---
title: Developing password credential validators
description: Password credential validators allow PingFederate administrators to define a centralized location for username/password validation, allowing PingFederate configurations to reference validator instances.
component: pingfederate
version: 13.1
page_id: pingfederate:sdk_developers_guide:pf_develop_pass_credent_vallidat
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/sdk_developers_guide/pf_develop_pass_credent_vallidat.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: July 5, 2022
---

# Developing password credential validators

Password credential validators allow PingFederate administrators to define a centralized location for username/password validation, allowing PingFederate configurations to reference validator instances.

To implement a custom password credential validator, import the following Java packages:

* `org.sourceid.saml20.adapter.gui`

* `org.sourceid.saml20.adapter.conf`

* `org.sourceid.util.log`

* `com.pingidentity.sdk`

* `com.pingidentity.sdk.password`

For each implementation, in addition to the methods described under [Shared plugin interfaces](pf_share_plugin_interface.html), you must define the following method.

```
AttributeMap processPasswordCredential(String username,
  String password)
  throws PasswordValidationException
```

This method takes a username and password and verifies the credential against an external source. If the credentials are valid, it returns an \[.apiname]AttributeMap containing at least one entry representing the principal. If the credentials are invalid, then it returns `null` or an empty map. If the plugin was unable to validate the credentials (for example, due to an offline host or network problems), it returns a `PasswordValidationException`.

To enable password changes in a password credential validator, implement the `com.pingidentity.sdk.password.ChangeablePasswordCredential` interface.

To enable password resets in a password credential validator, implement the `com.pingidentity.sdk.password.ResettablePasswordCredential` interface.

|   |                                                                                                                                                                                                              |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|   | Depending on your password management system, you might need additional system configuration to enable password changes. For example, you can change passwords in Active Directory only if LDAPS is enabled. |