Ping Identity PT-AM-CPE Exam Questions

In PingAM 8.0.2, the term Affinity Mode (or session affinity) is strictly related to Load Balancing (Option B). It describes a configuration where a load balancer ensures that all requests belonging to a specific user session are consistently routed to the same PingAM server instance in a cluster.

According to the 'Load Balancing' and 'Deployment Planning' documentation:

Affinity is critical for performance in stateful deployments. While PingAM can operate in a 'stateless' manner by retrieving sessions from the Core Token Service (CTS) on every request, this creates unnecessary overhead. Affinity Mode allows the AM server to satisfy requests using its local 'In-memory' session cache.

There are two primary levels of affinity discussed in PingAM documentation:

Client-to-AM Affinity: Usually handled by the load balancer using a cookie (like the AMLB cookie) to keep the user on the same AM node.

AM-to-DS Affinity: Used when AM connects to the CTS (PingDS). This ensures that an AM server always talks to the same directory server node to avoid 'replication lag' where a session might be written to one DS node but not yet visible on another.

Without affinity, the system remains functional due to the CTS, but performance decreases as every request requires a cross-network database lookup. Therefore, affinity is a core concept of the Load Balancing and high-availability architecture.

While OpenID Connect (OIDC) is built on top of OAuth2, it introduces specific endpoints for handling ID Tokens (the identity layer). In PingAM 8.0.2, when a client receives an ID Token, it is recommended to validate it locally using the provider's public keys. However, PingAM also provides a convenience endpoint for validation.

According to the 'OpenID Connect 1.0 Endpoints' documentation:

/oauth2/idtokeninfo (Option A): This is the dedicated endpoint designed to receive an ID Token as a parameter.8 It validates the token's signature, checks the expiration and audience, and returns the claims contained within the token in a JSON format. This is specifically used for unencrypted ID tokens.

/oauth2/userinfo (Option B): This endpoint returns claims about the authenticated user but requires a valid Access Token in the authorization header, not an ID Token.9

/oauth2/introspect (Option C): This is a standard OAuth2 endpoint (RFC 7662) used to check the metadata and 'activeness' of Access Tokens or Refresh Tokens, not the internal identity claims of an OIDC ID Token.10

/oauth2/tokeninfo (Option D): This is a legacy/non-standard endpoint that was used in older versions for Access Token validation and is not the primary OIDC validation endpoint in version 8.0.2.11

Therefore, for the specific task of validating an ID Token and retrieving its claims, /oauth2/idtokeninfo is the correct and authoritative endpoint in the PingAM 8.0.2 OIDC implementation.

The scenario described---where a client (Relying Party) already knows who the user is and needs them to authorize an action on a different device---is the primary use case for the Backchannel Request Grant, also known as Client-Initiated Backchannel Authentication (CIBA).

According to the PingAM 8.0.2 documentation on 'OpenID Connect Grant Flows' and 'CIBA':

Unlike traditional OIDC flows (Implicit, Authorization Code, Hybrid) that require a browser redirect (front-channel) to the OpenID Provider, CIBA is a back-channel flow. It is designed for 'decoupled' authentication.

The Trigger: The RP sends a request directly to PingAM's backchannel authentication endpoint, providing a user identifier (like a username or email).

The Consent: PingAM then reaches out to the user's Authentication Device (usually a smartphone with the ForgeRock Authenticator app) via a Push notification.

The Approval: The user approves the request on their phone.

The Tokens: The RP, which has been polling PingAM or waiting for a callback, receives the ID Token and Access Token.

Common real-world examples include a bank teller initiating a login on their terminal which the customer approves on their mobile banking app, or a call center agent verifying a caller's identity via a push notification. Option D is the only flow that supports this decoupled, separate-device architecture. Options A, B, and C are all 'Front-channel' flows that require the user's interaction to happen in the same browser session that initiated the request.

In a high-availability PingAM 8.0.2 cluster, the Load Balancer (LB) is responsible for distributing traffic across multiple AM instances. Session Stickiness (also known as session affinity) ensures that all requests from a specific user session are routed to the same AM server that initially created the session.

According to the PingAM 'Deployment Planning' and 'Load Balancing' documentation, PingAM is designed to be 'sticky-preferred' but not 'sticky-required' if the Core Token Service (CTS) is used. If stickiness is not ensured:

Performance Impact: Every time a user request lands on a different AM server (Server B) than the one that holds the session in local memory (Server A), Server B must query the CTS (External Store) to retrieve the session details, deserialize the object, and reconstruct the session state. This cross-server look-up introduces significant latency and increases the load on the PingDS instances hosting the CTS.

CTS Load: Without stickiness, every single request becomes a 'Global' session lookup. This drastically increases the I/O and CPU overhead on the back-end directory servers, potentially leading to performance degradation of the entire identity platform.

Why other options are incorrect:

Option A: Session failover requires the CTS, but stickiness actually minimizes the need for failover logic during normal operation. Failover still works without stickiness, it just becomes the 'default' behavior for every request.

Option B: AM servers in a cluster share the same encryption keys and back-end stores. Any server can technically validate a session by looking it up in the CTS; the browser doesn't 'know' which server is correct.

Option C: Redirects are handled at the application logic level. While some internal processing changes, it doesn't necessarily result in extra browser-level HTTP redirects.

Thus, the primary negative impact of lacking stickiness in a correctly configured cluster is a decrease in performance (Option D) due to the constant session synchronization overhead.

============

The authentication lifecycle in a Ping Identity environment follows a strict sequence to ensure that only authorized users can access protected resources. This process is governed by the interaction between a Policy Enforcement Point (PEP), such as a Web Agent or PingGateway, and the Policy Decision Point (PDP), which is PingAM.

Following the chronological flow according to the PingAM 8.0.2 'Introduction to Authentication' and 'Web Agent User Guide':

Step 2: The process begins when an unauthenticated user attempts to access a protected URL.

Step 5: The Agent/PingGateway intercepts the request, detects the absence of a valid session cookie, and redirects the user to the PingAM login URL (the UI).

Step 1: The user interacts with the AM UI, providing the necessary credentials or answering the 'callbacks' (username, password, MFA) defined in the authentication tree.

Step 6: Upon successful authentication, PingAM issues a session token and redirects the user back to the original resource they were trying to access.

Step 4: The Agent/PingGateway receives the request again, but this time it contains a session token. The agent then validates the session with PingAM to ensure it is still active and possesses the correct permissions.

Step 3: Finally, the lifecycle ends when the session expires due to inactivity (Idle Timeout), reaches its Max Session Time, or the user explicitly logs out.

Sequence 2-5-1-6-4-3 (Option B) accurately captures this 'Round-Trip' nature of modern web authentication. Options A and D are incorrect because they place the callback interaction before the initial redirect or the resource access. Option C is incorrect because it suggests the session reaches a timeout before the agent has a chance to validate the session for the current request.

============