PingFederate Server

PingFederate 13.1 (June 2026)

New features and enhancements

Redis cache storage support

New PF-38267 PF-38345 PF-38841 PF-38842 PF-38843 PF-38844

We added support for storing data from the following services in a Redis cache:

  • Assertion Replay Prevention Service data

  • Dynamic JSON Web Keys

  • Session Revocation Service data

  • OAuth Reference Bearer Access Token Plugin data

  • IdP Session Registry Service data

  • SP Session Registry Service data

PingFederate stores short-lived data in a Redis cache to improve resiliency and scalability. It also eases upgrades in clustered environments.

Learn more in Storing PingFederate data with Redis.

SP Connection for OAuth Token Exchange

New PF-38312

We added the ability to configure SP connections for OAuth token exchange.

This allows clients or AI agents to obtain tokens from third-party authorization servers using a cross-domain assertion. It also supports Identity Assertion JWT Authorization Grant (ID-JAG) token exchange.

Learn more in Configuring SP connections for OAuth token exchange.

Mac platform SSO

New PF-38487

We added support for the JWT Bearer Grant Processor IdP connection type.

This connection type facilitates workforce user SSO from their macOS login.

Learn more in JWT Bearer Grant Processors and Configuring Platform SSO for macOS in the PingOne documentation.

Private Key JWT client authentication for REST API datastore

New PF-38489

We added the ability to use private key JWT client assertions to request OAuth 2.0 bearer tokens for accessing REST API datastores.

This feature improves authentication security and ensures compatibility after Microsoft Exchange Online support for basic authentication ends in late 2026.

Learn more in Configuring a REST API datastore.

PUT, PATCH, and DELETE in REST API datastore

New PF-38492

We added support for PUT, PATCH, and DELETE requests to the REST API datastore.

These standard API request types give you more options for managing user data in a REST API datastore.

Learn more in Configuring a REST API datastore.

User and authentication context for authorization details

New PF-38493

We added support for accessing authenticated user details and authentication context in the AuthorizationDetailsProcessor SDK.

This feature allows user-aware validation and enrichment in custom authorization details processors.

Learn more in the PingFederate 13.1 SDK documentation.

Secret managers for OAuth clients

New PF-38494

We added support for secret managers to OAuth clients.

This improves security and convenience by allowing you to centrally manage authentication secrets for clients.

Learn more in Configuring OAuth clients.

OAuth bearer token authentication for SMTP servers

New PF-38500

We added support for OAuth 2.0 bearer token authentication for SMTP servers.

This feature improves authentication security, and ensures compatibility after Microsoft Exchange Online support for basic authentication ends in late 2026.

Learn more in Configuring an SMTP Notification Publisher instance.

Disable automatic IdP adapter validation

New PF-38501

We added a feature that allows you to disable automatic validation of IdP adapters when you go to the Authentication > Integration > IdP Adapters menu.

Disabling automatic validation can reduce loading time if you have a large number of IdP adapters configured.

Learn more in Disabling automatic IdP adapter validation.

Identity Assertion JWT Authorization Grant (ID-JAG)

New PF-38825

We added support for Identity Assertion JWT Authorization Grant (ID-JAG) flows in PingFederate.

PingFederate can now issue ID-JAG tokens through OAuth token exchange and accept ID-JAG tokens in OAuth JWT-bearer grant requests. This update also adds a Refresh Token Token Processor for token-exchange processor policies.

Learn more in Configuring a Refresh Token Token Processor instance.

OAuth client tags

New PF-38826

We added the ability to apply tags to resources like OAuth clients.

Tags make it easier for you to categorize, organize, and filter resources. You can also create policies to make decisions based on resource tags.

Learn more in Tag Management.

CIMD for OAuth clients

New PF-38827

We added support for Client ID Metadata Documents (CIMD) for OAuth clients.

This feature allows PingFederate to retrieve and validate client metadata during runtime transactions and dynamically create clients. This is especially useful for AI agents and other automated or short-lived clients that need dynamic access without being pre-registered individually.

Learn more in Client ID metadata documents (CIMD) and the CIMD specification.

Multiple authentication methods for OAuth clients

New PF-38828

We added support for configuring more than one client authentication method for an OAuth client.

This feature helps you transition clients from one authentication method to another without requiring a single cutover event.

Learn more in Configuring OAuth clients and OAuth Client Management Service.

Per-client DPoP settings

New PF-38845

We added support for per-client Demonstrating Proof-of-Possession (DPoP) settings and DPoP defaults for dynamically registered clients.

This feature lets you override global DPoP defaults for individual clients.

Learn more in Configuring OAuth clients and Managing client configuration defaults.

EncryptedKey selection for encrypted SAML attributes

New PF-38882

We added support for CarriedKeyName-based decryption key selection for encrypted attributes in SAML 2.0 response processing.

This improves support for certificate rollover and deployments that use different decryption keys across recipients or clusters.

Learn more in Specifying XML encryption policy (for SAML 2.0).

Full JSON response mapping in REST API datastore

Improved PF-34615

We added support for mapping the full JSON response document to a local attribute in a REST API datastore.

This gives you more flexibility when mappings or decisions depend on the complete response structure.

Learn more in Configuring a REST API datastore.

Redesigned OAuth client management

Improved PF-38499

We redesigned the Clients page and the client configuration form.

These redesigned pages make it easier to review existing clients at a glance and to find and configure attributes for both new and existing clients.

Learn more in Managing OAuth clients and Configuring OAuth clients.

Pushed Authorization Request request_uri lifecycle

Improved PF-38880

We changed how PingFederate invalidates request_uri values in Pushed Authorization Request (PAR) flows.

PingFederate now invalidates the request_uri when consent details are presented to the user, or when the PAR Reference Timeout expires. If consent details aren’t presented, clients can reuse the request_uri until the PAR Reference Timeout expires.

Learn more in Pushed authorization requests endpoint.

Unconnected cluster node startup

Improved PF-38898

We added the force.require.replication.data.on.startup parameter to the cluster-config-replication.conf file.

This parameter allows you to prevent an engine node from starting up without establishing a connection to the cluster.

Learn more in Cluster management.

JGroups upgrade

Info PF-35844

We upgraded JGroups to version 5.5.2.Final.

Windows Server 2025

Info PF-36967

We qualified PingFederate for use with Microsoft Windows Server 2025.

Jakarta EE 9 migration

Info PF-37687

We updated PingFederate for Jakarta EE 9 migration, including dependency updates to Spring Framework 6.2.19, Jetty 12.0.36, Jersey 3, and OpenAPI 3.

Oracle Unified Directory

Info PF-38046

We qualified PingFederate for use with Oracle Unified Directory version 14c.

PAR parameters

Info PF-38526

We added a new configuration option to limit the Pushed Authorization Request (PAR) to the parameters mentioned in the specification when the connection is configured to use JWT-secured Authorization Request (JAR).

log4j-core update

Info PF-38538

We upgraded log4j-core to version 2.25.3.

This upgrade ensures continued alignment with maintained upstream dependencies and resolves a potential security vulnerability.

Java 25 support

Info PF-38798

We qualified PingFederate for use with Java 25.

Info PF-38847

We added a Helpful Link from the PingFederate admin console to the Identity for AI Solutions documentation. These guides help you learn about how to configure Ping Identity solutions (including PingFederate) to work with artificial intelligence (AI).

OAuth Playground 6.0

Info PF-38902

We released version 6.0 of the OAuth Playground.

Earlier versions of the OAuth Playground aren’t compatible with PingFederate 13.1 or later.

Learn more in OAuth Playground.

Amazon Aurora MySQL

Info PF-38913

We qualified PingFederate for use with Amazon Aurora MySQL 3.12.0 (compatible with MySQL 8.0.44)

PostgreSQL

Info PF-38914

We qualified PingFederate for use with PostgreSQL versions 16.13, 17.9, and 18.3.

Amazon Aurora PostgreSQL

Info PF-38915

We qualified PingFederate for use with Amazon Aurora PostgreSQL (compatible with PostgreSQL 16.13 and 17.9).

Opentelemetry

Info PF-39298

We upgraded opentelemetry to the latest versions.

Bundled integration kits

Info PF-39444

We updated the following bundled integration kits to their latest versions:

  • Agentless Integration Kit 2.3.1

  • PingID Integration Kit 2.30

  • PingOne Integration Kit 3.1.1

  • PingOne MFA Integration Kit 3.3

  • PingOne Protect Integration Kit 1.0.8

  • PingOne Verify Integration Kit 2.3.4

Resolved issues

Security PF-34376 PF-37650

We updated how the cross-site request forgery (CSRF) cookie is issued and validated in the admin console for more effective CSRF protection.

Private key JWT OAuth client authentication improvements

Security PF-36847

We improved the way the aud claim is managed in private_key_jwt OAuth authentications. This aligns PingFederate with RFC 7523 specifications and security best practices.

Exposed filepath in end-user error page

Security PF-38109

We fixed a security vulnerability that could’ve exposed a PingFederate filepath when displaying an error message to end users.

OGNL executable code

Security PF-38241

We fixed a security vulnerability where a misconfigured PingFederate deployment could’ve executed code included in an OGNL expression.

OGNL code test

Security PF-38742

We improved role-based access control (RBAC) for the administrative expression testing endpoint. Access to expression evaluation is now limited to appropriately-privileged roles, ensuring alignment with intended administrative permissions.

jackson-core update

Security PF-38830

We’ve upgraded jackson-core to version 2.21.1 to continue alignment with maintained upstream dependencies and remove potential security vulnerabilities.

SLO failure

Fixed PF-38442

We fixed a defect where front-channel logouts requests to /idp/startSLO.ping failed to send logout requests to relying party URIs.

Multiple Sign-On Delay routing

Fixed PF-38801

We fixed a defect that caused PingFederate to route users to the base URL for the Multiple Sign-On Delay page when they should’ve been routed to the virtual host URL.

Extended properties for password change/reset

Fixed PF-38262

We fixed a defect that prevented extended properties from applying to password change and password reset flows.

pi.flow response_mode fix

Fixed PF-38417

We fixed a defect where setting response_mode to pi.flow in Pushed Authorization Requests (PAR) or standard request objects resulted in an INVALID_REQUEST error.

Fixed NPE when updating SP connection

Fixed PF-38508

We fixed a defect that caused a null pointer exception (NPE) error when an SP connection with backchannel authentication inbound authentication type set to No Client Authentication and Require SSL enabled was created or updated using the Admin API.

Dynamic client registration failure

Fixed PF-38548

We fixed a defect that caused dynamic client registration to fail when Retain Client Secret was enabled and Client Secret Retention Period was set globally in Authorization Server Settings.

Kerberos realm validation error

Fixed PF-38585

We fixed a defect that prevented PingFederate from creating, updating, or testing Kerberos realms when the AutoGenerateKrb5Conf parameter was set to false in the com.pingidentity.common.util.KerberosConfigUtil file.

Kerberos realm test connectivity overwriting krb5.conf

Fixed PF-38585

We fixed a defect where PingFederate temporarily overwrote the krb5.conf file during Kerberos realms testing when AutoGenerateKrb5Conf was disabled.

Heartbeat endpoint failure

Fixed PF-38595

We fixed a defect that caused the heartbeat endpoint to be potentially unresponsive in rare concurrent access situations.

Authentication policy error

Fixed PF-38623

We fixed a defect that caused an error when authentication policies with a Requested AuthN Context Authentication had Add or Update AuthN Context Attribute enabled.

Log settings not applied to new engine nodes

Fixed PF-38627

We fixed a defect where log settings weren’t applied to newly-joined engine nodes.

Response code for refresh token exchange failure with revoked user session

Fixed PF-38656

We fixed a defect that caused a refresh token for access token exchange to fail with 500 Internal Server Error instead of 400 Bad Request when the user’s sessions had been revoked.

Client secret endpoint

Fixed PF-38659

We fixed a defect where the client secret updated even when the request to the oauth/clients/{id}/clientAuth/clientSecret endpoint resulted in a validation error.

CIBA token request fails with LDAP persistent grant storage

Fixed PF-38706

We fixed a defect that caused CIBA token requests to fail when persistent grants are stored in an LDAP directory like PingDirectory.

Admin API OAuth authentication failure

Fixed PF-38722

We fixed a defect that caused OAuth and JWT authentication through the Admin API to fail when the role attribute name parameter used the scope claim containing space-delimited values.

Local identity profile attribute caching

Fixed PF-38824

We fixed a defect that caused PingFederate to cache user registration form attributes for local identity profiles when the registration workflow is configured to run after account creation.

Custom Authentication Selector error

Fixed PF-38875

We fixed a defect that prevented viewing or editing certain custom Authentication Selectors in the admin console.

Serialized Java objects in signed request object

Fixed PF-38889

We fixed a defect that caused parameters added to request objects (signed JWT) sent to the OIDC provider in OIDC IdP connections to lose their original data type.

Extended Property Authentication Selector dependency error warning

Fixed PF-38901

We fixed a defect that caused PingFederate to continue displaying a dependency error warning for the Extended Property Authentication Selector after the selector instance is deleted.

Dynamic JWKS rotation timer

Fixed PF-38903

We fixed a defect that prevented dynamic JWKS rotation timing from resetting after a node joined a cluster.

URL validation for TargetResource

Fixed PF-38907

We fixed a defect where PingFederate rejected valid TargetResource values.

Cluster node joining failure

Fixed PF-39240

We fixed a defect that prevented an engine node from joining a cluster when both active and passive admin consoles were online during a data upgrade.

Client certificate authentication behind proxy

Fixed PF-39335

We fixed a defect where PingFederate, when deployed behind a proxy with mTLS, used the TLS layer certificate instead of the client certificate forwarded in the client certificate header, which caused certificate authentication failure.

Known issues and limitations

PingOne Verify IK unexpected error

Issue PF-36573

PingFederate returns an unexpected error when you create an instance of the PingOne Verify Integration Kit version 2.2.2 in PingFederate with the Verify feature in PingOne disabled.

Issue PF-35772

Due to multiple vendors' recent browser versions that block third-party cookies, you might experience issues related to single logout with OIDC (via Front-Channel) and WS-Federation.

Refer to browsers' documentation regarding third-party cookie management to unblock them, if feasible.

Passive admin console UI refresh

Issue PF-35643

When you promote a passive admin console to active, the UI doesn’t refresh until you perform an action.

Multiple active admin consoles

Issue PF-35439

When you make configuration changes on the active console (especially large configuration changes like bulk imports or data archive imports), then promote a passive console to active, it can cause multiple consoles to be active at once. This can result in inconsistent configurations.

Learn how to resolve this issue in Resolving multiple active administrative nodes.

Administrative console and administrative API

Issue

  • Although PingFederate 11.3 and later support DPoP, a known limitation is that the following features don’t support DPoP when PingFederate is the RP:

    • The administrative console authentication scheme using OIDC

    • The administrative API authentication scheme using OAuth 2.0

  • /bulk: Only resource types currently supported by the administrative API are included in the exported data. We don’t intend to introduce administrative API support to the following areas:

  • Previously, the administrative API did not accurately reflect a Persistent Grant Max Lifetime setting of 29 days (or shorter) with the selection of the Grants Do Not Timeout Due To Inactivity option. As a result, if you have configured such OAuth authorization server settings and have generated a bulk export in version 10.0 through 10.0.2, we recommend that you re-generate a new bulk export after upgrading to version 10.0.3 (or a more recent version). The newly exported data does not contain the aforementioned flaw, and you can safely import it to version 10.0.3 (or a more recent version).

  • When enabling mTLS certificate-based authentication, administrators often configure a list of acceptable client certificate issuers. When you use a browser to access the console or the administrative API documentation, PingFederate returns to the browser the list of acceptable issuers as part of the TLS handshake. If the browser’s client certificate store contains multiple client certificates, the browser often presents you only the certificates whose issuer matches one of the acceptable issuers. However, when PingFederate runs in a Java 17 environment, Chrome presents you all its configured client certificates, regardless of whether the issuer matches one of the acceptable issuers or not.

  • When using mTLS authentication to authenticate to an LDAP server for administrative console or administrative API access, PingFederate doesn’t support using a Microsoft Active Directory server.

  • Prior to toggling the status of a connection with the administrative API, you must ensure that any expired certificates or no longer available attributes are replaced with valid certificates or attributes; otherwise, the update request fails.

  • When creating or updating a child instance of a hierarchical plugin, the administrative API retains objects with an "inherited": false name/value pair (or without such name/value pair altogether), ignores those with a value of true, and returns a 200 HTTP status code. No error messages are returned for the ignored objects.

  • Using the browser’s navigation mechanisms (for example, the Back button) causes inconsistent behavior in the administrative console. Use the navigation buttons provided at the bottom of windows in the PingFederate console.

  • Using the PingFederate console in multiple tabs on one browser might cause inconsistent behavior which could corrupt its configuration.

  • If authenticated to the PingFederate administrative console using certificate authentication, a session that has timed out might not appear to behave as expected. Normally (when using password authentication), when a session has timed out and a user attempts some action in the console, the browser is redirected to the sign-on page, and then back to the administrative console after authentication is complete. Similar behavior applies for certificate authentication, in principle. However, because the browser might automatically resubmit the certificate for authentication, the browser might redirect to the administrative console and not the sign on page.

TLS cipher suite customization

Issue

PingFederate’s TLS cipher suites can be customized by modifying com.pingidentity.crypto.SunJCEManager.xml (or a similarly-named file if BCFIPS or an HSM is configured). After updating the file and replicating, all cluster nodes must be restarted for the change to take effect.

Java

Issue

  • Updating Java version 8 to version 11 results in an error when PingFederate is already installed and running on Windows. To work around this issue, uninstall and reinstall the PingFederate Windows service by running the UninstallPingFederateService.bat and InstallPingFederateService.bat files located in <pf_install>/pingfederate/sbin/wrapper.

HSMs

Issue

AWS CloudHSM

  • It is not possible to use an elliptic curve (EC) certificate as an SSL server certificate.

  • When creating an EC certificate with a signatureAlgorithm smaller than the keySize value, a 500 Server error occurs. For example, a signatureAlgorithm of SHA256withECDSA with a keySize of 384 results in an error. Learn more in ECDSA signing fails with "invalid mechanism" error starting with SDK 5.16 in the CloudHSM documentation.

  • TLS 1.3 is not currently supported with Oracle JDK 17 or 21.

Thales HSMs

  • JWT token decryption using ECDH-ES may fail. This issue only arises if PingFederate is configured with static OAuth and OpenID Connect keys, a static key is stored on the HSM, and PingFederate is consuming a token encrypted with this key.

  • It is not possible to use an EC certificate as an SSL server certificate.

  • TLS 1.3 isn’t currently supported with Oracle JDK 17.

Entrust HSMs

  • JWT token decryption using ECDH-ES may fail. This issue only arises if PingFederate is configured with static OAuth and OpenID Connect keys, a static key is stored on the HSM, and PingFederate is consuming a token encrypted with this key.

  • It is not possible to import a PKCS12- or PEM-formatted EC certificate.

  • It is not possible to use an EC certificate as an SSL server certificate.

  • TLS 1.3 isn’t currently supported with Oracle JDK 17.

SSO and SLO

Issue

  • When consuming SAML metadata, PingFederate does not report an error when neither the validUntil nor the cacheDuration attribute is included in the metadata. Note that PingFederate does reject expired SAML metadata as indicated by the validUntil attribute value, if it is provided.

  • The anchored-certificate trust model cannot be used with the single logout (SLO) redirect binding because the certificate cannot be included with the logout request.

  • If an IdP connection is configured for multiple virtual server IDs, PingFederate will always use the default virtual server ID for IdP Discovery during an SP-initiated SSO event.

Composite Adapter configuration

Issue

SLO is not supported when users are authenticated through a Composite Adapter instance that contains another instance of the Composite Adapter.

Self-service password reset

Issue

Passwords can be reset for Microsoft Active Directory user accounts without the permission to change password.

OAuth

Issue

PingFederate does not support a case-sensitive naming convention for OAuth client ID values when client records are stored in a directory server. For example, after creating a client with an ID value of sampleClient, PingFederate does not allow the creation of another client with an ID value of SampleClient.

Although it’s possible to create clients using the same ID values with different casings when client records are stored in XML files, a database server, or custom storage, we recommend not doing so to avoid potential record migration issues.

Customer identity and access management

Issue

Some browsers display a date-picker user interface for fields that have been designed for date-specific inputs. Some browsers do not. If one or more date-specific fields are defined on the registration page or the profile management page (or both), end users must enter the dates manually if their browsers do not display a date-picker user interface for those fields.

Provisioning

Issue

  • LDAP referrals return an error and cause provisioning to fail if the user or group objects are defined at the DC level, and not within an OU or within the Users CN.

  • The totalResults value in SCIM responses indicates the number of results returned in the current response, not the total number of estimated results on the LDAP server.

Logging

Issue

  • If a source attribute has been configured for masking in an IdP adapter or IdP connection and the source attribute is mapped to OAuth’s persistent grant USER_KEY attribute, the USER_KEY attribute will not be masked in the server logs. Other persistent grant attributes will be masked.

  • Even if a source attribute has been configured for masking in an IdP adapter and the source attribute is mapped as the adapter’s unique user key, the user key attribute is not masked in the server or audit logs.

Database logging

Issue

  • If a source attribute has been configured for masking in an IdP adapter or IdP connection and the source attribute is mapped to OAuth’s persistent grant USER_KEY attribute, the USER_KEY attribute will not be masked in the server logs. Other persistent grant attributes will be masked.

  • Even if a source attribute has been configured for masking in an IdP adapter and the source attribute is mapped as the adapter’s unique user key, the user key attribute is not masked in the server or audit logs.

RADIUS NAS-IP-Address

Issue

The RADIUS NAS-IP-Address is only included in Access-Request packets when the pf.bind.engine.address is set with an IPv4 address. IPv6 is not supported.

Amazon SNS Notification Publisher

Issue

When deploying PingFederate with a forward proxy, plugins based on the AWS SDK, such as the Amazon SNS Notification Publisher, will only honor the http.proxyHost, http.proxyPort, http.proxyUser, and http.proxyPassword properties in run.properties. The plugin will rely on these properties even if the service URL is https.

Deprecated features

No features were deprecated for PingFederate 13.1.