PingOne

(Workforce only) Configuring offline MFA

Offline multi-factor authentication (MFA) allows users to authenticate when the PingOne server is unreachable. If your organization is using MFA as a primary or secondary mode of authentication for federated single sign-on (SSO), you can implement the offline MFA feature of the PingOne MFA IdP Adapter adapter, so you can circumvent unforeseen outages or network issues preventing users from signing on to access their applications.

When the PingOne server is available, the adapter caches each user’s device credentials in an LDAP data source. If the PingOne server can’t be reached, the adapter uses those cached credentials to authenticate the user locally.

PingOne MFA policies are not enforced during offline authentication.

Before you begin

Before configuring offline MFA, make sure that you have the following:

  • PingOne Workforce environment with the PingFederate Administrator role: The PingFederate Administrator role is required to use offline MFA.

  • PingOne MFA IdP Adapter 4.1 or later.

  • LDAP data source: An LDAP data source must be configured in PingFederate to store offline device credentials as an attribute on the user object.

  • Encryption key (recommended): An encryption key is strongly recommended to protect device data at rest. Without an encryption key, device credentials are stored as plain text in LDAP, and the Allow Offline Devices Without Encryption checkbox must be selected before you can save the configuration.

  • Unlimited Strength Java Cryptography Extension (JCE): Required for supporting the 256-byte key size for cryptographic algorithms. Without it, the feature will return an exception related to the missing library and will not function.

Steps

  1. In the PingFederate administrative console, go to Authentication > Integration > IdP Adapters and select the PingOne MFA IdP Adapter adapter, or create a new one.

  2. On the IdP Adapter tab, click Show Advanced Fields.

  3. Configure the offline MFA fields:

    • LDAP Data Source: Select the LDAP data source where your user objects are stored. Offline device data is currently configured to reside directly on the user object.

    • Encryption Key For Devices: A base64url-encoded 256-bit key used to encrypt device credentials before saving them to LDAP.

      If the encryption key is changed, users must authenticate online at least once for their cached device credentials to be re-encrypted with the new key. Until then, offline authentication follows the No Devices Failure Mode setting.

    • Allow Offline Devices Without Encryption: Select the checkbox to confirm that device credentials will be stored as plain text. Required if the Encryption Key field is empty.

    • LDAP Search Scope: Select the scope used when searching the directory for the user’s device data. Only applies when device data is stored on the user object.

    • LDAP Data Source Filter: An LDAP search filter used to locate the user entry. Use ${username} as a placeholder for the authenticating user’s username. For example, for Active Directory: sAMAccountName=${username}.

    • State Attribute: The name of an LDAP attribute on the user object that overrides how that user is authenticated during offline authentication. When set, the adapter reads this attribute to determine whether to bypass or block the individual user. If left empty, no per-user override is applied.

  4. In the Service Unavailable Failure Mode field, configure how the adapter behaves when it’s unable to access PingOne. Options include:

    • Block user: Block the user’s sign-on attempt.

    • Bypass authentication: Authenticate the user without requiring MFA.

    • Enforce offline authentication: The adapter requires offline MFA authentication regardless of PingOne availability. Use this option temporarily if PingOne is down and passive offline authentication isn’t prompting users to authenticate offline.

    • Passive offline authentication: The adapter attempts offline MFA when PingOne is unreachable, then falls back to the No Devices Failure Mode setting if the user has no cached offline credentials.

  5. Click Done, then click Save.