participants/adr-cba/pingfederate/README.md

adr-cba-pf: CBA PingFederate (CBA OIDC OP)

PingFederate 13.1.3 as the CBA OpenID Provider:

• iOS app tokens. Client cba-ios-app (public, auth code + PKCE, redirect cbaapp://oauth-callback). Access tokens are RS256 JWTs with sub = CBA customer id (cba-cust-00x) and iss = public_base_url (= CBA_ISSUER). JWKS: {CBA_ISSUER}/ext/cba/jwks (= CBA_JWKS_URL; the key is also in /pf/JWKS).
• MATTR VII authentication provider. Client mattr-vii (client_secret_post, redirect = the MATTR tenant callback, approval page bypassed).
• Login. Demo customer picker (mobile + name) plus the fixed OTP 000789. HTML Form adapter with the template templates/cba.login.template.html and a Simple PCV whose usernames are the cbaSubs.

It is not the Data Recipient. DCR, PAR and DH token custody live in ../cdr-kit (see docs/adr-notes.md).

Build model

terraform/*.tf is the source. data.zip is the built artefact, a raw zip of server/default/data from a scratch PF the Terraform was applied to, and it is imported at boot by the drop-in deployer. data.zip and overlay/pf.jwk + overlay/pingfederate-system-keys.xml hold the master key, so they are gitignored. Ship with railway up --no-gitignore.

Rebuild loop:

docker run -d --name adr-spike-pf --env-file <devops.env> -e PING_IDENTITY_ACCEPT_EULA=YES \
  -p 39999:9999 -p 39031:9031 pingidentity/pingfederate:13.1.3-latest
# stock image without a profile: accept the licence + create the admin via the admin API
#   PUT /license/agreement {"accepted":true}; POST /administrativeAccounts {...ADMINISTRATOR...}
docker cp templates/cba.login.template.html adr-spike-pf:/opt/out/instance/server/default/conf/template/
cd terraform && PINGFEDERATE_PROVIDER_PRODUCT_VERSION=13.1.0 TF_VAR_pf_admin_password=... \
  terraform apply -var public_base_url=https://<adr-cba-pf domain> -var 'virtual_host_names=["<adr-cba-pf domain>"]'
docker cp adr-spike-pf:/opt/out/instance/server/default/data /tmp/pfdata
(cd /tmp/pfdata && zip -qr $OLDPWD/../data.zip . -x 'drop-in-deployer/*' 'hypersonic/*' 'pingfederate-admin-user.xml' 'archive/*' 'local/*')
cp /tmp/pfdata/pf.jwk /tmp/pfdata/pingfederate-system-keys.xml ../overlay/

Gotchas found on 13.1.3:

• GET /configArchive/export returned 401 RBAC "no EXPORT permission" even with every admin role, so the raw zip is the workaround.
• The raw zip must include pf.jwk, pingfederate-system-keys.xml and the .jks files. With the keys only in the /opt/in overlay, PF minted a fresh master key at boot and the import failed with "Unable to deobfuscate text".

data.zip currently bakes public_base_url = http://localhost:9034. Re-apply with the Railway domain before deploying. The issuer is baked into the archive.

Run

docker build -t adr-cba-pf:local . && docker run -d -p 9034:9080 \
  -e PING_IDENTITY_DEVOPS_USER -e PING_IDENTITY_DEVOPS_KEY adr-cba-pf:local

Railway: target port 9080 (plain HTTP behind the edge). Licence comes from the DevOps env vars, which fetch an eval licence each boot.

MATTR wiring

Register this PF as the cba-demo1 authentication provider (url = public base, client mattr-vii, secret = var.mattr_client_secret, client_secret_post, scopes openid profile). If MATTR's redirectUrl differs from var.mattr_redirect_uris, update the variable and rebuild. The id_token carries only sub (cbaSub). Identity claims for the credential come from the cba-issuer claim source.