PingOne Advanced Identity Cloud

Push notification delivery settings

Push notification delivery settings configure the AWS Simple Notification Service (SNS) infrastructure that Advanced Identity Cloud uses to send push notifications to end users' devices.

You must configure these settings before end users can receive push notifications from the PingID app. This configuration requires AWS credentials that are specific to your Advanced Identity Cloud environment. You retrieve these from Backstage before configuring push notification delivery.

Advanced Identity Cloud uses an external AWS service to send push notifications. Its configuration requires access keys and other metadata. As a Ping Identity customer, you have streamlined access to the required metadata.

Before you start, log in to Backstage, then follow the instructions in How To Configure Service Credentials (Push Auth, Docker) in Backstage.

Download the AWS credential data in JSON format and refer to that as you configure push notification delivery.

If you update the AWS credentials for push notification delivery after end users have registered their devices, you must re-register all end user devices. Devices registered with the previous credentials will encounter authorization errors until they’re re-registered.

You must also configure Push Authentication to control how Advanced Identity Cloud stores device profiles.

Configure push notification delivery settings

  1. In the Advanced Identity Cloud admin console, go to verified_user Authentication > Authentication Methods.

  2. Click Push Notification Delivery.

  3. If push notification delivery is not already enabled, click Enable Push Notification Delivery to create it with default settings before configuring it.

  4. Configure the following settings:

    SNS Access Key ID

    The Amazon Simple Notification Service Access Key ID. Find more information in Create an AWS (Push Auth) Credential in Backstage.

    For example, you might set this property to: AKIAIOSFODNN7EXAMPLE

    SNS Access Key Secret

    Amazon Simple Notification Service Access Key Secret. Find more information in Create an AWS (Push Auth) Credential in Backstage.

    For greater security, you can store this secret in the realm secret store.

    Map the secret to the secret label am.services.pushnotification.sns.accesskey.secret.

    If a secret is mapped to this secret label, Advanced Identity Cloud uses that secret and ignores the value of the SNS Access Key Secret property.

    If a secret is mapped to this secret label and Advanced Identity Cloud can’t locate the secret, it falls back to the value of the SNS Access Key Secret property.
    SNS Endpoint for APNS

    The Simple Notification Service endpoint in Amazon Resource Name format, used to send push messages to the Apple Push Notification Service (APNS).

    For example, you might set this property to: arn:aws:sns:us-east-1:1234567890:app/APNS/production

    SNS Endpoint for GCM

    The Simple Notification Service endpoint in Amazon Resource Name format, used to send push messages over Google Cloud Messaging (GCM).

    For example, you might set this property to: arn:aws:sns:us-east-1:1234567890:app/GCM/production

    SNS Client Region

    Region of your registered Amazon Simple Notification Service client. Find more information in https://docs.aws.amazon.com/general/latest/gr/rande.html.

    The possible values for this property are:

    • us-gov-west-1

    • us-east-1

    • us-west-1

    • us-west-2

    • eu-west-1

    • eu-west-2

    • eu-central-1

    • ap-southeast-1

    • ap-southeast-2

    • ap-southeast-3

    • ap-northeast-1

    • ap-northeast-2

    • sa-east-1

    • ca-central-1

    • cn-north-1

    Message Transport Delegate Factory

    The fully qualified class name of the factory responsible for creating the PushNotificationDelegate. The class must implement org.forgerock.openam.services.push.PushNotificationDelegate.

    Response Cache Duration

    The minimum lifetime to keep unanswered message records in the message dispatcher cache, in seconds. To keep unanswered message records indefinitely, set this property to 0.

    Response Cache Concurrency

    Level of concurrency to use when accessing the message dispatcher cache. Must be greater than 0. Choose a value to accommodate as many threads as will ever concurrently access the message dispatcher cache.

    Response Cache Size

    Maximum size of the message dispatcher cache, in number of records. If set to 0 the cache can grow indefinitely. If the number of records that need to be stored exceeds this maximum, then older items in the cache will be removed to make space.

  5. Click Save.