PingFederate 10.3 - June 2021 - PingFederate - 10.3

Enhancements

Customer IAM

Mandatory email ownership verification

Administrators now have the option to make email ownership verification a requirement in their customer IAM configurations. If configured, PingFederate prompts the newly registered users to verify the email address they provided, and until the users complete the verification process, they won’t be able to SSO to their target applications. This optional capability can improve the data quality of customer identities as well as unify the end-user experience in the area of email ownership verification process.

Session Management API

Query and revoke by user identifiers

PingFederate 10.3 allows OAuth applications to query PingFederate authentication sessions based on user identifiers. When multiple session identifiers exist—a user has signed on using multiple browsers, for example—PingFederate groups session information by session identifiers. Equipped with this information, applications can better understand the behavior of their users.

Version 10.3 also allows OAuth applications to revoke all sessions associated with a given user. This bulk revocation capability provides an easy way to close server-side authentication sessions on a per-user basis, perhaps because of changes in employment conditions or security concerns as a result of compromised credentials. This new capability can improve access security because once revoked and without valid credentials, such end-users will not be able to fulfill authentication requirements and access protected resources.

Delete individual session data

When responding to a query, the Session Management API groups session information per authentication source; each session data block comes with its unique identifier. Version 10.3 allows OAuth applications to remove individual session data based on those unique identifiers. This enhancement allows applications to clean up after themselves without affecting applications.

OpenID Connect

Virtual issuers

Administrators can now define multiple virtual issuers for OpenID Connect. If configured, when minting ID tokens, PingFederate populates the issuer (iss) claim based on the Virtual Issuers configuration as well as the initial authorization requests. If the relying parties use the private key JWT authentication scheme, the same configurations apply when validating the audience (aud) claim from the inbound JWTs.

ID token signing keys

PingFederate 10.3 allows administrators to create multiple ID token signing key sets, each associated with one or more virtual issuers. When minting an ID token, PingFederate signs the ID token with a key from the applicable key set based on the Token Signing Keys configuration, the Virtual Issuers configuration, and the destination of the initial authorization request.

For customers who participate in Open Banking or need to maintain multiple brands, the Virtual Issuers and Token Signing Keys configurations eliminate the need for separate environments, thus significantly lowering the total cost of ownership.

Bundled integration kits

We have added more integration kits to our product distribution for the following scenarios:

• Identity risk scoring (PingOne Protect)
• Multi-factor authentication (PingOne MFA)

For more information, see Integration Directory.

Security Enhancements

Bouncy Castle FIPS Provider

PingFederate 10.3 now includes the Bouncy Castle FIPS (BCFIPS) Provider as part of the installation. As needed, customers can operate PingFederate using only FIPS-approved algorithms that satisfy cryptographic-related FedRAMP data processing controls.

PKCE relying party support

Both the IdP connections using the OpenID Connect protocol and the SSO-via-OpenID Connect authentication scheme for the administrative console now support the Proof Key for Code Exchange (PKCE) open standard (RFC7636). This enhancement helps mitigate the authorization code interception attack.

Other improvements

• The character set used by the Email One-Time Password option, part of the self-service password reset (SSPR) configuration, is now customizable.
• Email templates are now configurable per HTML Form Adapter instance.
• Password management and username recovery HTML templates now come with additional variables, such as $adapterId and $client_id, for maximum flexibility in customization and branding.
• In the context of OIDC authentication for the administrative console, the domain portion of the redirect URL that PingFederate sends to an OpenID Provider is now customizable through a new setting (pf.admin.baseurl) in the run.properties file, most suitable for environments where the network device—a reverse proxy server or a load balancer—fronting the console uses a different hostname, port number, or both.
• The PingFederate SDK now supports custom storage for persistent authentication sessions. Look for the SessionStorageManager interface in our SDK documentation for more information.

We also updated the following bundled components and third-party dependencies:

• Apache Commons BeanUtils 1.9.4
• Apache JSP 8.5.54
• Apache Taglibs 1.2.5
• Jackson-Databind 2.11.4
• Jetty 9.4.40.v20210413
• jose4j 0.7.8
• UnboundID LDAP SDK 5.1.3

Resolved issues