PingOne

PingOne MFA attributes reference

PingOne MFA provides two attributes that can be useful in your PingFederate authentication policy.

pingone.mfa.status attribute

This attribute describes the status of the current multifactor authentication request.

pingone.mfa.status values
Value Description

com.pingidentity.pingone.web_login_no_devices

Set when MFA is bypassed for any reason, such as when a user without any trusted devices signs on from the web and the system is configured to bypass authentication for users without a trusted device.

com.pingidentity.pingone.web_login_sms

This status is returned on successful SMS authentication from a web sign on flow.

com.pingidentity.pingone.web_login_email

This status is returned on successful email authentication from a web sign on flow.

com.pingidentity.pingone.web_login_voice

This status is returned on successful voice authentication from a web sign on flow.

com.pingidentity.pingone.web_login_mobile

This status is returned on successful SDK mobile app authentication from a web sign on flow.

com.pingidentity.pingone.web_login_fido

This status is returned on successful biometric/security key authentication from a web sign on flow.

com.pingidentity.pingone.web_login_whatsapp

This status is returned on successful WhatsApp authentication from a web sign on flow.

com.pingidentity.pingone.web_login_otp

This status is returned on successful third-party "timed one-time passcode" (TOTP) authenticator authentication from a web sign on flow.

com.pingidentity.pingone.web_login_oath_token

This status is returned on successful OATH token authentication from a web sign on flow.

com.pingidentity.pingone.mobile_login_sms

This status is returned on successful SMS authentication when the user signs on from an untrusted mobile device.

com.pingidentity.pingone.mobile_login_email

This status is returned when a user signs on with an untrusted mobile device and is authenticated using their trusted email device.

com.pingidentity.pingone.mobile_login_voice

This status is returned on successful voice authentication when the user signs on from an untrusted mobile device.

com.pingidentity.pingone.mobile_login_mobile

This status is returned on successful mobile authentication when the user signs on from an untrusted mobile device.

com.pingidentity.pingone.mobile_login_otp

This status is returned when a user signs on with an untrusted mobile device and is authenticated using their trusted third-party OTP authenticator.

com.pingidentity.pingone.mobile_login_oath_token

This status is returned on successful OATH token authentication when the user signs on from an untrusted mobile device.

com.pingidentity.pingone.mobile_login_fido

This status is returned on successful biometric/security key authentication when the user signs on from an untrusted mobile device.

com.pingidentity.pingone.mobile_login_authentication_code

This status is returned when a user signs on from an untrusted mobile device and completes authentication with an authentication code.

com.pingidentity.pingone.mobile_login_whatsapp

This status is returned on successful WhatsApp authentication when the user signs on from an untrusted mobile device.

com.pingidentity.pingone.mfa_bypassed_during_errors

A user signs on when the system is configured to bypass authentication if there are network problems or PingOne is unreachable.

com.pingidentity.pingone.device_paired

Set when the end-to-end pairing process is completed. That is, the ID token from PingOne has been consumed by the PingOne mobile SDK and the user approved the pairing.

com.pingidentity.pingone.device_not_paired

Set when the device is paired through the front channel. The device is reported as not paired because the ID token is returned as part of the attribute contract and cannot be passed to the PingOne mobile SDK until after authentication.

Also set as part of the API flow when the device was not paired. That is, the user was denied.

com.pingidentity.pingone.pairing_error

Set when there is an error during the pairing flow.

com.pingidentity.pingone.mfa_bypassed_skip_mfa

A user with no authentication methods was prompted to set up MFA, but they clicked Skip.

com.pingidentity.pingone.web_login_pingid_mobile

This status is returned on successful PingID Mobile App authentication from a web sign-on flow.

com.pingidentity.pingone.web_login_pingid_desktop

This status is returned on successful PingID Desktop App (Legacy) authentication from a web sign-on flow.

com.pingidentity.pingone.web_login_pingid_desktop_gen2

This status is returned on successful PingID Desktop App authentication from a web sign-on flow.

com.pingidentity.pingone.web_login_pingid_yubikey

This status is returned on successful YubiKey authentication from a web sign-on flow.

com.pingidentity.pingone.mobile_login_pingid_mobile

This status is returned on successful PingID Mobile App authentication when the user signs on from an untrusted mobile device.

com.pingidentity.pingone.mobile_login_pingid_desktop

This status is returned on successful PingID Desktop App (Legacy) authentication when the user signs on from an untrusted mobile device.

com.pingidentity.pingone.mobile_login_pingid_desktop_gen2

This status is returned on successful PingID Desktop App authentication when the user signs on from an untrusted mobile device.

com.pingidentity.pingone.mobile_login_pingid_yubikey

This status is returned on successful YubiKey authentication when the user signs on from an untrusted mobile device.

com.pingidentity.pingone.device_authorized

This status is returned when authentication completes successfully using device authorization on a previously paired, trusted mobile device. Applies regardless of whether extra verification is required. If extra verification is enabled, the status is only returned after verification is successfully confirmed.

com.pingidentity.pingone.device_authorized_no_response_passive_push

This status is returned when device authorization succeeds on a trusted mobile device where:

  • The session is configured for permissive extra verification

  • The silent background push used for the extra verification doesn’t receive a response confirming successful verification

In this scenario, step up to MFA still succeeds because extra verification is permissive.

com.pingidentity.pingone.mfa_bypassed_invalid_user

MFA is bypassed because the user was not found in PingOne and the User Not Found Failure Mode is set to bypass authentication.

com.pingidentity.pingone.mfa_bypassed_user_mfa_disabled

MFA is bypassed because MFA is disabled for the user in PingOne.

com.pingidentity.pingone.mfa_bypassed_client_side_authentication_used

MFA is bypassed because the user authenticated using a client-side authenticator (such as Conditional UI, or passwordless sign-on).

com.pingidentity.pingone.mfa_bypassed

MFA is bypassed because the user does not meet the conditions that require MFA, such as IP range, user population, or user attributes defined in the adapter configuration.

com.pingidentity.pingone.mfa_completed_externally

MFA was completed by an adapter other than the PingOne MFA IdP Adapter, such as an adapter for an external MFA provider.

com.pingidentity.pingone.mfa_failed

This status is returned when PingOne MFA reports that the MFA attempt failed.

com.pingidentity.pingone.mfa_denied

This status is returned when a policy denies authentication before the MFA attempt begins.

pingone.mfa.status.reason attribute

When the pingone.mfa.status attribute is device_paired, this attribute describes the paired device. When the status is mfa_bypassed, this attribute is set to conditions_not_met.

pingone.mfa.status.reason values
Value Description

mobile_login_sms

The user is using SMS to authenticate.

mobile_login_email

The user is using email to authenticate.

mobile_login_voice

The user is using a voice call to authenticate.

mobile_login_mobile

The user is using the mobile app to authenticate.

mobile_login_otp

The user is using a third-party OTP authenticator to authenticate.

mobile_login_oath_token

The user is using an OATH token to authenticate.

mobile_login_fido

The user is using a biometric/security key authenticator to authenticate.

mobile_login_whatsapp

The user is using WhatsApp to authenticate.

mobile_login_pingid_mobile

The user is using the PingID Mobile App to authenticate.

mobile_login_pingid_desktop

The user is using the PingID Desktop App (Legacy) to authenticate.

mobile_login_pingid_desktop_gen2

The user is using the PingID Desktop App to authenticate.

mobile_login_yubikey

The user is using a YubiKey to authenticate.

conditions_not_met

The user does not meet the conditions that require MFA, so MFA is bypassed and authentication succeeds.

pingone.mfa.device.paired.type attribute

Indicates the authentication method that the user paired during the current authentication session.

pingone.mfa.device.paired.type values
Value Description

EMAIL

Email authentication.

SMS

SMS authentication.

VOICE

Voice authentication.

WHATSAPP

WhatsApp authentication.

MOBILE

Mobile app authentication.

TOTP

TOTP authenticator authentication.

PLATFORM

Platform authenticator authentication.

SECURITY_KEY

Security key authentication.

FIDO2

FIDO2 authenticator authentication.

OATH_TOKEN

OATH token authentication.

PINGID_DESKTOP

PingID Desktop authentication.

PINGID_DESKTOP_GEN2

PingID Desktop (Gen2) authentication.

PINGID_MOBILE

PingID Mobile authentication.

YUBIKEY

YubiKey authentication.

Passwordless authentication attributes

When the PingOne MFA IdP Adapter completes a passwordless (usernameless) authentication, it populates the following attributes in the PingFederate attribute contract. These attributes are available for use in downstream policy steps.

The usernameless_auth_desktop_app_version and usernameless_auth_desktop_os_version attributes are only populated when usernameless_auth_device_type is DESKTOP.
Passwordless authentication attribute values
Attribute Value Description

pi.csa.username

String

The username resolved during passwordless authentication.

is_usernameless_auth_success

true or false

Indicates whether passwordless authentication succeeded.

usernameless_auth_device_type

DESKTOP or FIDO

The type of device used for passwordless authentication.

usernameless_auth_device_id

String

The unique identifier of the device used for passwordless authentication, as assigned by PingOne.

usernameless_auth_desktop_app_version

String

The PingID Desktop App version on the device that completed authentication, as defined in PingOne. Only populated when usernameless_auth_device_type is DESKTOP.

usernameless_auth_desktop_os_version

String

The operating system version on the device that completed authentication, as defined in PingOne. Only populated when usernameless_auth_device_type is DESKTOP.