Release Notes

New PF-36314

We’ve added the ability for PingFederate to read extended properties in adapter contract mappings.

This improves flexibility by allowing you to use extended properties as values for attributes fulfilled by your adapter or as lookup values from your datastore.

Learn more in Configuring IdP adapter contract fulfillment and Defining issuance criteria for IdP adapter contract.

New PF-36315

We’ve added the ability for PingFederate to read extended properties in token generator mappings and token exchange policy processor mappings.

This improves flexibility by allowing you to use extended properties in token generation and exchange operations. You can also use extended properties as lookup values from your data store.

New PF-36316

We’ve added the ability for PingFederate to read extended properties in adapter and authentication policy contract (APC) mappings for browser single sign-on (SSO).

This improves flexibility by allowing you to use extended properties in identity provider (IdP) and service provider (SP) connections.

Learn more in Configuring target session fulfillment.

New PF-35864

We’ve added support for Kerberos validation when PingFederate is deployed in the cloud without direct Key Distribution Center (KDC) connectivity.

This can improve performance by allowing PingFederate to validate Kerberos tickets locally without the need for additional components.

Learn more in Adding Active Directory domains and Kerberos realms.

New PF-35343

We’ve improved the logging of authentication policies and fragments used during authentication. The following items are now included in their respective log files:

Learn more about the audit.log changes in Security audit logging.

New PF-36649

We’ve added a feature that allows PingFederate to consume URL-encoded client certificate headers.

This improves compatibility with NGINX mTLS-terminating reverse proxy.

Learn more in Configuring incoming proxy settings.

New PF-34426

We’ve added a feature that automatically upgrades an imported configuration data archive from an older version of PingFederate to be compatible with the current version.

This makes it easier to upgrade to newer versions of PingFederate by allowing you to upgrade your configuration data without using the Upgrade Utility.

Learn more in Upgrading configuration data and Importing and deploying administrative console configuration data.

New PF-36296

We’ve added a feature that allows PingFederate to automatically replicate configuration data archives to clustered server nodes when they uploaded to the drop-in deployer.

This makes it easier to ensure that your clustered nodes have the same configuration data.

Learn more in Upgrading configuration data and Configuration-archive deployment.

New PF-35863

We’ve added a feature that allows you to customize which attributes are returned in the Token Endpoint response based on the scopes that are included in the request.

This improves flexibility by giving you more control over where PingFederate can return attributes.

Learn more in Defining the token endpoint management contract.

New PF-36602

We’ve improved the error output for the Administrative API. When access to the administrative API in configured to use OAuth 2.0 or JWT authorization, and the access token is invalid, the error response now includes both error and error_description in the WWW-Authentication header.

This improves troubleshooting by providing an error code and description when authorization fails.

New PF-36291

We’ve added an optional description field to the CIDR Authentication Selector.

This helps you keep track of your defined network ranges by giving them an easily identifiable name.

Learn more in Configuring the CIDR Authentication Selector.

New PF-35859

We’ve added a feature that allows PingFederate to include an ID token along with an access token and refresh token in OAuth token exchanges.

This can improve your end-user experience by passing ID token information along with access tokens during SSO and other token exchange operations.

Learn more in Configuring policy and ID token settings.

New PF-36317

We’ve added support for JSON formatted logging for most PingFederate logs through the log4j2 logging library.

This improves your ability to monitor PingFederate perfomance by producing logs in an easily parsed standard format.

Learn more in Logging in JSON format.

New PF-35420

We’ve added a feature that allows you to collect support data using the administrative console and the administrative API.

This will improve your Ping Identity Support experience by allowing you to more easily customize and collect support data.

Learn more in Collecting support data in the administrative console.

New PF-29353

We’ve added the ability to include the name of OAuth clients in HTML form login templates. You can use the $escape utility with the $clientName variable to include the client name.

This allows you to track the name of the client you use when customizing user-facing login pages.

Learn more in Customizable user-facing pages.

New PF-35854

We’ve added TLS 1.3 support for Hardware Security Modules (HSMs). New installations of PingFederate will have TLS 1.3 enabled by default when in HSM mode.

This improves security by adding TLS by default to your HSM, and streamlines the HSM configuration process by removing a step to manually add TLS.

New PF-35858

We’ve added a feature that allows PingFederate to return ID tokens when issuing OpenID device authorization grants.

This allows you to personalize response messages during device authorization flows. For example, you can display the user’s name as part of the authorization message.

Learn more in Configuring authorization server settings.

New PF-36302

We’ve added support for Google Cloud Key Management System (KMS).

This improves security by allowing you to encrypt the master key file when PingFederate is running in Google Cloud Platform.

Learn more in Implementing a MasterKeyEncryptor using Google Cloud KMS.

New PF-36298

We’ve made it possible to globally disable the MaxMaliciousActions parameter in the <pf-install>/pingfederate/server/default/data/config-store/com.pingidentity.common.security.AccountLockingService.xml file.

This prevents an issue during upgrades where PingFederate unintentionally locks out an OAuth client when it tries to revoke invalid Reference Bearer Access Tokens.

New PF-36299

We’ve made it possible to override the MaxMaliciousActions parameter in the <pf-install>/pingfederate/server/default/data/config-store/com.pingidentity.common.security.AccountLockingService.xml file as it applies to an OAuth client.

This prevents an issue during upgrades where PingFederate unintentionally locks out an OAuth client when it tries to revoke Reference Bearer Access Tokens.

We’ve also improved the error messaging to clarify when it’s the client, not the account, that’s locked out.

Learn more in Configuring authorization server settings and Managing client configuration defaults.

New PF-35855

We’ve added new feature that allows clients to access the Administrative API using a JSON Web Token (JWT).

This improves flexibility by adding a new secure method for your applications to access PingFederate administrative functions.

Learn more in Enabling JWT authorization.

New PF-36588

PingFederate can now accept OAuth access tokens without scopes through the Admin API.

New PF-34715

We’ve moved the setting for JGroups maximum thread pool size from tcp.xml and udp.xml to run.properties.

This new parameter in the run.properties file allows you to configure your JGroups thread pool more easily and ensure that changes are carried over during upgrade.

Learn more in Deploying cluster servers.

New PF-32832

We’ve added the jetty.runtime.requestlog.format property to the run.properties file to allow you to customize the format of the Jetty runtime log request.

You can use this property to add milliseconds to your log format, which is helpful for troubleshooting high volumes of requests.

Learn more in Configuring PingFederate properties.

New PF-35861

We’ve added support for Google reCAPTCHA Enterprise.

reCAPTCHA Enterprise can handle higher volumes of assessment transactions and offers more levels of bot score granularity.

Learn more in Configuring Google reCAPTCHA Enterprise.

New PF-35862

We’ve added JSON web token (JWT) support to PingFederate’s UserInfo endpoint when acting as the OpenId provider (OP). As the relying party (RP), PingFederate now supports consuming JWT-based responses from other OPs UserInfo endpoint.

This improves security by replacing information sent in JSON form with a signed token, an encrypted token, or both.

Learn more in Configuring OAuth clients and OAuth Client Management Service.

Improved PF-28890

We’ve added a new provisioner-channel-summary.log file to capture data about users and groups added, removed, and updated by provisioning cycles. We’ve also added new information at the INFO level to the provisioner.log and provisioner-audit.log files.

These updates give you improved summary information about provisioning operations without the unnecessary detail of DEBUG-level logging.

Learn more in PingFederate log files.

PingFederate now supports Microsoft External Authentication Method (EAM) to handle multi-factor authentication (MFA) flows with PingID or other MFA integrations.

Learn more in Microsoft EAM Integration Kit.

Info PF-35782

We’ve confirmed that PingFederate 12.2 and 12.1 are compatible with Microsoft Active Directory 2022.

Info PF-36312 PF-36288

We’ve confirmed that PingFederate version 12.2 is compatible with PostgreSQL versions 16.4 and 17.

Info PF-36289

We’ve confirmed that PingFederate is compatible with Amazon Aurora PostgreSQL version 16.4.

Info PF-36445

PingFederate now uses the jose4j library version 0.9.6.

Info PF-36446

PingFederate now uses Apache Commons Compress library version 1.27.1.

Info PF-36579

We’ve upgraded the Amazon Web Services (AWS) Key Management Service (KMS) master-key-encryptor library to the latest version as of this release.

Info PF-36675

Forward slashes are now valid characters in the request header for correlation ID.

Learn more in General settings and Correlating PingFederate events with PingDirectory LDAP activities.

info PF-36276

We’ve updated the provisioning Flag Comparison Value attribute to be case-insensitive.

Learn more in Modifying source settings.

Fixed PF-35919

We’ve fixed a defect that caused PingFederate to return an unexpected error when replicating on a newly promoted passive admin node after deleting connections or clients on the previously active admin node.

Fixed PF-35990

We’ve fixed a defect that caused Kerberos and Form SSO policies to fail when a user attempted SSO using iOS.

Fixed PF-36035

We’ve fixed a defect that caused outbound provisioning to fail and cease if a source user object exceeded a 255-character limit. In the new behavior, PingFederate will skip user objects that exceed 255 characters and log a warning.

Fixed PF-36232

We’ve fixed a defect that prevented PingFederate from issuing a password expiration warning when using PingDirectory as a datastore.

Fixed PF-36239

We’ve fixed a defect that could cause inconsistent sessions or authentication errors when starting multiple applications in different browser tabs at the same time.

Fixed PF-36478

We’ve fixed a defect that caused PingFederate to fail to restart when forcing an import of an unsupported configuration data archive using the drop-in deployer.

Fixed PF-36546

We’ve fixed a defect that caused the banner message warning that a configuration is out of date to persist after a configuration had been replicated. This defect occurred when running PingFederate as a Windows service.

Fixed PF-36550

We’ve fixed a defect that caused PingFederate to log errors without including details of what error occurred.

Fixed PF-36574

We’ve fixed a defect that caused the email verification screen to fail to appear when a user registered through an authentication source.

Fixed PF-36600

We’ve fixed an issue that caused PingFederate to fail to revoke multi-part refresh tokens through the revoke_token.oauth2 endpoint.

Issue PF-36573

PingFederate returns an unexpected error when you create an instance of the PingOne Verify Integration Kit version 2.2.2 in PingFederate with the Verify feature in PingOne disabled.

Issue PF-36487

When PingFederate is configured to use the Amazon Web Services or Google Cloud Platform Key Management System (KMS), importing a valid configuration data archive with Reencrypt Data enabled fails with a Could not reencrypt data archive error message. This failure causes PingFederate to fail to restart.

Issue PF-35772

Due to multiple vendors' recent browser versions that block third-party cookies, you might experience issues related to single logout with OIDC (via Front-Channel) and WS-Federation.

Refer to browsers' documentation regarding third-party cookie management to unblock them, if feasible.

Issue PPQ-33519

POST requests to the Session Revocation API do not support the Private Key JWT authentication type.

Issue PF-35643

When you promote a passive admin console to active, the UI doesn’t refresh until you perform an action.

Issue PF-35439

When you make configuration changes on the active console (especially large configuration changes like bulk imports or data archive imports), then promote a passive console to active, it can cause multiple consoles to be active at once. This can result in inconsistent configurations.

Learn how to resolve this issue in Resolving multiple active administrative nodes.

Issue

Issue

PingFederate’s TLS cipher suites can be customized by modifying com.pingidentity.crypto.SunJCEManager.xml (or a similarly-named file if BCFIPS or an HSM is configured). After updating the file and replicating, all cluster nodes must be restarted for the change to take effect.

Issue

Issue

AWS CloudHSM

Thales HSMs

Entrust HSMs

Issue

Issue

SLO is not supported when users are authenticated through a Composite Adapter instance that contains another instance of the Composite Adapter.

Issue

Passwords can be reset for Microsoft Active Directory user accounts without the permission to change password.

Issue

PingFederate does not support a case-sensitive naming convention for OAuth client ID values when client records are stored in a directory server. For example, after creating a client with an ID value of sampleClient, PingFederate does not allow the creation of another client with an ID value of SampleClient.

Although it’s possible to create clients using the same ID values with different casings when client records are stored in XML files, a database server, or custom storage, we recommend not doing so to avoid potential record migration issues.

Issue

Some browsers display a date-picker user interface for fields that have been designed for date-specific inputs. Some browsers do not. If one or more date-specific fields are defined on the registration page or the profile management page (or both), end users must enter the dates manually if their browsers do not display a date-picker user interface for those fields.

Issue

Issue

Issue

Issue

The RADIUS NAS-IP-Address is only included in Access-Request packets when the pf.bind.engine.address is set with an IPv4 address. IPv6 is not supported.

Issue

When deploying PingFederate with a forward proxy, plugins based on the AWS SDK, such as the Amazon SNS Notification Publisher, will only honor the http.proxyHost, http.proxyPort, http.proxyUser, and http.proxyPassword properties in run.properties. The plugin will rely on these properties even if the service URL is https.

New PF-34962

We’ve added a feature that allows you to create an active admin console and one or more passive backup admin consoles in a clustered environment.

Even though only one node can be active, the passive nodes are always kept in sync, so you can easily promote them to the active console. This reduces downtime in the event of an outage on the node with the active admin console.

Learn more in Active and passive administrative nodes.

New PF-35345

We’ve added the ability to implement runtime thread bulkheads that limit the percentage of threads that can be waiting on external data sources. After the limit is reached, further requests are rejected.

This improves resilience, reliability, and availability by minimizing the impact of a broken data source connection on other connections.

You can configure bulkheads in the com.pingidentity.common.util.resiliency.BulkheadManagerImpl.xml file. You can also configure runtime notifications for bulkhead threshold events.

Learn more in Configuring runtime thread bulkheads.

New PF-34887

We’ve added a new special attribute, SAML_AUTHN_RESPONSE_ASSERTION, to access the Assertion element of the SAML 2.0 response messages during attribute mapping.

Learn more in Special attribute names in contracts.

New PF-34883

We’ve added the ability to define a custom key identifier (KID) for OIDC and OAuth signing and decryption keys for each RSA-based signing algorithm.

Custom KID values help with special environments and custom requirements for RSA-based JSON Web Keys (JWK) published in the JSON Web Keys endpoint.

Learn more in Keys for OAuth and OpenID Connect.

New PF-34889

We’ve added the ability to enable a redirectless authentication API OAuth flow through the authorization endpoint without cookies.

You can now use the authentication API without having to manage and process cookies. Instead of cookies, the API includes details within the JSON response that need to be included as a simple HTTP header value in responses to PingFederate.

This improvement is especially useful for native app developers and reduces the implications of third-party cookie issues.

Learn more in Configuring OAuth clients.

New PF-35341

We’ve added support for the resource parameter to allow clients to indicate the protected resources to which it is requesting access.

The resource parameter is available for use during access token mapping.

Learn more in the RFC 8707 specification and Token endpoint.

New PF-31859

We’ve added support for the Australia region in the PingOne unified admin feature. You can now configure the pf.pingone.admin.url.region property for Australia (.com.au).

The Asia region is deprecated. We recommend using the Australia region instead.

Learn more in Configuring PingFederate properties.

New PF-34886

We’ve added the ability to optionally publish asymmetric signing keys configured in a JWT Access Token Management Plugin instance to the PingFederate JWKS endpoint.

Publishing JWKs to the JWKS endpoint reduces the number of required JWKS endpoints, and allows you to use more standard client libraries and fewer custom clients.

Published keys are discoverable using the OpenID Provider configuration endpoint.

Learn more in Configuring an access token management instance.

New PF-35342

PingFederate now publishes the x5t x.509 certificate SHA-1 thumbprint parameter from the JWKS endpoint by default.

Learn more in JSON Web Keys endpoint.

New PF-34891

We’ve added support for custom URI schemes in redirect validation for OAuth and OIDC clients.

You can now allow redirects to URIs such as native applications or APIs outside of the HTTP/HTTPS scheme. Because application URIs are often company or brand-specific, this feature reduces the potential for naming collisions with other apps on the same device.

Learn more in Configuring redirect validation.

New PF-34884

We’ve added support for JWT Authorization Response Mode (JARM) to identity provider (IdP) connections.

PingFederate already supports JARM in its role as a relying party (RP), and now supports it in its role as an OpenID provider (OP). Instead of having to receive an issued authorization_code and state parameter as a query component, your connection can process a JWT instead.

Learn more in Creating an OpenID Connect IdP connection.

New PF-34885

We’ve added a feature allowing you to configure the interval of rolling OAuth tokens in hours, minutes, or seconds.

Learn more in Configuring OAuth clients, Configuring authorization server settings, and Managing client configuration defaults.

New PF-34422

We’ve added support for the PingFederate Magic Link Integration Kit.

Learn more in the Magic Link Integration Kit documentation.

New PF-35012

We’ve added the ability to configure the timeout duration for LDAP health checks.

You can configure this option in the ~/server/default/data/config-store/com.pingidentity.common.util.ldap.LDAPUtil.xml file using the HealthCheckResponseTimeoutMillis parameter.

The default value is 2000.

New PF-35349

PingFederate now supports LDAPv3 with the StartTLS command to secure LDAP connections to a directory server.

This feature allows LDAP connections to be initiated on a non-SSL port (such as 389), and then be upgraded to SSL on the same port. This reduces the number of ports that potentially have to be opened within a firewall.

Learn more in Configuring an LDAP connection.

New PF-35346

PingFederate now supports the OpenID Connect (OIDC) offline_access scope.

You can now configure OAuth and OIDC clients to receive only a refresh_token when this scope is requested. You can also optionally configure a resource owner consent as required.

Learn more in Configuring authorization server settings and OAuth Client Management Service.

New PF-35347

PingFederate now supports user registration through OIDC 1.0 using the prompt=create command.

Including this parameter initiates a user registration flow within the context of OIDC, which reduces developer efforts by eliminating the need for a separate customer registration flow.

Learn more in Configuring request parameters and SSO URLs.

New PF-35453

We’ve added the IN_PARAMETER_NAME_SRI parameter to the SDK, which contains the current pi.sri.

We’ve also exposed the pi.sri value in the Context type for most attribute mappings.

New PF-34464

We’ve added a new SessionManager class in the SDK to allow for revoking all sessions or all but the current session.

This works similarly to the Revoke sessions after password change or reset option in the HTML Form Adapter.

New PF-34338

We’ve added support for the log tracking ID feature in PingDirectory 10.0. PingFederate can use this tracking ID as a transactionId value.

Learn more in Security audit logging.

Improved PF-35079

We’ve improved logging capabilities to associate an adapter ID with adapters that fail to load. This makes misconfigured adapters easier to trace.

Improved PF-34952

We’ve added a pop-up modal to several OAuth scope reference pages to improve the scope management user interface.

Learn more in Configuring scope constraints.

Improved PF-34890

We’ve improved the user interface for the Scope Management page, including pagination, a search feature, and new tabs for managing common and exclusive scope groups.

Learn more in Defining scopes.

Improved PF-34892

We’ve added new connection pool metrics to the heartbeat endpoint and JMX MBeans for Java Database Connectivity (JDBC) and LDAP connections.

New metrics include maximum connection pool size, minimum connection pool size, number of active connections, and number of idle connections.

Learn more in Customizing the heartbeat message and Liveliness and responsiveness.

Improved PF-35527

Refresh grants are no longer revoked when issuance criteria fail.

Also, new grants or access tokens are not issued due to the failure of issuance criteria.

This is the new default behavior for refresh grants.

Improved PF-35325

The PingOne MFA Integration Kit has been updated to version 2.3.1.

Improved PF-35383

PingFederate now supports Aurora PostgreSQL version 16.2.

Improved PF-35384

PingFederate now supports PostgreSQL version 16.2.

Info PF-34434

We’ve added support for PingDS (formerly ForgeRock DS) datastore.

Learn more in System requirements.

Improved PF-34039

We’ve upgraded Jetty to version 10.

Info PF-34897

PingFederate 12.1 is certified for FAPI OpenID Providers (OP) and Profiles, and FAPI CIBA OpenID Providers and Profiles.

Fixed PF-34523

We’ve fixed an issue that caused PingFederate’s OIDC admin console login to fail when the node.group.id value didn’t match an existing node id.

Fixed PF-34333

We’ve fixed an issue that caused PingFederate to query all attributes for PingDirectory users, rather than just the required attributes.

Fixed PF-35082

We’ve fixed a defect that caused access token requests to fail due to OAuth 2.0 Demonstrating Proof of Possession (DPoP) proof validation failure when reusing existing persistent access grant is enabled for confidential claims.

Fixed PF-35114

We’ve fixed an issue that caused PingFederate to display the expiration date of a PingFederate license in terms of the browser time zone rather than the server time zone.

Fixed PF-35272

We’ve fixed an issue that caused significant slowdown when PingFederate processed an unencrypted JSON web token (JWT) using JSON web encryption (JWE) deobfuscation.

Fixed PF-35352

We’ve fixed a defect that caused the PingFederate REST API datastore to pass malformed cookies into datastore request headers.

Fixed PF-35744

We’ve fixed a defect where client in-use detection caused an IndexOutOfBoundsException when a custom solution is used for client storage.

Fixed PF-35753

We’ve fixed a defect that caused changes in ClientManagerDynamoDBImpl not to apply when performing a bulk import or using the configuration store API unless you restarted PingFederate.

Fixed PF-35075

We’ve fixed a defect that caused PingFederate to ignore valid license files if they were issued prior to the current license file.

Issue PF-35772

Due to multiple vendors' recent browser versions that block third-party cookies, you might experience issues related to single logout with OIDC (via Front-Channel) and WS-Federation.

Refer to browsers' documentation regarding third-party cookie management to unblock them, if feasible.

Issue PPQ-33519

POST requests to the Session Revocation API do not support the Private Key JWT authentication type.

Issue PF-35642

When you switch a passive console to active, PingFederate might display a notification that the configuration has not been replicated, even though the configuration is up-to-date.

Issue PF-35643

When you promote a passive admin console to active, the UI doesn’t refresh until you perform an action.

Issue PF-35439

When you make configuration changes on the active console (especially large configuration changes like bulk imports or data archive imports), then promote a passive console to active, it can cause multiple consoles to be active at once. This can result in inconsistent configurations.

Learn how to resolve this issue in Resolving multiple active administrative nodes.

Issue

Issue

PingFederate’s TLS cipher suites can be customized by modifying com.pingidentity.crypto.SunJCEManager.xml (or a similarly-named file if BCFIPS or an HSM is configured). After updating the file and replicating, all cluster nodes must be restarted for the change to take effect.

Issue

Issue

AWS CloudHSM

Thales HSMs

Entrust HSMs

Issue

Issue

SLO is not supported when users are authenticated through a Composite Adapter instance that contains another instance of the Composite Adapter.

Issue

Passwords can be reset for Microsoft Active Directory user accounts without the permission to change password.

Issue

PingFederate does not support a case-sensitive naming convention for OAuth client ID values when client records are stored in a directory server. For example, after creating a client with an ID value of sampleClient, PingFederate does not allow the creation of another client with an ID value of SampleClient.

Although it’s possible to create clients using the same ID values with different casings when client records are stored in XML files, a database server, or custom storage, we recommend not doing so to avoid potential record migration issues.

Issue

Some browsers display a date-picker user interface for fields that have been designed for date-specific inputs. Some browsers do not. If one or more date-specific fields are defined on the registration page or the profile management page (or both), end users must enter the dates manually if their browsers do not display a date-picker user interface for those fields.

Issue

Issue

Issue

Issue

The RADIUS NAS-IP-Address is only included in Access-Request packets when the pf.bind.engine.address is set with an IPv4 address. IPv6 is not supported.

Issue

When deploying PingFederate with a forward proxy, plugins based on the AWS SDK, such as the Amazon SNS Notification Publisher, will only honor the http.proxyHost, http.proxyPort, http.proxyUser, and http.proxyPassword properties in run.properties. The plugin will rely on these properties even if the service URL is https.

Info PF-34682

The authorizationDetails JSON field returned by the OAuth consent management endpoint has been deprecated in favor of the new authorizationDetail and authorizationDetailDescription fields.

Learn more about the consent management endpoint in OAuth Consent Management Service.

New PF-34418

OpenID Connect (OIDC) relying party (RP) initiated logout allows OAuth clients to request that the OpenID Provider (OP) perform a federated logout. PingFederate now supports this standard, both when PingFederate acts as the OP as well as when it acts as the RP via an OIDC IdP connection.

For more information, see OAuth Client Management Service, Configuring OpenID Provider information, and OpenID Connect RP-initiated logout endpoint.

New PF-34415

You can now add risk provider such as CAPTCHA to Identifier First adapters.

For more information, see Configuring an Identifier First Adapter instance

New PF-34413

API-capable IdP adapters can now prevent a redirect to the authentication application if no user interaction is required.

For more information, see Upgrade considerations.

New PF-34437

You can now configure runtime notifications to alert you when the number of threads in use exceeds a set threshold. You can also use this feature to initiate and log a thread dump event.

For more information, see Configuring runtime notifications.

New PF-33318

You can now configure your authorization server settings for OAuth and OIDC users so that their decisions to grant access can be persisted after a refresh_token is revoked.

For more information, see Authorization Consent in Configuring authorization server settings.

New PF-34428

PingFederate will now issue a notification in the admin console before a certificate expires. You can configure the duration of the notification before and after expiry in the Runtime Notifications menu.

Deleted certificates are removed from the notifications menu.

For more information, see Configuring runtime notifications.

New PF-33989

We further improved support for self-service and application on-boarding use cases. OAuth applications and SAML connections can now be replicated to PingFederate engine nodes without affecting any dependencies. This enhancement lets development teams manage their applications without the help of PingFederate administrators. For more information, see Cluster management.

New PF-33986

Continuing the PingFederate tradition of recognizing open identity standards, it now supports the OpenID Connect Front-Channel Logout specification. This feature enables global sign-off user journeys. It’s available in addition to PingFederate’s proprietary front-channel logout protocol. For more information, see Configuring OAuth clients.

New PF-33987

For OpenID Connect IDP connections, log files now include more details so that you can analyze and resolve connection problems easier. You can enable this feature just by selecting a check box in the Log Settings. For more information, see Log settings.

New PF-33982

Now you can configure PingFederate to enable sessions on shared devices. Devices can be configured as private or public (unspecified) and maintain persistent sessions. This feature is available through the HTML Form Adapter. For more information, see Configuring authentication sessions.

New PF-33985

The integration with the CyberArk Secret Manager now allows access to all values available through the CyberArk interface. This gives you more freedom when building user journeys. For more information, see Configuring instances of the secret manager plugin for the CyberArk Credential Provider.

New PF-33983

When you use OAuth and OpenID Connect flows with response_mode=pi.flow, users are redirected back to the associated authentication application rather than to PingFederate. This is enables more consistent user journeys. For more information, see Configuring self-service account recovery.

New PF-33988

To further support Amazon DynamoDB use cases, now you can also use account linking with this NoSQL database. For more information, see Configuring an Amazon DynamoDB for account-link storage.

New PF-33332

This feature simplifies the use of PingFederate policies because it no longer requires input or output contracts for certain fragments. This improves the readability, maintainability, and performance of these policies. For more information, see Defining policy fragments.

New PF-33631

Enhancing PingFederate’s support for OAuth DPoP, this release includes support for this type of access token. It lets developers learn more about the use and importance of the dpop_bound_access_tokens parameter. For more information about the parameter, see the PingFederate Open Banking Software Assertion Validator plug-in on GitHub.

New PF-34640

In rare cases where plugin creation and initialization significantly slows down PingFederate startup, you can now turn off plugin creation and initialization. Plugins will then only be initialized on first use.

The default startup behavior is recommended for most customers. For more information about this option and the tradeoffs involved in enabling it, open a support case.

New PF-34147

The PingOne Protect Integration Kit is now bundled with PingFederate.

Improved PF-34369

The PingID Integration Kit has been updated to version 2.26.

Improved PF-34368

The PingOne MFA Integration Kit has been updated to version 2.2.1.

Improved PF-34168

When integrating with Thales Luna Network hardware security modules (HSMs), you can now use Java 17.

For more information, see Integrating with Thales Luna Network HSM

Improved PF-34050

The administrator audit log file (admin.log) now logs any OGNL expression tests performed and the expression variables used with an event type of TEST_EXPRESSION. For more information, see Administrator audit logging.

Improved PF-33095

The Collect Support Data (CSD) script has been improved to capture more details.

Improved PF-33621

Now PingFederate supports authentication to Azure SQL Managed Instance through Azure Active Directory without a username and password. For more information, see Configuring a JDBC connection.

Improved PF-32747

Upgraded the BCFIPS library to 1.0.2.4, which now supports enabling BCFIPS mode with Java 17.

For more information, see Bouncy Castle FIPS provider and Integrating Bouncy Castle FIPS providers.

Improved

Security PF-34645

Fixed a potential security vulnerability described in SECADV040.

Security PF-34646

Fixed a Server-Side Request Forgery vulnerability in the Initial Setup Wizard described in security advisory SECADV041.

Fixed PF-34718

For fresh installs, we changed the default value of pf.cluster.TCPPING.return_entire_cache in jgroups.properties from true to false.

This prevents an issue where remote procedure calls (RPCs) can be dropped in large clusters that use TCPPING.

For more information, see Upgrade considerations.

Fixed PF-34500

Fixed an issue with the administrative API doc on the /oauth/accessTokenMappings endpoint not matching the actual endpoint response.

Policy Rules conditions that use multi-value contains DN now ignore case while comparing the DN value.

Fixed PF-33305

Now log messages about illegal characters in API calls are logged at the DEBUG level rather than the WARN level.

Fixed PF-34115

Added the value none to /.well-known/openid-configuration/token_endpoint_auth_methods_supported

Fixed PF-34210

The id_token_jti property is no longer included in token endpoint responses.

Fixed PF-34216

Fixed an administrative API defect when a fragment rule had Default to Success disabled

Fixed PF-34322

Fixed an issue that was returning a 404 error if the /idp/startSLO.ping endpoint was hit while a virtual issuer was configured. You can now configure virtual issuers with a context path.

Fixed PF-34504

Clients that maintain a JWKS endpoint can now use private key JWT based authentication when requesting an access token.

Fixed PF-34606

Checking for existing but expired grants with DynamoDB no longer causes a null pointer exception error (NPE).

Fixed PF-34545

Fixed an issue preventing PingFederate from closing connections after receiving a 401 or 403 response from PingOne MFA.

Fixed PF-33466

You can now turn off server-side sorting via a configuration option.

Fixed PF-34433

You can now copy and paste a policy contract below a selector node.

Fixed PF-34536

Fixed an issue where decryption of an encrypted SAML element could fail if a KeyName was specified.

Fixed PF-33983

When using redirectless mode, now the one-time link (OTL) in password-reset email messages returns users to the authentication API application configured for the policy, rather than to PingFederate.

Fixed PF-34111

When a service provider (SP) authentication policy fails, PingFederate now renders the sp.sso.error.page.template.html page instead of the idp.sso.error.page.template.html page.

Fixed PF-34146

Fixed a defect where an OAuth client created with dynamic client registration (DCR) couldn’t be updated with DCR after it was modified with the administrative console.

Fixed PF-34163

Now PingFederate closes idle JDBC datastore connections until the minimum pool size is reached instead of closing and recreating all of them.

Fixed PF-34210

The id_token_jti property is no longer included in token endpoint responses.

Fixed PF-34216

Fixed an administrative API defect when a fragment rule had Default to Success disabled

Fixed PF-34225

Resolved an issue that caused PingFederate to send email notifications for licensing events even though they were disabled in the Runtime Notifications configuration.

Fixed PF-31865

We upgraded the Jetty library, resolving CVE-2022-2047 and CVE-2022-2048.

Fixed PF-33056

Using submit and onSubmit as OAuth scope names in the administrative UI drop-down no longer causes front-end JavaScript errors.

Fixed PF-33156

Policy fragments with valid authentication sources no longer fail with an Invalid Configuration error during runtime.

Fixed PF-33441

PingFederate, when configured with PingDirectory as an outbound provisioning data source, no longer sends redundant group updates in each provisioning cycle when the entry remains unchanged.

Fixed PF-33449

We’ve resolved a potential security vulnerability that is described in security advisory SECADV037.

Fixed PF-33450

We fixed an issue so that PingFederate as a Windows service now runs on Java 17. When updating to the latest maintenance release using an in-place update method (for example, from 11.3.0 to 11.3.x), in addition to the steps in Updating to the latest maintenance release, you must remove the existing PingFederate Windows service. After removal, re-install the PingFederate Windows Service to apply this fix.

Fixed PF-33519

When an OIDC identity provider (IdP) connection fails in an authentication policy, PingFederate now continues on to the fail path of the authentication policy.

Fixed PF-33722

We resolved an issue that incorrectly produced an administrative API validation error when the fragment mapping references context.RequestedUser as the mapping source.

Fixed PF-33863

PingFederate now processes authorization details within a rich authorization request (RAR) as a JSON Array in a JWT request. Additionally, PingFederate no longer supports authorization details sent as stringified JSON arrays.

Fixed PF-33881

Resolved a replication issue that, in rare cases, caused an engine node in a cluster to start without replication data from other nodes.

Fixed PF-33920

Resolved an issue that prevented user sessions from being revoked through the session management API when using persistent sessions.

Fixed PF-33935

We’ve resolved a potential security vulnerability that is described in security advisory SECADV037.

Fixed PF-33957

When utilizing the PingFederate administrative API to create or update a fragment that includes another fragment, the API will no longer produce a validation error when fragment mapping involves an input source type.

Fixed PF-34016

The message-template-end-user-password-change.html template now contains the USERNAME variable.

Fixed PF-34017

We’ve resolved a potential security vulnerability that is described in security advisory SECADV037.

Fixed PF-34051

We fixed a policy evaluation issue that occurred when ui_locales was present in an authentication request.

Fixed PF-34074

We updated the administrative UI to include certification serial number in the drop-down, thus preventing import errors for certifications sharing the same Subject DN and expiration date combination.

Fixed PF-34099

We fixed an attribute lookup error that occurred when different DynamoDB attributes shared an overlapping path.

Fixed PF-34077

We fixed a defect that caused PingFederate to check every certificate when loading certificate-related pages in the administrative interface, which slowed down performance.

Issue

PingFederate versions 11.1.4, 11.1.5, 11.2.1, and 11.2.2 contain version 3.0.2 of the PingID password credential validator (PCV). That version of the PCV has known issues that you should review before upgrading. For more information, see Known issues in PingID RADIUS PCV 3.0.2.

Issue

Issue PingOne MFA

PingFederate 11.3 is not compatible with the PingOne MFA CIBA Authenticator bundled in PingOne MFA Integration Kit version 2.1 and earlier. This issue was resolved in version 2.2 of that integration kit.

Issue

For Java versions that don’t support TLSv1.3 (meaning versions earlier than 8u261), PingFederate fails on start up with a NoSuchAlgorithmException exception. To resolve this error, remove TLSv1.3 from the following settings in the run.properties file:

Issue

PingFederate’s TLS cipher suites can be customized by modifying com.pingidentity.crypto.SunJCEManager.xml (or a similarly-named file if BCFIPS or an HSM is configured). After updating the file and replicating, all cluster nodes must be restarted for the change to take effect.

Issue

Issue

AWS CloudHSM

Thales HSMs

Entrust HSMs

Issue

Issue

SLO is not supported when users are authenticated through a Composite Adapter instance that contains another instance of the Composite Adapter.

Issue

Passwords can be reset for Microsoft Active Directory user accounts without the permission to change password.

Issue PPQ-33519

POST requests to the Session Revocation API do not support the Private Key JWT authentication type.

Issue

PingFederate does not support a case-sensitive naming convention for OAuth client ID values when client records are stored in a directory server. For example, after creating a client with an ID value of sampleClient, PingFederate does not allow the creation of another client with an ID value of SampleClient.

Although it’s possible to create clients using the same ID values with different casings when client records are stored in XML files, a database server, or custom storage, we recommend not doing so to avoid potential record migration issues.

Issue

Some browsers display a date-picker user interface for fields that have been designed for date-specific inputs. Some browsers do not. If one or more date-specific fields are defined on the registration page or the profile management page (or both), end users must enter the dates manually if their browsers do not display a date-picker user interface for those fields.

Issue

Issue

Issue

Issue

The RADIUS NAS-IP-Address is only included in Access-Request packets when the pf.bind.engine.address is set with an IPv4 address. IPv6 is not supported.

Issue

When deploying PingFederate with a forward proxy, plugins based on the AWS SDK, such as the Amazon SNS Notification Publisher, will only honor the http.proxyHost, http.proxyPort, http.proxyUser, and http.proxyPassword properties in run.properties. The plugin will rely on these properties even if the service URL is https.

Info

As of PingFederate 12.0, these features have been deprecated, and will be removed in a future release.

Info

Starting with PingFederate 12.0, self-service password reset (SSPR) has been removed.

Info

Starting with version 12.0, PingFederate no longer supports upgrading from PingFederate version 6.x and 7.x.

Info PingOne Fraud

The PingOne Fraud integration kit is no longer bundled with PingFederate.

Info

Ping Identity commits to deliver the best experience for administrators and users. As we continue to improve our products, we encourage you to migrate off of Microsoft Internet Explorer 11. Starting with PingFederate 11.0, Internet Explorer 11 is no longer included in the PingFederate qualification process for administrators or users. For a list of supported browsers, see System requirements.

Info

As of PingFederate 10.2, these features have been deprecated and will be removed in a future release.

Info

As Oracle ended its Premier Support for Oracle Directory Server Enterprise Edition (ODSEE 11g) in December 2019, we no longer include ODSEE as part of the PingFederate qualification process (starting with PingFederate 10.2). We continue to qualify against Oracle Unified Directory (www.oracle.com/middleware/technologies/unified-directory.html) and other supported directory servers. For a full list, see System requirements.

Info

Starting with PingFederate 10.2, monitoring and reporting through the SNMP has been removed.

Info

Starting with PingFederate 10.1, roles and protocols are always enabled and no longer configurable through the administrative console and API.

Info

Starting with PingFederate 10.1, the S3_PING discovery protocol has been deprecated. Customers running on AWS infrastructure should instead use NATIVE_S3_PING.

Info

Starting with PingFederate 10.0, the Red Hat Enterprise Linux install script is no longer available. To install PingFederate 10.0 for Linux, you must download and extract the product distribution .zip file.

New

Now you can configure access token managers to include the JSON web token (JWT) access_token claims nbf (not before) and iat (issued at). This enables stronger validations by receiving clients or protected resources that process that access_token. For more information, go to Configuring an access token management instance, and in the JSON web token data model section click the JSON token management tab.

New

To further improve reliability and robustness, now PingFederate executes retries rather than failover only. PingFederate initiates a single retry if a request fails and it appears the connection has become invalid. For more information, see the Retry Failed Operations field in Setting advanced LDAP options.

New

For authorization requests, parameters can now be referenced for incoming PAR requests (pushed authorization requests) inside authentication policies. This lets PingFederate process incoming requests independently of how it received them. For more information, see Pushed authorization requests endpoint.

New

To improve logging, PingFederate now uses a transactionId. For each transaction, this value won’t change between the initial request and the final response. This is especially useful for troubleshooting. For more information, see the transactionid field in Security audit logging.

New

Now you can configure HTML and mail templates with user details. With these details, you can personalize user facing pages and include messages, such as greetings by name, or email addresses that were used for a password recovery flow. The attributes are documented in the templates.

New

Previously, PingFederate produced notifications to inform administrators about expiring certificates. Now you can configure PingFederate to log upcoming expirations without producing notifications. For more information, see Configuring runtime notifications.

New

Two major SAML 2.0 messaging improvements align PingFederate closer to EU regulations:

New

Because proxy servers can require credentials for authentication purposes, now you can configure PingFederate with proxy server credentials so that connections can be easily established and secured. For more information, see Configuring forward proxy server settings.

New

Our continued effort to support Amazon DynamoDB (NoSQL) now lets you use DynamoDB as a source for attribute lookups. The connector supports the DynamoDB query language so you can easily configure it. For more information, see Configuring an AWS DynamoDB datastore.

New

As regulations for APIs in the context of financial services tighten, it’s important to support highly secure API authentication and authorization methods. OAuth DPoP (Demonstrating Proof-of-Possession) is an extension to the OAuth framework and specifies how OAuth tokens are bound to clients. Clients must digitally prove the ownership of these tokens at runtime, which prevents unauthorized clients from misusing them. This extension is useful for any OAuth scenario, not only in financial environments. For more information, see Configuring authorization server settings.

New

For TLS connections, PingFederate can now log the TLS version that clients use. This gives you an easy way to identify clients that might need updates to use newer versions. For more information, see the tlsversion field in Security audit logging.

New

In the administrative console, now certificate selection menus show the distinguished name (DN) and expiration date for each certificate, rather than a serial number. This gives you easy access to relevant information.

New

A new JWT token processor enhances the token exchange capabilities so that you can leverage any configured issuer. Now PingFederate can validate and accept incoming tokens that were created by pre-configured issuers. For more information, see Configuring a JWT Token Processor 2.0 instance.

New

Complex authentication policies are sometimes challenging to manage. To simplify your work and add flexibility to policies, PingFederate provides several policy enhancements:

New

PingFederate now initiates outbound authorization requests using the PAR endpoint of the target authorization server if you expose it. This enhancement lets PingFederate use PAR inbound and outbound, which improves OAuth flow security. For more information, see the Pushed Authorization Request Endpoint field in Configuring OpenID Provider information.

New

In the context of OpenID session management, PingFederate now supports back-channel logout. PingFederate supports this feature whether it’s configured as an OpenID Connect provider (OP) or a relying party (RP). For more information, see the OpenID Connect Back-Channel Logout 1.0 specification.

New

Now PingFederate can include JWT header values x5t and typ in the ID tokens it issues. You can include the x5t header with static keys enabled, whereas you can configure the typ header to an appropriate value without a dependency on the types of keys. The x5t header adds another mechanism for verifying the validity of a received JWT. For information about the x5t and typ parameters, see the JSON web key (JWK) and JWT specifications, respectively, and steps 9 and 10 in Configuring policy and ID token settings.

New

The alg header is now supported in PingFederate’s JWKS endpoint. Any elliptic curve keys and all RSA-256 based keys expose this header. This feature lets clients verify that a received JWT has been signed by the advertised algorithm. For information about the alg parameter, see the JWK specification and JSON Web Keys endpoint.

New

With the client_secret_jwt authentication method, a client can choose to create a signed JWT when authenticating against PingFederate’s token endpoint, introspection endpoint, PAR endpoint, or CIBA endpoint instead of providing the client secret. This feature prevents potential client secret leakage because it’s not actively exchanged with any party. PingFederate also supports this feature when it acts as an RP. For more information, see client_secret_jwt in the Open ID Connect specification and Client authentication schemes.

New

PingFederate now revokes a chain of tokens if a refresh token is revoked or if a refresh token is reused. This includes derived authorization codes and access tokens. For more information, see the Refresh Token settings section of Configuring authorization server settings.

New

Now you can configure many properties as environment variables instead of setting them in properties files. This is especially important for container environments, which is common practice.

New

Several enhancements provide more details in PingFederate generated logs. These include the logging of JWT IDs (jti), hashed values of authorization codes, access tokens, and refresh tokens. Also, PingFederate now logs which system has locked out users after multiple, unsuccessful login attempts, so you’ll know if it was PingFederate or an LDAP server. PingFederate also adds more details to the administrative API logs, so now there are almost no differences between logs generated when using the administrative console or administrative API. For more information, see Administrator audit logging, Administrative API audit log, and Security audit logging.

New

Now you can manage OAuth clients in Amazon DynamoDB. With this update, you can use DynamoDB to manage OAuth clients, persistent grants, and persistent authorization sessions. For more information, see Configuring an Amazon DynamoDB for client storage.

New

PingFederate now supports Apache Velocity Engine 2.3. For more information, see Upgrading in the Apache Velocity Engine documentation.

New

Now you can include CSP policies for HTML templates without having to implement workarounds. For more information, see Customizable user-facing pages.

New

Now you can use Velocity templates with more tools, such as cookieTool.

New

PingFederate now supports Microsoft Azure SQL Managed Instance. For more information, see the Datastore integration table in System requirements, and for more information on how to configure a connection to Microsoft Azure SQL Managed Instance, see Configuring a JDBC connection.

New

PingFederate now supports mutual TLS (mTLS) client authentication for REST API datastores.

New

PingFederate now supports mTLS client authentication for LDAP datastores.

New

Now when you integrate an Entrust nShield hardware security module (HSM) with PingFederate, you can use Java 11.

New

We added the User Count Utility (UCU) as a bundled component. You can use the UCU to produce unique and active user counts in a PingFederate environment.

New

We upgraded the following third-party components:

Fixed PF-33168

We improved SP-Initiated SAML login session tracking. This security improvement can affect existing SAML SP connections that rely on multiple session states in a single transaction.

For more information about how your configuration can be affected, and the steps to resolve issues, see Solicited SAML Response Validation in the Ping Identity Support Portal.

Fixed PF-32427

Now when multiple entries match the LDAP PCV search filter, the following message appears in the log at DEBUG level: error code 4 - This search operation has sent the maximum of 1 entries to the client

Fixed PF-32783

Now multivalued request parameters work as expected in authorization requests for OIDC administrative console authentication.

Fixed PF-32914

Now you can use tracked parameters in the Attribute Sources and User Lookup LDAP search filter when using the administrative API.

Fixed PF-33059

Now all password entry fields in PingFederate templates have icons that let users show and hide the password they’re entering.

Fixed PF-33311

When a connection or OAuth client references a deleted extended property, PingFederate no longer throws a null pointer exception. Instead it ignores the extended property and logs an error.

Fixed PF-33151

Now PingFederate can use customized messages from external consent adapters in error responses.

Fixed PF-33487

When restrictToDefaultAccessTokenManager is enabled on an OAuth client, the client can only get access tokens when being validated by password credential validators that are mapped to the restricted access token manager.

Fixed PF-33598

When an OAuth client has Bypass Authorization Approval enabled, now that setting takes precedence over the prompt parameter in requests.

Fixed PF-33605

Updated the file permissions of legal documents.

Fixed PF-33610

The memoryoptions script no longer allocates excessive JVM heap on Windows systems.

Fixed PF-33622

For the Device Authorization grant type, if Check Activation Code is set to Before Authentication, then authorization detail is set in the input parameters map when IdpAuthenticationAdapterV2 in the SDK is invoked.

Fixed PF-33637

Now when PingFederate retrieves a binary attribute from a PingOne LDAP gateway datastore, it correctly converts the attribute value to the specified format (base64, SID, hex).

Fixed PF-33709

When more than one trusted CA matches the issuer DN of an OAuth client, now PingFederate only flags the trusted CA as in use if its certificate hasn’t expired and its subject DN matches the client’s configured issuer DN.

Fixed PF-33867

Removed a potential information disclosure vulnerability.

Fixed PF-33869

Now PingFederate allows Jetty to precompress resources such as images and CSS.

Fixed PF-30236

When a system-level issue causes a data source attribute lookup to fail during OAuth flows, if the <pf_install>/pingfederate/server/default/data/config-store/org.sourceid.saml20.domain.AttributeMapping.xml file’s AbortOnAttrLookupFailure attribute is set to true, now PingFederate returns a 500 error instead of a 400 error.

Fixed PF-32757

When you run the Usercount Utility’s aggregate command:

Fixed PF-32837

Now when the CPU load is 0, heartbeat pages display the value with digits instead of as “N/A”.

Fixed PF-32989

We resolved an issue that caused an unexpected carriage return in audit logs during SP-initiated single sign-on (SSO) if an identity provider responded with a non-success status.

Issue

PingFederate versions 11.1.4, 11.1.5, 11.2.1, and 11.2.2 contain version 3.0.2 of the PingID password credential validator (PCV). That version of the PCV has known issues that you should review before upgrading. For more information, see Known issues in PingID RADIUS PCV 3.0.2.

Issue

Issue PingOne MFA

PingFederate 11.3 is not compatible with the PingOne MFA CIBA Authenticator bundled in PingOne MFA Integration Kit version 2.1 and earlier. This issue was resolved in version 2.2 of that integration kit.

Issue

For Java versions that don’t support TLSv1.3 (meaning versions earlier than 8u261), PingFederate fails on start up with a NoSuchAlgorithmException exception. To resolve this error, remove TLSv1.3 from the following settings in the run.properties file:

Issue

PingFederate’s TLS cipher suites can be customized by modifying com.pingidentity.crypto.SunJCEManager.xml (or a similarly-named file if BCFIPS or an HSM is configured). After updating the file and replicating, all cluster nodes must be restarted for the change to take effect.

Issue

Issue

AWS CloudHSM

Thales HSMs

Entrust HSMs

Issue

Issue

SLO is not supported when users are authenticated through a Composite Adapter instance that contains another instance of the Composite Adapter.

Issue

Passwords can be reset for Microsoft Active Directory user accounts without the permission to change password.

Issue PPQ-33519

POST requests to the Session Revocation API do not support the Private Key JWT authentication type.

Issue

PingFederate does not support a case-sensitive naming convention for OAuth client ID values when client records are stored in a directory server. For example, after creating a client with an ID value of sampleClient, PingFederate does not allow the creation of another client with an ID value of SampleClient.

Although it’s possible to create clients using the same ID values with different casings when client records are stored in XML files, a database server, or custom storage, we recommend not doing so to avoid potential record migration issues.

Issue

Some browsers display a date-picker user interface for fields that have been designed for date-specific inputs. Some browsers do not. If one or more date-specific fields are defined on the registration page or the profile management page (or both), end users must enter the dates manually if their browsers do not display a date-picker user interface for those fields.

Issue

Issue

Issue

Issue

The RADIUS NAS-IP-Address is only included in Access-Request packets when the pf.bind.engine.address is set with an IPv4 address. IPv6 is not supported.

Issue

When deploying PingFederate with a forward proxy, plugins based on the AWS SDK, such as the Amazon SNS Notification Publisher, will only honor the http.proxyHost, http.proxyPort, http.proxyUser, and http.proxyPassword properties in run.properties. The plugin will rely on these properties even if the service URL is https.

Info PingOne Fraud

The PingOne Fraud integration kit is no longer bundled with PingFederate.

Info

Ping Identity commits to deliver the best experience for administrators and users. As we continue to improve our products, we encourage you to migrate off of Microsoft Internet Explorer 11. Starting with PingFederate 11.0, Internet Explorer 11 is no longer included in the PingFederate qualification process for administrators or users. For a list of supported browsers, see System requirements.

Info

As of PingFederate 10.2, these features have been deprecated and will be removed in a future release.

Info

As Oracle ended its Premier Support for Oracle Directory Server Enterprise Edition (ODSEE 11g) in December 2019, we no longer include ODSEE as part of the PingFederate qualification process (starting with PingFederate 10.2). We continue to qualify against Oracle Unified Directory (www.oracle.com/middleware/technologies/unified-directory.html) and other supported directory servers. For a full list, see System requirements.

Info

Starting with PingFederate 10.2, monitoring and reporting through the SNMP has been removed.

Info

Starting with PingFederate 10.1, roles and protocols are always enabled and no longer configurable through the administrative console and API.

Info

Starting with PingFederate 10.1, the S3_PING discovery protocol has been deprecated. Customers running on AWS infrastructure should instead use NATIVE_S3_PING.

Info

Starting with PingFederate 10.0, the Red Hat Enterprise Linux install script is no longer available. To install PingFederate 10.0 for Linux, you must download and extract the product distribution .zip file.

New

PingFederate now supports OAuth 2.0 authorization server metadata. This allows OAuth clients to retrieve relevant endpoints and other details about features that PingFederate supports. The API response is like the OpenID Connect Discovery endpoints response but doesn’t include OpenID Connect relevant details. This lets you configure endpoints for your particular use case. See OAuth authorization server metadata endpoint.

New

For outbound provisioning, PingFederate now supports nested groups and nested search for PingDirectory. This lets you freely choose your favorite directory without needing to choose based on the support for nested groups. See nested group and nested search in Specifying a source location.

New

The AccessGrantManagerAccessor is now accessible in the PingFederate SDK. This lets developers query existing persistent grants at run time. See <pf_install>/pingfederate/sdk/doc/com/pingidentity/access/AccessGrantManagerAccessor.html in the SDK documentation.

New

Now you can configure PingFederate to keep users signed in after they change their password. This prevents users from having to sign on again, right after updating their password, improving the user experience. See the Require Re-authentication settings HTML Form Adapter advanced fields.

New

Now you can configure the PingFederate administrative API to accept either OAuth access_token or basic authentication. This is especially useful in cases where applications shouldn’t include administrator’s credentials in API requests. See pf.admin.api.authentication in Configuring PingFederate properties.

New

PingFederate now supports Google reCAPTCHA v3. reCAPTCHA v3 produces a score between 0.0 - 1.0 (risky to safe) that you can use in policies to require step-up authentication or other actions. By default, reCAPTCHA v3 doesn’t interrupt user journeys, which are in the control of application developers. Learn more in Managing CAPTCHA and risk providers.

PingFederate also now provides an SDK that allows for integrations with custom CAPTCHA providers, which adds great flexibility to the CAPTCHA feature.

New

Instead of showing an active bell icon, the administrative console now displays a banner when cluster replication is required. The banner includes a link to the Cluster Management window for easy access. See Cluster management.

New

You can configure PingFederate to function as an OpenID Connect client and let administrators sign on to the administrative console using their PingOne credentials. PingFederate initiates an OpenID Connect flow that includes the claims parameter. You can also use this feature outside the PingOne environment, leveraging any authorization server that supports the claims parameter. This allows for a simpler, seamless login flow. See Request Parameters in Enabling OIDC-based authentication.

New

You can configure PingFederate to accept incoming parameters, such as iss, that are processed and included in an outgoing authorization request if configured to do so. This feature lets administrators sign on to PingFederate from PingOne. This feature also supports other OpenID Connect authorization servers that support incoming parameters. See Request Parameters in Enabling OIDC-based authentication.

New

The PingFederate distribution now includes the PingOne DaVinci integration kit. See PingOne DaVinci Adapter in Bundled adapters and authenticators.

New

PingFederate can now manage persistent user sessions in AWS DynamoDB. Persistent user sessions keep sessions active even after a restart of PingFederate. This feature reduces the interruption of user journeys. See Configuring an Amazon DynamoDB for persistent authentication sessions in Defining a datastore for persistent authentication sessions.

New

When defining policy rules, now attributes that were processed in an earlier step can be accessed further down in the policy tree. This feature enhances the management and usability of policies. See Configuring rules in authentication policies.

New

The data exposed by the heartbeat endpoint and JMX interface now include more details, such as the number of errors per data store. See Liveliness and responsiveness.

Improved

Updated the bundled PingOne MFA Adapter to the newest version, 2.0. See PingOne MFA Adapter in Bundled adapters and authenticators.

New

Gone are the days you had to edit the log4j2.xml file on multiple servers to enable or disable DEBUG messages in their server logs. Now you can toggle log settings in the administrative console or with the administrative API.

PingFederate provides a set of message categories, each targeting a specific scenario. For example, the XML Signatures category helps you troubleshoot XML signature issues. You can also add your own categories to suit your unique requirements.

New

When viewing lists of OAuth clients and Browser single sign-on (SSO)/security token service (STS) connections, you can now sort them by modification or creation time. The timestamps can also help you understand the history and the relationship between clients and connections.

New

If you integrate with Amazon Web Services (AWS) CloudHSM, now you can choose between Java 8 and Java 11.

New

OAuth rich authorization requests (RAR) provide a standard way for OAuth client applications to specify fine-grained authorization requirements in their requests. For example, when initiating a money transfer, a personal banking application can pass all relevant information to the authorization server via the new parameter authorization_details. The authorization server supporting RAR processes the authorization_details parameter value accordingly and ultimately returns tokens to the application if the process completes successfully.

RAR is on track to become a requirement in Financial-grade API (FAPI) 2.0. With this new capability, you can confidently build your open banking solutions with PingFederate.

New

Now you can optionally define a sender name for each SMTP notification publisher instance.

PingFederate now supports XML Encryption 1.1.

Fixed PF-29355

For LDAP and database-related fields, PingFederate now sorts values alphabetically and in case-insensitive order.

Fixed PF-30514

We’ve added detailed comments to the log4j2.xml file to prevent misconfigurations that could lead to service hangs and production outages. For more information on logging, see Log4j 2 logging service and configuration.

Fixed PF-30514

We’ve added a configuration option to control whether SAML error responses include Cause. The new setting is IncludeErrorCauseInSamlResponse in config-store/org.sourceid.saml20.protocol.StatusResponseTypeUtil.xml. The default value is true.

Fixed PF-31149

The #HttpServletRequest and #HttpServletResponse variables are now available in SP STS message customization. For more information, see Message types and available variables.

Fixed PF-31531

We’ve resolved an issue where connections with multiple protocol types would only filter on a single protocol type.

Fixed PF-31717

When using OIDC for administrative console authentication, PingFederate no longer throws an NPE if private_key_jwt is used for client authentication method and the client.secret property is not set.

Fixed PF-31761

We’ve introduced a new separate stored value to track when refresh tokens should be reissued to OAuth clients, resolving a defect where rolling refresh tokens read the incorrect update timestamp to determine refresh token rolling criteria. For more information, see Configuring authorization server settings.

Fixed PF-31786

When adding clients to Active Directory (AD) or other LDAP stores, PingFederate now automatically escapes reserved characters from clientIDs.

Fixed PF-31791

We’ve improved detection around invalid Group distinguished names (DN) and added exceptions in the provisioner log. For more information on Group DN, see Specifying a source location.

Fixed PF-31806

We’ve updated the supported browsers list for the SameSite=None header attribute to filter out problematic clients with the SameSite cookie attribute bug: Safari version 12 and Embedded Apple Webkit Browser Safari 12 on macOS.

Fixed PF-31807

PingFederate’s administrative console now identifies expired user sessions on timeout and properly removes the session regardless of user interaction.

Fixed PF-31862

PingFederate now logs the policy and fragment name before fragment processing.

Fixed PF-31870

Resolved an issue where bulk import fails for identity provider (IdP) connections that fulfill Persistent Grant Extended Attributes.

Fixed PF-31957

PingFederate templates no longer allow double-submission.

Fixed PF-32001

PingFederate now recovers from initial connection failure when logging into the administrative console using external LDAP authentication.

Fixed PF-32028

You can now configure the IncludeUserInfoInResponses setting in the <install dir>/server/default/data/config-store/org.sourceid.saml20.domain.mgmt.impl.AuthnApiManagerImpl.xml file to hide user information from authentication API responses.

Fixed PF-32073

When an error occurs on policies containing fragments and configured to handle failures locally, PingFederate no longer redirects a user to the service provider (SP) error page on SP-initiated SSO.

Fixed PF-32081

We’ve resolved an issue around password requirements messaging during password management.

Fixed PF-32088

We’ve updated the description text on the import IdP/SP connection page to indicate that PingFederate only performs minimal validation for imported connections. We suggest using the administrative API for connection migration, which performs thorough validation.

Fixed PF-32090

In the case where a one-time link (OTL) for password reset expires or is reused, PingFederate now responds with the appropriate error message in the authentication API and logs the error response in the audit.log. For more information on OTL for password reset, see Configuring self-service account recovery.

Fixed PF-32234

We’ve resolved a defect that allowed scope and scope group names to be the same when saved through the administrative console. For more information on scopes, see Scopes and scope management.

Fixed PF-32254

We’ve decreased the maximum key length for saasGroupName, resolving a warning that occurred when creating SQL provisioning tables.

Fixed PF-32343

On sign-on pages, we’ve improved the accessibility of the 'Change Password' link, regardless of browser window size.

Fixed PF-32345

We’ve added a notification publisher accessor to the SDK, addressing an error where plugins utilizing a notification publisher could not invoke one of the notification publishers configured in PingFederate.

Fixed PF-32461

PingFederate now processes policy fragments independently from policies and other fragments.

Fixed PF-32574

We’ve resolved a defect where Local Identity Profile (LIP) registration via a third-party service and the authentication API would still require a password, despite previously registering with the third party.

Issue

PingFederate versions 11.1.4, 11.1.5, 11.2.1, and 11.2.2 contain version 3.0.2 of the PingID password credential validator (PCV). That version of the PCV has known issues that you should review before upgrading. For more information, see Known issues in PingID RADIUS PCV 3.0.2.

Issue

Issue

For Java versions that don’t support TLSv1.3 (meaning versions earlier than 8u261), PingFederate fails on start up with a NoSuchAlgorithmException exception. To resolve this error, remove TLSv1.3 from the following settings in the run.properties file:

Issue

PingFederate’s TLS cipher suites can be customized by modifying com.pingidentity.crypto.SunJCEManager.xml (or a similarly-named file if BCFIPS or a hardware security module (HSM) is configured). After updating the file and replicating, all cluster nodes must be restarted for the change to take effect.

Issue

Issue

AWS CloudHSM

Thales HSMs

Entrust HSMs

Issue

Issue

SLO is not supported when users are authenticated through a Composite Adapter instance that contains another instance of the Composite Adapter.

Issue

Passwords can be reset for Microsoft Active Directory user accounts without the permission to change password.

Issue

PingFederate does not support a case-sensitive naming convention for OAuth client ID values when client records are stored in a directory server. For example, after creating a client with an ID value of sampleClient, PingFederate does not allow the creation of another client with an ID value of SampleClient.

Although it’s possible to create clients using the same ID values with different casings when client records are stored in XML files, a database server, or custom storage, we recommend not doing so to avoid potential record migration issues.

Issue

Some browsers display a date-picker user interface for fields that have been designed for date-specific inputs. Some browsers do not. If one or more date-specific fields are defined on the registration page or the profile management page (or both), end users must enter the dates manually if their browsers do not display a date-picker user interface for those fields.

Issue

Issue

Issue

Issue

The RADIUS NAS-IP-Address is only included in Access-Request packets when the pf.bind.engine.address is set with an IPv4 address. IPv6 is not supported.

Info PingOne Fraud

The PingOne Fraud integration kit is no longer bundled with PingFederate.

Info

Ping Identity commits to deliver the best experience for administrators and users. As we continue to improve our products, we encourage you to migrate off of Microsoft Internet Explorer 11. Starting with PingFederate 11.0, Internet Explorer 11 is no longer included in the PingFederate qualification process for administrators or users. For a list of supported browsers, see System requirements.

Info

As of PingFederate 10.2, these features have been deprecated and will be removed in a future release.

Info

As Oracle ended its Premier Support for Oracle Directory Server Enterprise Edition (ODSEE 11g) in December 2019, we no longer include ODSEE as part of the PingFederate qualification process (starting with PingFederate 10.2). We continue to qualify against Oracle Unified Directory (www.oracle.com/middleware/technologies/unified-directory.html) and other supported directory servers. For a full list, see System requirements.

Info

Starting with PingFederate 10.2, monitoring and reporting through the Simple Network Management Protocol (SNMP) has been removed.

Info

Starting with PingFederate 10.1, roles and protocols are always enabled and no longer configurable through the administrative console and API.

Info

Starting with PingFederate 10.1, the S3_PING discovery protocol has been deprecated. Customers running on AWS infrastructure should instead use NATIVE_S3_PING.

Info

Starting with PingFederate 10.0, the Red Hat Enterprise Linux install script is no longer available. To install PingFederate 10.0 for Linux, you must download and extract the product distribution .zip file.

New PingOne

We’ve added Kerberos authentication via PingOne and the PingOne LDAP Gateway Data Store. This new capability allows PingFederate in the cloud, without a direct connection to Active Directory, to complete Kerberos authentication for browser-based SSO requests and STS transactions through PingOne.

New

We’re proud to support JWT Secured Authorization Response Mode (JARM) in version 11.1. JARM allows authorization servers to transmit authorization responses in JSON web tokens (JWTs), providing digital signature and encryption, sender authentication, and audience restriction. As JARM becomes a requirement in FAPI 2, you can deploy open banking solutions confidently.

New

We’re also introducing support for JWT Response for OAuth Token Introspection, a draft specification on track to become one of the authorization server requirements in the FAPI 2 Advanced Profile. JWT-secured introspection responses provide stronger assurance to the introspection requesters, most relevant when the requester, such as a resource server, expects to receive verified claims from the authorization server.

New

Seamless client secret rotation no longer requires real-time coordination between PingFederate administrators and the application development teams. You can now configure PingFederate to retain previous secrets for a configurable period, during which the application teams can work on updating the client secrets in their apps. This enhancement drastically lowers the costs of securing applications that use client secrets for authentication. For more information, see "Client Secret Retention Period" in the topic Managing client configuration defaults.

New

In addition to template-driven user experience, the user authorization step from Device Authorization Grant supports API now. You can also decide whether PingFederate should check the device activation code before or after authentication. These new capabilities enable you to build applications with the desired user experience for input-constrained devices, such as smart TVs or telepresence equipment.

New

You can store OAuth persistent grants in Amazon DynamoDB, which allows you to take advantage of a NoSQL database where it matters most: delivering responsive experiences to globally distributed users and offering high availability at ease.

New

You can optionally enable direct revocation for self-contained access tokens (JWT access tokens). This flexibility provides a secure way to invalidate access tokens without revoking the underlying refresh tokens or persistent grants. For more information, see Configuring JSON token management and its description of the Enable Token Revocation check box.

New

PingFederate 11.1 centralizes alerts, such as the reminder to replicate configuration, under the new bell icon in the top menu. You can review important alerts from any configuration window.

New

Previously, if you wanted to update an authentication policy or a reusable policy fragment midstream, they had to reconfigure all downstream paths, which can take some effort. With PingFederate 11.1, you can copy a subtree of policy paths before removing a step (such as an IdP adapter), adding a new step (such as a selector or another IdP adapter), and then pasting the subtree back to the policy. This new capability applies to reusable policy fragments and between authentication policies and reusable policy fragments.

New

You can use the administrative API to move an individual policy to a specific location. This enhancement makes re-organizing policies by API requests easier and safer.

New

PingFederate engine nodes now capture common configuration replication issues in their server logs and send replication status back to the console node. The Cluster Management window provides live updates when you select Replicate Configuration in the Cluster Management window. If an error occurs, you can act on it immediately and recover from potential outages faster.

New

You can now associate authentication sessions with user identities passed through the new Passthrough Identity Provider (IdP) Adapter. By placing the Passthrough IdP Adapter downstream from an IdP connection in a policy tree, you can take advantage of additional capabilities associated with defining a user key. For example, you can use the user key to query or revoke a user’s authentication sessions.

New

The Kerberos Adapter and the Kerberos Token Processor now return the ObjectSID attribute value. Because ObjectSID uniquely identifies the user in Active Directory, leveraging it helps streamline the Attribute Source & Lookup configuration.

New

You can configure the Kerberos Adapter to fail when the service provider asks for re-authentication by including ForceAuthn=true (SAML 2.0) or prompt=login (OpenID Connect) in their authentication requests. For example, suppose user interactions are required when the partners ask for re-authentication. In that case, you can add the HTML Form Adapter to the Fail policy path of the Kerberos Adapter.

New

New

You can now leverage extended properties in Velocity templates when customizing template-driven end-user interactions. You can reference extended properties in the templates instead of creating multiple If/ElseIf/Else directives, significantly reducing the initial effort. New and updated experiences can be inherited from extended property values from the OAuth client records and Browser SSO connections, eliminating most of the maintenance costs. PingFederate also passes extended property values to authentication API applications. As a result, application developers who create and maintain end-user UX for customer identities will benefit from this new enhancement.

New

We’ve also improved inline documentation in our Velocity templates. Moving forward, we will maintain variable names and their definitions consistently to communicate changes, such as introducing new variables.

New

Both Java 11 and 8 environments are supported when integrating with Thales Luna Cloud Hardware Security Module (HSM) Services or Luna Network HSMs. For more information about Thales Luna HSM Client, see the Luna Cloud HSM Service Client Guide and Luna Network HSM Documentation Archive.

New

You can now add a secondary signing certificate to your connections. If configured, PingFederate includes it in both the metadata exports and the metadata URL responses. This flexibility allows you to notify your partners about upcoming changes more easily through metadata.

New

We improved the PingFederate administrative API to manage the following configurations:

New

Fixed PF-21198

Upgraded the H2 database engine to version 2.1.210.

Fixed PF-24501

The username no longer appears in the URL during change password flows.

Fixed PF-28932

Upgraded the Guava dependency to version 30.1.1.

Fixed PF-29368

If the administrative API was used to create an OAuth client that has the Client Certificate authentication type, and the client’s Issuer DN does not have a normalized DN value, the administrative console’s Client window no longer fails to show the Issuer DN as the default value. This issue didn’t affect runtime behavior.

Fixed PF-29761

When a user record in a datastore mistakenly has a future date for the last update time, PingFederate no longer uses that date as the value of attrib_last_timestamp in the channel_variable table. Instead, PingFederate sets the value to the maximum time stamp that is not in the future.

Fixed PF-29835

The JSON response from REST API data source lookups now retains number and Boolean data types instead of converting them to strings.

Fixed PF-30075

Resolved an issue that caused the NotYetConnectedException warning message to repeatedly appear in the server.log when using AWS_PING for dynamic cluster discovery.

Fixed PF-30146

If the OAuth client’s redirection URI contains a wild card in the authority part of the URI, and the redirect_uri parameter of the token request contains userinfo in the authority part, then PingFederate will no longer consider the redirection URI a match.

Fixed PF-30255

Resolved a potential security vulnerability.

Fixed PF-30495

In a specific case, when PingFederate logs an invalid assertion error, the error message no longer fails to include a remark about why the assertion or response is invalid.

Fixed PF-30558

When an OAuth client is performing a password reset through the authentication API, if PingFederate does not find any session attributes, now PingFederate logs an error state instead of a null pointer exception.

Fixed PF-30770

Resolved an issue that prevented PingFederate from correctly determining the authentication instant for the flow when the initial OIDC authorization request specifies a max_age, the flow falls through to legacy authentication source selection (policies are disabled or no policy applies), and the user chooses an upstream OIDC IdP connection.

Fixed PF-30806 PingOne MFA

PingFederate now includes all the templates for PingOne MFA 1.6.1.

Fixed PF-31054

When saving SAML token processors or generators, PingFederate now correctly handles dependency errors caused by misconfigured settings on the Protocol Settings window’s Federation Info tab.

Fixed PF-31145

Now PingFederate preserves the order of map type configurations under <pf_install>/pingfederate/server/default/data/config-store when performing a bulk export or a GET operation at the /configStore administrative API endpoint.

Fixed PF-31280

Now if you use the PingFederate administrative console in multiple tabs on one browser, it warns you that doing so might cause inconsistent behavior which could corrupt its configuration.

Fixed PF-31304

Resolved an issue that caused PingFederate to overwrite the scope.whitelist in the \data\config-store\org.sourceid.oauth20.domain.AuthzServerManagerImpl.xml file when you save the authorization server settings.

Fixed PF-31561

Now OAuth client MODIFY, CREATE, and DELETE event log entries in the admin.log include the client ID.

Fixed PF-31575

Now PingFederate honors the value of http.maxRequestBodySize in the run.properties file, which specifies the maximum HTTP request body size of any incoming request to PingFederate’s web services and administrative API.

Issue

Issue

For Java versions that don’t support TLSv1.3 (meaning versions earlier than 8u261), PingFederate fails on start up with a NoSuchAlgorithmException exception. To resolve this error, remove TLSv1.3 from the following settings in the run.properties file:

Issue

PingFederate’s TLS cipher suites can be customized by modifying com.pingidentity.crypto.SunJCEManager.xml (or a similarly-named file if BCFIPS or a hardware security module (HSM) is configured). After updating the file and replicating, all cluster nodes must be restarted for the change to take effect.

Issue

Issue

Issue

Issue

SLO is not supported when users are authenticated through a Composite Adapter instance that contains another instance of the Composite Adapter.

Issue

Passwords can be reset for Microsoft Active Directory user accounts without the permission to change password.

Issue

PingFederate does not support a case-sensitive naming convention for OAuth client ID values when client records are stored in a directory server. For example, after creating a client with an ID value of sampleClient, PingFederate does not allow the creation of another client with an ID value of SampleClient.

Although it’s possible to create clients using the same ID values with different casings when client records are stored in XML files, a database server, or custom storage, we recommend not doing so to avoid potential record migration issues.

Issue

Some browsers display a date-picker user interface for fields that have been designed for date-specific inputs. Some browsers do not. If one or more date-specific fields are defined on the registration page or the profile management page (or both), end users must enter the dates manually if their browsers do not display a date-picker user interface for those fields.

Issue

Issue

Issue

Issue

The RADIUS NAS-IP-Address is only included in Access-Request packets when the pf.bind.engine.address is set with an IPv4 address. IPv6 is not supported.

Info

Ping Identity commits to deliver the best experience for administrators and users. As we continue to improve our products, we encourage you to migrate off of Microsoft Internet Explorer 11. Starting with PingFederate 11.0, Internet Explorer 11 is no longer included in the PingFederate qualification process for administrators or users. For a list of supported browsers, see System requirements.

Info

As of PingFederate 10.2, these features have been deprecated and will be removed in a future release.

Info

As Oracle ended its Premier Support for Oracle Directory Server Enterprise Edition (ODSEE 11g) in December 2019, we no longer include ODSEE as part of the PingFederate qualification process (starting with PingFederate 10.2). We continue to qualify against Oracle Unified Directory (www.oracle.com/middleware/technologies/unified-directory.html) and other supported directory servers. For a full list, see System requirements.

Info

Starting with PingFederate 10.2, monitoring and reporting through the Simple Network Management Protocol (SNMP) has been removed.

Info

Starting with PingFederate 10.1, roles and protocols are always enabled and no longer configurable through the administrative console and API.

Info

Starting with PingFederate 10.1, the S3_PING discovery protocol has been deprecated. Customers running on AWS infrastructure should instead use NATIVE_S3_PING.

Info

Starting with PingFederate 10.0, the Red Hat Enterprise Linux install script is no longer available. To install PingFederate 10.0 for Linux, you must download and extract the product distribution .zip file.