Applications consuming signed JWTs need the JSON Web Key Set (JWKS) endpoint to retrieve the public keys used for validating JWT signatures. PingAccess exposes this at /pa/authtoken/JWKS .

Exact Extract:

“When using JWT identity mapping, applications can obtain the signing keys from the /pa/authtoken/JWKS endpoint to validate the JWT signature.”

Option A is correct — /pa/authtoken/JWKS provides the key set for signature validation.

Option B is incorrect — that’s an administrative API for configuring identity mappings, not a runtime validation endpoint.

Option C is incorrect — /pa/aidc/cb is the OIDC callback endpoint.

Option D is incorrect — /pa-admin-api/v3/authTokenManagement is for admin token management, not JWT validation.

When a backend application requires its own authentication (e.g., Basic Auth or mutual TLS), PingAccess uses a Site Authenticator to inject the necessary credentials.

Exact Extract:

“Site Authenticators provide the credentials PingAccess uses when authenticating to target applications that require their own authentication mechanisms.”

Option A (Token Provider) is incorrect — this is used for OIDC/OAuth tokens, not site-level authentication.

Option B (Web Session) manages end-user sessions, not backend site authentication.

Option C (Site Authenticator) is correct — it handles authentication between PingAccess and the backend.

Option D (Access Control Rule) enforces authorization, not backend authentication.

When applications require additional attributes:

The Web Session must be configured to retrieve those attributes from the token provider (OIDC or PingFederate).

The Identity Mapping must be updated to forward those attributes to the application (e.g., as headers).

Exact Extract:

“Web sessions define how user attributes are retrieved from the token provider. Identity mappings determine how those attributes are inserted into requests to applications.”

Option A is not necessarily required; attributes can be retrieved via userinfo endpoint or access token, not only ID tokens.

Option B is correct — Identity Mappings must be updated to pass attributes to the app.

Option C is incorrect — Site Authenticators define how PingAccess authenticates to apps, not attribute handling.

Option D is incorrect unless the architecture specifically requires access token updates; PingAccess often uses the Web Session to fetch attributes.

Option E is correct — Web Session must be updated to retrieve additional attributes.

When applications depend solely on header-based identity mapping , attackers can attempt to bypass PingAccess by injecting headers directly into requests sent to the backend. To prevent spoofing, PingAccess should be configured to pass cryptographically verifiable tokens (e.g., ID tokens from OIDC ) instead of relying on plain headers.

Exact Extract:

“Headers can be spoofed if not protected. Use signed tokens, such as ID tokens or JWTs, to provide strong identity assurance and prevent header injection attacks.”

Option A (Use ID Tokens) is correct — ID tokens are signed and verifiable, preventing spoofing.

Option B (Add Site Authenticator) protects PingAccess-to-site authentication, not client-to-API spoofing.

Option C (Require HTTPS) prevents eavesdropping but does not stop header spoofing from inside the network.

Option D (Use Target Host Header) ensures host header integrity but not user identity.

For multiple subdomains to share the same PingAccess session, the Cookie Domain must be configured so that the session cookie is valid across all listed applications.

Exact Extract:

“Set the Cookie Domain in the web session configuration to a parent domain (for example, .company.com) to enable applications in different subdomains to share the same session.”

Option A (Set Audience option) applies to OAuth token validation, not cookie sharing.

Option B (Set Cookie Domain option) is correct — e.g., setting .company.com allows session cookies to be shared.

Option C (Rewrite Cookie Domain rule) modifies upstream cookies for back-end applications, not PingAccess session cookies.

Option D (Rewrite Cookie Path rule) is unrelated; it modifies paths for cookies, not domains.