PingOne Privilege

Requiring PingID Workforce Authentication for PingOne Privilege app connections

PingOne Privilege integrates with PingID Workforce Authentication, so users can authenticate with the multi-factor authentication (MFA) method their organization already uses. When you enable this integration, PingOne Privilege challenges users with PingID Workforce Authentication when they connect the PingOne Privilege app to the gateway.

This topic applies to Endpoint Controller-based deployment models. Learn more in Choosing a deployment model.

How PingID Workforce Authentication works with the PingOne Privilege app

In Endpoint Controller-based deployments, users connect the PingOne Privilege app to the gateway to reach their resources. When you require PingID Workforce Authentication, PingOne Privilege issues a challenge before privileged actions such as sign-on or mid-session step-up authentication:

  1. The user launches the PingOne Privilege app and clicks Connect.

  2. If the PingID Workforce Authentication policy applies, the user receives an MFA challenge.

  3. The user can then select from a list of available MFA methods.

  4. The user approves the challenge in the PingID mobile app or the PingID desktop app.

  5. When the challenge succeeds, the app connects to the gateway and the user can request access to their resources through the console.

After the app connects, the user can also launch the admin or user console through the Endpoint Controller. When the PingID Workforce Authentication policy applies, launching the console includes the same MFA challenge.

Users who already use PingID across their PingOne environment sign on with the MFA method they know, without a separate credential for PingOne Privilege. After the app connects, users open the user console through the Endpoint Controller. Learn more in Accessing the user console.

Supported PingID Workforce Authentication methods

Both PingID applications work with this integration:

  • PingID mobile app: users approve a push notification or enter a one-time passcode (OTP).

  • PingID desktop app: users approve the challenge from their desktop application.

Requiring PingID Workforce Authentication for app connections

Before you begin

  • Your organization uses PingID Workforce Authentication in PingOne. Learn how to configure PingID in the PingOne documentation.

  • Users have installed the Endpoint Controller and onboarded their devices. Learn more in Onboarding users.

Steps

You enable PingID Workforce Authentication for PingOne Privilege app connections as a policy option in PingOne.

  1. In the PingOne admin console, go to the MFA policy settings for PingOne Privilege.

  2. Select the option to require MFA when users connect the PingOne Privilege app to the gateway.

  3. Select from the list the PingID authentication methods that users can use to approve the challenge.

  4. Define the users or groups to which the policy applies.

  5. Save the policy.

The next time a user connects the PingOne Privilege app, PingOne Privilege challenges the user with PingID Workforce Authentication before the connection completes.

In No Endpoint Controller-based deployments, single sign-on (SSO) to the admin and user consoles already supports PingID Workforce Authentication through PingOne. No additional configuration is required. Learn more in Tenant settings.