Scheduling expired PingFederate grant cleanup as a recurring task

PingDirectory provides three recurring tasks for cleaning up expired PingFederate data stored in the directory. These tasks are alternatives to the PingFederate plugins:

clean-up-expired-ping-federate-persistent-access-grants removes expired OAuth persistent access grants.
clean-up-expired-ping-federate-persistent-sessions removes persistent sessions whose maximum lifetime has elapsed.
clean-up-inactive-ping-federate-persistent-sessions removes persistent sessions that have been idle beyond the configured timeout.

When a task is configured on multiple servers in a replication topology, PingDirectory automatically staggers task start times by replication priority so that servers don’t all perform duplicate cleanup work simultaneously.

Before you begin

The accessGrantExpires attribute must be indexed for ordering. Learn more in Indexing grant attributes in PingDirectory in the PingFederate documentation.
Disable the PingFederate built-in cleanup task before enabling any PingDirectory cleanup. Learn more in Managing expired persistent grants in PingDirectory in the PingFederate documentation.
Ensure you only have one PingFederate data cleanup solution in place to avoid conflicts.

Steps

The following examples use the clean-up-expired-ping-federate-persistent-access-grants task, but all three tasks are configured the same way. Use the following properties when creating the task:

base-dn: The DN under which PingFederate stores access grants. For the correct value, check the following file: <pf_install>/pingfederate/server/default/conf/access-grant/ldif-scripts/access-grant-ldap-pingdirectory.ldif.
max-updates-per-second: (Optional) Throttles the delete rate to smooth the performance impact. Set this above the average rate at which expired grants accumulate. The default value is 100.

Create the recurring task.

Example:
```
$ bin/dsconfig create-recurring-task \
  --task-name "Clean Up Expired PF Access Grants" \
  --type clean-up-expired-ping-federate-persistent-access-grants \
  --set base-dn:ou=accessgrants,dc=example,dc=com \
  --set max-updates-per-second:100
```
To also schedule cleanup of expired or inactive persistent sessions, repeat this step using clean-up-expired-ping-federate-persistent-sessions or clean-up-inactive-ping-federate-persistent-sessions as the --type value.

Create a recurring task chain to schedule the task.

Example:

The following example schedules cleanup to run every day at 2:00 AM:

$ bin/dsconfig create-recurring-task-chain \
  --chain-name "Clean Up Expired PF Access Grants" \
  --set enabled:true \
  --set "recurring-task:Clean Up Expired PF Access Grants" \
  --set scheduled-date-selection-type:every-day \
  --set "scheduled-time-of-day:02:00" \
  --set time-zone:America/Denver

Adjust scheduled-time-of-day and time-zone to match your maintenance window. Learn more about scheduling options in About recurring tasks and task chains.

Result

PingDirectory runs the cleanup task at the scheduled time. Some expired PingFederate data might accumulate between executions because the task doesn’t run continuously.