How to configure custom password validator in PingFederate?

Requirement 

Use an existing oracle table (password is plain text) in PingFederate to validate user credential for authorization code flow.

Analysis

By default PingFederate supports the following password validators

1. LDAP Username Password Credentials Validator
2. PingOne Directory Password Credential Validaot
3. RADIUS Username Password Credential Validator
4. Simple Username Password Credential Validator

 

SQL password validator is not in the list. So how to use an existing oracle table to validate the user credentials.

Solution

Need to create SQL custom password validator (jar). You may also contact PingFederate support team for this.  

Download 

How to Configure Custom Password Validator?

1. Stop PingFederate instance
2. Copy the jar file (pf.plugins.password-credential-validator-sql-v2.jar) to the following folder on PingFederate server

                 <PingFederateInstall>/pingfederate/server/default/deploy/

      

    3. Restart PingFederate server

    4. Login to PingFederate admin console and select “Server Configuration >> Password Credential Validator”

    5. Select “Create New Instance”

    6. Now you would see an additional validator in the dropdown control. Select “SQL Password Credential Validator v2” for type and update necessary details then click “Next”.

   7. In “Instance Configuration”, update the following fields

• Select desired data source from list for “JDBC DATASOURCE”. If hashing is not for password then select “None” for “HASH ALGORITHM”. 

• Select “SQL Query” option box for “DATABASE QUERY TYPE”.

• Provided necessary query to fetch username and password from user table in “DATABASE QUERY”

• Ex: Select passwd, username from usermstr where userno=?

• Even if hashing is not used for password, update “SALT COLUMN NAME” and “PASSWORD HASH COLUMN NAME” with column selected from previous query. (These two column can’t be left empty. It must be valid table column)

Now you may use this sql password validator in "HtmlLoginAdapter"