--- title: Google Chrome Device Trust node description: Use the Google Chrome Device Trust node to establish device trust with Chrome Enterprise in an Advanced Identity Cloud journey. component: auth-node-ref version: latest page_id: auth-node-ref:cloud:google-chrome-device-trust canonical_url: https://docs.pingidentity.com/auth-node-ref/latest/cloud/google-chrome-device-trust.html llms_txt: https://docs.pingidentity.com/auth-node-ref/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-10-07T16:18:42Z keywords: ["Nodes & Trees", "Journeys", "Authentication"] section_ids: example: Example availability: Availability inputs: Inputs dependencies: Dependencies set-up-pinggateway: Set up PingGateway about_pinggateway_routes: About PingGateway routes set-up-scripted-decision: Set up the Scripted Decision node configuration: Configuration outputs: Outputs callbacks: Callbacks outcomes: Outcomes errors: Errors --- # Google Chrome Device Trust node The Google Chrome Device Trust node establishes device trust with [Chrome Enterprise](https://cloud.google.com/blog/products/chrome-enterprise/establish-device-trust-chrome-enterprise-and-ping-identity). ## Example The following example journey uses the Google Chrome Device Trust node to collect device trust signals from the user's managed Chrome browser and make an access decision based on them: ![Journey using the Google Chrome Device Trust node](_images/chrome-device-trust-journey.png) * The user signs on. * The Chrome Device Trust Headers node, a [Scripted Decision node](../scripted-decision.html), redirects to PingGateway to handle the Google Chrome challenge-response process. Find an example redirect script in [Set up the Scripted Decision node](#set-up-scripted-decision). * PingGateway generates the challenge, retrieves the challenge response, and sets it as a request parameter before redirecting back to the journey. * The Google Chrome Device Trust node uses the challenge response to retrieve the Chrome device trust signals, storing them in the node state. * The Check Disk Encryption node, another [Scripted Decision node](../scripted-decision.html), determines whether the `diskEncryption` signal is enabled and makes an access decision. > **Collapse: Sample script for the Check Disk Encryption node** > > ```javascript > var diskEncrypted = nodeState.get("deviceSignals").get("diskEncryption"); > > if(diskEncrypted === "DISK_ENCRYPTION_DISABLED") { > outcome = "true" > } else { > outcome = "false" > } > ``` ## Availability | Product | Available? | | ---------------------------------------------- | ---------- | | PingOne Advanced Identity Cloud | Yes | | PingAM (self-managed) | Yes (1) | | Ping Advanced Identity Software (self-managed) | Yes (1) | (1) For self-managed products, download the node from the [Ping Identity Marketplace](https://marketplace.pingone.com/item/google-chrome-device-trust). ## Inputs This node reads the `challengeresponse` request parameter, which a Scripted Decision node earlier in the journey populates with the value it retrieves from PingGateway. ## Dependencies This node requires: * [PingGateway must be installed and configured](#set-up-pinggateway). * [A Scripted Decision node must be configured earlier in the journey for redirection](#set-up-scripted-decision). ### Set up PingGateway 1. Install PingGateway as described in the [Quick Install Guide](https://docs.pingidentity.com/pinggateway/2026/getting-started/preface.html). 2. Configure the `admin.json` file to run PingGateway on ports 9090 and 9443. Learn more in [Start PingGateway with custom settings](https://docs.pingidentity.com/pinggateway/2026/installation-guide/start-stop.html#starting-options). If you use port 9443 for HTTPS, configure PingGateway for server-side TLS. Learn more in [Configure PingGateway for TLS](https://docs.pingidentity.com/pinggateway/2026/installation-guide/securing-connections.html#server-side-tls). 3. Download the generate_challenge.json and challengeresponse.json route files from the [project GitHub repository](https://github.com/ForgeRock/tntp-google-chrome-device-trust/tree/main/gateway). 4. Store the two route files in your `routes` directory, for example: * `$HOME/.openig/config/routes` (on Mac or Linux) * `%appdata%\OpenIG\config\routes` (on Windows) 5. Download the getChallenge.groovy script file from the [project GitHub repository](https://github.com/ForgeRock/tntp-google-chrome-device-trust/tree/main/gateway) and store it in your `groovy` directory, for example: * `$HOME/.openig/scripts/groovy` (on Mac or Linux) * `%appdata%\OpenIG\scripts\groovy` (on Windows) If the `groovy` directory doesn't exist, create it. #### About PingGateway routes The `generate_challenge.json` route executes the `getChallenge.groovy` script to perform the following tasks: 1. Make an `HTTP POST` request to the Google Chrome Verified Access API to generate the challenge. 2. Get the challenge from the API response. 3. Set the challenge as the value of the `x-verified-access-challenge` custom HTTP response header. Google Chrome recognizes the custom HTTP response header and uses the challenge value to calculate a challenge response. 4. Google Chrome creates a new custom HTTP request header, `x-verified-access-challenge`, and sets the challenge response as the header value. The `generate_challenge.json` route redirects the user to the `challengeresponse.json` route to perform these tasks: 1. Get the challenge response from the request headers. 2. Set the challenge response value in the query parameter of the redirect URL as the `challengeresponse` key. 3. Redirect back to Advanced Identity Cloud. ### Set up the Scripted Decision node This node requires a [Scripted Decision node](../scripted-decision.html) earlier in the journey to redirect the end user to PingGateway to generate and retrieve the `challengeresponse`. Configure a Scripted Decision node with the following example script. > **Collapse: Example redirect script for the Scripted Decision node** > > ```javascript > try { > var redirectMethod = "GET"; > var redirectUrl = "https://ig.example.com:9443/pinggateway-route-name"; > if (!requestParameters.get("challengeresponse")) { > callbacksBuilder.redirectCallback(redirectUrl, {}, redirectMethod, true); > } else { > var challenge = requestParameters.get("challengeresponse"); > nodeState.putShared("x-verified-access-challenge", challenge); > action.goTo("true"); > } > > } catch (error) { > nodeState.putShared("errorMessage", error.toString()); > action.goTo('false').withErrorMessage(error); > } > ``` The script uses the next-generation script engine. The `challengeresponse` parameter must be in the redirect to Advanced Identity Cloud as a query parameter from PingGateway. The Google Chrome Device Trust node retrieves the `challengeresponse` value from the request parameters. The path in `redirectUrl` must match the `condition` field in the `generate_challenge.json` route file. ## Configuration | Property | Usage | | ------------------------ | -------------------------------------------------------------------------------- | | API Key | The Google Cloud API key. | | Private Key | The Google Cloud administrator credential's private key. | | Key ID | The unique identifier used to verify the authenticity and integrity of the JWT. | | Credentials Client Email | The email address of the client with the Google Cloud administrator credentials. | ## Outputs The node writes each key-value pair from the Chrome Verified Access API response, such as `deviceSignals`, to the node state. On error, the node writes the exception message and stack trace to the node state. ## Callbacks This node doesn't send any callbacks. ## Outcomes * `Continue` The node retrieved the device trust signals successfully. * `Error` The node couldn't obtain the device trust signals; for example, the `challengeresponse` request parameter is missing or the Google Chrome Verified Access API request failed. ## Errors The node can log the following errors: * `[GoogleChromeDeviceTrust][Version: ][Marketplace]Exception occurred` An exception occurred while the node retrieved the device trust signals. The node stores the exception message and stack trace in the node state.