Installing the PingID integration for Mac login - PingID

PingID Administration Guide
Page created: 19 Oct 2020 |
Page updated: 23 Nov 2021
| 1 min read

PingId Product

You can install the PingID integration for Mac login with the UI wizard or with the command-line installation.

Note: If for some reason you decide to downgrade to an earlier version of the PingID integration with Mac login, you must completely remove the installed version and only then install the earlier version.

Installing PingID integration for Mac login using UI wizard

Page created: 19 Oct 2020 |
Page updated: 14 Feb 2023
| 4 min read

PingId Product

Install PingID integration for Mac login through the User Interface (UI).

Important:

Adding any multi-factor authentication (MFA) is a procedure that carries the risk of being locked out of the machine.

  • Several verifications are done on the parameters supplied for the installation to minimize any locking. The PingID integration for Mac login permits recovery from a lockout scenario, by restarting the machine in Single User Mode.
  • Ensure that the remote login option is enabled on the Mac to allow connection to the machine by SSH.

To install the PingID integration, you must have:

  • Administrator privileges on the target Mac machine.
  • A copy of the organization's pingid.properties file. For instructions on how to download the relevant PingID properties file (with full or restricted permissions), see Managing the PingID properties file.
To install the PingID Integration for Mac login using the UI wizard:
  1. On the PingID Downloads page, go to Integrations and download the PingID package .pkg file for Mac login.
  2. Double-click the PingID-MacOS-Login<version>.dmg file to launch the setup wizard.

    The installer opens.


    Ping ID for Mac login - initial screen
  3. Double-click the PingID.pkg icon.
  4. At the security check window, click Continue.
  5. At the installer commencement window, click Continue.
    The Software License Agreement window is displayed.
  6. Review the Software License Agreement, click Continue, and when prompted, click Agree.

    The installation proper starts with the Installation Type window.


    Mac login installation - select installation type
  7. Optional: Click Change Install Location.

    The Destination Select window opens.


    Mac login installation - select destination
  8. Keep the highlighted option unless there are compelling reasons for a different choice. Click Continue and then click Install.
  9. If required, enter your machine user name and password.

    You see the following caution message.


    Mac login installation - installation confirmation message
  10. Click Continue Installation.
  11. In the Organization Information pane, click Browse, and then select the pingid.properties file that you downloaded from the Admin portal.

    For more information, see Downloading PingID properties file with restricted permissions.



  12. Click Continue.

    The Manual Authentication window opens.


    Mac login - manual authentication options
    Choose the option to use for situations where the user cannot communicate with the PingID server:
    • Required - User can use the PingID mobile app for offline access. If they do not have a paired mobile device, their access is blocked.
    • Optional - User must use the PingID mobile app for offline access, but if they don't have a paired mobile device, MFA is bypassed.
    • Disabled - Offline access is not permitted.
  13. Click Continue.

    The Organization Information window is displayed.


    Mac login installation - organization information window
  14. Optional: In the Organization Domain window, In the Organization Domain field, specify your organization's default domain.

    The domain format should be:

    • @domainname, such as @somewhere.com.
    • Maximum of 50 characters.
    • The string entered in this field is appended to the username during sign on.

    If specified, users can enter their user name, such as john.smith, rather than entering user name plus domain name, such as john.smith@somewhere.com, where the domain name is otherwise required.

    Note:

    Because the username (plus domain name if set here) is sent to PingID for second factor authentication, it must precisely match a username entered through the admin portal. For PingID, user john.smith is not the same as johm.smith@somewhere.com even if the domain is correct.

  15. Click Continue.

    If you changed anything in the previous step, you might be asked to enter your machine username and password.

    When the installation is complete, you see the following window.


    Mac login installation - installation success message
  16. Click Log Out.

    You are asked what to do with the installer package.


    Mac login installation - question about deleting installer package
  17. Decide whether or not to keep the installer package.

    The installer exits and the machine is logged out to apply the changes.

  18. Optional: After successful installation, the downloaded pingid.properties file may be deleted from the Mac.
  19. To verify the installation, test that a user can sign on to the Mac machine using the PingID integration for Mac login.

Installing PingID integration for Mac login using CLI

Page created: 19 Oct 2020 |
Page updated: 14 Feb 2023
| 2 min read

PingId Product

Install the PingID integration for Mac login using the command-line interface (CLI).

Important:

Adding any multi-factor authentication (MFA) is a procedure that carries the risk of being locked out of the machine.

  • Several verifications are done on the parameters supplied for the installation to minimize any locking. The PingID integration for Mac login permits recovery from a lockout scenario by restarting the machine in Single User Mode.
  • Ensure that the remote login option is enabled on the Mac to allow connection to the machine by SSH.

To install the PingID integration, you must have:

  • Administrator privileges on the target Mac machine.
  • A copy of the organization's pingid.properties file. For instructions on how to download the relevant PingID properties file (with full or restricted permissions), see Managing the PingID properties file.

Installing the PingID integration from the command line is useful for deploying to multiple machines in batch mode.

To install the PingID Integration for Mac login using the CLI:
  1. On the PingID Downloads page, go to Integrations, and download the PingID package .pkg file for Mac login.
  2. Double-click the PingID-MacOS-Login<version>.dmg file to launch the setup wizard.

    The installer opens.


    Ping ID for Mac login - initial screen
  3. Copy and paste the PingID.pkg and InstallPingID files to a convenient location.
  4. Download the PingID properties file to the location in step 3.
  5. Open a terminal session and change directory to where you copied the file in step 3.
  6. Optional: To see the available CLI help, run the ./InstallPingID --help command.
  7. Run the installation from a command prompt or create a script containing the required install command.
    • Install using the pingid.properties file to supply parameter values.

      ./InstallPingID --orgSettingsFilePath /Users/admin/Downloads/pingid.properties [optional parameters]

    • Install without using the pingid.properties file. Supply the --orgAlias, --orgKey, --authenticatorAddress, and --token parameter values on the command line.

      ./InstallPingID --orgAlias <organization alias string> --orgKey <organization key string> --authenticatorAddress <URL of PingID data center> --token <API key identifier> [optional parameters]

Mac login command line reference

Page created: 19 Oct 2020 |
Page updated: 14 Feb 2023
| 4 min read

PingId Product

The following tables provide an overview of the command line commands you can use for the PingID integration for Mac login

Running the installer from the CLI

The general command line is ./InstallPingID [options] [filepath_opt]

Where:

[filepath_opt] takes the form -p <PingID.pkg file path> or --package <PingID.pkg file path>.

PingID properties
Parameter <Argument> Description

-f, --orgSettingsFilePath <Full pingid.properties filepath>

The full file path of the PingID properties file. For example, /Users/admin/Downloads/pingid.properties.

The PingID properties file is referenced from this location during the installation process.

You must specify either:

  • -f, --orgSettingsFilePath

OR all of the following parameters:

  • -a, --orgAlias
  • -k, --orgKey
  • -u, --authenticatorAddress
  • -t, --token
Note:

If any of the above parameters are specified, and /orgSettingsFilePath is also specified on the command line, then the values are retrieved from the pingid.properties file only, and the values of these other parameters specified on the command line are ignored.
-a, --orgAlias <organization's alias string>

The organization's alias. This value is an entry in the PingID properties file.

If the --orgSettingsFilePath parameter is not specified, it is mandatory to provide the --orgAlias parameter.

If both the --orgSettingsFilePath and --orgAlias are specified, the value is retrieved from the pingid.properties file, and the value of the --orgAlias parameter is ignored.

-k, --orgKey <organization key string>

The organization's base64 key. This value is an entry in the PingID properties file.

If the --orgSettingsFilePath parameter is not specified, it is mandatory to provide the --orgKey parameter.

If both the --orgSettingsFilePath and --orgKey are specified, the value is retrieved from the pingid.properties file, and the value of the --orgKey parameter is ignored.

-u, --authenticatorAddress <URL of PingID data center>

The URL of the PingID data center to which the organization is associated.

It is the URL that is listed on the line in the pingid.properties file that begins with authenticator_url=.

If the --orgSettingsFilePath parameter is not specified, it is mandatory to provide the --authenticatorAddress parameter.

If both the --orgSettingsFilePath and --authenticatorAddress are specified, the value is retrieved from the pingid.properties file, and the value of the --authenticatorAddress parameter is ignored.

-t, --token <API key identifier>

The identifier of the API key. This value is an entry in the PingID properties file.

If the --authenticatorAddress parameter is not specified, it is mandatory to provide the --token parameter.

If both the --orgSettingsFilePath and --token are specified, the value is retrieved from the pingid.properties file, and the value of the --token parameter is ignored.

-i, --ignoreConnectionErrors

The installer attempts to address the PingID authenticator heartbeat to confirm connectivity. If there is no response before installing any of the elements, continue the installation.

-s, --silent

The installer will prompt with a Log out now? message box.

.

-m, --very-silent

The installer will sign out without asking.
Domain
Parameter <Argument> Description

-d, --domainPostfix <@organization domain name>

Configures the installation to append the value supplied in this parameter to the username at sign-on time.

Note:

You can define a suffix, such as @domain.com, but not a prefix, such as domain/.

Important:

Enter the leading "@" before the domain name, for example --domainPostfix @somewhere.com.

This parameter has a maximum length of 50 characters, including the leading "@".
Offline Authentication
Parameter <Argument> Description

-o, --offlineAuthType <type>

The --offlineAuthType parameter specifies whether to allow PingID offline (manual) MFA.

Possible values for <type> are:

0

 Allow offline MFA with the PingID mobile app.

1

 If the user does not have a paired PingID mobile app with their account, bypass MFA during login.

2

 Do not allow offline MFA.

-r, --rsa_padding <none>

By default, OAEP padding is used in the encryption for offline authentication. Use --rsa_padding none if you do not want to use OAEP padding for offline authentication.
HTTP Request Timeout
Parameter <Argument> Description

--timeout <ms>

 Defines HTTP request timeout value. Possible values are between 1000-30000 ms.
Common
Parameter <Argument> Description
-h, --help

Show a user guide.
-v, --version

Show the Installer version.