PingFederate Certification

Ping Identity Certified Advanced System Administrator

The Ping Identity Certified Advanced System Administrator - PingFederate certification measures the candidate’s ability to perform advanced PingFederate configuration, troubleshooting, and more advanced instances of basic configuration operations covered in the Professional-level exam.

This exam covers the following knowledge about PingFederate version 11 or later:

Exam Delivery

This exam is delivered as a proctored performance-based exam using a live environment, in which the candidate needs to perform system configuration and administration tasks. This exam consists of 4 main tasks with a number of subtasks in each main task. Once a candidate has moved on from a main task, they will not be able to return to a completed task. There is a time limit of approximately 210 minutes (3.5 hours)

The exam environment is a CentOS 7 Linux-based desktop environment. All tools and information needed to complete the tasks are provided within the exam environment. Some tools that are available in the environment include:

VSCode Text Editor
Postman
ApacheDirectoryStudio
DBeaver
PingFederate Product Documentation

Instructions for the tasks are open upon accessing the exam environment. There is also a shortcut on the Desktop to reopen the instructions if needed.

For more information about how exams are delivered, please refer to our testing guide.

Advanced Configuration

Configure attribute mappings from an external data store with failover
Configure attribute mappings from an external data store with failsafe mappings
Configure attribute mappings from an external data store using OGNL
Create custom attributes using OGNL
Customize the HTML Form Adapter
Self-service password reset
Self-service account recovery
Self-service username recovery
Advanced use of authentication policies
Local identity profiles
SP Target URL Mapping
Configure Redirect Validation
Using RelayState to request a specific resource
Configure certificate revocation checking
Configure certificate rotation for self-signed certificates

SSO IdP/SP Configuration

Create custom URLs using SSO endpoint variables
Configure IdP-to-SP bridging
Configure session cookies

OAuth/OIDC Configuration

Configure dynamic client registration
Configure an external DB for persistent grants

Clustering

Configure an adaptive cluster
Configure dedicated state servers in a directed cluster
Configure sub-clusters in a directed cluster
Configure cluster runtime state-management services

Troubleshooting

Interpret the contents of individual log files
Change logging levels
Configure log file rotation using log4j2.xml
Configure custom log listeners using log4j2.xml
Configure database logging

Basic Configuration

Configure an HTML Form Adapter
Customize the HTML Form Adapter
Configure an HTTP Basic Adapter
Configure a Kerberos Adapter
Configure an OpenToken Adapter
Configure a One-Time Passcode Adapter
Configure a RefID Adapter
Configure an X509 Adapter
Configure a Composite Adapter
Configure attribute mappings from an external data store
Create custom attributes using OGNL
Configure an SP/IdP SAML connection using the POST binding
Configure an SP/IdP connection using OIDC
Configure an SP/IdP connection utilizing multiple ACS endpoints
Create custom URLs using SSO endpoint variables
Create OAuth clients
Configure persistent grant settings
Configure common scopes
Configure exclusive scopes
Configure internally referenced access tokens
Configure JWT access tokens
Configure attribute mapping for ROPC grant type
Configure attribute mapping for all other grant types
Configure refresh tokens
Configure OIDC policies
Configure OIDC attribute scopes
Configure an external LDAP database
Manage certificates
Manage CAs