Which PingAM feature only uses the PingAM keystore?

In PingAM 8.0.2, the management of cryptographic material has evolved toward the Secret Store framework, which allows secrets to be stored in various locations (Filesystem, HSM, or Environment Variables). However, for specific core features, the internal PingAM keystore (historically keystore.jks) remains the primary repository for the keys used to protect session integrity.

According to the "Client-side Session Security" documentation, when a realm is configured forClient-side sessions, the entire state of the user's session is encapsulated within a signed and encrypted JSON Web Token (JWT). This JWT is then stored in the user's browser cookie. To ensure that this token cannot be tampered with or read by unauthorized parties, PingAM must sign and encrypt the payload. The AM engine is hardcoded to look for the specific aliases (such as am.services.session.encryption and am.services.session.signing) within thedefault-keystoresecret store, which points directly to the PingAM keystore.

While other features likeOAuth2 providers(Option D) and thePersistent Cookie node(Option B) utilize secret stores, they are designed to be highly flexible and can be configured to use keys from any defined secret store in the realm.Authentication trees(Option C) are logical constructs and do not "use" the keystore directly, although individual nodes within a tree might. The distinction forClient-side sessionsis that the feature's fundamental security model is built specifically around the cryptographic keys managed within the AM keystore to provide "stateless" session management. Administrators must ensure that the same keystore and aliases are shared across all nodes in a cluster to allow any AM instance to validate a client-side session token issued by another node.