Part 1 defined the identity contract. This part puts actual PingFederate servers behind it.

The objective was narrow: implement the Gateway 2 exchange adapter, trust only approved issuers and JWKS, authenticate the confidential client with a signed JWT, and preserve the original human and actor. The local simulation had to continue working.

The container lab used PingFederate 13.1.0 on an existing Windows Docker host. That version describes the tested lab, not a recommendation to ignore later patches or your organisation's supported release policy.

Step 1: Create an explicit adapter boundary

The real implementation lives behind typed contracts in src/adapters/token-exchange.ts . The JOSE implementation, configuration loader and mode selection are separate modules.

// Abbreviated interface, not the repository's full exported type.…