PingFederate
Enterprise Learning Roadmap
A progressive, hands-on roadmap from an absolute beginner to an Enterprise IAM Architect using Docker-based Proof of Concepts (POCs).
Track 0 — Foundations
- POC-000Lab Architecture & Docker Environment— Skipped
- POC-001Install PingFederate: Runtime, Admin Console & Engine Cluster Node— Stand up the PingFederate runtime, admin console, and an engine cluster node in Docker.
- POC-002PingFederate Architecture— Federation, IdP, SP, OAuth AS roles (coming soon)
- POC-003First Login— HTML Form Adapter, authentication basics (coming soon)
- POC-004Authentication Policy— Policy tree, policy flow design (coming soon)
- POC-005Authentication Policy Contract— Identity attributes and contracts (coming soon)
Track 1 — Authentication
- POC-010Local Users— Datastores & local user profiles (coming soon)
- POC-011LDAP Authentication— Integration with Active Directory/LDAP directory servers (coming soon)
- POC-012Active Directory— AD, domain-joining, integrated authentication (coming soon)
- POC-013Kerberos— Windows SSO implementation (coming soon)
- POC-014Password Policies— Custom password rules and expiration (coming soon)
- POC-015MFA— Step-up authentication routing (coming soon)
- POC-016Selectors— Authentication selectors (coming soon)
- POC-017Authentication Failures— Error page customization and error mapping (coming soon)
Track 2 — OAuth 2.0 & OIDC
- POC-020OAuth Fundamentals— Roles, endpoint types, and standard endpoints (coming soon)
- POC-021Authorization Code— Standard web flow implementation (RFC 6749) (coming soon)
- POC-022PKCE— Proof Key for Code Exchange for SPAs & mobile apps (RFC 7636) (coming soon)
- POC-023Client Credentials— Machine-to-machine integration (coming soon)
- POC-024Refresh Tokens— Understanding the token lifecycle and rotation (coming soon)
- POC-025JWT— JSON Web Tokens structure, validation, and metadata (RFC 7519) (coming soon)
- POC-026ID Token— OpenID Connect identity assertion structure (coming soon)
- POC-027Discovery— OpenID Connect Discovery Metadata endpoint (.well-known) (coming soon)
- POC-028UserInfo— Retrieving user claims from the UserInfo endpoint (coming soon)
- POC-029Dynamic Client Registration— Automating client creation (RFC 7591) (coming soon)
Track 3 — SAML
- POC-030SAML Basics— Assertions, Protocols, and XML schemas (coming soon)
- POC-031IdP Configuration— Importing and exporting SAML Metadata (coming soon)
- POC-032SP Connection— Setting up service provider federation (coming soon)
- POC-033Attribute Mapping— Attribute contract fulfillment in assertions (coming soon)
- POC-034SLO— Single Logout profiles (Front-channel vs Back-channel) (coming soon)
- POC-035Certificates— Signing, encryption, and certificate pinning (coming soon)
Track 4 — Tokens & Claims
- POC-040Access Token Managers— Configuring ATM instances (coming soon)
- POC-041Claim Mapping— Token attribute contract fulfillment (coming soon)
- POC-042Token Lifetime— Expiration strategies and token validation (coming soon)
- POC-043Custom Claims— Generating complex claims using OGNL expressions (coming soon)
- POC-044Signing Keys— Dynamic JWKS endpoints and key rotation (JWK) (coming soon)
- POC-045Token Introspection— Validating tokens at the authorization server (RFC 7662) (coming soon)
- POC-046Token Revocation— Revoking access and refresh tokens (RFC 7009) (coming soon)
Track 5 — Enterprise Design
- POC-050Multiple OAuth Clients— Scaling client management (coming soon)
- POC-051Customer vs Workforce— Configuring separated identity domains (coming soon)
- POC-052Shared Authentication— Reusing adapters across multiple connections (coming soon)
- POC-053Multiple ATMs— Shaping tokens for different downstream resource servers (coming soon)
- POC-054Authentication Branching— Complex policy decisions (group/IP-based checks) (coming soon)
- POC-055Session Management— Cookie control, absolute vs idle timeouts, SSO sessions (coming soon)
- POC-056Logout Strategies— Coordinating global logout sessions (coming soon)
Track 6 — API & M2M
- POC-060Service Accounts— Hardening Client Credentials clients (coming soon)
- POC-061Token Exchange— Exchanging tokens for internal microservices (RFC 8693) (coming soon)
- POC-062API Protection— Securing APIs using PingFederate and API Gateways (coming soon)
- POC-063OAuth Scopes— Designing dynamic authorization scopes (coming soon)
- POC-064Audience Restriction— Restricting tokens to target resource servers (coming soon)
- POC-065Delegation— On-Behalf-Of workflows for multi-tier API environments (coming soon)
Track 7 — High Availability
- POC-070Clustering— Dynamic vs Static clustering configurations (JGroups) (coming soon)
- POC-071Load Balancing— Reverse proxying and distributing client traffic (coming soon)
- POC-072Session Replication— Replicating sessions across cluster engine nodes (coming soon)
- POC-073Certificate Rotation— Graceful rollover of signing and decryption certs (coming soon)
- POC-074Backup & Restore— Exporter, archive configs, and automated recovery (coming soon)
Track 8 — Enterprise Migration
- POC-080Inventory— Discovering and cataloging legacy SAML/OAuth configurations (coming soon)
- POC-081OAuth Client Classification— Identifying migration categories (coming soon)
- POC-082SAML Connection Inventory— Cataloging partners, bindings, and certificates (coming soon)
- POC-083Dependency Analysis— Tracing policies, custom adapters, and ATMs (coming soon)
- POC-084Shared Components— Identifying candidates for reuse (coming soon)
- POC-085Customer Tenant— Designing isolated customer setups (coming soon)
- POC-086Workforce Tenant— Designing isolated workforce setups (coming soon)
- POC-087Tenant Split— Migrating configuration segments (coming soon)
- POC-088Parallel Run— Side-by-side execution strategies (coming soon)
- POC-089Fallback & Rollback— De-risking cutovers with clear rollbacks (coming soon)
Track 9 — Architect Labs
- POC-090Enterprise Reference Architecture— End-to-end IAM topology design (coming soon)
- POC-091Banking IAM Patterns— Open Banking, PSD2, and FAPI compliance (coming soon)
- POC-092Multi-Tenant Design— Scaling single instances for multiple customers (coming soon)
- POC-093Zero Trust Integration— Real-time risk scoring and continuous auth (coming soon)
- POC-094Performance & Scaling— Load testing, heap settings, and thread tuning (coming soon)
- POC-095Security Hardening— TLS cipher suites, HTTP headers, secret managers (coming soon)
- POC-096Operational Runbook— Health checks, Prometheus metrics, and log pipelines (coming soon)
- POC-097Disaster Recovery— Active-Active cross-region replication (coming soon)
- POC-098End-to-End Enterprise Implementation— Delivering a production-ready environment (coming soon)
- POC-099Architect Challenge— Designing and reviewing custom topologies (coming soon)