can now enforce a strong client secret for applications by requiring that PingCentral generate the client secret. With this feature enabled, when developers promote an application, they won’t be able to create a client secret manually. This avoids the usage of weak client secrets. For more information, see Managing environments.

Multiple SLO Service URLs

New PASS-6609

When promoting SAML applications, developers can adjust and configure single logout (SLO) URLs. This adds flexibility and removes the need to manage multiple SAML applications only because different SLO URLs are required. For more information, see Promoting SAML applications.

JDK 17 support

New

We added support for Java Development Kit (JDK) 17.

SAML metadata export

Fixed PASS-5630

To set up a service provider (SP) connection, PingCentral now accepts SAML metadata files exported from other SP connections. These files are used to extract the following information: entity IDs, ACS URLs, SLO service URLs, certificates, and attributes.

Configure APC mappings for OIDC applications in PingFederate

Issue PASS-3613 PingFederate

PingCentral promotes access token mappings and authentication policy contracts (APCs) with OIDC applications, but the APC mappings that link the APCs to the access token managers are not currently promoted with them. If the APC mappings do not already exist in the target PingFederate environments, applications do not function as expected.

When new APCs are promoted in PingCentral, access token mapping referencing the APC is created, but persistent grant mapping is not established, so the configurations are invalid.

To resolve these issues, configure the APC mappings within PingFederate.

Promoting applications with authentication challenge policies

Issue PASS-4948 PingAccess

Customized authentication challenge responses, which support single-page applications, are available in PingAccess 6.2 or later. Applications with this type of policy can be added to PingCentral but cannot be promoted to another environment unless the authentication challenge policy, with the same UUID, also exists in the target environment.

SP certificates and assertion encryption certificates must be different

Issue PASS-5663 PingAccess

When promoting SAML applications, PingFederate does not allow you to use the same certificate as both a service provider (SP) certificate and an assertion encryption certificate. Instead of preventing the promotion to continue, you receive a message similar to the following:

Environment'staging':  {pingfed}. This certificate either has the same ID or the same content as the certificate with index 0.

To continue the promotion, ensure that the SP certificate and the assertion encryption certificate are different.

Update truststore path if PingCentral fails to start

Issue PASS-5977

After upgrading to 1.8, 1.9, 1.10, or 1.11, PingCentral fails to start if $\{pingcentral.home} is used in the trust store path. To prevent this from happening, change the home path to be the absolute trust store path and delete the Certificates table in the database.

Cannot update or revert templates created in 1.2 or earlier

Issue PASS-6466

Templates created in 1.2 or earlier do not store the environment ID, so you cannot update their grant types, scopes, or policy contracts, nor can you revert them to previous versions.

PingCentral 1.11 (March 2023)

For the best possible experience, review these notes before using PingCentral 1.11.

Updated client secret generation to produce client secrets compatible with PingFederate

New

When creating a new client, PingCentral now generates OAuth client secrets compatible with PingFederate. For more information, see Promoting OAuth and OIDC applications.

Multiple ACS URLs

New

You can now configure multiple Assertion Consumer Service (ACS) URLs during SAML application creation. This new feature simplifies application development since the same application can use different URLs simultaneously. For more information, see Using SAML 2.0 templates.

Set application name

New

When promoting an application between environments, you can now configure an application name for OAuth and OpenID Connect (OIDC) clients, SAML connections, and PingAccess applications. For more information, see Promoting applications.

Deleting an application in PingCentral also deletes it in other environments

Improved

You can now choose to delete applications from PingFederate or PingAccess in addition to PingCentral. This feature is flexible because you can select which environments to delete the application from. For more information, see Managing applications.

Configure OAuth credentials for use instead of username and password to connect to PingFederate or PingAccess

Improved

Instead of using administrator credentials for basic authentication, you can now configure PingCentral to use OAuth client credentials to connect to PingFederate or PingAccess. PingCentral will request an access_token to use whenever it connects to PingFederate or PingAccess. For more information, see Configuring PingFederate and PingAccess for SSO.

Upgraded from v1 H2 database to v2

Security

Along with other dependencies (libraries), we’ve upgraded the H2 database from v1 to v2. For more information, see Upgrading PingCentral.

Configure APC mappings for OIDC applications in PingFederate

Issue PASS-3613 PingFederate

PingCentral promotes access token mappings and authentication policy contracts (APCs) with OIDC applications, but the APC mappings that link the APCs to the access token managers are not currently promoted with them. If the APC mappings do not already exist in the target PingFederate environments, applications do not function as expected.

When new APCs are promoted in PingCentral, access token mapping referencing the APC is created, but persistent grant mapping is not established, so the configurations are invalid.

To resolve these issues, configure the APC mappings within PingFederate.

Promoting applications with authentication challenge policies

Issue PASS-4948 PingAccess

Customized authentication challenge responses, which support single-page applications, are available in PingAccess 6.2 or later. Applications with this type of policy can be added to PingCentral but cannot be promoted to another environment unless the authentication challenge policy, with the same UUID, also exists in the target environment.

SP certificates and assertion encryption certificates must be different

Issue PASS-5663 PingAccess

When promoting SAML applications, PingFederate does not allow you to use the same certificate as both a service provider (SP) certificate and an assertion encryption certificate. Instead of preventing the promotion to continue, you receive a message similar to the following:

Environment’staging': PingFederate. This certificate either has the same ID or the same content as the certificate with index 0.

To continue the promotion, ensure that the SP certificate and the assertion encryption certificate are different.

Update truststore path if PingCentral fails to start

Issue PASS-5977

After upgrading to 1.8, 1.9, 1.10, or 1.11, PingCentral fails to start if $\{pingcentral.home} is used in the trust store path. To prevent this from happening, change the home path to be the absolute trust store path and delete the Certificates table in the database.

Cannot update or revert templates created in 1.2 or earlier

Issue PASS-6466

Templates created in 1.2 or earlier do not store the environment ID, so you cannot update their grant types, scopes, or policy contracts, nor can you revert them to previous versions.

Cannot migrate the H2 database if the installation path has any spaces

Issue PASS-6591

If the installation path has any spaces in the existing or new instance, the H2 database is not migrated during upgrade. Upon removing the spaces from the file path, the migration is successful.

PingCentral 1.10 (June 2022)

For the best possible experience, review these notes before using PingCentral 1.10.

Update OAuth and OIDC template grant types, scopes, and policy contracts and revert to previous versions

New PASS-2017

If you are an administrator, you can now update the grant types, scopes, and policy contracts in OAuth and OpenID Connect (OIDC) templates to further customize them to meet your needs.The history of these templates is also available to review and compare with previous versions. You can see which administrator modified the template configuration or policy contract, when it was modified, and details regarding these modifications. You can also revert templates to previous versions, if necessary. See OAuth and OIDC templates for details.

Update applications with the latest template version available

New PASS-6007

If an application is based on an outdated template, an Outdated Template icon now displays next to its name in the applications list. Edit the template and click the Update Template button. See Updating applications for details.

Use SSO to access PingFederate and PingAccess from PingCentral

New PASS-5202 and PASS-6018

You can now use SSO to access PingFederate and PingAccess from PingCentral. For details, see Configuring PingFederate and PingAccess for SSO.

Account lockout mechanisms added to mitigate password guessing

Improved PASS-6388

Account lockout mechanisms that prevent users from accessing the application or API after a specified number of failed sign-on attempts were added to this release. Specify the number of failed attempts that are allowed before users are locked out and the lockout period in the application.yaml file.

Cannot update or revert templates created in version 1.2 or earlier

Issue PASS-6466

Templates created in version 1.2 or earlier do not store the environment ID, so you cannot update their grant types, scopes, or policy contracts, nor can you revert them to previous versions.

Resolved a potential security vulnerability

Security PASS-6387 and PASS-6378

Resolved a potential security vulnerability that is described in security bulletin SECBL022 (requires sign-on).

Configure APC mappings for OIDC applications in PingFederate

Issue PASS-3613 PingFederate

PingCentralpromotes access token mappings and authentication policy contracts (APCs) with OIDC applications, but the APC mappings that link the APCs to the access token managers are not currently promoted with them. If the APC mappings do not already exist in the target PingFederate environments, applications do not function as expected.When new APCs are promoted in PingCentral, access token mapping referencing the APC is created, but persistent grant mapping is not established, so the configurations are invalid.To resolve these issues, configure the APC mappings within PingFederate.

SP certificates and assertion encryption certificates must be different

Issue PASS-5663 PingFederate

When promoting SAML applications, PingFederate does not allow you to use the same certificate as both a service provider (SP) certificate and an assertion encryption certificate. Instead of preventing the promotion to continue, you receive a message similar to the following:Environment’staging': PingFederate. This certificate either has the same ID or the same content as the certificate with index 0.To continue the promotion, ensure that the SP certificate and the assertion encryption certificate are different.

Promoting applications with authentication challenge policies

Issue PASS-4948 PingAccess

Customized authentication challenge responses, which support single-page applications, are available in PingAccess 6.2 or later. Applications with this type of policy can be added to PingCentral, but cannot be promoted to another environment unless the authentication challenge policy, with the same UUID, also exists in the target environment.

Update truststore path if PingCentral fails to start

Issue PASS-5977

After upgrading to 1.8, 1.9, or 1.10, PingCentral fails to start if $\{pingcentral.home} is used in the trust store path. To prevent this from happening, change the home path to be the absolute trust store path and delete the Certificates table in the database.

Adding SAML applications through the API

Issue PASS-5009

If you attempt to add a SAML application to PingCentral from an existing application through the API, and the connection JSON contains identity attribute names and placeholders, you receive an error message advising you to nullify the Names field. However, even if you nullify this field, you still receive an error message because the JSON contains placeholders. Remove these placeholders before you proceed.

Managing environments through the API

Issue PASS-5001 and PASS-5002

When creating, updating, or validating an environment through the API, you receive a server error message if the environment Name or Password fields are null or missing. API requests cannot be processed without this information, so ensure that these fields contain valid values.You will also receive a misleading error message if the PingAccess Password field is null. Rather than informing you that the information in this field is invalid, it informs you that you cannot connect to the PingFederateadministrative console, which is misleading.Requests to connect PingAccess to a PingCentral environment cannot be processed without this information, so ensure that this field contains a valid value.