Upgrade considerations introduced in PingFederate 7.x

For LDAP type datastores with LDAPS enabled, hostname verification of the certificate is enabled by default for all new datastores beginning with PingFederate 7.3. When upgrading from a previous version of PingFederate, this option is disabled for existing datastores for compatibility reasons. Administrators should consider activating this new option for greater security.

Outbound provisioning of groups and nested group membership requires an update in the internal datastore. Follow the instructions in Reviewing database changes to add or update the group_membership table.

To mitigate the POODLE attack, the SSLv3 protocol is disabled by default starting in PingFederate 7.3. It can be re-enabled by modifying the connector configuration in jetty-runtime.xml and jetty-admin.xml found in the <pf_install>/pingfederate/etc directory.

Starting with PingFederate 7.3, multivalued attributes in WS-Federation assertions are now represented as multiple AttributeValue elements under a single Attribute element. Previously, they were represented as a series of Attribute elements with the same name. The new behavior was implemented for compatibility with ADFS 2.0. To revert to the previous behavior, a setting is available in wstrust-global-settings.xml.

PingFederate 7.3 added an index (EXPIRESIDX) for the expires column in the pingfederate_access_grant database table. For information on adding this index to your existing table, see Reviewing database changes.

Starting with PingFederate 7.2 R2, a new database table needs to be created to support OAuth’s persistent grant extended attributes. The database scripts to create this table can be found in <pf_install>/pingfederate/server/default/conf/access-grant/sql-scripts/access-grant-attribute-<databaseServer>.sql. See Reviewing database changesfor more information.

Starting with PingFederate 7.2, LDAP filters only allow spaces in matched-against values.

Starting with version 7.1 R3, PingFederate tracks login attempts in the HTML Form Adapter. When the number of login failures reaches the Challenge Retries threshold defined in the adapter, the user is locked out for one minute. See HTML Form Adapter for more information.

PingFederate 7.1 R3 added an index (CLIENTIDIDX) for the client_id column in the pingfederate_access_grant database table. For information on adding this index to your existing table, see Reviewing database changes.

In releases prior to 7.1 R2, when the Requested AuthN Context Authentication Selector received a list of authentication contexts, it used the last context that it could match, rather than the first. However, both the SAML and OpenID Connect specifications treat an authentication context list as appearing in order of preference. To align the Requested AuthN Context Authentication Selector with these specifications, the selection order was changed in 7.1 R2. With this release, the selector will use the first authentication context it can match, rather than the last.

In releases before version 7.1, if an OGNL expression was used to populate a SaaS-partner field in outbound provisioning, only the first value of a selected multivalued LDAP attribute was used in the OGNL expression. As of PingFederate 7.1, this behavior was changed to use all values in the expression.