Automatic rotation removes manual renewal work, not lifecycle complexity. Your acceptance tests must cover planned rotation, unknown signing keys, transient outages, and the interaction between credentials issued at different layers.<\/p>\n
X.509-SVID verification uses certificate trust material. JWT-SVID verification uses the corresponding JWT signing public keys. An OIDC discovery\/JWKS integration can expose JWT verification metadata for consumers, but an X.509 bundle is not interchangeable with a JWKS document. Document exactly which discovery component is deployed and how PingFederate trusts it.<\/p>\n
Review discovery issuer association, TLS trust, permitted metadata endpoints, cache limits, and key rollover behavior. A kid identifies a candidate key; it does not make a key trustworthy. Do not follow arbitrary jku or x5u values from untrusted token input. Bind verification material to configured issuers.<\/p>\n
Recommended sequence: publish the new verification key, allow intended verifiers to acquire it, begin signing with it, and retain old verification material for the remaining lifetime of valid old tokens plus permitted skew and bounded propagation delays. Confirm the actual signing-key publisher behavior rather than assuming it follows this sequence. Emergency compromise rollover requires a different plan because retaining the old key preserves trust in forged tokens.<\/p>\n
On unknown kid, perform a bounded, issuer-specific refresh if supported. If the key remains unknown, deny the token. Rate-limit and coalesce refreshes to prevent attacker-controlled kid values from turning verification into a discovery-service denial of service. Valid cached material may remain usable within a documented policy; this is not permission to extend token expiration or trust unknown keys.<\/p>\n
Condition<\/strong><\/td>\n| Recommended behavior<\/strong><\/td>\n | Evidence to collect<\/strong><\/td>\n<\/tr>\n | SPIRE unavailable<\/strong><\/td>\n | No fabricated credentials; use only still-valid material under policy<\/td>\n | Issuance failures and remaining lifetime<\/td>\n<\/tr>\n | STS unavailable<\/strong><\/td>\n | Do not bypass exchange or broaden authority<\/td>\n | Exchange failures and job\/backoff behavior<\/td>\n<\/tr>\n | Discovery unavailable<\/strong><\/td>\n | Bounded cache use; reject unknown keys<\/td>\n | Cache age and refresh outcomes<\/td>\n<\/tr>\n | Clock skew<\/strong><\/td>\n | Enforce reviewed bounded leeway<\/td>\n | Clock offset and time-validation failures<\/td>\n<\/tr>\n | Old signing key removed<\/strong><\/td>\n | Observe rejected old credentials; follow planned policy<\/td>\n | Affected kid and issuer<\/td>\n<\/tr>\n | Policy distribution unavailable<\/strong><\/td>\n | Explicit fail behavior, never implicit permit<\/td>\n | Policy version and stale-state duration<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n | <\/p>\n Sender binding complicates credential rotation<\/h2>\nRFC 8705 certificate-bound access tokens use the thumbprint of a specific client certificate. Binding to an X.509-SVID certificate therefore binds that token to that particular certificate, not merely to its stable SPIFFE ID. Coordinate token renewal and certificate rotation, and avoid a gap where only a replacement certificate remains but the access token expects the old one.<\/p>\n DPoP is an alternative sender-constraint mechanism only where the issuer and resource server support the agreed profile. Its key lifecycle is separate from SPIRE certificate rotation. Do not imply that configuring SPIRE automatically enables DPoP in PingFederate or a downstream API.<\/p>\n Connections and authorization lifetime<\/h2>\nEstablished TLS connections and application sessions need their own lifecycle review. A certificate rollover is not guaranteed to trigger a new authentication handshake on every existing connection. Decide whether token authorization is evaluated per request, once per connection, or when a session is created; verify the implementation. Connection draining and maximum session duration may be needed for predictable containment.<\/p>\n
|