--- title: PingFederate 13.1 (June 2026) description: New PF-38267 PF-38345 PF-38841 PF-38842 PF-38843 PF-38844 component: pingfederate version: 13.1 page_id: pingfederate:release_notes:pf_release_notes_131 canonical_url: https://docs.pingidentity.com/pingfederate/13.1/release_notes/pf_release_notes_131.html llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md section_ids: new-features-and-enhancements: New features and enhancements redis-cache-storage-support: Redis cache storage support sp-connection-for-oauth-token-exchange: SP Connection for OAuth Token Exchange mac-platform-sso: Mac platform SSO private-key-jwt-client-authentication-for-rest-api-datastore: Private Key JWT client authentication for REST API datastore put-patch-and-delete-in-rest-api-datastore: PUT, PATCH, and DELETE in REST API datastore user-and-authentication-context-for-authorization-details: User and authentication context for authorization details secret-managers-for-oauth-clients: Secret managers for OAuth clients oauth-bearer-token-authentication-for-smtp-servers: OAuth bearer token authentication for SMTP servers disable-automatic-idp-adapter-validation: Disable automatic IdP adapter validation identity-assertion-jwt-authorization-grant-id-jag: Identity Assertion JWT Authorization Grant (ID-JAG) oauth-client-tags: OAuth client tags cimd-for-oauth-clients: CIMD for OAuth clients multiple-authentication-methods-for-oauth-clients: Multiple authentication methods for OAuth clients per-client-dpop-settings: Per-client DPoP settings encryptedkey-selection-for-encrypted-saml-attributes: EncryptedKey selection for encrypted SAML attributes full-json-response-mapping-in-rest-api-datastore: Full JSON response mapping in REST API datastore redesigned-oauth-client-management: Redesigned OAuth client management pushed-authorization-request-request_uri-lifecycle: Pushed Authorization Request request_uri lifecycle unconnected-cluster-node-startup: Unconnected cluster node startup jgroups-upgrade: JGroups upgrade windows-server-2025: Windows Server 2025 jakarta-ee-9-migration: Jakarta EE 9 migration oracle-unified-directory: Oracle Unified Directory par-parameters: PAR parameters log4j-core-update: log4j-core update java-25-support: Java 25 support identity-for-ai-admin-console-link: Identity for AI admin console link oauth-playground-6-0: OAuth Playground 6.0 amazon-aurora-mysql: Amazon Aurora MySQL postgresql: PostgreSQL amazon-aurora-postgresql: Amazon Aurora PostgreSQL opentelemetry: Opentelemetry bundled-integration-kits: Bundled integration kits resolved-issues: Resolved issues admin-console-cookie-improvements: Admin console cookie improvements private-key-jwt-oauth-client-authentication-improvements: Private key JWT OAuth client authentication improvements exposed-filepath-in-end-user-error-page: Exposed filepath in end-user error page ognl-executable-code: OGNL executable code ognl-code-test: OGNL code test jackson-core-update: jackson-core update slo-failure: SLO failure multiple-sign-on-delay-routing: Multiple Sign-On Delay routing extended-properties-for-password-changereset: Extended properties for password change/reset pi-flow-response_mode-fix: pi.flow response_mode fix fixed-npe-when-updating-sp-connection: Fixed NPE when updating SP connection dynamic-client-registration-failure: Dynamic client registration failure kerberos-realm-validation-error: Kerberos realm validation error kerberos-realm-test-connectivity-overwriting-krb5-conf: Kerberos realm test connectivity overwriting krb5.conf heartbeat-endpoint-failure: Heartbeat endpoint failure authentication-policy-error: Authentication policy error log-settings-not-applied-to-new-engine-nodes: Log settings not applied to new engine nodes response-code-for-refresh-token-exchange-failure-with-revoked-user-session: Response code for refresh token exchange failure with revoked user session client-secret-endpoint: Client secret endpoint ciba-token-request-fails-with-ldap-persistent-grant-storage: CIBA token request fails with LDAP persistent grant storage admin-api-oauth-authentication-failure: Admin API OAuth authentication failure local-identity-profile-attribute-caching: Local identity profile attribute caching custom-authentication-selector-error: Custom Authentication Selector error serialized-java-objects-in-signed-request-object: Serialized Java objects in signed request object extended-property-authentication-selector-dependency-error-warning: Extended Property Authentication Selector dependency error warning dynamic-jwks-rotation-timer: Dynamic JWKS rotation timer url-validation-for-targetresource: URL validation for TargetResource cluster-node-joining-failure: Cluster node joining failure client-certificate-authentication-behind-proxy: Client certificate authentication behind proxy known-issues-and-limitations: Known issues and limitations pingone-verify-ik-unexpected-error: PingOne Verify IK unexpected error third-party-cookie-blocking-affecting-single-logout: Third-party cookie blocking affecting single logout passive-admin-console-ui-refresh: Passive admin console UI refresh multiple-active-admin-consoles: Multiple active admin consoles administrative-console-and-administrative-api: Administrative console and administrative API tls-cipher-suite-customization: TLS cipher suite customization java: Java hsms: HSMs sso-and-slo: SSO and SLO composite-adapter-configuration: Composite Adapter configuration self-service-password-reset: Self-service password reset oauth: OAuth customer-identity-and-access-management: Customer identity and access management provisioning: Provisioning logging: Logging database-logging: Database logging radius-nas-ip-address: RADIUS NAS-IP-Address amazon-sns-notification-publisher: Amazon SNS Notification Publisher deprecated-features: Deprecated features --- # PingFederate 13.1 (June 2026) ## New features and enhancements ### Redis cache storage support New PF-38267 PF-38345 PF-38841 PF-38842 PF-38843 PF-38844 We added support for storing data from the following services in a Redis cache: * Assertion Replay Prevention Service data * Dynamic JSON Web Keys * Session Revocation Service data * OAuth Reference Bearer Access Token Plugin data * IdP Session Registry Service data * SP Session Registry Service data PingFederate stores short-lived data in a Redis cache to improve resiliency and scalability. It also eases upgrades in clustered environments. Learn more in [Storing PingFederate data with Redis](../administrators_reference_guide/pf_storing_pf_data_redis.html). ### SP Connection for OAuth Token Exchange New PF-38312 We added the ability to configure SP connections for OAuth token exchange. This allows clients or AI agents to obtain tokens from third-party authorization servers using a cross-domain assertion. It also supports Identity Assertion JWT Authorization Grant (ID-JAG) token exchange. Learn more in [Configuring SP connections for OAuth token exchange](../administrators_reference_guide/pf_configuring_sp_connections_oauth_token_exchange.html). ### Mac platform SSO New PF-38487 We added support for the JWT Bearer Grant Processor IdP connection type. This connection type facilitates workforce user SSO from their macOS login. Learn more in [JWT Bearer Grant Processors](../administrators_reference_guide/pf_jwt_bearer_grant_processors.html) and [Configuring Platform SSO for macOS](https://docs.pingidentity.com/pingone/strong_authentication_mfa/p1_pid_psso_macos_config.html) in the PingOne documentation. ### Private Key JWT client authentication for REST API datastore New PF-38489 We added the ability to use private key JWT client assertions to request OAuth 2.0 bearer tokens for accessing REST API datastores. This feature improves authentication security and ensures compatibility after Microsoft Exchange Online support for basic authentication ends in late 2026. Learn more in [Configuring a REST API datastore](../administrators_reference_guide/pf_config_rest_api_datastore.html). ### PUT, PATCH, and DELETE in REST API datastore New PF-38492 We added support for PUT, PATCH, and DELETE requests to the REST API datastore. These standard API request types give you more options for managing user data in a REST API datastore. Learn more in [Configuring a REST API datastore](../administrators_reference_guide/pf_config_rest_api_datastore.html). ### User and authentication context for authorization details New PF-38493 We added support for accessing authenticated user details and authentication context in the AuthorizationDetailsProcessor SDK. This feature allows user-aware validation and enrichment in custom authorization details processors. Learn more in the [PingFederate 13.1 SDK documentation](https://download.pingidentity.com/public/documentation/pingfederate/13.1/doc/index.html). ### Secret managers for OAuth clients New PF-38494 We added support for secret managers to OAuth clients. This improves security and convenience by allowing you to centrally manage authentication secrets for clients. Learn more in [Configuring OAuth clients](../administrators_reference_guide/pf_configuring_oauth_clients.html). ### OAuth bearer token authentication for SMTP servers New PF-38500 We added support for OAuth 2.0 bearer token authentication for SMTP servers. This feature improves authentication security, and ensures compatibility after Microsoft Exchange Online support for basic authentication ends in late 2026. Learn more in [Configuring an SMTP Notification Publisher instance](../administrators_reference_guide/help_notificationsendermanagementstate_configureauthnadapterstate_smtp.html). ### Disable automatic IdP adapter validation New PF-38501 We added a feature that allows you to disable automatic validation of IdP adapters when you go to the **Authentication > Integration > IdP Adapters** menu. Disabling automatic validation can reduce loading time if you have a large number of IdP adapters configured. Learn more in [Disabling automatic IdP adapter validation](../administrators_reference_guide/pf_disabling_automatic_idp_adapter_validation.html). ### Identity Assertion JWT Authorization Grant (ID-JAG) New PF-38825 We added support for Identity Assertion JWT Authorization Grant (ID-JAG) flows in PingFederate. PingFederate can now issue ID-JAG tokens through OAuth token exchange and accept ID-JAG tokens in OAuth JWT-bearer grant requests. This update also adds a Refresh Token Token Processor for token-exchange processor policies. Learn more in [Configuring a Refresh Token Token Processor instance](../administrators_reference_guide/pf_configuring_refresh_token_processor_instance.html). ### OAuth client tags New PF-38826 We added the ability to apply tags to resources like OAuth clients. Tags make it easier for you to categorize, organize, and filter resources. You can also create policies to make decisions based on resource tags. Learn more in [Tag Management](../administrators_reference_guide/pf_tag_management.html). ### CIMD for OAuth clients New PF-38827 We added support for Client ID Metadata Documents (CIMD) for OAuth clients. This feature allows PingFederate to retrieve and validate client metadata during runtime transactions and dynamically create clients. This is especially useful for AI agents and other automated or short-lived clients that need dynamic access without being pre-registered individually. Learn more in [Client ID metadata documents (CIMD)](../administrators_reference_guide/pf_cimd.html) and the [CIMD specification](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/). ### Multiple authentication methods for OAuth clients New PF-38828 We added support for configuring more than one client authentication method for an OAuth client. This feature helps you transition clients from one authentication method to another without requiring a single cutover event. Learn more in [Configuring OAuth clients](../administrators_reference_guide/pf_configuring_oauth_clients.html) and [OAuth Client Management Service](../developers_reference_guide/pf_oauth_client_manage_service.html). ### Per-client DPoP settings New PF-38845 We added support for per-client Demonstrating Proof-of-Possession (DPoP) settings and DPoP defaults for dynamically registered clients. This feature lets you override global DPoP defaults for individual clients. Learn more in [Configuring OAuth clients](../administrators_reference_guide/pf_configuring_oauth_clients.html) and [Managing client configuration defaults](../administrators_reference_guide/help_clientsettingstasklet_oauthdynamicclientregistrationdefaultsstate.html). ### EncryptedKey selection for encrypted SAML attributes New PF-38882 We added support for `CarriedKeyName`-based decryption key selection for encrypted attributes in SAML 2.0 response processing. This improves support for certificate rollover and deployments that use different decryption keys across recipients or clusters. Learn more in [Specifying XML encryption policy (for SAML 2.0)](../administrators_reference_guide/help_idpprotocolsettingstasklet_selectidpxmlassertionencryptionstate.html). ### Full JSON response mapping in REST API datastore Improved PF-34615 We added support for mapping the full JSON response document to a local attribute in a REST API datastore. This gives you more flexibility when mappings or decisions depend on the complete response structure. Learn more in [Configuring a REST API datastore](../administrators_reference_guide/pf_config_rest_api_datastore.html). ### Redesigned OAuth client management Improved PF-38499 We redesigned the **Clients** page and the client configuration form. These redesigned pages make it easier to review existing clients at a glance and to find and configure attributes for both new and existing clients. Learn more in [Managing OAuth clients](../administrators_reference_guide/help_oauthclientsmanagementtasklet_oauthclientsmanagementstate.html) and [Configuring OAuth clients](../administrators_reference_guide/pf_configuring_oauth_clients.html). ### Pushed Authorization Request request\_uri lifecycle Improved PF-38880 We changed how PingFederate invalidates `request_uri` values in Pushed Authorization Request (PAR) flows. PingFederate now invalidates the `request_uri` when consent details are presented to the user, or when the **PAR Reference Timeout** expires. If consent details aren't presented, clients can reuse the `request_uri` until the **PAR Reference Timeout** expires. Learn more in [Pushed authorization requests endpoint](../developers_reference_guide/pf_pushed_authoriz_request_endpoint.html). ### Unconnected cluster node startup Improved PF-38898 We added the `force.require.replication.data.on.startup` parameter to the `cluster-config-replication.conf` file. This parameter allows you to prevent an engine node from starting up without establishing a connection to the cluster. Learn more in [Cluster management](../administrators_reference_guide/pf_cluster_management.html). ### JGroups upgrade Info PF-35844 We upgraded JGroups to version 5.5.2.Final. ### Windows Server 2025 Info PF-36967 We qualified PingFederate for use with Microsoft Windows Server 2025. ### Jakarta EE 9 migration Info PF-37687 We updated PingFederate for Jakarta EE 9 migration, including dependency updates to Spring Framework 6.2.19, Jetty 12.0.36, Jersey 3, and OpenAPI 3. ### Oracle Unified Directory Info PF-38046 We qualified PingFederate for use with Oracle Unified Directory version 14c. ### PAR parameters Info PF-38526 We added a new configuration option to limit the Pushed Authorization Request (PAR) to the parameters mentioned in the specification when the connection is configured to use JWT-secured Authorization Request (JAR). ### `log4j-core` update Info PF-38538 We upgraded `log4j-core` to version 2.25.3. This upgrade ensures continued alignment with maintained upstream dependencies and resolves a potential security vulnerability. ### Java 25 support Info PF-38798 We qualified PingFederate for use with Java 25. ### Identity for AI admin console link Info PF-38847 We added a **Helpful Link** from the PingFederate admin console to the [Identity for AI Solutions](https://docs.pingidentity.com/solution-guides/identity-for-ai/identity-for-ai-solutions.html) documentation. These guides help you learn about how to configure Ping Identity solutions (including PingFederate) to work with artificial intelligence (AI). ### OAuth Playground 6.0 Info PF-38902 We released version 6.0 of the OAuth Playground. Earlier versions of the OAuth Playground aren't compatible with PingFederate 13.1 or later. Learn more in [OAuth Playground](../developers_reference_guide/pf_oauth_playground.html). ### Amazon Aurora MySQL Info PF-38913 We qualified PingFederate for use with Amazon Aurora MySQL 3.12.0 (compatible with MySQL 8.0.44) ### PostgreSQL Info PF-38914 We qualified PingFederate for use with PostgreSQL versions 16.13, 17.9, and 18.3. ### Amazon Aurora PostgreSQL Info PF-38915 We qualified PingFederate for use with Amazon Aurora PostgreSQL (compatible with PostgreSQL 16.13 and 17.9). ### Opentelemetry Info PF-39298 We upgraded opentelemetry to the latest versions. ### Bundled integration kits Info PF-39444 We updated the following bundled integration kits to their latest versions: * Agentless Integration Kit 2.3.1 * PingID Integration Kit 2.30 * PingOne Integration Kit 3.1.1 * PingOne MFA Integration Kit 3.3 * PingOne Protect Integration Kit 1.0.8 * PingOne Verify Integration Kit 2.3.4 ## Resolved issues ### Admin console cookie improvements Security PF-34376 PF-37650 We updated how the cross-site request forgery (CSRF) cookie is issued and validated in the admin console for more effective CSRF protection. ### Private key JWT OAuth client authentication improvements Security PF-36847 We improved the way the `aud` claim is managed in `private_key_jwt` OAuth authentications. This aligns PingFederate with [RFC 7523](https://datatracker.ietf.org/doc/html/rfc7523) specifications and security best practices. ### Exposed filepath in end-user error page Security PF-38109 We fixed a security vulnerability that could've exposed a PingFederate filepath when displaying an error message to end users. ### OGNL executable code Security PF-38241 We fixed a security vulnerability where a misconfigured PingFederate deployment could've executed code included in an OGNL expression. ### OGNL code test Security PF-38742 We improved role-based access control (RBAC) for the administrative expression testing endpoint. Access to expression evaluation is now limited to appropriately-privileged roles, ensuring alignment with intended administrative permissions. ### `jackson-core` update Security PF-38830 We've upgraded `jackson-core` to version 2.21.1 to continue alignment with maintained upstream dependencies and remove potential security vulnerabilities. ### SLO failure Fixed PF-38442 We fixed a defect where front-channel logouts requests to `/idp/startSLO.ping` failed to send logout requests to relying party URIs. ### Multiple Sign-On Delay routing Fixed PF-38801 We fixed a defect that caused PingFederate to route users to the base URL for the Multiple Sign-On Delay page when they should've been routed to the virtual host URL. ### Extended properties for password change/reset Fixed PF-38262 We fixed a defect that prevented extended properties from applying to password change and password reset flows. ### `pi.flow` `response_mode` fix Fixed PF-38417 We fixed a defect where setting `response_mode` to `pi.flow` in Pushed Authorization Requests (PAR) or standard request objects resulted in an `INVALID_REQUEST` error. ### Fixed NPE when updating SP connection Fixed PF-38508 We fixed a defect that caused a null pointer exception (NPE) error when an SP connection with backchannel authentication inbound authentication type set to **No Client Authentication** and **Require SSL** enabled was created or updated using the Admin API. ### Dynamic client registration failure Fixed PF-38548 We fixed a defect that caused dynamic client registration to fail when **Retain Client Secret** was enabled and **Client Secret Retention Period** was set globally in **Authorization Server Settings**. ### Kerberos realm validation error Fixed PF-38585 We fixed a defect that prevented PingFederate from creating, updating, or testing Kerberos realms when the `AutoGenerateKrb5Conf` parameter was set to `false` in the `com.pingidentity.common.util.KerberosConfigUtil` file. ### Kerberos realm test connectivity overwriting `krb5.conf` Fixed PF-38585 We fixed a defect where PingFederate temporarily overwrote the `krb5.conf` file during Kerberos realms testing when `AutoGenerateKrb5Conf` was disabled. ### Heartbeat endpoint failure Fixed PF-38595 We fixed a defect that caused the heartbeat endpoint to be potentially unresponsive in rare concurrent access situations. ### Authentication policy error Fixed PF-38623 We fixed a defect that caused an error when authentication policies with a Requested AuthN Context Authentication had **Add or Update AuthN Context Attribute** enabled. ### Log settings not applied to new engine nodes Fixed PF-38627 We fixed a defect where log settings weren't applied to newly-joined engine nodes. ### Response code for refresh token exchange failure with revoked user session Fixed PF-38656 We fixed a defect that caused a refresh token for access token exchange to fail with `500 Internal Server Error` instead of `400 Bad Request` when the user's sessions had been revoked. ### Client secret endpoint Fixed PF-38659 We fixed a defect where the client secret updated even when the request to the `oauth/clients/{id}/clientAuth/clientSecret` endpoint resulted in a validation error. ### CIBA token request fails with LDAP persistent grant storage Fixed PF-38706 We fixed a defect that caused CIBA token requests to fail when persistent grants are stored in an LDAP directory like PingDirectory. ### Admin API OAuth authentication failure Fixed PF-38722 We fixed a defect that caused OAuth and JWT authentication through the Admin API to fail when the `role attribute name` parameter used the scope claim containing space-delimited values. ### Local identity profile attribute caching Fixed PF-38824 We fixed a defect that caused PingFederate to cache user registration form attributes for local identity profiles when the registration workflow is configured to run after account creation. ### Custom Authentication Selector error Fixed PF-38875 We fixed a defect that prevented viewing or editing certain custom Authentication Selectors in the admin console. ### Serialized Java objects in signed request object Fixed PF-38889 We fixed a defect that caused parameters added to request objects (signed JWT) sent to the OIDC provider in OIDC IdP connections to lose their original data type. ### Extended Property Authentication Selector dependency error warning Fixed PF-38901 We fixed a defect that caused PingFederate to continue displaying a dependency error warning for the Extended Property Authentication Selector after the selector instance is deleted. ### Dynamic JWKS rotation timer Fixed PF-38903 We fixed a defect that prevented dynamic JWKS rotation timing from resetting after a node joined a cluster. ### URL validation for `TargetResource` Fixed PF-38907 We fixed a defect where PingFederate rejected valid `TargetResource` values. ### Cluster node joining failure Fixed PF-39240 We fixed a defect that prevented an engine node from joining a cluster when both active and passive admin consoles were online during a data upgrade. ### Client certificate authentication behind proxy Fixed PF-39335 We fixed a defect where PingFederate, when deployed behind a proxy with mTLS, used the TLS layer certificate instead of the client certificate forwarded in the client certificate header, which caused certificate authentication failure. ## Known issues and limitations ### PingOne Verify IK unexpected error Issue PF-36573 PingFederate returns an unexpected error when you create an instance of the PingOne Verify Integration Kit version 2.2.2 in PingFederate with the Verify feature in PingOne disabled. ### Third-party cookie blocking affecting single logout Issue PF-35772 Due to multiple vendors' recent browser versions that block third-party cookies, you might experience issues related to single logout with OIDC (via Front-Channel) and WS-Federation. Refer to browsers' documentation regarding third-party cookie management to unblock them, if feasible. ### Passive admin console UI refresh Issue PF-35643 When you promote a passive admin console to active, the UI doesn't refresh until you perform an action. ### Multiple active admin consoles Issue PF-35439 When you make configuration changes on the active console (especially large configuration changes like bulk imports or data archive imports), then promote a passive console to active, it can cause multiple consoles to be active at once. This can result in inconsistent configurations. Learn how to resolve this issue in [Resolving multiple active administrative nodes](../server_clustering_guide/pf_resolving_multiple_active_admin_nodes.html). ### Administrative console and administrative API Issue * Although PingFederate 11.3 and later support DPoP, a known limitation is that the following features don't support DPoP when PingFederate is the RP: * The administrative console authentication scheme using OIDC * The administrative API authentication scheme using OAuth 2.0 * /bulk: Only resource types currently supported by the administrative API are included in the exported data. We don't intend to introduce administrative API support to the following areas: * [SAML 2.0 IdP Discovery](../administrators_reference_guide/pf_configuring_standard_idp_discovery.html) * [SAML 2.0 SP Affiliation](../administrators_reference_guide/help_affiliationstasklet_affiliationmgmtstate.html) * [SMS Provider](../administrators_reference_guide/help_smsprovidersettingstasklet_smsprovidersettingsstate.html) * Previously, the administrative API did not accurately reflect a **Persistent Grant Max Lifetime** setting of 29 days (or shorter) with the selection of the **Grants Do Not Timeout Due To Inactivity** option. As a result, if you have configured such OAuth authorization server settings and have generated a bulk export in version 10.0 through 10.0.2, we recommend that you re-generate a new bulk export after upgrading to version 10.0.3 (or a more recent version). The newly exported data does not contain the aforementioned flaw, and you can safely import it to version 10.0.3 (or a more recent version). * When enabling mTLS certificate-based authentication, administrators often configure a list of acceptable client certificate issuers. When you use a browser to access the console or the administrative API documentation, PingFederate returns to the browser the list of acceptable issuers as part of the TLS handshake. If the browser's client certificate store contains multiple client certificates, the browser often presents you only the certificates whose issuer matches one of the acceptable issuers. However, when PingFederate runs in a Java 17 environment, Chrome presents you all its configured client certificates, regardless of whether the issuer matches one of the acceptable issuers or not. * When using mTLS authentication to authenticate to an LDAP server for administrative console or administrative API access, PingFederate doesn't support using a Microsoft Active Directory server. * Prior to toggling the status of a connection with the administrative API, you must ensure that any expired certificates or no longer available attributes are replaced with valid certificates or attributes; otherwise, the update request fails. * When creating or updating a child instance of a hierarchical plugin, the administrative API retains objects with an `"inherited": false` name/value pair (or without such name/value pair altogether), ignores those with a value of `true`, and returns a 200 HTTP status code. No error messages are returned for the ignored objects. * Using the browser's navigation mechanisms (for example, the **Back** button) causes inconsistent behavior in the administrative console. Use the navigation buttons provided at the bottom of windows in the PingFederate console. * Using the PingFederate console in multiple tabs on one browser might cause inconsistent behavior which could corrupt its configuration. * If authenticated to the PingFederate administrative console using certificate authentication, a session that has timed out might not appear to behave as expected. Normally (when using password authentication), when a session has timed out and a user attempts some action in the console, the browser is redirected to the sign-on page, and then back to the administrative console after authentication is complete. Similar behavior applies for certificate authentication, in principle. However, because the browser might automatically resubmit the certificate for authentication, the browser might redirect to the administrative console and not the sign on page. ### TLS cipher suite customization Issue PingFederate's TLS cipher suites can be customized by modifying `com.pingidentity.crypto.SunJCEManager.xml` (or a similarly-named file if BCFIPS or an HSM is configured). After updating the file and replicating, all cluster nodes must be restarted for the change to take effect. ### Java Issue * Updating Java version 8 to version 11 results in an error when PingFederate is already installed and running on Windows. To work around this issue, uninstall and reinstall the PingFederate Windows service by running the `UninstallPingFederateService.bat` and `InstallPingFederateService.bat` files located in `/pingfederate/sbin/wrapper`. ### HSMs Issue AWS CloudHSM * It is not possible to use an elliptic curve (EC) certificate as an SSL server certificate. * When creating an EC certificate with a `signatureAlgorithm` smaller than the `keySize` value, a `500 Server error` occurs. For example, a `signatureAlgorithm` of `SHA256withECDSA` with a `keySize` of `384` results in an error. Learn more in [ECDSA signing fails with "invalid mechanism" error starting with SDK 5.16](https://docs.aws.amazon.com/cloudhsm/latest/userguide/ki-all.html?utm_source=chatgpt.com#ki-all-12) in the CloudHSM documentation. * TLS 1.3 is not currently supported with Oracle JDK 17 or 21. Thales HSMs * JWT token decryption using ECDH-ES may fail. This issue only arises if PingFederate is configured with static OAuth and OpenID Connect keys, a static key is stored on the HSM, and PingFederate is consuming a token encrypted with this key. * It is not possible to use an EC certificate as an SSL server certificate. * TLS 1.3 isn't currently supported with Oracle JDK 17. Entrust HSMs * JWT token decryption using ECDH-ES may fail. This issue only arises if PingFederate is configured with static OAuth and OpenID Connect keys, a static key is stored on the HSM, and PingFederate is consuming a token encrypted with this key. * It is not possible to import a PKCS12- or PEM-formatted EC certificate. * It is not possible to use an EC certificate as an SSL server certificate. * TLS 1.3 isn't currently supported with Oracle JDK 17. ### SSO and SLO Issue * When consuming SAML metadata, PingFederate does not report an error when neither the `validUntil` nor the `cacheDuration` attribute is included in the metadata. Note that PingFederate does reject expired SAML metadata as indicated by the `validUntil` attribute value, if it is provided. * The anchored-certificate trust model cannot be used with the single logout (SLO) redirect binding because the certificate cannot be included with the logout request. * If an IdP connection is configured for multiple virtual server IDs, PingFederate will always use the default virtual server ID for IdP Discovery during an SP-initiated SSO event. ### Composite Adapter configuration Issue SLO is not supported when users are authenticated through a Composite Adapter instance that contains another instance of the Composite Adapter. ### Self-service password reset Issue Passwords can be reset for Microsoft Active Directory user accounts without the permission to change password. ### OAuth Issue PingFederate does not support a case-sensitive naming convention for OAuth client ID values when client records are stored in a directory server. For example, after creating a client with an ID value of `sampleClient`, PingFederate does not allow the creation of another client with an ID value of `SampleClient`. Although it's possible to create clients using the same ID values with different casings when client records are stored in XML files, a database server, or custom storage, we recommend not doing so to avoid potential record migration issues. ### Customer identity and access management Issue Some browsers display a date-picker user interface for fields that have been designed for date-specific inputs. Some browsers do not. If one or more date-specific fields are defined on the registration page or the profile management page (or both), end users must enter the dates manually if their browsers do not display a date-picker user interface for those fields. ### Provisioning Issue * LDAP referrals return an error and cause provisioning to fail if the `user` or `group` objects are defined at the DC level, and not within an OU or within the Users CN. * The `totalResults` value in SCIM responses indicates the number of results returned in the current response, not the total number of estimated results on the LDAP server. ### Logging Issue * If a source attribute has been configured for masking in an IdP adapter or IdP connection and the source attribute is mapped to OAuth's persistent grant `USER_KEY` attribute, the `USER_KEY` attribute will not be masked in the server logs. Other persistent grant attributes will be masked. * Even if a source attribute has been configured for masking in an IdP adapter and the source attribute is mapped as the adapter's unique user key, the user key attribute is not masked in the server or audit logs. ### Database logging Issue * If a source attribute has been configured for masking in an IdP adapter or IdP connection and the source attribute is mapped to OAuth's persistent grant `USER_KEY` attribute, the `USER_KEY` attribute will not be masked in the server logs. Other persistent grant attributes will be masked. * Even if a source attribute has been configured for masking in an IdP adapter and the source attribute is mapped as the adapter's unique user key, the user key attribute is not masked in the server or audit logs. ### RADIUS NAS-IP-Address Issue The RADIUS NAS-IP-Address is only included in Access-Request packets when the `pf.bind.engine.address` is set with an IPv4 address. IPv6 is not supported. ### Amazon SNS Notification Publisher Issue When deploying PingFederate with a forward proxy, plugins based on the AWS SDK, such as the Amazon SNS Notification Publisher, will only honor the `http.proxyHost`, `http.proxyPort`, `http.proxyUser`, and `http.proxyPassword` properties in `run.properties`. The plugin will rely on these properties even if the service URL is `https`. ## Deprecated features No features were deprecated for PingFederate 13.1.