vendor hub
Ping Identity
Everything on ronutz.com for Ping Identity, through one door: its tools, grouped by family, and its articles, and where they exist its certification guides, a reading path, the career chapter, the industry record and the lineage. Tools compute locally in your browser; articles are grounded in vendor documentation.
Working with Ping Identity →
The career chapter: what the work with Ping Identity actually was, which accounts, which escalations, and what it certified.
The Ping Identity story in the industry section →
How Ping Identity got here: the acquisitions, the pivots, and the people whose work ended up inside the platform.
Ping Identity lineage →
What Ping Identity is made of, and who made it. Every acquisition below is verified against primary sources, with the product line it turned into where that connection is documented rather than inferred.
Certification prep
PingFederate administration, end to end →
The blueprint's assumed fundamentals first - the directory model and the Kerberos ticket machinery - then the ten product articles in teaching order, SCIM beside the provisioning stop, and the SSO flows to close. The reading spine behind the PFP-001 certification guide.
16 articles
The Ping Identity Platform →
The whole Ping estate in reading order: the PingOne platform map and the ForgeRock lineage first, so every product name resolves; then PingAccess policy, the PingDirectory data platform, and DaVinci orchestration; closing with the PingFederate shelf - the self-managed federation core - in its established teaching order. The companion walk to the Certified Professional guides on the certifications hub.
15 articles
Tools (11)
Single sign-on & federation
OIDC-decoder
Plak een OpenID Connect ID-token of een .well-known/openid-configuration-document en decodeer het: de kern-claims, profiel-claims, endpoints en mogelijkheden, met controles op vereiste claims, ondertekeningsalgoritme, nonce en PKCE.
Identiteit & tokensSAML Decoder
Paste a SAML Response or assertion (raw, base64, or URL-encoded) and decode its issuer, status, subject, conditions, audience, and attributes, with signature and weak-algorithm checks. Hardened against XXE.
Identiteit & tokens
OAuth & tokens
JWKS explainer + key matcher
Paste a JSON Web Key Set to break down every key, flag any private material, and match a JWT to its key by kid. Nothing leaves your browser.
Identiteit & tokensJWT-decoder en -verificateur
Decodeer de header en claims van een JSON Web Token, lees de vervaltijd en timing in gewone taal en verifieer een HS256/384/512-handtekening met een geplakt geheim. Draait volledig in je browser.
Identiteit & tokensOAuth-PKCE-verificateur en -challenge
Genereer een OAuth 2.0-code_verifier en leid de S256-code_challenge ervan af, of plak je eigen exemplaar en controleer het aan de lengte- en tekensetregels van RFC 7636. Dezelfde SHA-256-base64url-afleiding die je autorisatieserver verwacht. Draait volledig in je browser.
Identiteit & tokens
Risk & client signals
HTTP header-order fingerprint
Paste a request header block and see how header order and casing fingerprint the client - the passive-HTTP analog of JA3.
Security & WAFJA3 / JA3N passive TLS fingerprint
Paste a JA3 string and it recomputes the JA3 hash, computes the permutation-stable JA3N, decodes the fields, and flags GREASE values.
Security & WAFJA4 / JA3 TLS fingerprint decoder
Decode a JA4 TLS client fingerprint or a JA3 fingerprint into its fields, compute the hashed JA4 from raw values, or compute a JA3 MD5. It auto-detects which you paste. All in your browser.
Security & WAFUser-Agent entropy analyzer
Paste a User-Agent string and see the identifying tokens it exposes, the distinguishing bits each contributes, and the Client Hints migration.
Security & WAF
Articles (12)
More
How Users Prove Who They Are: PCVs and the Five Adapters
The PingFederate authentication toolkit the exam names: Password Credential Validators as the reusable password-checking layer, then the five adapters and the integration pattern each one embodies - HTML Form for interactive login, HTTP Basic for the 401 challenge, Kerberos for silent desktop SSO, OpenToken for integration-kit handoff, and Reference ID for the agentless back-channel.
Identiteit & tokensReadICMP, ping, and traceroute: the Control Messages That Explain Your Network
The Internet Control Message Protocol (ICMP) is the part of IP that reports on delivery instead of carrying data: Echo and Echo Reply are ping, Time Exceeded is traceroute, and Destination Unreachable names what failed. After reading, you can read a ping line and its summary field by field, follow a traceroute probe by probe from TTL 1 to the final Port Unreachable, tell a filtered path from a dead one, say whose address a hop line prints, and decode the Unreachable codes in IPv4 and ICMPv6.
NetwerkenReadInstalling PingFederate: Requirements, First Run, and the Setup Wizard
What a PingFederate deployment needs before the ZIP is even extracted - a supported Java runtime, the 9999/9031 port plan, a dedicated service account - then the install itself on Windows or Linux, and exactly what the initial configuration wizard asks of you on first login: license, first administrator, and the base URL partners will trust.
Identiteit & tokensReadPingFederate Authentication Policies: Trees, Selectors, and the Contract at the End
How PingFederate decides who authenticates how: policy trees whose nodes are authentication sources and selectors, Fail and Success branches flowing top-down, reusable fragments for common sequences, and the Authentication Policy Contract at the end of every successful path - the normalization layer that makes everything downstream source-independent.
Identiteit & tokensReadPingFederate Data Stores: LDAP and JDBC, Defined Once, Used Everywhere
Data stores are PingFederate's reusable connection definitions: an LDAP store with directory type, failover hosts, bind credentials, and LDAPS; a JDBC store with its connection URL, validation query, and the driver JAR that must be deployed before anything connects. Credential validators, attribute lookups, and provisioning all consume the same definitions - which is the whole point.
Identiteit & tokensReadPingFederate OGNL Expressions: Mappings, Criteria, and Why Authoring Is Its Own Role
PingFederate lets you write OGNL in attribute mappings and issuance criteria. A mapping returns a value; a criterion must return true or false, and confusing the two fails quietly in a way that looks like an authorisation problem elsewhere. Expression authoring is gated behind a separate administrative role for one reason: an expression runs code on the server, which is a different permission from configuring a connection.
Identiteit & tokensReadPingFederate Operational Hygiene: License, Notifications, and the Configuration Archive
Three habits that keep a PingFederate deployment boring in the best way: managing the license file and its expiry, wiring notification publishers so certificate and licensing events announce themselves, and treating the data.zip configuration archive - manual exports and the automatic snapshots - as the backup, migration, and undo mechanism it is.
Identiteit & tokensReadThe PingFederate Log Files: Which One Answers Which Question
The cast of <pf_install>/pingfederate/log and what each member is for: server.log for the application, admin.log and admin-api.log for who changed what, transaction.log for runtime protocol summaries, audit.log for authentication and security events - plus the log4j2.xml levels that control verbosity and the habit of matching the question to the file.
Identiteit & tokensReadThe PingFederate Startup Files: Who Controls What
A tour of the files that decide how a PingFederate server runs: the run.sh/run.bat launchers, run.properties for ports and the clustered role, jvm-memory.options for the heap, and log4j2.xml for what gets written where - plus the habit of knowing which file owns which behavior before you need it at 3 a.m.
Identiteit & tokensReadUpgrading PingFederate: The Utility, the Merge, and the Cluster Order
How PingFederate upgrades actually work: the Upgrade Utility that copies configuration from the old install into the new one, the release notes you read for every version crossed, the custom-logging merge everyone forgets, and the console-first order that keeps a cluster consistent.
Identiteit & tokensReadWho Administers PingFederate: Native Accounts, Roles, and Console Login via LDAP
The administrative access model: native accounts and the role set that divides power - User Admin, Admin, Expression Admin, Auditor, and the cryptographic role - plus how console authentication moves from native accounts to an LDAP directory through run.properties and ldap.properties, with directory groups mapped onto the same roles.
Identiteit & tokensRead