PingOne Advanced Identity Cloud

Push authentication settings

Push authentication settings control how Advanced Identity Cloud stores and protects the device metadata registered by end users of an authenticator app. You must configure these settings to enable push authentication journeys in the realm where you create the journey.

By default, Advanced Identity Cloud creates the configuration with no encryption. For production environments, you should select an encryption scheme and store the associated key in an ESV secret.

You must also configure Push notification delivery before Advanced Identity Cloud can send push notifications to end users' devices.

Configure push authentication settings

  1. In the Advanced Identity Cloud admin console, go to verified_user Authentication > Authentication Methods.

  2. Click Push Authentication.

  3. If push authentication is not already enabled, click Enable Push Authentication to create it with default settings before configuring it.

  4. Configure the following settings:

    Profile Storage Attribute

    The user attribute where Advanced Identity Cloud stores the device profiles registered for push authentication.

    Device Profile Encryption Scheme

    Encryption scheme to use to secure device profiles stored on the server.

    If enabled, each device profile is encrypted using a unique random secret key using the given strength of AES encryption in CBC mode with PKCS#5 padding. An HMAC-SHA of the given strength (truncated to half-size) is used to ensure integrity protection and authenticated encryption. The unique random key is encrypted with the given RSA key pair and stored with the data.

    The possible values for this property are:

    • AES-256/HMAC-SHA-512 with RSA Key Wrapping

    • AES-128/HMAC-SHA-256 with RSA Key Wrapping

    • No encryption of device settings.

    Default value: No encryption of device settings.

    Encryption Key Store

    Path to the key store from which to load encryption keys.

    Updating this setting isn’t currently supported in Advanced Identity Cloud. Changing its value may lead to a loss of functionality in this feature.

    For greater security, store encryption key information in ESVs, instead of in the configuration. Use the secret label am.services.authenticatorpush.encryption to map an alias for push authentication secrets.

    If you update encryption key information in the configuration or in the secret stores, end users with existing device profiles can no longer sign on using push authentication on those devices. Delete the end user’s device profile so that they can create a new one when they next sign on.

    If Advanced Identity Cloud finds a matching secret for the am.services.authenticatorpush.encryption label in the realm’s ESV secret store, this value is ignored.
    Key Store Type

    Type of key store to load.

    This property is preconfigured in your Advanced Identity Cloud tenant and shouldn’t be altered.

    Default value: Java Cryptography Extension Key Store (JCEKS).

    Key Store Password

    Password to unlock the key store. This password is encrypted when it is saved in the Advanced Identity Cloud configuration.

    If Advanced Identity Cloud finds a matching secret for the am.services.authenticatorpush.encryption label in the realm’s ESV secret store, this value is ignored.
    Key-Pair Alias

    Alias of the certificate and private key in the key store. The private key is used to encrypt and decrypt device profiles.

    If Advanced Identity Cloud finds a matching secret for the am.services.authenticatorpush.encryption label in the realm’s ESV secret store, this value is ignored.
    Private Key Password

    Password to unlock the private key.

    If Advanced Identity Cloud finds a matching secret for the am.services.authenticatorpush.encryption label in the realm’s ESV secret store, this value is ignored.
    ForgeRock Authenticator (Push) Device Skippable Attribute Name

    The name of the attribute in a user’s profile used to store their decision on skipping push authentication.

  5. Click Save.