ronutz
← All study guides

CP-PingIDM

Certified Professional - PingIDM

Part of Certified Professional - PingIDM

Credential valid for 3 years. Validates install, configure, administer, troubleshoot, and maintain for PingIDM (formerly ForgeRock Identity Management). Official recommended training: PingIDM Deep Dive.

Independent study aid built from the public exam blueprint. Not affiliated with, authorized by, or endorsed by ping. Objectives are transcribed and mapped by hand, so this page may contain mistakes or may have fallen behind the vendor's current material: exam objectives, versions, numbering and availability all change without notice. Treat ping's own certification portal as the source of truth and verify against it before you book anything.

Section 1: Modeling Objects and Identities

  • 1.01 Modeling an identity profile

    What to know:
    • managed.json defines the managed object schema
    • Properties: type, required, searchable, encrypted, virtual
    • Policies validate values on create/update
    • Relationships declared as properties (ref types)
    On this site: The JSON Grammar: Six Types and a Few Strict Rules

  • 1.02 Querying IDM objects

    What to know:
    • Query by filter (_queryFilter), by id, or by named query
    • Filter operators: eq, co, sw, gt, and boolean composition
    • Fields, page-size, and sort parameters
    • Query endpoints over REST return uniform result envelopes
    On this site: LDAP search filters: reading the parentheses, HTTP Methods: The Verbs of the Web
    Tools: ldap-filter-explainer, curl-command-builder, http-request-translator

  • 1.03 Managing relationships

    What to know:
    • Relationships link managed objects (user-role, user-manager)
    • Bidirectional references kept consistent by IDM
    • Relationship properties carry grant metadata (e.g. temporal)
    • Reverse queries traverse the graph

  • 1.04 Managing organizations

    What to know:
    • Organizations model hierarchical business units
    • Owners, admins, and members as relationships
    • Delegated scope follows the org tree
    • Org membership can drive provisioning

  • 1.05 Delegating administration

    What to know:
    • Delegated admin via access-control rules (access.js)
    • Scope by relationship, org, or attribute condition
    • Privilege sets limit which properties/actions are allowed
    • Least privilege for helpdesk vs full admin

Section 2: Managing Connectors

Section 3: Managing Synchronization and Reconciliation

  • 3.01 Performing basic synchronization

    What to know:
    • Reconciliation compares source and target, applies situations/actions
    • Situations: ABSENT, MISSING, FOUND, UNQUALIFIED, etc.
    • Mappings define source-to-target attribute flow
    • Full recon vs targeted by id
    On this site: LDAP Fundamentals: The Directory Model Behind Identity Systems

  • 3.02 Running selective synchronization and LiveSync

    What to know:
    • LiveSync polls the connector changelog for deltas
    • Selective sync via query filters on the mapping
    • Lower latency than scheduled full recon
    • When to prefer LiveSync vs reconciliation
    On this site: LDAP search filters: reading the parentheses
    Tools: ldap-filter-explainer

  • 3.03 Configuring role-based provisioning

    What to know:
    • Roles carry assignments that grant entitlements
    • Conditional (query-based) vs manual role membership
    • Assignment attributes flow to target on provisioning
    • Deprovisioning on role removal

Section 4: Getting Started With Workflow

  • 4.01 Deploying and starting a workflow

    What to know:
    • BPMN workflows deployed to the embedded engine
    • Start via REST, UI, or event trigger
    • Task queues and candidate assignment
    • Process variables carry request context

  • 4.02 Deploying and creating a workflow

    What to know:
    • Author BPMN with user tasks, script tasks, gateways
    • Package and deploy the process definition
    • Forms bind to user tasks for input
    • Versioning of process definitions

Section 5: OAuth and OIDC Configuration

  • 5.01 Installing IDM

    What to know:
    • Unpack, configure repo (JDBC/DS), start via startup script
    • boot.properties and resolver config
    • First-run admin bootstrap
    • Ports and TLS keystore setup

  • 5.02 Deploying IDM in a cluster

    What to know:
    • Shared repository backs the cluster state
    • Cluster node identity and instance config
    • Scheduler coordination so jobs run once
    • Load balancer in front of the nodes

  • 5.03 Managing IDM in a cluster

    What to know:
    • Node health and cluster membership monitoring
    • Config propagation across nodes
    • Rolling restarts without downtime
    • Scheduler failover behavior

  • 5.04 Monitoring and troubleshooting

    What to know:
    • Health endpoints and metrics (Prometheus-style)
    • Audit and recon logs for troubleshooting
    • Common failure points: connector creds, mapping errors
    • Log levels per logger for diagnosis

  • 5.05 Implementing explicit mapping

    What to know:
    • Explicit attribute mapping vs default/implicit
    • Transform scripts on individual attributes
    • Conditional mapping and default values
    • onCreate/onUpdate hooks in the mapping

  • 5.06 Upgrading IDM

    What to know:
    • Upgrade tooling migrates config and repo schema
    • Back up conf/ and the repository first
    • Custom scripts and mappings review post-upgrade
    • Version-order the steps in a cluster

Public sources, used in good faith

These guides are independent study aids built from publicly available material: published exam blueprints, official product documentation, and vendor training catalogues. Product names, exam codes, and trademarks belong to their owners and are used only to identify the subject being taught. This site is not affiliated with or endorsed by any vendor named here. If you hold rights in material published on this page and believe it should be removed or corrected, please send the exact URL and a short note on the issue through the contact page; requests are reviewed promptly and in good faith. Read the full disclaimer →