OpenToken
termsecurityweb dev
Ping Identity's encrypted token format for integration kits: the authenticated identity travels between PingFederate and an application as an OpenToken carried by cookie, query parameter, or POST.
The OpenToken adapter runs both directions - handing a user to an agent-equipped application after SSO, or accepting one the application already authenticated.
OpenToken is Ping Identity's encrypted token format used by its integration kits, carrying attributes from the identity provider to an application in a compact encrypted blob rather than in a signed XML assertion.
Its role is worth understanding as a pattern rather than a product. Integration kits exist because applications that cannot speak SAML or OIDC natively still need federated identity, so an agent handles the protocol and hands the result to the application in a simpler form. The security boundary therefore moves to the shared key between the agent and the application, which is where deployments go wrong: a default or widely-copied key means anyone who knows it can mint an assertion of identity.
Also known as: OpenToken adapter