PingOne MFA CIBA Authenticator settings reference

Field descriptions for the PingOne MFA CIBA Authenticator configuration tab.

Standard fields

Field Description

Field	Description
PingOne Environment	Select the PingOne connection that you created in PingOne MFA IdP Adapter settings reference. This field is blank by default.
Application	The PingOne application that you created in Creating a web or native OIDC application in PingOne. This list is populated after you select the PingOne Environment and PingOne Population. This field is blank by default.
MFA Policy for Authentication	The PingOne MFA policy designed for client-initiated backchannel authentication (CIBA). This list allows you to select the specific MFA policy that the adapter uses for authentication. The adapter maps the ID of the selected policy to the `policy.id` parameter of the direct MFA service API request. This field defaults to `Default`, which uses the default MFA policy in PingOne. This field replaces the PingOne Authentication Policy text field. If you are upgrading from version 3.2, you must manually select the appropriate policy from this list. This field is blank by default.

PingOne Environment

Select the PingOne connection that you created in PingOne MFA IdP Adapter settings reference.

This field is blank by default.

Application

The PingOne application that you created in Creating a web or native OIDC application in PingOne.

This list is populated after you select the PingOne Environment and PingOne Population.

This field is blank by default.

MFA Policy for Authentication

The PingOne MFA policy designed for client-initiated backchannel authentication (CIBA). This list allows you to select the specific MFA policy that the adapter uses for authentication.

The adapter maps the ID of the selected policy to the policy.id parameter of the direct MFA service API request.

This field defaults to Default, which uses the default MFA policy in PingOne.

This field replaces the PingOne Authentication Policy text field. If you are upgrading from version 3.2, you must manually select the appropriate policy from this list.

This field is blank by default.

Advanced fields

Field Description

Test Username

The PingOne username that the adapter uses to test the PingOne MFA connection on the Actions tab.

Enter the username for a user that has a paired device and multi-factor authentication (MFA) enabled in PingOne.

This field is blank by default.

PingOne Template Name

Determines the PingOne notification template is used to show the CIBA request to the user.

For example, if your CIBA notification template in PingOne is a "transaction" template variant called "ciba-purchases", enter transaction.

The default value is transaction.

PingOne Template Variant

Determines which version of the PingOne notification template used to show the CIBA request to the user.

For example, if your CIBA notification template in PingOne is a "transaction" template variant called "ciba-purchases", enter ciba-purchases.

Variants for PingOne notification templates are only available through the PingOne API at this time.

This field is blank by default.

Client Context

This optional field allows you to customize the information sent to PingOne with the CIBA request.

While the CIBA prompt customizations allows you to customize the user-facing message, this field allows you to send additional information that can be used by the mobile application for your needs.

In this field, you can use the following:

$oobAuthRequestContext

Context for the out-of-band authentication/authorization request.

This information is always provided to PingOne.

$languagePackMessages

The language-pack file configured for this authenticator.

This allows you to dynamically customize the language of the message.

$subject

The user’s PingOne username or user ID.

$JSONValue

A JSON utility class that can be used to escape text and convert objects to JSON. Methods include:

escape(String s): Escape quotes, \, /, \r, \n, \b, \f, \t and other control characters (U+0000 through U+001F).
toJSONString(Object value): Convert an object to JSON text.

CIBA request policy contract attributes

Attributes that you add on the Extended Contract tab are available here using the $<name> syntax. For example, $currency.

The following example shows a variety of context parameters:

{
   "requestingApplicationName": "$JSONValue.escape($oobAuthRequestContext.requestingApplication.name)",
   "requestedScope": ",$JSONValue.toJSONString($oobAuthRequestContext.requestedScope.values())",
   "amount": "$JSONValue.escape($amount)",
   "alert.color": "red"
}

Lines that appear between #* and *# are comments. They are not evaluated or sent to PingOne.

The default value is a comment explaining the above.

Messages Files

Identifies the customizable language-pack file that the authenticator uses.

If you customize the language-pack file names in the /server/default/conf/template/language-packs directory, enter the new name here.

The default selection is pingone-mfa-messages.

API Request Timeout

The amount of time in milliseconds that PingFederate allows when establishing a connection with PingOne MFA or waiting for a response to a request. A value of 0 disables the timeout.

The default value is 2000.

Proxy Settings

Defines proxy settings for outbound HTTP requests.

The default value is System Defaults.

Custom Proxy Host

The proxy server host name to use when Proxy Settings is set to Custom.

This field is blank by default.

Custom Proxy Port

The proxy server port to use when Proxy Settings is set to Custom.

This field is blank by default.