PingOne Privilege

Configuring AI gateways

The PingOne Privilege AI Gateway secures AI-agent interactions at a single enforcement point. It authenticates every caller, enforces policy at the tool, model, and agent boundaries, and injects backend credentials at runtime so agents never hold them. Every request and response is inspected for AI-specific threats, and all interactions are recorded in one audit trail.

PingOne Privilege allows you to add an AI gateway using a setup wizard or through Docker.

Configure an AI gateway using the setup wizard

Before you begin

  • In the PingOne admin console, create an OIDC web application. For instructions, refer to Creating a web application in the PingOne documentation.

  • Before you add an AI gateway, create a new Virtual Machine (VM) to deploy the proxy container. Ensure the VM meets the required specifications for optimal performance and connectivity:

    • CPU: 2 cores, sufficient for processing proxy operations efficiently.

    • RAM: 4 GB ensures smooth container operation.

    • Storage: 20 GB accommodates system files and application data.

    • Firewall Policy:

      • Outbound: Allow all traffic.

  • Supported Operating Systems:

    • RHEL / CentOS (RPM x86_64)

    • Debian / Ubuntu AMD64

    • Debian / Ubuntu ARM64

Steps

To add an AI gateway using the setup wizard:

  1. In the PingOne Privilege admin console, go to Directory > Gateways.

  2. Click Add New, and then click Add via Wizard.

  3. Review the requirements for your VM, then click Next.

  4. Install Docker based on the official Docker installation guide for your OS.

  5. Verify Docker is running using the following command in your CLI:

    sudo docker ps

    If the command runs without errors, Docker is installed and running successfully.

  6. Select AI Gateway as your deployment mode. Click Next

  7. Enter a unique AI Gateway Name to identify the AI gateway.

  8. Enter the FQDN / Host IP of the server where the AI gateway is installed.

  9. Click Next.

  10. Enter the following fields:

    • AI Gateway Server fields:

      • Gateway URL: FQDN from the VM.

        This URL must have :8623 appended to it.

      • Cert Path: Filled by default.

      • (Optional): Redis URL: Point the Gateway to your Redis URL.

    • Fill in the following fields with information from the OIDC app created in PingOne:

      • Client ID

      • Client Secret

      • Auth URL

      • Token URL

      • User Info URL

      • User ID Claim

  11. Click Next.

  12. Create the environment file with the following commands:

    1. To create the directory, if not already present:

      sudo mkdir -p /var/lib/procyon

    2. To create the file and open it:

      sudo vi /var/lib/procyon/procyon-guest-agent.env

    3. Copy the generated content from your setup tasks and paste it inside the newly created file and save it.

    4. In the setup wizard, click Next.

  13. Select your operating system from the list. Click Show Instructions for the detailed steps for installing the package for your operating system.

  14. Click Finish.

Next steps

After adding the gateway, go to the Directory > Gateways page in the admin console. Your new AI gateway should be listed with a Verified status.

Configure an AI gateway using Docker

Before you begin

  • In the PingOne admin console, create an OIDC web application. For instructions, refer to Creating a web application in the PingOne documentation.

  • Ensure the following inbound ports are open on the host where you will install the Gateway Mesh Cluster:

    • 8623: AI clients to AI Gateway

    • 8680: Endpoint Controller to AI Gateway

    • 8690: Gateway to Gateway - Mesh Cluster

Steps

To add an AI gateway with Docker:

  1. In the PingOne Privilege admin console, go to Directory > Gateways.

  2. Click Add New, and then click Add via Docker.

  3. Select AI gateway.

  4. To generate a Docker command, fill in the following fields with information from the OIDC app created in PingOne:

    • Cluster ID

    • Host IP

    • AI Gateway Server URL

    • OIDC Client ID

    • OIDC Client Secret

    • OIDC Auth URL

    • OIDC Token URL

    • OIDC User URL

    • User ID Claim

  5. Click Get Docker Command.

  6. Click Copy Docker Command to copy the command to your clipboard.

  7. On your designated host within your on-premise network, run the Docker command you just copied.

    Result: The gateway will start and automatically register with the AI gateway.

The Endpoint Controller doesn’t have automatic visibility into on-premises network topology. After deploying the gateway, you must manually configure which resources are accessible through it.

Result

Your new AI gateway should be listed with a Verified status on the Directory > Gateways page.