PingGateway 2024.9

PingOneProtectEvaluationFilter

Passes data to PingOne Protect and gets a risk evaluation for an incoming request.

The PingOneProtectEvaluationFilter is available in Technology preview. It isn’t yet supported, may be functionally incomplete, and is subject to change without notice.

PingGateway makes a risk evaluation request to PingOne Protect. The PingOne Protect response returns a risk evaluation including the following items PingGateway retains in the evaluation context:

  • Risk level (low, medium, or high)

  • Risk score, a single aggregated numerical value

The PingOneProtectEvaluationFilter records the evaluation in a PingOneProtectEvaluationContext object. Configure a PingOneProtectThreatLevelRoutingHandler to act on the risk level set in the context. As an alternative, use a DispatchHandler to act on the risk score.

Usage

{
  "name": string,
  "type": "PingOneProtectEvaluationFilter",
    "config": {
      "pingOneService": PingOneService reference,
      "failureHandler": Handler reference,
      "userId": runtime expression<string>,
      "policySet": configuration expression<string>,
      "lowRiskEvaluationThrottlePeriod": configuration expression<duration>,
      "nonEvaluatedUrls": configuration expression<boolean>
  }
}

Configuration

"pingOneService": Handler reference, required

The PingOneService to access the evaluation endpoint in the PingOne environment.

"failureHandler": Handler reference, optional

The handler PingGateway calls when an error occurs.

Default: Return an HTTP 403 Forbidden response; if the request to the evaluation endpoint fails, PingGateway denies access by default.

"userId": runtime expression<string>, optional

An expression setting the user identifier, if available; for example, if the user has already authenticated in the route.

PingGateway raises an error if the expression resolves to null.

Default: A UUID that remains the same for the lifetime of the session

"policySet": configuration expression<string>, optional

The PingOne Protect policy set to use.

Default: The default policy set for the evaluation service

"lowRiskEvaluationThrottlePeriod": configuration expression<duration>, optional

When PingOne Protect returns a low risk level for an incoming request, PingGateway waits until this period expires before making another risk evaluation request for the same session.

Set this to zero to make a risk evaluation request for every incoming request.

Default: 2 minutes

"nonEvaluatedUrls": configuration expression<boolean>, optional

A boolean conditional expression matching request URLs to exclude from risk evaluation.

Default: false (evaluate risk for all request URLs)

Example

The following example prepares PingGateway to make requests to PingOne Protect for risk evaluation. It doesn’t request risk evaluation for CDSSO redirect requests to /home/cdsso/redirect. The policy set identifier depends on your PingOne Protect deployment:

{
    "name" : "PingOneProtectEvaluationFilter-1",
    "type" : "PingOneProtectEvaluationFilter",
    "config" : {
      "pingOneService" : "PingOneService-1",
      "policySet": "47447388-fa5a-40f7-b3f1-24fbbbbc30",
      "userId" : "${contexts.cdsso.claimsSet.subject}",
      "nonEvaluatedUrls" : "${find(request.uri.path, '/home/cdsso/redirect')}"
    }
}