Storing PingFederate data with Redis
You can store long-term PingFederate data in an external Redis cache. This offers fast, constant access to operating data, improving PingFederate resiliency and scalability. External caching also eases upgrading in a clustered environment.
Depending on your configuration, you lose some data such as long-lived tokens and transaction records when you restart a PingFederate cluster. Storing this data in Redis allows you to retain it even in the case of a full cluster reset. Retaining this data also improves scalability by eliminating the need for memory rebalancing after a node startup or shutdown.
Storing long term data on Redis makes upgrades easier by allowing newer versions of PingFederate to run on a cluster at the same time as older versions for a short time. This allows you to stagger your upgrades and reduce downtime.
PingFederate currently supports storing data from the following services on Redis:
-
Account locking
-
Authorization artifacts
-
Inter-Request State-Management (IRSM) data
Redis connection configurations
The redis-conection.conf file contains the following parameters to allow you to configure your Redis connection:
| Parameter | Description | ||
|---|---|---|---|
|
The mode of your Redis deployment. The default PingFederate supports the following deployment modes:
|
||
|
The minimum number of idle connections in the pool. The default value is |
||
|
The maximum number of idle connections in the pool. The default value is |
||
|
The total number of connections in the pool. The default value is |
||
|
Whether to test connections when borrowing from the pool. The default value is |
||
|
Whether to test connections when they return to the pool. The default value is |
||
|
Whether to test idle connections. The default value is |
||
|
Whether to use credentials to authenticate into Redis. A value of |
||
|
If The password can be in plain text, obfuscated, or stored in an external key store such as CyberArk.
|
||
|
The Redis host name when |
||
|
The Redis port number when |
||
|
The Redis database ID. The default value is |
||
|
A comma-separated list of Redis host/port pairs when |
||
|
The ID of the master node when |
||
|
The Redis database ID. The default value is |
Configuring your Redis connection
-
Open the
<pingfed_install>/pingfederate/server/default/conf/redis-connection.conffile in a text editor. -
Configure the parameters for your Redis deployment. Refer to the previous table for parameter information.
-
Save and close the file.
|
You can also enable the |
Configuring account locking with Redis
-
Open the
<pingfed_install>/pingfederate/server/default/conf/service-points.conffile in a text editor. -
Set the
account.locking.serviceparameter tocom.pingidentity.integrations.redis.lockingservice.AccountLockingServiceRedisImpl. -
Save and close the file.
-
If you’re running PingFederate in a clustered environment, repeat these steps for each node in the cluster.
-
Restart PingFederate.
Configuring artifact storage with Redis
You can configure PingFederate to store authorization artifacts in a Redis cache. Supported artifacts are:
Steps
-
Open the
<pf_install>/pingfederate/server/default/conf/service-points.conffile in a text editor. -
Set the
artifact.storeparameter tocom.pingidentity.integrations.redis.artifactpersistenceservice.ArtifactPersistenceServiceRedisImpl. -
Save and close the file.
-
If you’re running PingFederate in a clustered environment, repeat these steps for each node in the cluster.
-
Restart PingFederate.
Configuring IRSM data storage with Redis
You can configure PingFederate to store Inter-Request State-Management (IRSM) Service data in a Redis cache.
Steps
-
Open the
<pf_install>/pingfederate/server/default/conf/service-points.conffile in a text editor. -
Set the
inter.request.state.mgmtparameter tocom.pingidentity.integrations.redis.irsm.InterRequestStateMgmtRedisImpl. -
Save and close the file.
-
If you’re running PingFederate in a clustered environment, repeat these steps for each node in the cluster.
-
Restart PingFederate.