PingID Administration Guide

Background concepts for the PingID for Windows Login - Passwordless integration

These resources support administrators integrating PingID with Windows Login - Passwordless authentication. Because this integration bridges the PingID cloud platform and on-premise Windows Active Directory environments, effective implementation requires deep expertise in both domains.

The following topics cover areas that contribute to a successful integration. Some of these areas are vendor specific. They can change and require greater detail than a background article can cover. You should stay up to date on information relevant to supporting your integration.

The resources are organized into the following areas:

  • The environment: Resources about the underlying infrastructure that supports the integration. This covers Active Directory fundamentals, Domain Controllers, and networking concepts. Network concepts include components like Group Policy Objects (GPOs) for deploying software and the Windows Credential Provider framework, which allows for the custom login experience.

  • Security concepts: The integration relies on certificates to bridge cloud and on-premise. Information covers digital certificates including the distinction between Key Distribution Center (KDC) certificates (issued by internal certificate authorities for Active Directory) and issuance certificates (managed within PingOne).

  • Authentication protocols: Resources about the mechanics of the login process. This includes materials about the Kerberos protocol, the PKINIT configuration for certificate-based authentication, and the FIDO2 and WebAuthn standards used by security keys.

  • Troubleshooting: Diagnostic tools for verifying trust chains and checking revocation status.

The environment

It’s important to understand the existing environment to better understand how it integrates with PingID. The integration directly modifies the Windows login mechanism using the Credential Provider framework, which acts as the software bridge between the local Logon UI and the PingID cloud services.

The following areas will help you understand your environment:

  • Active Directory: A directory service for Windows domain networks. The centralized directory that manages the domain-joined clients that are integrated using PingID with passwordless Windows login.

    Learn more about Active Directory in AD DS Overview in the Microsoft documentation.

  • Domain controller (DC): Required to manage the security and identity requests in a Windows domain and hosts the Key Distribution Center (KDC). It runs the Active Directory Domain Services (AD DS) role.

  • Active Directory Domain Services (AD DS): Provides the fundamental structure for user and group management and domain integrity. It issues the KDC certificates that are crucial for the Kerberos authentication process in the passwordless login flow.

    Learn more in AD DS Overview.

  • Group Policy Management Console and Group Policy Objects (GPO): The GPO is the method used to push out and install the PingID integration software onto client machines using the provided Microsoft Installer (MSI). It also pushes out configuration settings that PingID needs to function properly on managed, domain-joined clients.

    Learn more in the Microsoft Group Policy Management Console documentation.

  • Windows credential providers: The specific framework PingID hooks into to override standard credential prompts with a custom passwordless interface. It orchestrates a handshake between the local Windows session, the Active Directory identity, and the PingID Cloud account to validate the user’s identity.

    Learn more about Windows credential providers in Credential Providers.

  • Networking and connectivity: Facilitation of authorized traffic between clients, domain controllers, and PingOne cloud requires well-configured DNS and firewall rules to resolve properly.

  • DNS: Maps human-readable domain names to IP addresses. Having DNS configured correctly ensures that clients can resolve the needed services and endpoints for authentication.

  • Firewall: Monitors and controls incoming and outgoing network traffic based on configured security rules. Because firewalls can block or inspect HTTPS traffic, their configuration is a common source of connectivity issues. For the Windows Login – Passwordless integration, ensure the firewall allows outbound HTTPS connections to the required PingID endpoints.

    Learn more in What is a Firewall?

  • Trusted Platform Module (TPM): A hardware-based security component that provides secure storage for cryptographic keys. In a passwordless context, the TPM acts as the secure storage for the private keys used in FIDO2 and WebAuthn flows, ensuring no process can export or tamper with them.

    Learn more about TPM in TPM 2.0 Library and Trusted Platform Module Overview.

  • Remote Desktop Protocol (RDP): You can configure Windows Login (passwordless) for use with RDP.

    Learn more in Configuration for use with RDP and Remote Desktop Protocol.

Security concepts

Important security concepts for the integration include the use of certificates for authentication, the role of the KDC in issuing Kerberos tickets, and the FIDO2 and WebAuthn standards for passwordless authentication.

Authentication protocols

Specific protocols used during the login process and how they work.

Troubleshooting

Administrators should monitor their installation, verify MSI installations, inspect trust chains, and troubleshoot Credential Provider "hooks" during the login process. Also maintaining certificates requires a specialized diagnostic toolkit.

The following tools are helpful for monitoring, troubleshooting, and diagnosing problems:

  • Audit the PingOne log files: The PingOne log files provide detailed activity information about Windows Login - Passwordless.

    Learn more in Check the log files.

  • Windows Event Viewer: Use the Applications and Services Logs to diagnose issues. Check entries for the PingID Credential Provider to determine why a login attempt failed.

    Learn more in Check Windows Event Viewer.

  • certmgr.msc: The Microsoft Management Console (MMC) snap-in to manage the current user’s certificates. You can use it to verify that root and intermediate CAs are correctly placed in the user’s certificate store. To open it, run certmgr.msc from the Run command or command prompt.

  • certutil: A command-line utility that you can use for verifying certificate validity and checking revocation status.

  • PowerShell: Essential for automating environment configuration and bulk management.

    Learn more in Introduction to PowerShell.

  • SSL Shopper: A tool to visualize and verify the certificate trust chains, ensuring that the server is configured correctly.

.