Changelog - PingFederate

Agentless Integration Kit 2.0.4 – November 2021

Fixed an issue that caused the adapter to incorrectly handle integers in JSON payloads.
Fixed an issue that caused the adapter to incorrectly handle multi-value attributes in PingFederate 10 and later.
Verified that the Reference ID IdP Adapter is compliant with US Federal Information Processing Standards (FIPS). For usage, see Integrating with Bouncy Castle FIPS provider in the PingFederate documentation.

Fixed an issue with client certificate authentication handling. See security bulletin SECADV025.

Improved the description for the Relax Pass Phrase Requirements setting.
Fixed an issue that caused the adapter to format multi-value attributes incorrectly.
Fixed an issue that could cause a validation error in the Logout Service Endpoint field when upgrading the adapter.

Fixed an issue that prevented an error from triggering when the wrong REF ID was provided.

Added the Send Request Parameters setting to control the information sent in query parameter mode.
Added validation to the Pass Phrase field to enforce strong passwords.
Added support for the JavaScript Widget for the PingFederate Authentication API.
Added support for the PingFederate authentication API.
Improved support for applications that do not maintain sessions. In the adapter configuration, the Logout Mode setting includes a None option.
Improved debug log entries to show the adapter instance ID more clearly.
Improved info log entries to show invalid reference ID errors.
Created new Java, .NET Core, PHP, and Python sample applications and example code. See the Ping Identity GitHub repository.

Added support for header names with dashes at the attribute pick up and dropoff endpoints.
Fixed an issue that could cause a PingFederate engine node to stop responding on configuration reload.
Fixed an issue that caused multi-valued attributes to be treated as a single string.
Fixed an issue that caused the drop-off endpoint to return HTML when an error occurred.

Fixed an issue that prevented the adapter from correctly linking federated users to application users.
Removed date from the adapter response.
Improved error messages.
Improved default values for some adapter configuration fields.

Improved the query parameter transport mode. It now passes query parameters to the authentication endpoint.

Included all-new sample applications in the distribution file. For the latest source code, see PingFederate Agentless Integration Kit Sample on the PingIdentity GitHub page.
Fixed a bug that caused an invalid content-type header value in some API responses.

Added the ability to direct authorization consent requests to an external application. See External consent approval.
Added support for virtual host names in the Reference ID Adapter. See the Configure virtual host names section of the PingFederate documentation.
Fixed a cross-site scripting (XSS) issue. See security bulletin SECBL013.

Improved the way Reference ID Adapter instance configurations are applied. Configuration changes now take effect without the need to restart PingFederate.

Reference ID IdP Adapter
- Added the capability to prefix attribute keys with source information.
- Added support for tracked parameters, a feature in the upcoming release of PingFederate Server 9.2.
- Added the capability to ignore untracked HTTP parameters.
- Added support for JSON object based claims inside signed JWT request object.
Reference ID IdP and SP Adapter
- Improved logging for back-channel authentication failures.
- Improved support for authentication method based on configured values.

Fixed issue with HTTP request parameters overriding signed JWT request parameter values.
Target resource validation and error resource validation are now enabled in the sample configuration archive.

Added two Transport Mode options (Query Parameter or Form Post) for Front Channel Communication for both the IdP and SP Reference ID Adapter.
Added an authentication endpoint for the SP Adapter, which enables end-user redirection for authentication.
Added Sample IdP/SP applications to the distribution. Sample applications provide a way to test an end-to-end identity provider (IdP) and service provider (SP) integration with PingFederate using the Agentless Integration Kit.
Added the Certificate DN Compare Fix in the Agentless Integration Kit.

Support for multiple client certificates in a single Reference ID Adapter instance for client-certificate authentication.
Allowed Subject DN and Allowed Issuer DN can be configured independently of each other.
Basic authentication no longer required when using client-certificate authentication.
HTTP Header ping.instanceId is optional when a single Reference ID Adapter instance is configured.
(Bug Fix) Unfound reference attribute association no longer returns Null Pointer Exception.
(Bug Fix) Account Linking with Reference ID Adapter corrected.