Federation for agent identity

Federation roles

A trust anchor is the entity whose configured public keys establish trust in a federation. Other entities form trust chains to that anchor through signed statements. PingFederate supports the following roles.

Trust chain validation

A trust chain links an entity’s signed Entity Configuration to a trust anchor through Subordinate Statements. PingFederate validates every statement in the chain.

1. Each statement has an asymmetric signature and identifies one signing key.
2. Each statement has a valid issue time and has not expired.
3. Each Entity Configuration is signed with a key it publishes.
4. Each Subordinate Statement is signed with a key established by its superior.
5. The trust anchor signature validates against configured keys.
6. Chain depth and domain names satisfy federation constraints.
7. Metadata policies are compatible and applied to the registered metadata.
8. Every critical claim and policy operator is understood.

A trust chain expires when its earliest statement expires. Chain discovery permits at most 24 fetches. By default, outbound requests require HTTPS and public IP addresses.

Trust anchor key configuration

OIDF_FEDERATION_TRUST_ANCHOR_JWKS={
  "https://federation.example.org": {"keys": [ ... ]},
  "https://partners.example.net":   {"keys": [ ... ]}
}
OIDF_FEDERATION_SELF_ANCHOR=https://pf.example.com

Metadata policy and constraints

An agent declares its requested scopes and authentication method. A metadata policy sets rules for those declarations. Federation constraints limit subordinate entities, including chain depth and permitted domains. PingFederate registers the resulting metadata.

"metadata_policy": {
  "oauth_client": {
    "scope": {
      "subset_of":   ["read", "write", "audit"],
      "superset_of": ["audit"]
    }
  }
}

Trust Marks

PingFederate accepts a Trust Mark when the trust anchor authorises its issuer, the issuer’s chain reaches that anchor and the signature is valid. Optional status checks confirm that the mark remains active. Invalid marks are ignored. Registration can require specified marks, and operators can grant marks for PingFederate to issue.

Automatic registration

Explicit registration

A relying party can register in advance by posting its Entity Statement or trust chain to /federation/register. PingFederate validates it and returns a signed response containing the registered metadata, keys and expiry.

Registration expiry and revocation

By default, registration expires after one day or when the trust chain expires, whichever comes first. An agent’s next request can renew its registration if validation succeeds. A background process disables expired clients without deleting them.

Policy decisions

{
  "subject":  {"type": "federation_entity",
               "id": "https://agents.example.com/a1"},
  "action":   {"name": "federation.register.automatic"},
  "resource": {"type": "openid_provider",
               "id": "https://pf.example.com"},
  "context":  {"scope": "read write", ...}
}

Endpoint client authentication

Federation endpoints allow unauthenticated access by default. Selected endpoints can require private_key_jwt client authentication. PingFederate validates the caller’s trust chain before accepting its signing key.

Audit records

Logs record registration decisions, renewals and expiry. They also record policy decisions and operator changes. Security events go to PingFederate’s audit log. Token-like values are replaced with fingerprints.

event=federation.registration.refused outcome=failure reason=policy_denied subject=https://agents.example.com/a1 ...

Test evidence

Limits

Validation uses other entities’ current published keys. Federation endpoints support private_key_jwt client authentication only. Policy settings apply across the deployment. Locally hosted conformance results do not constitute OpenID Foundation certification.