PingFederate Server

Inter-Request State-Management (IRSM) Service

PingFederate uses inter-request state management (IRSM) to retain short-lived session state data between HTTP requests during authentication flows. For example, after PingFederate redirects a user’s browser to another system for authentication, it retrieves the state when the browser returns.

Most deployments don’t require manual IRSM configuration. The InterRequestStateMgmt service point in <pf_install>/pingfederate/server/default/conf/service-points.conf uses InterRequestStateMgmtProxy by default. The proxy selects the IRSM implementation based on the deployment type:

  • In a standalone deployment, the proxy selects local memory-based session tracking.

  • In a clustered deployment, the proxy selects Group RPC-based session tracking.

Leave the default configuration unchanged unless you need to explicitly select a different implementation.

Local memory-based session tracking

The local-memory implementation stores the inter-request state in the memory of the PingFederate instance that processes the request. This is the default implementation for a standalone deployment. The state is not shared across nodes.

Although you can configure local memory in a clustered deployment with sticky sessions, this configuration is not recommended. Adaptive clustering doesn’t support the local memory implementation.

To explicitly select the local-memory implementation, set the inter.request.state.mgmt parameter in service-points.conf to:

inter.request.state.mgmt=org.sourceid.saml20.service.impl.localmemory.InterReqStateMgmtMapImpl

Group RPC-based session tracking

Group RPC distributes inter-request state across PingFederate nodes in a cluster. This is the default implementation for clustered deployments and supports adaptive and directed clustering.

Leave the inter.request.state.mgmt parameter set to InterRequestStateMgmtProxy unless you need to explicitly select another implementation. To select the Group RPC implementation, set inter.request.state.mgmt to:

inter.request.state.mgmt=org.sourceid.saml20.service.impl.grouprpc.InterRequestStateMgmtGroupRpcImpl

Before you use Group RPC, configure the cluster and Group RPC communication. The service-specific Group RPC configuration file is <pf_install>/pingfederate/server/default/conf/cluster-inter-request-state.conf. Learn more about settings such as rpc.timeout, synchronous.retrieve.majority.only, and preferred.node.indices in Adaptive clustering and Directed clustering.

For adaptive clustering, PingFederate shares inter-request state with a replica set. If region identifiers are defined, PingFederate shares inter-request state among replica sets across regions. You can override this default behavior by changing the inter.group.replicate.sessions value in the <pf_install>/pingfederate/server/default/conf/cluster-adaptive.conf file.

Redis cache session tracking

Redis is an optional external storage option for IRSM. It works in both standalone and clustered deployments. Redis can retain short-lived IRSM data across a full cluster restart and supports staggered upgrades in a clustered environment.

Before you enable Redis for IRSM, configure the Redis connection. Configuring the Redis connection alone doesn’t select Redis as the IRSM implementation. You must use one of the following methods to enable Redis storage:

  • Global Redis enablement: Set pf.redis.mode to ON in <pf_install>/pingfederate/bin/run.properties to enable Redis for all Redis-capable PingFederate services, including IRSM. When global enablement is on, you can’t enable or disable individual Redis-capable services.

  • Individual service enablement: Set pf.redis.mode to OFF, then configure the inter.request.state.mgmt parameter in service-points.conf to:

inter.request.state.mgmt=com.pingidentity.integrations.redis.irsm.InterRequestStateMgmtRedisImpl

Learn more in Storing PingFederate data with Redis and Configuring PingFederate services for Redis storage.