Agentic identity for PingFederate
Identity and access controls for AI agents and workloads.
Control access
for every agent.
Register agents through OpenID Federation. Authenticate each running instance with a credential bound to its key. Optional plugins apply access policy and supply device state during token issuance. The device-state mapping remains unverified.
Access controls and requirements
Capabilities, configuration requirements and implementation status.
Servlets inside PingFederate
Merged into pf-runtime.war by the image build, bundled in oidf.war, or deployed as gm-api.war.
PingFederate SDK plugins
The RAR and registry plugins support issuance controls and require separate installation. The CIBA simulator is for conformance testing. The registry descriptor remains unverified.
Decision path
Follow each access check and its failure response. The final tab covers grant evaluation and revocation after issuance.
Implementation limits
Known limits for deployment planning.
Servlets & web applications
Web components for federation, attestation and grant management. Component pages specify installation requirements and endpoint behaviour.
SDK plugins
Plugins for issuance policy and registry access, plus a CIBA test simulator. The registry descriptor and access token mapping remain unverified (item 9 in docs/unverified.md).
Libraries & services
Shared libraries have no PingFederate dependency. Services provide device enrolment and token validation. Command-line tools support verification.
Libraries
Services
Packaging & configuration
PingFederate endpoint filters
Registered in web.xml by the image build, which checks that auto-registration runs before attestation authentication on /as/token.oauth2.
Artefacts
Build outputs and distribution channels.
Security-relevant defaults
Configuration defaults and their security effects.
Build & release
Simulation
Explore access decisions for workload and device agents. These local simulations include optional controls and unverified mappings. They make no server calls.
PingFederate setup
Standards & assurance
Critical-method coverage gates
Standards implemented
Scope and known deviations, per standard.
Specifications written in this repository
Repository drafts and proposals. These are not adopted standards.
Unverified assumptions
Platform and design assumptions recorded in docs/unverified.md. Resolved items are labelled.
Deliberate divergences
Where the claim dictionary departs on purpose from a draft or profile, plus one value the specifications leave open.
Documentation
Repository documents grouped by purpose.