---
title: PingFederate 13.1.1 (July 2026)
description: Fixed PF-39487
component: pingfederate
version: 13.1
page_id: pingfederate:release_notes:pf_release_notes_1311
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/release_notes/pf_release_notes_1311.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
section_ids:
  resolved-issues: Resolved issues
  kerberos-realm-test-failure: Kerberos realm test failure
  cimd-loopback-url-validation: CIMD loopback URL validation
  pingid-client-side-authenticator-failure: PingID client-side authenticator failure
  heartbeat-endpoint-failure-with-redis: Heartbeat endpoint failure with Redis
  sso-and-slo-failure-in-redis-mode: SSO and SLO failure in Redis mode
  missing-subject-field-in-oidc-backchannel-slo-audit-log: Missing subject field in OIDC backchannel SLO audit log
  sp-adapter-session-termination-failure-in-redis-mode: SP adapter session termination failure in Redis mode
  oauth-client-authentication-method-conflict: OAuth client authentication method conflict
  cimd-authorization-failure-with-ldap-client-storage: CIMD authorization failure with LDAP client storage
  token-exchange-failure-with-id-jag-enabled: Token exchange failure with ID-JAG enabled
---

# PingFederate 13.1.1 (July 2026)

## Resolved issues

### Kerberos realm test failure

Fixed PF-39487

We fixed a defect that caused Kerberos realm test connections without explicitly configured Key Distribution Centers (KDCs) to fail.

### CIMD loopback URL validation

Fixed PF-39501

We fixed a defect where PingFederate rejected `http://` loopback `client_id` URLs at runtime. Client ID Metadata Documents (CIMD) policies that use those URLs now display a warning.

### PingID client-side authenticator failure

Fixed PF-39546

We fixed a defect that caused the PingID client-side authenticator to fail after the PingFederate 13.1 Jakarta migration.

### Heartbeat endpoint failure with Redis

Fixed PF-39580

We fixed a defect that caused the heartbeat endpoint to fail when PingFederate was configured with Redis and an internally managed reference token manager.

### SSO and SLO failure in Redis mode

Fixed PF-39584

We fixed a defect that caused single sign-on (SSO) and single logout (SLO) requests to fail after authentication through the grant management endpoint when using Redis for the identity provider (IdP) session registry.

### Missing subject field in OIDC backchannel SLO audit log

Fixed PF-39587

We fixed a defect that caused the subject field to be missing from the SLO audit log entries after OpenID Connect (OIDC) backchannel logout in Redis mode.

### SP adapter session termination failure in Redis mode

Fixed PF-39588

We fixed a defect that prevented SLO from terminating service provider (SP) adapter sessions in Redis mode, allowing users to remain authenticated after SLO.

### OAuth client authentication method conflict

Fixed PF-39589

We fixed a defect where enabling **Client TLS Certificate** authentication alongside other authentication methods on an OAuth client caused some methods, such as **Client Secret**, to fail.

### CIMD authorization failure with LDAP client storage

Fixed PF-39593

We fixed a defect that caused CIMD authorization requests to fail with HTTP 400 when PingFederate used LDAP client storage, requiring approximately 60 seconds of idle time before requests succeeded.

### Token exchange failure with ID-JAG enabled

Fixed PF-39604

We fixed a defect where enabling **Identity Assertion JWT (ID-JAG)** on an SP connection caused token exchange requests for other token types to fail due to an ID-JAG-specific validation check being incorrectly applied.