PingOne

Adding PingOne MFA to your authentication policy

By modifying your PingFederate authentication policy to include the PingOne MFA IdP Adapter, you can challenge users to complete a multi-factor authentication (MFA) step.

About this task

These steps are designed to help you add to an existing authentication policy. You can find more information about configuring authentication policies in Authentication policies in the PingFederate documentation.

Changes in Version 4.0:

  • Attribute Mapping: The id_token and access_token core contracts are removed. You must manually update policies to use pingone.mfa.enrollment or pingone.mfa.device.id.

Steps

  1. In the PingFederate administrative console, go to Authentication > Policies > Policies.

  2. Select the IdP Authentication Policies checkbox.

  3. Open an existing authentication policy, or click Add Policy.

    Learn more in Defining authentication policies in the PingFederate documentation.

  4. In the Policy area, in the Select list, select a PingOne MFA IdP Adapter instance.

    In the adapter configuration, ensure a selection is made in the MFA Policy for Authentication list.
    Adding the to the authentication policy

  5. Map the PingOne user ID or username into the PingOne MFA IdP Adapter instance.

    In version 4.0, the PingOne MFA IdP Adapter returns claims directly in the attribute map. To avoid errors, you must set the Source to Adapter.

    Attributes include:

    • pingone.mfa.enrollment

    • pingone.mfa.device.id

    You can use these attributes to define additional policy rules and branches.
    Passing the user ID from the first-factor authentication adapter to the

    1. Under the PingOne MFA IdP Adapter instance, click Options.

    2. In the Options modal, in the Source list, select a previous authentication source that collects the PingOne user ID or username.

      The adapter uses the Username Attribute value as the username when provisioning new users.

      In version 4.0, the User Not Found failure mode only applies if a user does not exist in the directory. It no longer covers disabled users or users with the MFA service disabled, as it did in earlier versions.

    3. In the Attribute list, select the user ID. Click Done.

    4. (Optional) Select the User ID Authenticated checkbox.

      The User ID Authenticated checkbox indicates whether the mapped user ID has been authenticated by the authentication source and therefore can be trusted by the current adapter. Device management options are limited if the user isn’t authenticated.

  6. (Optional) Define policy paths based on the pingone.mfa.status or pingone.mfa.status.reason attributes.

    Branching the authentication policy based on the pingone.mfa.status attribute.

    1. Under the PingOne MFA IdP Adapter instance, click Rules.

    2. In the Rules modal, in the Attribute Name list, select pingone.mfa.status or pingone.mfa.status.reason.

    3. In the Condition list, select equal to.

    4. In the Value field, enter a value from PingOne MFA status attributes reference.

    5. In the Result field, enter a name. This appears as a new policy path that branches from the authentication source.

    6. If you want to add more authentication paths, click Add and repeat steps a-e.

    7. Click Done.

  7. Configure each of the authentication paths.

    The complete authentication policy

  8. Click Done.

  9. Configure tracked HTTP parameters:

    1. On the Tracked HTTP Parameters tab, in the Parameter Name field, enter the name of the parameter that you want to track.

      For example:

      • To enable automatic device pairing, enter mobilePayload.

    2. Click Add.

    3. Click Save.

    4. Repeat the previous steps for any other parameters that you want to add.