---
title: Create trees for push authentication and registration
description: Push authentication uses authentication trees to receive push notifications and to perform the actual authentication itself.
component: pingam
version: 7.2
page_id: pingam:authentication-guide:authn-mfa-trees-push
canonical_url: https://docs.pingidentity.com/pingam/8/am-authentication/authn-mfa-trees-push.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
superseded_by: https://docs.pingidentity.com/pingam/8/am-authentication/authn-mfa-trees-push.html
section_ids:
  proc-authn-mfa-tree-push: Create a tree for push authentication
  proc-authn-mfa-tree-push-passwordless: Create a tree for passwordless authentication
---

# Create trees for push authentication and registration

Push authentication uses authentication trees to receive push notifications and to perform the actual authentication itself.

Authentication trees can be used for passwordless authentication using push notifications. When configured for passwordless authentication, the authentication flow asks the user to enter their user ID but not their password. A push notification is then sent to their registered device to complete the authentication by using the ForgeRock Authenticator app.

Before implementing passwordless push authentication, consider the [Limitations when using passwordless push authentication](mfa-push-passwordless-limitations.html).

## Create a tree for push authentication

The procedure assumes the following:

* Users will provide user IDs and passwords as the first step of MFA.

* A push notification will be sent to the device as a second factor to complete authentication.

* The following services are configured:

  * ForgeRock Authenticator (Push) Service

    Specifies the attribute in which to store information about the registered Push device, and whether to encrypt the data.

    For detailed information about the available properties, see [ForgeRock Authenticator (Push) Service](../reference/global-services-configuration.html#global-authenticatorpushservice).

  * Push Notification Service

    Configures how AM sends push notifications to registered devices, including endpoints, and access credentials.

    For information on provisioning the credentials required by the Push Notification Service, see [How To Configure Service Credentials (Push Auth, Docker) in Backstage](https://backstage.pingidentity.com/knowledge/backstagehelp/article/a92326771) in the *ForgeRock Knowledge Base*.

    For detailed information about the available properties, see [Push Notification Service](../reference/global-services-configuration.html#global-pushnotification).

To create an MFA tree, follow these steps:

1. In the AM admin UI, go to Realms > *Realm Name* > Authentication > Trees, and create the authentication tree as follows:

   * Select Authentication > Trees, and click Create Tree.

   * Specify a name of your choosing; for example `myPushTree`, and click Create.

     The authentication tree designer is displayed, with the start entry point connected to the failure exit point.

     You can add nodes to the authentication tree by dragging the node from the Components panel on the left-hand side and dropping it into the designer area.

   * Add the following nodes to the authentication tree:

     * [Username Collector node](auth-node-configuration-hints.html#auth-node-username-collector)

     * [Password Collector node](auth-node-configuration-hints.html#auth-node-password-collector)

     * [Push Sender node](auth-node-configuration-hints.html#auth-node-push-sender)

     * [Push Result Verifier node](auth-node-configuration-hints.html#auth-node-push-result-verifier)

     * [Polling Wait node](auth-node-configuration-hints.html#auth-node-polling-wait)

     * [MFA Registration Options node](auth-node-configuration-hints.html#auth-node-mfa-registration-options)

     * [Opt-out Multi-Factor Authentication node](auth-node-configuration-hints.html#auth-node-opt-out-multi-factor)

     * [Push Registration node](auth-node-configuration-hints.html#auth-node-push-registration)

     * [Get Authenticator App node](auth-node-configuration-hints.html#auth-node-get-authenticator-app)

     * `Success Node`

   * Connect the nodes as demonstrated in the following figure:

     ![trees-node-push-sender-example.png](_images/trees-node-push-sender-example.png)Figure 1. Example Push Tree (Standalone AM)![trees-node-push-sender-example-platform.png](_images/trees-node-push-sender-example-platform.png)Figure 2. Example Push Tree (Ping Identity Platform)

   * Save your changes.

2. Test your authentication tree as follows:

   * Log out of AM, and then go to a URL similar to the following: `https://openam.example.com:8443/openam/XUI/?realm=/alpha&service=myPushTree#login`

   * Follow the procedure described in [Test push authentication](mfa-authenticating-push.html) to verify that you can use the ForgeRock Authenticator app to perform MFA. If the authentication tree is correctly configured, authentication is successful and AM displays the user profile page.

## Create a tree for passwordless authentication

The procedure assumes the following:

* Users will provide only their user IDs as the first step of MFA.

* This procedure assumes users have a device registered for push authentication.

* A push notification will be sent to the device as a second factor to complete authentication, without the need to enter the user's password.

* The following services are configured:

  * ForgeRock Authenticator (Push) Service

    Specifies the attribute in which to store information about the registered Push device, and whether to encrypt the data.

    For detailed information about the available properties, see [ForgeRock Authenticator (Push) Service](../reference/global-services-configuration.html#global-authenticatorpushservice).

  * Push Notification Service

    Configures how AM sends push notifications to registered devices, including endpoints, and access credentials.

    For information on provisioning the credentials required by the Push Notification Service, see [How To Configure Service Credentials (Push Auth, Docker) in Backstage](https://backstage.pingidentity.com/knowledge/backstagehelp/article/a92326771) in the *ForgeRock Knowledge Base*.

    For detailed information about the available properties, see [Push Notification Service](../reference/global-services-configuration.html#global-pushnotification).

To create an MFA tree for passwordless authentication, follow these steps:

1. In the AM admin UI, go to Realms > *Realm Name* > Authentication > Trees, and create the authentication tree as follows:

   * Select Authentication > Trees, and click Create Tree.

   * Enter a name for the tree, for example `myPasswordlessAuthTree`, and click Create.

     The authentication tree designer is displayed, with the Start entry point connected to the Failure exit point.

     You can add nodes to the authentication tree by dragging the node from the Components panel on the left-hand side and dropping it into the designer area.

   * Add the following nodes to the authentication tree:

     * [Username Collector node](auth-node-configuration-hints.html#auth-node-username-collector)

     * [Push Sender node](auth-node-configuration-hints.html#auth-node-push-sender)

     * [Push Result Verifier node](auth-node-configuration-hints.html#auth-node-push-result-verifier)

     * [Polling Wait node](auth-node-configuration-hints.html#auth-node-polling-wait)

     * `Success Node`

   * Connect the nodes as demonstrated in the following figure:

     ![An authentication tree setup for passwordless push authentication.](_images/passwordless-auth-tree.png)Figure 3. Passwordless Push Authentication Example (Standalone AM)![An authentication tree setup for passwordless push authentication.](_images/passwordless-auth-tree-platform.png)Figure 4. Passwordless Push Authentication Example (Ping Identity Platform)

   * Save your changes.

2. Test your authentication tree as follows:

   * Log out of AM, and then go to a URL similar to the following: `https://openam.example.com:8443/openam/XUI/?realm=/alpha&service=myPasswordlessAuthTree#login`

   * Follow the procedure described in [Test push authentication](mfa-authenticating-push.html) to verify that you can use the ForgeRock Authenticator app to perform MFA. If the authentication tree is correctly configured, authentication is successful and AM displays the user profile page, without having to enter a password.