Specific schema objects are required in order for PingFederate to store authentication sessions on your directory server. LDIF scripts are provided for PingDirectory .

  1. Update the LDAP schema.
    1. Sign on to the PingDirectory administrative console.
    2. Go to the LDAP Schema > Schema Utilities screen.
    3. Click Import Schema Element.
    4. Copy the schema changes from the authentication-session-attributes-ldap-pingdirectory.ldif file and paste them into the text area.
      The file is located in the <pf_install>/pingfederate/server/default/conf/authentication-session/ldif-scripts directory.

      Replace placeholder values with relevant information from your directory server.

    5. Click Import.
  2. Create the following indexes.
    Attribute name Index type
    pf-authn-session-group-hashed-session-id equality
    pf-authn-session-group-user-ids equality
    pf-authn-session-group-expiry-time ordering
    pf-authn-session-group-last-activity-time ordering

    Use PingDirectory's dsconfig utility to create these indexes. The dsconfig utility is interactive. You can also provide inputs as command arguments. For example, the following samples create the pf-authn-session-group-hashed-session-id and pf-authn-session-group-expiry-time indexes:

    $ bin/dsconfig create-local-db-index \
      --backend-name userRoot \
      --index-name pf-authn-session-group-hashed-session-id \
      --set index-type:equality
    $ bin/dsconfig create-local-db-index \
      --backend-name userRoot \
      --index-name pf-authn-session-group-expiry-time \
      --set index-type:ordering

    After adding the indexes, use the rebuild-index utility to build the indexes. For instance, the following sample builds the required indexes.

    $ bin/rebuild-index \
      --baseDN "dc=example,dc=com" \
      --index pf-authn-session-group-hashed-session-id \
      --index pf-authn-session-group-user-ids \
      --index pf-authn-session-group-expiry-time \
      --index pf-authn-session-group-last-activity-time

    For more information, see Working with Indexes in the PingDirectory Administration Guide .

  3. If you have not already done so, create an LDAP datastore for your directory server on the System > Data Stores screen.
  4. Copy the system ID of the applicable LDAP datastore from the System > Data Stores screen.
  5. Edit the org.sourceid.saml20.service.session.data.impl.SessionStorageManagerLdapImpl.xml file, located in the <pf_install>/pingfederate/server/default/data/config-store directory.
    Note:

    For a clustered environment, edit this file on the administrative console node first, and then replicate to other engine nodes using System > Server > Cluster Management as explained in later steps.

    1. Replace the <c:item name="PingFederateDSJNDIName"/> element value with the system ID of your datastore connection.

      For example, if the system ID is LDAP-123456789ABCDEF123456789ABCDEF123456A0AC, update the configuration file as follows:

      ...
      <!-- Data store id -->
      <c:item name="PingFederateDSJNDIName">LDAP-123456789ABCDEF123456789ABCDEF123456A0AC</c:item>
      ...
    2. Enter a value for the <c:item name="SearchBase"/> element.
      Tip:

      This is the distinguished name (DN) that points to the client location. For more information, see the inline comment and the LDIF scripts in the <pf_install>/pingfederate/server/default/conf/authentication-session/ldif-scripts directory.

    3. Update the attribute names only if you have changed attribute names in the LDIF scripts located in the <pf_install>/pingfederate/server/default/conf/authentication-session/ldif-scripts directory.
    4. Save the file.
  6. Edit the <pf_install>/pingfederate/server/default/conf/META-INF/hivemodule.xml file.
    1. Locate the SessionStorageManager service point:
      <!-- Service for storing Authentication Sessions. -->
      <service-point id="SessionStorageManager" interface="org.sourceid.saml20.service.session.data.SessionStorageManager">
          <invoke-factory>
              <!--
              Supported classes are
              org.sourceid.saml20.service.session.data.impl.SessionStorageManagerJdbcImpl : Use this service-point for a Jdbc implementation.
              org.sourceid.saml20.service.session.data.impl.SessionStorageManagerLdapImpl : Use this service-point for a LDAP implementation.
              -->
              <construct class="org.sourceid.saml20.service.session.data.impl.SessionStorageManagerJdbcImpl"/>
          </invoke-factory>
      </service-point>
      
    2. Set the value of the class attribute to org.sourceid.saml20.service.session.data.impl.SessionStorageManagerLdapImpl.
    3. Save the file.
    Note:

    For a clustered environment, you must edit the hivemodule.xml file on each node manually as cluster replication cannot replicate this change to other nodes.

  7. Start or restart the PingFederate service.
    Note:

    For a clustered PingFederate environment, replicate this new configuration to other engine nodes on the System > Cluster Management screen; then start or restart the PingFederate service on each engine node to activate the change.

When storing persistent authentication sessions on a PingDirectory server, you must also configure a cleanup plugin in PingDirectory to remove expired authentication sessions from your directory server. For more information, see Managing authentication sessions stored in PingDirectory.