PingOne

Overview of the SSO flow

With the PingOne MFA Integration Kit, PingFederate includes PingOne MFA in the sign-on flow.

The following figure illustrates a single sign-on (SSO) scenario in which PingFederate authenticates users to a service provider (SP) application using PingOne MFA.

The PingFederate sign-on flow including the

Description

  1. The user initiates SSO with PingFederate and completes the first-factor authentication step, such as an HTML Form Adapter instance.

  2. The PingFederate MFA Adapter directly invokes PingOne MFA Device Authentication APIs to initiate the multi-factor authentication (MFA) challenge.

    This direct API integration replaces the authentication policy in the Flow Orchestration Service (FOS) used in versions 3.2 and earlier.

  3. PingOne MFA returns the available authentication methods, such as a one-time passcode (OTP) or push notification. If the user has more than one device paired, PingOne MFA also provides a list of devices.

  4. If the user has multiple devices, PingFederate shows the user a list of devices. The user selects a device.

  5. Depending on the authentication method, one of the following occurs:

    • For OTP authentication, PingOne MFA sends the OTP to the user by email or SMS. In the browser, PingFederate shows a form requesting the OTP. The user enters the OTP in the form and PingFederate validates it directly via API.

    • For push notification, PingOne MFA sends a push notification to the user’s mobile app. PingFederate polls the application programming interface (API) until PingOne MFA provides the authentication result.

  6. If the user authenticated successfully, the PingOne MFA IdP Adapter returns the authentication result to PingFederate, which then completes the SSO flow and provides access to the requested resource.

    Direct MFA APIs do not return OIDC tokens (access_token or id_token). PingFederate treats the MFA result as a discrete step and uses the returned metadata to fulfill the final authentication response.

    Otherwise, it shows the user an optional page with the reason authentication failed.