feat(pingidentity): add PingFederate auth provider

[JessicaJHee]

Hey, I just made a Pull Request!

Adds a new authentication module for PingFederate integration with PingFederate-specific sign-in resolvers and configs

New sign-in resolvers:

• ldapUuidMatchingAnnotation - Matches LDAP UUID claim to backstage.io/ldap-uuid annotation
  • works with LDAP catalog provider
  • Configurable UUID claim key (default: ldap_uuid)
  • Validates UUID in both userinfo and ID token
• subClaimMatchingPingIdentityUserId - Matches sub claim to pingidentity.org/id annotation
  • For PingOne catalog provider integration
  • Validates sub claim in both userinfo and ID token

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)
• All your commits have a Signed-off-by line in the message. (more info)

[backstage-goalie]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage-community/plugin-auth-backend-module-pingfederate-provider	workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider	minor	v0.0.0
@backstage-community/plugin-catalog-backend-module-pingidentity	workspaces/pingidentity/plugins/catalog-backend-module-pingidentity	minor	v0.11.1

[Copilot]

Pull request overview

Adds a new PingFederate OIDC auth backend module under the pingidentity workspace, including PingFederate-specific sign-in resolvers (LDAP UUID and Ping Identity user ID) and accompanying configuration + tests. It also updates PingIdentity catalog module wording to explicitly describe PingOne ingestion and updates the workspace lockfile for the new package.

Changes:

• Introduces @backstage-community/plugin-auth-backend-module-pingfederate-provider with authenticator, backend module registration, and PingFederate-specific sign-in resolvers.
• Adds test coverage for the authenticator and module wiring using MSW + startTestBackend.
• Updates PingIdentity catalog module docs/metadata to refer to PingOne and clarifies ingestion purpose; updates yarn.lock accordingly.

Reviewed changes

Copilot reviewed 15 out of 18 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
workspaces/pingidentity/yarn.lock	Adds the new workspace package and updates dependency resolutions/versions.
workspaces/pingidentity/plugins/catalog-backend-module-pingidentity/README.md	Renames/clarifies documentation to describe PingOne ingestion.
workspaces/pingidentity/plugins/catalog-backend-module-pingidentity/package.json	Updates description to reflect PingOne/Ping Identity cloud ingestion.
workspaces/pingidentity/plugins/catalog-backend-module-pingidentity/config.d.ts	Improves config documentation for PingOne ingestion configuration.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/src/resolvers.ts	Adds PingFederate-specific sign-in resolvers (LDAP UUID + Ping Identity user ID).
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/src/module.ts	Registers the PingFederate provider module with the auth backend.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/src/module.test.ts	Adds integration-style module test using startTestBackend + MSW.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/src/index.ts	Exposes authenticator/module/resolvers as the package public API.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/src/authenticator.ts	Implements PingFederate OIDC authenticator (start/authenticate/refresh/logout).
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/src/authenticator.test.ts	Adds unit tests for the authenticator flows.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/report.api.md	API Extractor output for the new package.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/README.md	Usage, installation, and configuration documentation for the new provider.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/package.json	Defines the new package metadata and dependencies.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/knip-report.md	Adds a knip report placeholder for the package.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/dev/index.ts	Dev harness to run the module with a backend instance.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/config.d.ts	Config schema typings for PingFederate provider configuration.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/catalog-info.yaml	Catalog metadata for the new module package.
workspaces/pingidentity/plugins/auth-backend-module-pingfederate-provider/.eslintrc.js	ESLint config for the new package.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 18 changed files in this pull request and generated 7 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 18 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 19 changed files in this pull request and generated 4 comments.

[PatAKnight]

Couple of comments, seems like you also have a few GitHub copilot suggestions as well.

[PatAKnight]

Is this being used? I don't see it anywhere at the moment.

[JessicaJHee]

This config is handled here for all auth providers

[PatAKnight]

I see that we are updating the naming from "Ping Identity" to "Ping One", is this necessary? I worry that it could cause some confusion since the plugin is still named "pingidentity"

[JessicaJHee]

I wanted to clarify that the catalog provider currently only works with PingIdentity's cloud offering PingOne. I was looking into changing the plugin name but maybe in the future we will add more support for other PingIdentity products for org data ingestion. WDYT?