PF ID-JAG: Can PingFederate 12.3.3 issue an ID-JAG through a custom token generator? For the fixed-destination proof described here, the answer is yes. A live PingFederate server returned the assertion, and its signature verified against that server's published JWKS. That result matters, but so does its boundary. It is not evidence that an arbitrary application can accept the assertion, that a complete Cross-App Access deployment exists, or that the implementation conforms to every require...