PingOne

PingOne MFA IdP Adapter settings reference

Field descriptions for the PingOne MFA IdP Adapter configuration page.

Standard fields
Field Description

MFA for User Attributes

The user attributes to be sent to PingOne as part of the authentication context. Add a new row and specify the attribute name and attribute value. These attributes can be referenced within PingOne policies to determine when MFA is required.

PingOne Environment

Select the PingOne connection that you created in Connecting PingFederate to PingOne.

This field is blank by default.

PingOne Population

When Provision Users is selected, if a user doesn’t already exist in PingOne, the adapter provisions the user to this PingOne population. To prevent users from encountering an account-linking failure when they later access PingOne applications, ensure that the population’s default Identity Provider is set to the PingFederate external IdP. Learn more in Adding an identity provider - SAML and Managing populations.

This list is populated after you select the PingOne Environment.

This field is blank by default.

Application

The PingOne application that you created in Creating a web or native OIDC application in PingOne.

This list is populated after you select the PingOne Environment and PingOne Population.

This field is blank by default.

MFA Policy for Authentication

Select the desired policy from the list. This field displays MFA policies created in PingOne. Defaults to Default, which uses the default MFA policy in PingOne.

This field can be overridden by a chained attribute coming from an upstream adapter, such as the PingOne Protect adapter.

MFA Policy for Registration

Select the PingOne MFA policy that you want to use for device pairing.

This field can be overridden by a chained attribute coming from an upstream adapter, such as the PingOne Protect adapter.

MFA by User Population

Prompt the user for MFA when a user is a member of any of the listed populations. Multiple populations must be separated by commas.

MFA for Accessing from IP Out of Range

Prompt the user for MFA if the request comes from an IP address outside of the specified range. Use CIDR notation to specify the IP address range. Multiple ranges must be separated by commas.
Advanced fields
Field Description

LDAP data source

LDAP data store, configured in PingFederate to store offline device credentials. The PingOne MFA adapter supports storing device data either as an attribute on the user object, or on a separate object in the same or a different directory.

Base Domain

The location that’s used to search for the user, including subgroups. This attribute is equivalent to the Search Base attribute in Active Directory (AD) (for example, Base Domain: CN=Users,DC=domainname,DC=global). The Base Domain path must include at least one group, as well as the domain name.

Filter

The LDAP attribute used to find the LDAP entry for a specific user entity. To be used when the offline authentication attributes are stored on the user entry in the main user LDAP. For example, for AD, this is SAMAccountName=${username}.

LDAP Search Scope

OBJECT_SCOPE: Limits the search to the base object.

  • Subtree_scope: (Default): Searches all child objects as well as the base object.

  • Object_scope: Limits the search to the base object.

  • One_level_scope: Searches the immediate children of a base object, but excludes the base object itself.

Encryption Key For Devices:

A base64url-encoded 256-bit key used to encrypt device credentials before saving them to LDAP.

Allow Offline Devices Without Encryption:

If selected, confirms that device credentials will be stored as plain text. Required if the Encryption Key for Devices field is empty.

Notification Template Variant Override

Overrides the notification template variant that the adapter sends to PingOne for authentication and transaction approval flows.

Admin Message

A message that appears on all authentication screens to provide users with administrator contact information or other guidance.

Test Username

The PingOne username that the adapter uses to test the PingOne MFA connection on the Actions tab.

Enter the username for a user that has a paired device and MFA enabled in PingOne.

This field is blank by default.

HTML Template Prefix

Identifies the set of HTML templates that the adapter uses.

The default value is pingone-mfa.

Messages Files

Identifies the customizable language-pack file that the adapter uses.

The default value is pingone-mfa-messages.

Prompt Users to Set Up MFA

Determines whether users with no authentication methods are prompted to add one.

Allow Users to Skip MFA Setup

Determines whether the MFA setup prompt includes a Skip option. This allows the user to sign on without setting up MFA. Applies only when Prompt Users to Set Up MFA is selected.

Enforce authentication after device registration

Require users to authenticate after registering a device before they are granted access to the relevant resources or application.

Allow Users to Manage Authentication Methods

Determines whether users can add another authentication method, set an existing one as the default, or remove or rename an existing one during sign-on.

Allow Users to Perform Multiple Device Management Operations Consecutively

Select this checkbox to allow users to perform multiple device management actions without being redirected.

Provision Users

If a user doesn’t already exist in PingOne, the adapter provisions the user to PingOne. If Provision Users is selected, configure the selected population’s default Identity Provider as the PingFederate external IdP. Learn more in Adding an identity provider - SAML and Managing populations.

Provision Authentication Methods

Determines whether the adapter adds authentication methods based on the user’s attribute values.

Update Authentication Methods

This setting allows the adapter to automatically add new authentication methods for existing users.

Overwrite Authentication Methods Configurations

If the adapter identifies new values for SMS, voice, WhatsApp, or email devices, this setting determines whether the adapter replaces the existing methods.

Email Field Behavior

Defines how the email address field is handled during device registration: not pre-filled, pre-populated from the user directory, or pre-populated and locked to prevent user edits.

  • None: The field is blank and the user enters their email address.

  • Pre-populate: The field is pre-populated with the email address from the user directory. The user can edit the value.

  • Pre-populate and Restrict: The field is pre-populated with the email address from the user directory and is read-only. If no value exists in the directory for this user, the email device type isn’t offered during registration.

SMS Field Behavior

Defines how the SMS phone number field is handled during device registration: not pre-filled, pre-populated from the user directory, or pre-populated and locked to prevent user edits.

  • None: The field is blank and the user enters their phone number.

  • Pre-populate: The field is pre-populated with the phone number from the user directory. The user can edit the value.

  • Pre-populate and Restrict: The field is pre-populated with the phone number from the user directory and is read-only. If no value exists in the directory for this user, the SMS device type isn’t offered during registration.

Voice Field Behavior

Defines how the voice call phone number field is handled during device registration: not pre-filled, pre-populated from the user directory, or pre-populated and locked to prevent user edits.

  • None: The field is blank and the user enters their phone number.

  • Pre-populate: The field is pre-populated with the phone number from the user directory. The user can edit the value.

  • Pre-populate and Restrict: The field is pre-populated with the phone number from the user directory and is read-only. If no value exists in the directory for this user, the voice device type isn’t offered during registration.

WhatsApp Field Behavior

Defines how the WhatsApp phone number field is handled during device registration: not pre-filled, pre-populated from the user directory, or pre-populated and locked to prevent user edits.

  • None: The field is blank and the user enters their phone number.

  • Pre-populate: The field is pre-populated with the phone number from the user directory. The user can edit the value.

  • Pre-populate and Restrict: The field is pre-populated with the phone number from the user directory and is read-only. If no value exists in the directory for this user, the WhatsApp device type isn’t offered during registration.

Enable Cookie Based Tracking

When selected, the adapter tracks a previously authenticated device in a cookie.

Use Password Config Attribute

Adds a Use Password button to the device selection screen.

Bypass MFA For Device Management Attribute

Enter the name of the attribute that controls whether users can bypass MFA when accessing the Device Management page.

Username Attribute

Determines the PingOne username for all API calls, including user lookup, provisioning, and MFA.

If you identify users by their PingOne username, leave this field blank. New users are named based on the incoming user ID set for the adapter in your PingFederate authentication policy.

If you identify users by their PingOne user ID, enter the name of an authentication policy attribute. The adapter uses that attribute value as the username instead of the incoming user ID.

Use Username Attribute During Authentication

When selected, the adapter uses the value of the Username Attribute field as the PingOne username during authentication as well as provisioning.

Requires a value to be entered in Username Attribute. Has no effect if Username Attribute is blank.

SMS Attribute

The attribute name used for SMS provisioning. Default value is sms.

Secondary SMS Attribute

An additional LDAP attribute name that can be used for SMS provisioning.

Voice Attribute

When provisioning users or updating authentication methods, the adapter checks for phone numbers in each attribute that begins with this prefix. The adapter adds these phone numbers as voice authentication methods. Can include multiple attributes. Default value is voice. This field is only relevant if Update Authentication Methods is selected.

Secondary Voice Attribute

An additional LDAP attribute name that can be used for Voice calls. If undefined, the Secondary SMS Attribute is used for voice calls.

Email Attribute

The attribute name used for Email provisioning. Default value is email.

Secondary Email Attribute

An additional LDAP attribute name that can be used for Email provisioning.

State Attribute

The LDAP attribute used to override how a specific user is authenticated during offline authentication. This attribute is preset in AD. If empty, the user attribute set in the directory isn’t used during offline authentication.

WhatsApp Attribute

The attribute name used for WhatsApp provisioning. Default value is whatsapp.

Application ID for Authentication Code Flow

The application ID to use for an authentication code-based flow.

Default Authentication Method for Provisioned Users

Sets the default method for new users. Default selection is SMS.

User Not Found Failure Mode

Determines whether the adapter blocks the user’s sign-on attempt when a user error occurs in PingOne.

In version 4.0, this setting only covers: User does not exist.

No Devices Failure Mode

Determines whether the adapter blocks the user’s sign-on attempt or bypasses MFA authentication when the user has no MFA devices enrolled and 'Prompt Users to Set Up MFA' is not enabled, or when no applicable devices are available for offline MFA authentication. Options include:

  • Block authentication: the user’s authentication attempt is blocked.

  • Bypass authentication: the user is authenticated without requiring MFA.

Your registration policy can use an MFA policy with different requirements than the MFA policy or policies that the MFA Policy for Authentication uses, so make sure to set up MFA policies that are compatible with each other.

Service Unavailable Failure Mode

This setting determines how the adapter behaves when it is unable to access PingOne. Depending on the selected mode, the adapter can block the user’s sign-on attempt, bypass authentication, enforce offline authentication, or attempt passive offline authentication.

To configure offline MFA, including prerequisites and offline-specific fields, see Configuring offline MFA.

Change Authentication Method

Determines whether users can go back and change their authentication device during a sign-on session.

  • Allow: A Change device link appears on authentication screens, allowing users to return to the device selection screen.

  • Deny: The Change device link is not shown.

If using MFA by User Population or MFA for User Attributes, set this to Deny.

Display target application name:

Display the target application name in the authentication screens and supported notifications if available. If not selected, or no target application name is available, uses the values from the language-pack file configured in the Message Files field (default pingone-mfa-messages.properties).

Show Success Screens

Determines whether the adapter shows a success page.

Show Error Screens

Determines whether the adapter shows an error page.

Show Timeout Screens

Determines whether the adapter shows a timed-out page when an MFA push notification times out or the flow fails.

To allow OTP fallback after a push timeout, this setting must be enabled.

Enable Audit Log

When selected, the adapter logs browser and authentication details in the audit log.

One-Time Device Display Mode

During authentication, display one-time devices either:

  • Standalone: Display one-time device separately to paired devices.

  • With Paired Devices: In a list with the user’s paired devices.

  • As Backup Authentication Devices: Displays one-time devices as options behind a “Forgot your device?” option during authentication.

Note: The "support-one-time-device-otp" chained attribute must be enabled (true) for all options.

Learn more in Support for stateless one-time device OTP flow.

Conditional UI

Select the mode for selectively displaying passkeys and WebAuthn sign-on processes:

  • Disabled: Disable all conditional UI features in the sign-on HTML form.

  • Optional: If a passkey exists in the current domain, automatically display a WebAuthn modal prompting the user to select it when the sign-on page renders.

  • Conditional: When the user clicks the Username field, show a list of available passkeys as auto-fill sign-on options.

Note: This field is only relevant when configuring a PingFederate policy for a consistent passwordless experience.

FIDO2 RPID Source

The source of the Relying Party Identifier (RPID) sent to PingOne for FIDO2 device registration and legacy usernameless authentication. Options include:

  • PingOne FIDO Policy: Adapter doesn’t send the RPID. PingOne API uses the value configured in the FIDO policy.

  • SSO Application Endpoint Host: Use the SSO Application Endpoint Host as the default RPID.

Notes:

  • In AuthN API flows, any RPID or PR Name specified in the SELECT_DEVICE_PAIRING_METHOD request payload take precedence.

  • Workforce environments should use the default value.

API Request Timeout

The amount of time in milliseconds that PingFederate allows when establishing a connection with PingOne or waiting for a response to a request. A value of 0 disables the timeout. A negative value uses the PingFederate system defaults.

Proxy Settings

Defines the proxy settings for outbound HTTP requests. The default value is System Defaults.

Custom Proxy Host

The proxy server host to use when Proxy Settings is set to Custom.

Custom Proxy Port

The proxy server port to use when Proxy Settings is set to Custom.

This field is blank by default.

Custom Proxy Connection Type

Select whether to connect to the proxy server using HTTP or HTTPS when Proxy Settings is set to Custom.