PingOne Advanced Identity Cloud

Device binding settings

Device binding associates trusted devices with user identities. Journeys can use device binding to support risk-based or step-up authentication. For example, device binding can let end users skip a second factor on a device they’ve previously verified, or require stronger authentication when a sign-on comes from an unrecognized device.

Device binding settings control how Advanced Identity Cloud stores and protects data for bound devices.

By default, Advanced Identity Cloud creates the configuration with no encryption. For production environments, you should select an encryption scheme and store the associated key in an ESV secret.

Updating the encryption key store setting after end users have bound their devices isn’t supported. If you change encryption key information (in the configuration or in the secret stores) end users with existing bound devices can no longer sign on using those bound devices. You’ll need to delete each affected end user’s device profile so they can re-bind their device the next time they sign on.

Configure device binding settings

  1. In the Advanced Identity Cloud admin console, go to verified_user Authentication > Authentication Methods.

  2. Click Device Binding.

  3. If device binding is not already enabled, click Enable Device Binding to create it with default settings before configuring it.

  4. Configure the following settings:

    Device Binding Attribute

    The user’s attribute in which to store bound device data.

    Default value: boundDevices

    Device Binding Encryption Scheme

    Encryption scheme to use to secure device binding data stored on the server.

    If enabled, the data for each bound device is encrypted using a unique random secret key using the given strength of AES encryption in CBC mode with PKCS#5 padding. An HMAC-SHA of the given strength (truncated to half-size) is used to ensure integrity protection and authenticated encryption. The unique random key is encrypted with the given RSA key pair and stored with the data.

    The possible values for this property are:

    • AES-256/HMAC-SHA-512 with RSA Key Wrapping

    • AES-128/HMAC-SHA-256 with RSA Key Wrapping

    • No encryption of device settings.

    Default value: No encryption of device settings.

    Encryption Key Store

    Path to the key store from which to load encryption keys.

    Updating this setting isn’t currently supported in Advanced Identity Cloud. Changing its value may lead to a loss of functionality in this feature.

    For greater security, store encryption key information in ESVs, instead of in the configuration. Use the secret label am.services.devicebinding.encryption to map an alias for Device Binding secrets.

    If you update encryption key information in the configuration or in the secret stores, end users with existing device profiles can no longer sign on using those bound devices. Delete the end user’s device profile so that they can create a new one when they next sign on.

    If Advanced Identity Cloud finds a matching secret for the am.services.devicebinding.encryption label in the realm’s ESV secret store, this value is ignored.

    Default value: /path/to/openam/security/keystores/keystore.jks

    Key Store Type

    Type of key store to load.

    This property is preconfigured in your Advanced Identity Cloud tenant and shouldn’t be altered.

    Default value: Java Key Store (JKS)

    Key Store Password

    Password to unlock the key store. This password is encrypted when it is saved in the Advanced Identity Cloud configuration. You should modify the default value.

    If Advanced Identity Cloud finds a matching secret for the am.services.devicebinding.encryption label in the realm’s ESV secret store, this value is ignored.
    Key-Pair Alias

    Alias of the certificate and private key in the key store. The private key is used to encrypt and decrypt bound device data.

    If Advanced Identity Cloud finds a matching secret for the am.services.devicebinding.encryption label in the realm’s ESV secret store, this value is ignored.
    Private Key Password

    Password to unlock the private key.

    If Advanced Identity Cloud finds a matching secret for the am.services.devicebinding.encryption label in the realm’s ESV secret store, this value is ignored.

  5. Click Save.