Using the administrative console, create advanced registration mapping by defining authentication policies in your adapter instances.

To illustrate the configuration steps, consider the following setup that you have already made with the parameters username and policy.action. Whether or not the local identity profile is configured with any authentication sources, if the user chooses to register directly by clicking on the Register now link, PingFederate sets the value to identity.registration. This fulfillment allows you to create rules to differentiate authentication requirements from the registration flow.

  • A PingDirectory installation with a set of users.
  • An LDAP datastore, an LDAP Username Password Credential Validator instance, and an HTML Form Adapter instance on PingFederate to validate credentials stored in PingDirectory.
  • An IdP authentication policy that chains the HTML Form Adapter instance, an PingID Adapter instance, and an authentication policy contract for the purpose of enforcing PingID multi-factor authentication in multiple browser-based single sign-on (SSO) use cases through service provider (SP) connections, OAuth authorization code flow, and OAuth implicit flow. The following window capture illustrates your existing policy.
    A screen capture of the Manage Authentication Policy window that displays existing authentication policies

To illustrate the configuration steps, consider the following setup that you have. You need to add support for a consumer registration use case similar to the one in Setting up self-service registration, and, at the same time, keep the policy that enforces the multi-factor authentication requirement.

Configuration steps.

  1. Set up PingDirectory for customer identities.
  2. Make a note of which authentication policy contract is currently being used in your policy.
  3. Create a local identity profile.
    1. G to Authentication > Policies > Local Identity Profiles configuration wizard.
    2. On the Profile Info tab, in the Local Identity Profile Name field, enter a name of the local identity profile, and from the Authentication Policy Contract list, select the authentication policy from step 2. Select the Enable Registration check box.

      If you want to enable profile management as well, select the relevant check box.

  4. Configure the HTML Form Adapter instance for customer identities.
    1. Go to Authentication > Integration > IdP Adapters.
    2. From the Instance Name section, select the HTMLFormAdapter.
    3. On the IdP Adapter tab, from the Local Identity Profile list, select a local identity profile.
    4. Complete the rest of the configuration and save all changes.
  5. Modify your existing IdP authentication policy.
    1. Go to Authentication > Policies > Policies.
    2. On the Policies tab, under the Policy section, click the relevant policy to open the Policy window.
    3. Under the Success path of the HTML Form Adapter instance, click Rules.
    4. In the Rules dialog, create a policy path for users who choose to register. For this sample use case, configure as follows.
      Defining authentication policy rules attributes field and values
      Attribute Name Condition Value Result
      policy.action equal to identity.registration Registration

      Complete the rest of the configuration to create the local identity. The Result field controls the label shown for the policy path of this rule.

      In addition, ensure the Default to Success check box is selected. When selected, the Success path remains, which is important for this sample use case where users are redirected to the PingID Adapter instance to fulfill the multi-factor authentication requirement after authenticating successfully against the HTML Form Adapter.

      When finished, click Done, which brings you back to the Manage Authentication Policies window.

    5. For the Registration path, select the local identity profile from step 3 under Action and then complete its Local Identity Mappingconfiguration.

      The following screen capture illustrates your new policy.

      A screen capture of configuring authentication sources and successful paths to policy contracts to reuse mapping configuration.
    6. If you have enabled profile management in step 3, you must also replace the policy contract with the local identity profile and then complete its Local Identity Mapping configuration.

      This step is required so that PingFederate can route users through the HTML Form > PingID policy path when they try to access the profile management page.

      The following screen capture illustrates this change.

      A screen capture of configuring an authentication policy to enable PingFederate to route users through the HTML Form Adapter to PingID
      Note:

      No reconfiguration is required in your Browser SSO connections and OAuth grant-mapping configuration for your new policy to take effect.

    7. Click Save to keep your changes.

You have now successfully added the requested consumer registration and profile management use case to your current policy.