---
title: PingOne Identity Match node
description: The PingOne Identity Match node checks that users that exist in the ForgeRock platform also exist in the PingOne platform.
component: auth-node-ref
version: latest
page_id: auth-node-ref:pingone:pingone-identity-match
canonical_url: https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-identity-match.html
superseded_by: https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-identity-match.html
section_ids:
  example: Example
  availability: Availability
  inputs: Inputs
  dependencies: Dependencies
  configuration: Configuration
  outputs: Outputs
  callbacks: Callbacks
  outcomes: Outcomes
---

# PingOne Identity Match node

The PingOne Identity Match node checks that users that exist in the ForgeRock platform also exist in the PingOne platform.

## Example

The following example journey integrates PingOne Verify to perform user identity verification.

![Example PingOne Verify journey](_images/pingone-verify-example-journey-full.png)Figure 1. Example PingOne Verify journey

* The user enters their credentials and the [Data Store Decision node](../data-store-decision.html) matches them against the identity store.

* a The [PingOne Identity Match node](pingone-identity-match.html) checks PingOne for a matching user.

* b If a user is found, the [PingOne Verify Completion Decision node](pingone-verify-completion-decision.html) checks the user's most recent verification transaction to determine the status:

  * Success

    The user successfully completed the most recent PingOne Verify transaction, so the journey progresses directly to the Success node and authentication is successful.

  * Not Completed

    The user has an existing PingOne Verify transaction in progress, so the journey resumes the existing verification transaction.

    The node adds the user's existing transaction ID to the shared node state in a variable named `pingOneVerifyTransactionId`.

  * Not Started / Failure / Expired

    * The user doesn't have an existing PingOne Verify transaction (`Not Started`)

    * The user hasn't successfully completed the most recent PingOne Verify transaction

    * The most recent PingOne Verify transaction has expired

    The journey continues to start a new verification transaction.

* c If no matching user is found, the [PingOne Create User node](pingone-create-user.html) creates a new user in PingOne.

* d The [PingOne Verify Evaluation node](pingone-verify-evaluation.html) starts a new PingOne Verify evaluation or continues an existing evaluation if `pingOneVerifyTransactionId` is present in the shared node state. The node either completes or fails the journey based on the result.

## Availability

| Product                               | Available? |
| ------------------------------------- | ---------- |
| PingOne Advanced Identity Cloud       | Yes        |
| PingAM (self-managed)                 | Yes        |
| Ping Identity Platform (self-managed) | Yes        |

## Inputs

This node reads the `username` field from the shared node state to access the user's identity profile.

Implement a [Platform Username node](../platform-username.html) earlier in the journey.

## Dependencies

This node requires a PingOne Worker Service configuration so that it can authenticate to your PingOne instance.

Find more information in [Set up PingOne workers and configure them as Advanced Identity Cloud services](https://docs.pingidentity.com/pingoneaic/integrations/pingone-set-up-workers.html).

## Configuration

| Property                  | Usage                                                                                                                                                                                                                                                                                           |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| PingOne Worker Service ID | The ID of the PingOne worker service for connecting to PingOne.                                                                                                                                                                                                                                 |
| Population ID             | The ID of the population in PingOne to check for users or provision new ones.If not specified, the node uses the environment's default population ID.                                                                                                                                           |
| AM Identity Attribute     | The attribute from the user's ForgeRock profile that the node uses to match their account in PingOne.Default: `uid`                                                                                                                                                                             |
| Ping Identity Attribute   | The attribute from the user's PingOne profile that the node uses to search for a matching account.If there are multiple entries with the same attribute value in the PingOne directory server, ensure that this property is specific enough to retrieve only one entry.Default: `username`      |
| Capture failure           | Capture the details in shared state if a failure occurs.The node stores the details in a variable named `pingOneIdentityMatchFailureReason`.Default: `False`Example:```json
{
  "code": "ACCESS_TOKEN",
  "message": "Unable to get access token for PingOne Worker.",
  "exception": "",
}
``` |

## Outputs

If the node was able to find a unique match in PingOne it stores the PingOne user identifier in a state variable named `pingOneUserId`. For example `a648aaac-ch15-b357-457b-8d2e714180ff`.

If you select Capture failure, the node stores any error response in a shared state variable named `pingOneIdentityMatchFailureReason`.

## Callbacks

This node doesn't send any callbacks.

## Outcomes

`True`

The node found a unique matching account in PingOne.

`False`

The node did not find a unique match in PingOne.