Managing client configuration defaults

Private Key JWT - Replay Prevention

This field determines whether PingFederate mandates [.ph]a unique signed JWT from the client for each request when the client is configured to authenticate using the private_key_jwt client authentication method, to transmit request parameters using signed request objects, or to do both.

This check box is not selected by default.

Require Signed Requests

Determines whether the client must transmit request parameters in a single, self-contained parameter. The parameter name is request. The value of the request parameter is [.ph]a signed JWT whose claims represent the authorization request parameters. The OpenID Connect (OIDC) specification calls this JWT a request object.

This check box is not selected by default.

Require JWT Secured Authorization Response Mode (JARM)

When selected, the client must use JARM. The client’s authorization requests must include one of the following authorization response mode values:

JARM is a mechanism to enhance the security of the standard authorization response. It adds support for signing and encryption, sender authentication, and audience restriction. It also offers protection from replay, credential leakage, and mix-up attacks. JARM can be combined with any response type. For more information, see the JARM specification.

This setting works in conjunction with the other JWT Secured Authorization Response Mode settings on this window.

This check box is cleared by default.

Require Offline_Access Scope to Issue Refresh Tokens

Select to require the authorization server to issue refresh tokens when the offline_access scope is requested.

Offline_Access Requires Consent Prompt

Select to require the prompt parameter value to be set to consent when the offline_access scope is requested.

Available only if Require Offline_Access Scope to Issue Refresh Tokens is selected.

Default Access Token Manager

Determines the default Access Token Management (ATM) instance for this client.

Restrict to Default Access Token Manager

If selected, the client can use only the Default Access Token Manager, even if other ATMs include the client in their access control lists.

This check box is not selected by default.

Persistent Grants Max Lifetime

Overrides the Persistent Grant Max Lifetime value set globally in System → OAuth Settings → Authorization Server Settings.

Select one of the following options:

Persistent Grants Idle Timeout

Overrides the Persistent Grant Idle Timeout field value set globally in System → OAuth Settings → Authorization Server Settings.

Select one of the following options:

include::ROOT:partial$pf_rc_persistentgrantidletimeoutexpinfo.adoc[tags=pf_ph_desc_persistentGrantIdleTimeoutExpInfo] For more information, see Transient grants and persistent grants.

Client Authentication Certificate Issuer DN

Select a trusted CA from the list. You can review CA certificates imported into PingFederate them in Security → Certificate & Key Management → Trusted CAs. You can select Trust Any to trust all the issuers found in the list.

The default selection is None (Client TLS Certificate Authentication Disabled), which does not allow developers to submit client registrations with a token_endpoint_auth_method parameter value of tls_client_auth.

Refresh Token Rolling Policy

Overrides the Roll Refresh Token Values setting configured globally in System → OAuth Settings → Authorization Server Settings.

Select one of the following options:

Refresh Token Rolling Interval

Overrides the Minimum Interval to Roll Refresh Tokens value set in the Authorization Server Settings window.

Select one of the following options:

Refresh Token Rolling Grace Period (seconds)

The amount of time in seconds that a rolled refresh token is still valid in the event that the client failed to receive an updated one during a roll.

Select one of the following options:

+

OpenID Connect

If PingFederate is deployed to run in a Java 8 or Java 11 runtime environment, or is integrated with a hardware security module (HSM) and configured to use static keys for OAuth and OIDC, additional RSASSA-PSS signing algorithms become available for selection. For more information on HSM integration and static keys, see Supported hardware security modules and Keys for OAuth and OpenID Connect.

Device Authorization

Determines whether to use global device authorization grant settings defined in System → OAuth Settings → Authorization Server Settings.

The default selection is Use Global Settings.

You can select Override and configure any of the following settings.

For example, if your PingFederate server’s base URL is https://www.example.com and the User Authorization URL value is https://www.example.org/welcome, the target web server must redirect as follows:

This field has no default value.

Require Proof Key for Code Exchange (PKCE)

This field is only applicable when the client is configured to support the authorization code grant type.

Determines whether the client must provide certain parameters to reduce the risk of authorization code interception attack. For more information, see the Proof Key for Code Exchange (PKCE) by OAuth Public Clients specification.

When enabled, this client must include a one-time string value through the use of the code_challenge parameter in its authorization request. For more information, see Authorization endpoint. It must also submit the corresponding code verifier through the code_verifier parameter in its token request when exchanging an authorization code for an access token. For more information, see OAuth grant type parameters.

This check box is not selected by default.

Polling Interval (seconds)

Specifies the number of seconds that the client must wait between its attempts to check for the authorization results at the token endpoint. When PingFederate receives a token request within this time interval, it returns a slow_down error message to the client.

A valid value ranges from 1 to 3600.

The default value is 3.

Policy

Specifies the CIBA request policy associated with the client.

PingFederate uses CIBA request policies to determine various aspects of CIBA authentication request, such as the maximum lifetime of authentication requests, the validity of unsigned login hint tokens, and the mapping configuration of identity hints.

Select an existing CIBA policy. You may also leave the selection of Default to indicate that PingFederate should use the CIBA request policy that has been designated as the default CIBA request policy in Applications → OAuth → CIBA Request Policies.

Require CIBA Signed Requests

Determines whether the client must transmit request parameters in a single, self-contained parameter. The parameter name is request. The value of the request parameter is [.ph]a signed JWT whose claims represent the authorization request parameters. The OIDC specification calls this JWT a request object.

This check box is not selected by default.

Note that if client-initiated back channel authentication (CIBA) signed requests are required, the dynamic client registration must include either the JWKS URL or the actual JWKS.

Token Exchange

This field determines which token exchange processor policy PingFederate uses when the OAuth server receives an OAuth token exchange request from the client. If you select Default, PingFederate uses the token exchange processor policy that was set as the default on the Token Exchange Processor Policy Management tab, under Applications → Token Exchange → Processor Policies.

For more information, see OAuth token exchange.

Client Secret Retention Period

Set the number of minutes that PingFederate retains a client secret after it is replaced. The retention period lets application teams update the client secret in their apps without disruption.

If the value is 0, PingFederate won’t retain replaced secrets. The maximum value is 43800, which is one month.Use one of these options:

The default is to use the global setting. For information about configuring the global setting, see "Client Secret Retention Period" in Configuring authorization server settings.