--- title: Configuring PingOne for the Verified Frontline Workers flow pack solution description: Verify that your PingOne environment has the necessary configuration to run the Verified Frontline Workers flow pack solution and enable all the features that you want to use. component: pingone-solutions page_id: pingone-solutions:frontline-workers:getting-started/frontline-configuring-p1 canonical_url: https://docs.pingidentity.com/pingone-solutions/frontline-workers/getting-started/frontline-configuring-p1.html llms_txt: https://docs.pingidentity.com/pingone-solutions/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md section_ids: about-this-task: About this task steps: Steps --- # Configuring PingOne for the Verified Frontline Workers flow pack solution Verify that your PingOne environment has the necessary configuration to run the Verified Frontline Workers flow pack solution and enable all the features that you want to use. ## About this task These steps ensure that the PingOne configuration is correct and enable features such as magic links, agreements, and social sign-on. ## Steps 1. Create an Identity Verification policy for use in the **Frontline Worker - Registration, Authentication and Account Recovery with ID Verification and Recognize - Main Flow**. 1. In the PingOne admin console, go to **Identity Verification** > **Verify Policies**. 2. Click the **+** icon. 3. Configure Government ID settings. 1. Set **Government ID** to **Required**. 2. Select a **Document Authentication Provider** to verify the government ID. 3. Select an **Inspection Type** for the government ID. 4. In the **Government ID Retry Attempts** field, enter a number of times a user can retry scanning an ID if the first attempt fails. 5. If you have users in the USA, select the **Enable AAMVA** option to enable verification of ID information against the AAMVA Driver's License Data Verification (DLDV) service. 6. Select the **Fail Expired IDs** option to fail verification if the government ID has expired. 7. If you have users in India, select the **Enable Aadhaar Verification (India)** option to enable user verification of Aadhaar digital IDs through the DigiLocker wallet. 4. Configure Facial Comparison settings. 1. Set **Facial Comparison** to **Required**. 2. Select a **Threshold** for matching the selfie to the ID. 5. Configure Liveness settings. 1. Set **Liveness** to **Required**. 2. Select a **Threshold** for matching the selfie to the ID. 3. Select a number of **Selfie Retry Attempts**, between 0 and 3. 6. Configure Email settings. 1. Set **Email Verification** to **Disabled**. 7. Click **Save**. 2. Create an Identity Verification policy for use in the **Frontline Worker - Remote User Registration**. 1. In the PingOne admin console, go to **Identity Verification** > **Verify Policies**. 2. Click the **+** icon. 3. Configure Government ID settings. 1. Set **Government ID** to **Required**. 2. Select a **Document Authentication Provider** to verify the government ID. 3. Select an **Inspection Type** for the government ID. 4. In the **Government ID Retry Attempts** field, enter a number of times a user can retry scanning an ID if the first attempt fails. 5. If you have users in the USA, select the **Enable AAMVA** option to enable verification of ID information against the AAMVA Driver's License Data Verification (DLDV) service. 6. Select the **Fail Expired IDs** option to fail verification if the government ID has expired. 7. If you have users in India, select the **Enable Aadhaar Verification (India)** option to enable user verification of Aadhaar digital IDs through the DigiLocker wallet. 4. Configure Facial Comparison settings. 1. Set **Facial Comparison** to **Required**. 2. Select a **Threshold** for matching the selfie to the ID. 5. Configure Liveness settings. 1. Set **Liveness** to **Required**. 2. Select a **Threshold** for matching the selfie to the ID. 3. Select a number of **Selfie Retry Attempts**, between 0 and 3. 6. Configure Email settings. 1. Set **Email Verification** to **Required**. 7. Click **Save**. 3. (Optional) If you plan to use PingOne Protect, create a new predictor: 1. In the PingOne admin console, go to **Threat Protection** > **Predictors**. 2. Click the + icon to add a predictor. 3. In the **Choose Type** list, select **Custom**. 4. In the **Display Name** field, enter **Allowed IP List**. 5. In the **Compact Name** field, enter **allowedIPList**. 6. In the **Attribute Mapping** field, enter **${event.ip}**. 7. In the **Risk Level Mapping** section, click **IP Ranges**. 8. In the **Low**, **Medium**, and **High** fields, enter one or more IP ranges to match each risk rating. 9. Click **Save**. 4. (Optional) If you plan to use PingOne Protect, create a new risk policy: 1. In the PingOne admin console, go to **Threat Protection** > **Risk Policies**. 2. Click the **Global** policy tab. 3. Click the + icon to add a policy. 4. For **Name**, enter **Allowed IP Risk Policy**. 5. Click **+ Add Predictor**. 6. In the **Risk Model** list, select the **Allowed IP List** predictor. 7. Click **Apply**. 8. In the **Rules** section, click **Mitigation**, then click **+ Add**. 9. Set one or more mitigation rules. 1. Click **Add**. 2. In the **Rule** list, select a rule type. 3. Use the **Operator**, **Level**, and **Returned Action** lists to configure the rule. For example, if the rule is Adversary in the Middle and you select Equals, High, and Deny, the rule denies access if a high risk of an adversary in the middle attack is detected. 4. Click **Apply**. 10. Set the Fallback action to Deny. 1. Locate the **Fallback** rule and click **Edit**. 2. In the **Returned Action** list, select **Deny**. 3. Click **Apply**. 11. Click **Apply**. 5. Create three PingOne populations for workers, supervisors, and onboarding workers. 1. Go to **Directory > Populations**. 2. Click the + icon to add a population. 3. Enter a population name: | Name | Description | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- | | Supervisors | Contains users who can authenticate themselves and register new employees. | | Workers | Contains verified employee accounts who can authenticate themselves. | | Onboarding workers | Temporarily contains employees who are invited to register by email. After registration, these employees are moved to the worker population. | 4. Click **Save**. 5. Note the population ID for the new population. 6. Repeat steps a-e for the remaining populations. 6. Add the necessary user attributes. | Name | Description | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `accountStatus` | Controls whether the user account is active for authentication. Only enabled users appear on the login page.New accounts have a status of **DISABLED**. When the worker successfully completes the required identity verification and enrollment process, or when a supervisor approves the registration without ID verification, the status is set to **ENABLED**. | | `accountVerifyStatus` | Tracks the worker's current identity verification status. Valid values are **ID\_NOT\_VERIFIED**, **VERIFIED**, and **ID Verification Pending (Approved by Supervisor on-site)**. | | `dateOfBirth` | The user's date of birth. | | `inviteLinkExpiresAt` | The timestamp at which the invite link expires. | | `inviteTokenHash` | Stores the hash of the raw invitation token. | | `registrationRetryAttempts` | Stores the number of failed or successful registration attempts. This is used to limit the number of retries. | | `inviteTokenSalt` | Stores the per-invitation cryptographic salt used to generate and validate the invite token hash during remote registration. | | `lastAuthenticatedAt` | Stores the timestamp of the user's last successful authentication. | 1. In the PingOne admin console, go to **Directory** > **User Attributes**. 2. Click the **+** icon. 3. For the attribute type, select **Declared**. 4. Click **Next**. 5. In the **Name** field, enter an attribute name from the table above. 6. In the **Display Name** field, enter the same attribute name from the table above. 7. In the **Description** field, enter the description from the table above. 8. Select **No Validation**. 9. Click **Save**. 10. Click the blue toggle to the right to enable the attribute. 11. Repeat steps a-j for the remaining attributes. 7. Create the **Invite Notification** template: 1. In PingOne, go to **User Experience > Notification Templates**. 2. Click **[icon: plus, set=fa]**to create a new template. 3. In the **Type** list, select **General**. 4. In the **Name** field, enter a name for the template. For example: `Invite Notification`. | | | | - | ------------------------------------- | | | Note the template name for later use. | 5. Click **Create**. 6. In the **Subject** field, configure a subject: 1. Click the **Pencil** icon. 2. Enter the subject `Frontline Worker Account Registration`. 3. Click the **[icon: check, set=fa]**icon. 7. In the **New Email** field, configure the message body: 1. Click the **Pencil** icon. 2. Enter a body for the new transaction message. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | You can use the following variables in the message:- `${link}`: The invite link. - `${username}`: The new user's user name. - `${companyName}`: The name of your company. | For example: ```html Complete your registration
${companyName}
Complete your registration
You have been invited to complete your registration

${username},

Welcome to ${companyName}.

You have been invited to complete your registration. To get started, select the button below.

You will be asked to confirm your personal details and complete the required steps for your role.

Before continuing, review your personal details carefully. If anything is incorrect, contact ${supportEmail} before continuing.
Begin Registration

This message was sent by ${companyName}. If you were not expecting this email, contact support. Do not share your registration link with anyone else.

``` 3. Click the **[icon: check, set=fa]**icon. 8. Click **X** to close the template. 8. Create the **Account Created** template: 1. In PingOne, go to **User Experience > Notification Templates**. 2. Click **[icon: plus, set=fa]**to create a new template. 3. In the **Type** list, select **General**. 4. In the **Name** field, enter a name for the template. For example: `Account Created`. | | | | - | ------------------------------------- | | | Note the template name for later use. | 5. Click **Create**. 6. In the **Subject** field, configure a subject: 1. Click the **Pencil** icon. 2. Enter the subject `You are Welcome`. 3. Click the **[icon: check, set=fa]**icon. 7. In the **New Email** field, configure the message body: 1. Click the **Pencil** icon. 2. Enter a body for the new transaction message. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | You can use the following variables in the message:- `${link}`: The invite link. - `${username}`: The new user's user name. - `${companyName}`: The name of your company. | For example: ```html Welcome to ${companyName}
``` 3. Click the **[icon: check, set=fa]**icon. 8. Click **X** to close the template. 9. Create the **Helpdesk Request** template: 1. In PingOne, go to **User Experience > Notification Templates**. 2. Click **[icon: plus, set=fa]**to create a new template. 3. In the **Type** list, select **General**. 4. In the **Name** field, enter a name for the template. For example: `Helpdesk Request`. | | | | - | ------------------------------------- | | | Note the template name for later use. | 5. Click **Create**. 6. In the **Subject** field, configure a subject: 1. Click the **Pencil** icon. 2. Enter the subject `Frontline HelpDesk Request`. 3. Click the **[icon: check, set=fa]**icon. 7. In the **New Email** field, configure the message body: 1. Click the **Pencil** icon. 2. Enter a body for the new transaction message. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | You can use the following variables in the message:- `${link}`: The invite link. - `${username}`: The new user's user name. - `${companyName}`: The name of your company. | For example: ```html Account Recovery Assistance Request - ${companyName}
``` 3. Click the **[icon: check, set=fa]**icon. 8. Click **X** to close the template. 10. (Optional) If you plan to use an agreement, verify that you have an agreement configured in PingOne and copy the agreement ID. Learn more about configuring agreements in [Adding an agreement](https://docs.pingidentity.com/pingone/user_experience/p1_add_an_agreement.html) in the PingOne documentation. 1. Go to **User Experience > Agreements**. 2. Verify that the agreement exists and is enabled. 3. Click the agreement to open the details panel. 4. On the **API** tab, copy the **ID**. The agreement ID is used in a later procedure to configure the flows in DaVinci.