Installing the PingID integration for Windows login using CLI - PingID

/SILENT

If a restart is necessary and the /NORESTART command isn't used, it prompts with a Reboot now? message box. When using this parameter, the installation progress window is displayed.

/VERYSILENT

If a restart is necessary and the /NORESTART command isn't used (see below), it reboots without asking. When using this parameter, the installation progress window is not displayed.

/SP-

Disables the This will install... Do you wish to continue? prompt at the beginning of the installation.

/SUPPRESSMSGBOXES

Instructs the installer to suppress message boxes. It only has an effect when combined with /SILENT or /VERYSILENT. The default response in situations where there's a choice is:

• Yes in Keep newer file? situations.
• No in File exists, confirm overwrite situations.
• Abort in Abort/Retry situations.
• Cancel in Retry/Cancel situations.
• Yes (continue) in DiskSpaceWarning, DirExists, DirDoesntExist, NoUninstallWarning, ExitSetupMessage, and ConfirmUninstall situations.
• Yes (restart) in FinishedRestartMessage and UninstalledAndNeedsRestart situations.

/LOG=<Full output log filepath>

• /LOG without an assigned value causes the installer to create a log file in the user's TEMP directory, detailing file installation and actions taken during the installation process.
• /LOG=<Full output log filepath> allows you to specify a fixed path or filename to use for the log file. If a file with the specified name already exists, it is overwritten. If the file cannot be created, the installer aborts with an error message.

/orgSettingsFilePath=<Full pingid.properties filepath>

The full filepath of the PingID properties file. For example, C:\Users\admin\Downloads\pingid.properties. The PingID properties file is referenced from this location during the installation process. It is mandatory to specify either:

• /orgSettingsFilePath

Or all of the following parameters:

• /orgAlias
• /orgKey
• /authenticatorAddress
• /idpUrl
• /token

/orgAlias=<organization's alias string>

The organization's alias. This value is an entry in the PingID properties file. If the /orgSettingsFilePath parameter is not specified, it is mandatory to provide the /orgAlias parameter. If both the /orgSettingsFilePath and /orgAlias are specified, the value is retrieved from the pingid.properties file, and the value of the /orgAlias parameter is ignored.

/orgKey=<organization's key string>

The organization's base64 key. This value is an entry in the PingID properties file. If the /orgSettingsFilePath parameter is not specified, it is mandatory to provide the /orgKey parameter. If both the /orgSettingsFilePath and /orgKey are specified, the value is retrieved from the pingid.properties file, and the value of the /orgKey parameter is ignored.

/authenticatorAddress=<URL of PingID data center>

The URL of the PingID data center to which the organization is associated. It is the URL that is listed on the line in the pingid.properties file that begins with authenticator_url=. If the /orgSettingsFilePath parameter is not specified, it is mandatory to provide the /authenticatorAddress parameter. It is ignored if /orgSettingsFilePath is also specified.

/idpUrl=<URL of server used for PingID API requests>

URL of the server used for PingID API requests. Take this value from the idp_url entry in the PingID properties file. If the /orgSettingsFilePath parameter is not specified, it is mandatory to provide the /idpUrl parameter. It is ignored if /orgSettingsFilePath is also specified.

/token=<API key identifier>

The identifier of the API key. This value is an entry in the PingID properties file. If the /orgSettingsFilePath parameter is not specified, it is mandatory to provide the /token parameter. It is ignored if /orgSettingsFilePath is also specified.

/proxyAutoDetect=<0 or 1>

Automatically detect the proxy settings. Possible values:

• 0 = Disabled
• 1 = Enable automatic detection of proxy settings

/scriptProxyAddress=<URL>

When the organization uses a PAC script for automatic proxy configuration, the /scriptProxyAddress parameter should be specified using the http:// or https:// convention. /scriptProxyAddress is the proxy script URL, for example, http://proxy.company.com:8083//proxy.pac.

/proxyAddress=<proxy's URL>

When the connection is behind a proxy, the /proxyAddress parameter must be specified using the http:// or https:// convention.

/proxyAddress is the URL address of the proxy, for example, http://1.1.1.1:8080.

/proxyUserName=<proxy's username>

When the connection is behind a proxy, and the proxy requires credentials for authentication, the /proxyUserName and /proxyPassword parameters must be specified.

The proxy's username must be supplied as the value of the /proxyUserName parameter.

/proxyPassword=<proxy's password>

When the connection is behind a proxy, and the proxy requires credentials for authentication, the /proxyUserName and /proxyPassword parameters must be specified.

The proxy's password must be supplied as the value of the /proxyPassword parameter.

/proxyBypassList=<comma-separated list of IP addresses or DNS names>

The /proxyBypassList option can be used to specify that the communication with PingFederate should not go through the proxy that you configured. The value should be a list of one or more computers, separated with commas. The format can be domain name or IP address. For example, /proxyBypassList="pingfed.example.com" or /proxyBypassList="pingfed.example.com,250.15.147.17".

/ignoreConnectionErrors

The installer attempts to address the PingID authenticator heartbeat as an initial part of the installation flow, to confirm connectivity. When there is no response, the installer ends the flow with an error status, before installing any of the elements. The /ignoreConnectionErrors parameter may be used to bypass this status, and to continue the installation, even without connectivity.

/authenticationType=<0, 1 or 2>

/authenticationType configures the installation for when to apply PingID authentication on logins via the PingID integration for Windows. Possible values:

• 0: Both RDP and local logins (default, when not specified).
• 1: Only RDP logins.
• 2: Only local logins.

/excludeLocalUsers=<0 or 1>

/excludeLocalUsers configures whether to apply PingID authentication to local user logins. Possible values:

• 0: Local users must authenticate with PingID.
• 1: Disable PingID authentication for local users.

/excludeLocalAccounts=<0 or 1>

/excludeLocalAccounts defines whether to apply PingID authentication to local user logins:

• 0: Use PingID authentication for local user logins as well
• 1: Do not use PingID authentication for local user logins

/excludeMicrosoftAccounts=<0 or 1>

/offlineAuthType=<0, 1, 2 or 3>

The /offlineAuthType specifies whether to allow PingID offline (manual) MFA, and defines the manual authentication methods that can be used. Possible values:

• 0: Do not allow MFA for offline authentication.
• 1: Allow offline MFA using PingID mobile app only.
• 2: Allow offline MFA using a FIDO2 security key only.
• 3: Allow offline MFA using either PingID mobile app or a FIDO2 security key.

/RSA_PADDING=<oaep or none>

• Use oaep to specify that OAEP padding should be used in the encryption for offline authentication (default).
• If you do not want to use OAEP padding for offline authentication, use none.

/offlinePolicy=<0, 1>

/offlinePolicy configuration defines whether it is possible to bypass MFA if the user is offline. Options available for this parameter depend on the values selected in the /offlineAuthType parameter as follows:

• If /offlineAuthType=0: offline (manual) authentication is not allowed and the /offlinePolicy options are:
  • 0: The user is blocked.
  • 1: PingID bypasses MFA during sign on.
• If /offlineAuthType=1, 2, or 3: offline (manual) authentication is allowed and /offlinePolicy options are:
  • 0: At least one allowed authentication method must be paired for the user to authenticate with offline MFA, otherwise the user is blocked.
  • 1: If the user does not have at least one allowed authentication method for offline authentication paired with their account, PingID bypasses MFA during login.

/domainPostfix=<@organization's domain name>

/domainPostfix configures the installation to append the value supplied in this parameter, to the username at login time. A suffix, such as @domain.com, can be defined, however, a prefix, such as domain\, cannot be defined.

/MultipleDomain=<0 or 1>

/MultipleDomain allows the user to log in from multiple domains. This option is available with PingID for Windows login 2.2 and later. Options include:

• 0: Use of multiple domains is not permitted. (default)
• 1: Multiple domains are permitted. This option should not be used when /usernameMapping is set to None and a /domainPostfix is not specified.

/usernameMapping==UPN/SAM/SID/None

Select the attribute that you want to use to identify the user. The examples show how the username is mapped in PingID

• None (default): Use the legacy username parsing convention. This can be either with or without /domainPostfix. Example:
  • /domainPostfix set to @domain.com: jsmith@domain.com
  • /domainPostfix not specified: jsmith
  Note:

  • If you do not specify /domainPostfix, do not set the /MultipleDomains parameter to 1.
  • This option is not recommended in environments with multiple domains, or environments where PingID is also used to sign on locally.
• UPN: Use the userPrincipalName. For example, jsmith@domain.com
• SAM: Use the Domain Name as prefix, or the computer name when logged in locally, and then the SAMAccountName. For example, DOMAIN\jsmith
• SID: Use the objectSID. For example, S-1-5-21-668608636-2615149724-2645577550-1112

/DIR=<installation destination folder's full filepath>

The default installation location for the PingID integration for Windows login is C:\Program Files\Ping Identity\PingID\WindowsLogin. If you want the installation in a different folder, specify the /DIR parameter with the destination value.

/PingFedAddress=<baseurl>

The PingFederate Base URL used to integrate PingID for Windows login through PingFederate. This field must be included when integrating through PingFederate, as in the following example.

/PingFedAddress=https://10.132.102.92:9031

/CPWhiteList ={CP_GUID1};{CP_GUID2}

Enables you to exclude one or more credential providers that are not PingID credential provider (CP) from being filtered out by PingID integration with Windows login. Enter the credential provider GUID for each credential provider that you want to exclude, separated by a semicolon. PingID MFA does not work with any credential provider that is on the CP allow list.

/thirdPartyCredentials=<0 or 1>

Enables integration with a third party credential provider, such as McAfee Drive Encryption credential provider. Options include:

• 0: Do not integrate (default).
• 1: Integrate with McAfee Drive Encryption credential provider.

/HttpRequestTimeout=<timeinms>

Defines the HTTP request timeout value. Possible values between 1000-30000 ms.

/NORESTART

Prevents the installer from restarting the system following a successful installation.

/DeprecatedSecurityKeys=<Allow, Inform, or Delete>

In version 2.8 of the Windows login integration, an improved implementation was introduced for the use of security keys while offline. The /DeprecatedSecurityKeys parameter allows you to specify how PingID should relate to the security keys paired previously:

• Allow: Allow users to continue using these keys (this option is not recommended)
• Inform: Allow users to continue using these keys, but inform them that these keys should be manually deleted
• Delete: Automatically delete the keys that were paired before the change was introduced

If the /DeprecatedSecurityKeys parameter is omitted, the default behavior is Inform.

/AllowFullPermissionsPropertiesFile

If you include the /AllowFullPermissionsPropertiesFile option during installation, PingID will allow you to use the full-permissions properties file (rather than the restricted-permissions properties file intended for use with Windows login). However, it is strongly recommended that you refrain from doing so. Using the full-permissions properties file with Windows login is a security risk (for details, see CVE-2022-23717).