PingID Administration Guide

Installing passwordless Windows Login integration on client computers

You can install the integration for passwordless Windows login on your users' computers with the command-line interface that is provided or with the UI-based installation.

Requirements

  • To use the passwordless Windows login feature, users' computers must be running Windows 10 (64-bit) or Windows 11, and must support TPM 2.0.

    If you have set the Resident Key option to Required for FIDO2 security keys, users do not require TPM on their computer in order to use the passwordless login, provided that they paired their keys after the setting was changed to Required. For more information on the Resident Key option, see (Legacy) Configuring the FIDO2 security key for PingID. Since TPM 2.0 provides a higher degree of security, the passwordless login for Windows will always use TPM for storage if the relevant computer has the necessary support.

  • The first time that a user carries out passwordless Windows login, they need to be online and connected to the organizational network because certificate enrollment requires a connection to Active Directory. Afterwards, there is no need for a connection to the network, and authentication can be carried out online or offline (for as long as the certificate is valid).

  • UI-based installation

  • Command-line installation

Installing passwordless Windows Login integration on client computers (UI)

You can install the integration for passwordless Windows Login on your users' computers with the UI-based installation described in this topic.

Steps

  1. Run the provided executable, and when the welcome screen is displayed, click Next.

    Win Login Passwordless - UI-based installation - initial screen

  2. Accept the license agreement and click Next.

    Win Login Passwordless - UI-based installation - license agreement

  3. The settings that must be entered on the Passwordless Sign-on Settings screen should be copied from the Configuration tab of the application you created for Windows Login - Passwordless in PingOne. If your organization uses a proxy, click Configure Proxy. Otherwise, click Next.

    Win Login Passwordless - UI-based installation - application settings

  4. If you clicked Configure Proxy in the previous step, enter the proxy information, click Apply, and when you are returned to the Passwordless Sign-on Settings screen, click Next.

    Win Login Passwordless - UI-based installation - proxy configuration

  5. When the Ready to Install screen is displayed, click Install to start the installation.

    Win Login Passwordless - UI-based installation - final screen

Installing passwordless Windows Login integration on client computers (CLI)

While you can install the integration for passwordless Windows Login on your users' computers with the UI wizard that is provided, you can also use the CLI-based installation that is described in this topic.

== Mandatory parameters

The following parameters are mandatory and should be copied from the Configuration tab of the application you created for Windows Login - Passwordless, in PingOne.

  • /OIDCDiscoveryEndpoint - the OIDC discovery endpoint, from the URL section of the Configuration tab

  • /OIDCClientID - the client ID, from the General section of the Configuration tab

  • /OIDCSecret - the client secret, from the General section of the Configuration tab. Click the Show Secret icon, and then copy the text displayed.

== Optional Parameters

  • /DIR - the path where the software should be installed. If this parameter is not specified, it will be installed toC:\Program Files\Ping Identity\PingID\Windows Passwordless

  • /LOG - specify a path if you want a log file to be created for the installation

  • /VERYSILENT - neither the background window nor the installation progress window are displayed

  • /SILENT - the background window is not displayed, but the installation progress window is displayed

  • /ProxyAddress - proxy URI, if you are using a proxy

  • /ProxyUserName - user name if you are using a proxy

  • /ProxyPassword - password if you are using a proxy

  • /HttpRequestTimeout - timeout to use for HTTP requests, in milliseconds - can be between 1000 and 30000, default is 10000 milliseconds

  • /NORESTART - prevents installer from restarting the system following a successful installation. Note that Windows Login - Passwordless will not work until after the computer is rebooted.

  • /RSA_PADDING -use the value oaep to specify that OAEP padding should be used in the encryption for offline authentication (default). If you do not want to use OAEP padding for offline authentication, use the value none.

  • /ALG_KEY_TYPE - set the registry key algorithm type. Possible values:

    • 0 = RSA

    • 1= ECC

  • /AllowInsecureDiscouragedUV - Skip user verification for Windows login passwordless users when using any FIDO device. Possible values:

    • 0 = Disabled

    • 1 = Enabled

      Use this option with caution, as it relies solely on the FIDO device to authenticate, and does not distinguish between different users.

  • /SUPPORT_CAMERA_LAUNCHER: When enabled, the user can scan the manual authentication QR code from their device camera. When the user scans the manual authentication QR code with their device camera, PingID mobile app opens automatically, displaying the manual authentication key. This option requires PingID mobile app 2.3 or later. Possible values:

    • 0 = Disabled

    • 1 = Enabled

== Sample installation command

"PingIDWindowsLogin - Passwordless_1.0.0.0.exe" /LOG=C:\Users\user\Desktop\log.txt /VERYSILENT /ProxyAddress=http://1.1.1.1:8080/ /ProxyUserName=<username> /ProxyPassword=<password>/HttpRequestTimeout=5000 /OIDCDiscoveryEndpoint=https://auth-test.pingone.com/71ab9623-dd25-4eaf-8a72-597ee70532b1/as/.well-known/openid-configuration /OIDCClientID=17fbc3dc-aa45-6854-9a82-761d906cbcff /OIDCSecret=<secret>