---
title: Passthrough Authentication node
description: Authenticates an identity through a connector to a third-party service.
component: auth-node-ref
version: 7.3
page_id: auth-node-ref::auth-node-passthrough-authentication
canonical_url: https://docs.pingidentity.com/auth-node-ref/latest/passthrough-authentication.html
llms_txt: https://docs.pingidentity.com/auth-node-ref/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
section_ids:
  outcomes: Outcomes
  properties: Properties
  example: Example
---

# Passthrough Authentication node

Authenticates an identity through a connector to a third-party service.

This lets you migrate user profiles without forcing users to reset their passwords, or retain a third-party service indefinitely as the canonical store for authentication credentials.

|   |                                                                                                                                                                    |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|   | This functionality requires that you configure AM as part of a [Ping Identity Platform deployment](https://docs.pingidentity.com/platform/8/platform-setup-guide). |

Before you use the node:

* Configure the connector to the third-party service.

  Find more information in [Available connectors](https://docs.pingidentity.com/openicf/index.html#icf-available-connectors).

* If you plan to collect credentials in the identity repository for users, synchronize accounts from the third-party service.

  Find more information in [Synchronization](https://docs.pingidentity.com/pingidm/7.3/synchronization-guide/) in the IDM documentation.

Use this node after collecting the authentication credentials.

Implement a [Username Collector node](am-only/auth-node-username-collector.html) and [Password Collector node](am-only/auth-node-password-collector.html) (standalone AM) or [Platform Username node](auth-node-platform-username.html) and [Platform Password node](auth-node-platform-password.html) (Ping Identity Platform deployment) before this node in the journey.

Pass the credentials to this node to authenticate the identity against the service.

## Outcomes

* `Authenticated`

* `Missing Input`

* `Failed`

## Properties

| Property           | Usage                                                                                    |
| ------------------ | ---------------------------------------------------------------------------------------- |
| System Endpoint    | Required. Name of the connector to the third-party service that performs authentication. |
| Object Type        | The OpenICF object type for the object being authenticated.Default: `account`            |
| Identity Attribute | The username attribute for authentication.Default: `userName`                            |
| Password Attribute | The password attribute for authentication.Default: `password`                            |

## Example

|   |                                                                                                                                                                    |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|   | This functionality requires that you configure AM as part of a [Ping Identity Platform deployment](https://docs.pingidentity.com/platform/8/platform-setup-guide). |

Before trying this example, synchronize accounts from the third-party service. The example shows a login flow that tries pass-through authentication when local authentication fails, and stores the user password when authentication with the third-party service succeeds.

In this example, the user enters their credentials with the [Platform Username node](auth-node-platform-username.html) and [Platform Password node](auth-node-platform-password.html). The [Data Store Decision node](auth-node-data-store-decision.html) authenticates against the platform directory service. On failure, authentication passes through to the third-party service. If authentication with the third-party service is successful, the [Identify Existing User node](auth-node-identify-existing-user.html) and [Required Attributes Present node](auth-node-required-attributes-present.html) check for a valid user profile. The [Patch Object node](auth-node-patch-object.html) updates the user's profile with the successful password:

![Passthrough authentication that updates user credentials](_images/trees-node-passthrough-authentication-example-platform.png)

> **Collapse: Node connections**
>
> **List of node connections**
>
> | Source node                                                   | Outcome path  | Target node                 |
> | ------------------------------------------------------------- | ------------- | --------------------------- |
> | Page Node containing:- Platform Username
>
> - Platform Password | →             | Data Store Decision         |
> | Data Store Decision                                           | True          | Increment Login Count       |
> |                                                               | False         | Passthrough Authentication  |
> | Passthrough Authentication                                    | Authenticated | Identify Existing User      |
> |                                                               | Missing Input | Page Node                   |
> |                                                               | Failed        | Failure                     |
> | Identify Existing User                                        | True          | Required Attributes Present |
> |                                                               | False         | Increment Login Count       |
> | Required Attributes Present                                   | True          | Patch Object                |
> |                                                               | False         | Increment Login Count       |
> | Patch Object                                                  | Patched       | Increment Login Count       |
> |                                                               | Failed        | Increment Login Count       |
> | Increment Login Count                                         | →             | Inner Tree Evaluator        |
> | Inner Tree Evaluator                                          | True          | Success                     |
> |                                                               | False         | Failure                     |