Configure a PingFederate policy for passwordless authentication with FIDO biometrics.
Before configuring PingID for passwordless authentication, make sure you:
- Install the PingID Integration Kit 2.7 or later.
- Download the PingID properties file.
- Configure an HTML form adapter instance.
- Configure a PingID Adapter instance.
- (Optional) If you wish to configure the application name or application icon, do so in PingFederate . See Identify the target application.
To use PingID as a passwordless authentication solution for federated single sign-on (SSO) with PingFederate , in PingFederate you'll need to:
- Create an authentication policy contract.
- Create a local identity profile and associate it with the HTML Form Adapter instance.
- Create an authentication policy.
In PingFederate , create an authentication
policy contract: (see also Policy Contracts).
- In the Identity Provider tab, under AUTHENTICATION POLICIES area, click Policy Contracts.
- Click Create New Contract.
- In the Contract Name field, enter a name for the policy contract and click Next.
- In the Contract Attributes tab, for each attribute you want to add, in the Extend the Contract area, type the name of the attribute and then click Add. For a list of PingID attributes, see PingID authentication attributes.
- Click Next, and then click Done.
Create a local identity profile for passwordless authentication:
- In the Identity Provider tab, click Identity Profiles and then click Create New Profile.
- In the Profile Info tab, enter the following
information, and then click Next:
- Local Identity Profile Name : Enter a meaningful name for the profile.
- Authentication Policy Contract: Select your policy contract.
- In the Authentication Sources tab, in the Authentication Source field, enter FIDO as the name of your authentication source, click Add, and then click Next.
- Click Done, and then click Save. The local identity profile is saved.
In the Identity Provider tab, associate the HTML Form
Adapter instance with the local identity profile:
- Click Adapters.
- Click the HTML Form Adapter and then click the IdP Adapter tab.
- Scroll down, and in the Local Identity Profile field, select the local identity profile that you created. Then click Done, and Save.
Create a PingFederate
authentication policy for passwordless authentication. (See also Policies.)
- In the Identity Provider tab, under Authentication Policies, click Policies.
- In the Policies tab, ensure the IdP Authentication Policies checkbox is selected, and then click Add Policy.
- In the Name field, enter a meaningful name for the authentication policy.
- In the Policy dropdown, select IdP Adapters, and then select the HTML Form Adapter. A branch for the HTML Form Adapter is added to the PingFederate policy tree, and FAIL/SUCCESS fields are added.
- Directly under the HTML Form Adapter field, click
Rules. In the Rules
popup window, enter the following information, and then click
- Attribute Name: Select policy.action.
- Condition: Select equal to.
- Value: Enter FIDO as your authentication source.
- Result: Enter FIDO as your authentication source.
- Default to success: Ensure the checkbox is selected.
- In the HTML Form Adapter branch FAIL field, click Done.
- In the HTML Form Adapter branch
SUCCESS field dropdown list, select the
action that you want to apply and configure it appropriately. For
- If configuring the PingID Adapter (recommended), do the
- In the SUCCESS branch dropdown list, select IdP Adapters, and then select PingID Adapter. SUCCESS/FAIL fields are added to the branch.
- Under the PingID Adapter FAIL field, click Done.
- In the PingID Adapter SUCCESS field, select the local identity profile you created earlier.
- Under the local identity profile, click Local
Identity Mapping and complete the
relevant mapping. (See also Configuring contract
For a list of attributes that can be used upon successful authentication with PingID, see PingID authentication attributes.
- Under the PingID
Adapter entry, click
Options and specify the
- Source: HTML Form Adapter
- Attribute: Username
- If configuring a local identity profile:
- In the SUCCESS branch dropdown list, select the Local Identity Profiles, and then select the local identity profile that you created earlier.
- Directly under the HTML Form Adapter branch SUCCESS field, click Local Identity Mapping, complete the relevant mapping from your source to the local identity contract (see Configuring local identity mapping) and click Done.
The FIDO policy branch is added to the policy tree.
- If configuring the PingID Adapter (recommended), do the following:
- In the FIDO branch:
- In the dropdown list, select IdP Adapters, and then select the PingID Adapter. SUCCESS/FAIL fields are added.
- In the FAIL field, click Done.
- In the SUCCESS field dropdown list, select the endpoint you require. For example:
- Save the PingFederate policy.
- Add any further configurations, for example:
- To complete the passwordless configuration, see Configuring FIDO2 passwordless authentication.