PingOne Advanced Identity Cloud

Set up mapped PingOne environments

To integrate with PingOne, you need to set up a PingOne environment for each of your Advanced Identity Cloud tenant environments. To help you keep track of your PingOne environments, use the following rules:

  • Naming convention: Use this naming convention when you create PingOne environments. Because the naming convention is based on your tenant environment FQDNs, each name acts as an informal mapping and makes it easy to identify which PingOne environment corresponds to which Advanced Identity Cloud tenant environment.

  • Reuse environments: Use these same mapped PingOne environments for all PingOne products you integrate into Advanced Identity Cloud. Reusing environments reduces the number of PingOne environments and OIDC credentials you need to keep track of.

You also need to add the outbound static IP addresses of each of your Advanced Identity Cloud tenant environments to the server-sourced traffic exclusion list in the mapped PingOne environment. This prevents rate limits being applied to calls from Advanced Identity Cloud to PingOne services.

Create mapped PingOne environments

For each of your Advanced Identity Cloud tenant environments:

  1. In the Advanced Identity Cloud admin console:

    1. Find the tenant environment’s FQDN using the instructions in Confirm the FQDN in tenant settings. An example FQDN is openam-mycompany-ew2-dev.id.forgerock.io.

    2. Find the tenant environment’s outbound static IP addresses:

      1. Open the TENANT menu (upper right), then click Tenant Settings > Global Settings > IP Addresses.

      2. Make a note of the one or more listed IP addresses.

      If you don’t have this menu option, your tenant environment may not have outbound static IP addresses enabled. Learn more in How do I enable outbound static IP addresses for my tenants?.

  2. In the PingOne admin console:

    1. In the sidebar, click the Ping Identity logo to open the Environments page.

    2. Check if you already have a mapped PingOne environment (a PingOne environment with a name that corresponds to the FQDN of your Advanced Identity Cloud tenant environment). An example environment name is env-pingoneaic-mycompany-ew2-dev.

      • If a mapped environment exists, you can use that environment. You don’t need to create new environments for each PingOne product you integrate into Advanced Identity Cloud.

      • If no mapped environment exists, create one using the naming convention.

    3. Return to the Environments page, click the mapped PingOne environment, then click Manage Environment > Settings > Rate Limits.

    4. In the Server-Sourced Traffic section, under the Allowed IP addresses or CIDR ranges label, enter the outbound static IP addresses you noted from the Advanced Identity Cloud admin console. Enter each IP address in a separate field, and click the add Add button to add more fields as needed.

    5. Click Save.

Naming convention for mapped PingOne environments

The naming convention of the PingOne environments should follow the FQDN naming convention of your Advanced Identity Cloud tenant environments.

The following table shows an example of how to name PingOne environments based on the example FQDNs in Tenant environment FQDNs.

Tenant environment FQDN Mapped PingOne environment name

Sandbox

openam-mycompanysandbox1-ew2.forgeblocks.com

env-pingoneaic-mycompany-ew2-sandbox1

Sandbox 2

openam-mycompanysandbox2-ew2.forgeblocks.com

env-pingoneaic-mycompany-ew2-sandbox2

Development

openam-mycompany-ew2-dev.id.forgerock.io

env-pingoneaic-mycompany-ew2-dev

UAT

openam-mycompany-ew2-uat.id.forgerock.io

env-pingoneaic-mycompany-ew2-uat

UAT 2

openam-mycompany-ew2-uat2.id.forgerock.io

env-pingoneaic-mycompany-ew2-uat2

Staging

openam-mycompany-ew2-staging.id.forgerock.io

env-pingoneaic-mycompany-ew2-staging

Production

openam-mycompany-ew2.id.forgerock.io

env-pingoneaic-mycompany-ew2-prod