Ping SDKs

Before you begin

To successfully complete this tutorial refer to the prerequisites in this section.

The tutorial also requires a configured PingAM server.

Node and NPM

This sample requires a minimum Node.js version of 18, and is tested on versions 18 and 20. To get a supported version of Node.js, refer to the Node.js download page.

You will also need npm to build the code and run the samples.

Server configuration

This tutorial requires you to configure your PingAM server as follows:

Task 1. Create a demo user

The samples and tutorials in this documentation often require that you have an identity set up so that you can test authentication.

To create a demo user in PingAM, follow these steps:

  1. Log in to the PingAM admin UI as an administrator.

  2. Navigate to Identities, and then click Add Identity.

  3. Enter the following details:

    • User ID = demo

    • Password = Ch4ng3it!

    • Email Address = demo.user@example.com

  4. Click Create.

Task 2. Create an authentication journey

Authentication trees provide fine-grained authentication by allowing multiple paths and decision points throughout the authentication flow. Authentication trees are made up of nodes that define actions taken during authentication.

Each node performs a single task, such as collecting a username or making a simple decision. Nodes can have multiple outcomes rather than just success or failure. For details, see the Authentication nodes configuration reference in the PingAM documentation.

To create a simple tree for use when testing the Ping SDKs, follow these steps:

  1. Under Realm Overview, click Authentication Trees, then click Create Tree.

  2. Enter a tree name, for example sdkUsernamePasswordJourney, and then click Create.

    The authentication tree designer appears, showing the Start entry point connected to the Failure exit point.

  3. Drag the following nodes from the Components panel on the left side into the designer area:

    • Page Node

    • Username Collector

    • Password Collector

    • Data Store Decision

  4. Drag and drop the Username Collector and Password Collector nodes onto the Page Node, so that they both appear on the same page when logging in.

  5. Connect the nodes as follows:

    trees node login example
    Figure 1. Example username and password authentication tree

  6. Select the Page Node, and in the Properties pane, set the Stage property to UsernamePassword.

    You can configure the node properties by selecting a node and altering properties in the right-hand panel.

    One of the samples uses this specific value to determine the custom UI to display.

  7. Click Save.

Task 3. Register a public OAuth 2.0 client

Public clients do not use a client secret to obtain tokens because they are unable to keep them hidden. The Ping SDKs commonly use this type of client to obtain tokens, as they cannot guarantee safekeeping of the client credentials in a browser or on a mobile device.

To register a public OAuth 2.0 client application for use with the SDKs in AM, follow these steps:

  1. Log in to the PingAM admin UI as an administrator.

  2. Navigate to Applications > OAuth 2.0 > Clients, and then click Add Client.

  3. In Client ID, enter sdkPublicClient.

  4. Leave Client secret empty.

  5. In Redirection URIs, enter the following values:

    https://localhost:8443/callback.html

The Ping SDK for JavaScript attempts to load the redirect page to capture the OAuth 2.0 code and state query parameters that the server appended to the redirect URL.

If the page you redirect to does not exist, takes a long time to load, or runs any JavaScript you might get a timeout, delayed authentication, or unexpected errors.

To ensure the best user experience, we highly recommend that you redirect to a static HTML page with minimal HTML and no JavaScript when obtaining OAuth 2.0 tokens.

+

Also add any other domains where you will be hosting SDK applications. . In Scopes, enter the following values:

+ openid profile email address . Click Create.

+ PingAM creates the new OAuth 2.0 client, and displays the properties for further configuration. . On the Core tab: .. In Client type, select Public. .. Disable Allow wildcard ports in redirect URIs. .. Click Save Changes. . On the Advanced tab: .. In Grant Types, enter the following values:

+

Authorization Code
Refresh Token

  1. In Token Endpoint Authentication Method, select None.

  2. Enable the Implied consent property.

    1. Click Save Changes.

Task 4. Configure the OAuth 2.0 provider

The provider specifies the supported OAuth 2.0 configuration options for a realm.

To ensure the PingAM OAuth 2.0 provider service is configured for use with the Ping SDKs, follow these steps:

  1. Log in to the PingAM admin UI as an administrator.

  2. In the left panel, click Services.

  3. In the list of services, click OAuth2 Provider.

  4. On the Core tab, ensure Issue Refresh Tokens is enabled.

  5. On the Consent tab, ensure Allow Clients to Skip Consent is enabled.

  6. Click Save Changes.

Task 5. Configure CORS

Cross-origin resource sharing (CORS) lets user agents make cross-domain server requests. In PingAM, you can configure CORS to allow browsers from trusted domains to access PingAM protected resources. For example, you might want a custom web application running on your own domain to get an end-user’s profile information using the PingAM REST API.

The Ping SDK for JavaScript samples and tutorials all use https://localhost:8443 as the host domain, which you should add to your CORS configuration.

If you are using a different URL for hosting SDK applications, ensure you add them to the CORS configuration as accepted origin domains.

To enable CORS in PingAM, and create a CORS filter to allow requests from your configured domain names, follow these steps:

  1. Log in to the PingAM admin UI as an administrator.

  2. Navigate to Configure > Global Services > CORS Service > Configuration, and set the Enable the CORS filter property to true.

    If this property is not enabled, CORS headers are not added to responses from PingAM, and CORS is disabled entirely.

  3. On the Secondary Configurations tab, click Click Add a Secondary Configuration.

  4. In the Name field, enter ForgeRockSDK.

  5. in the Accepted Origins field, enter any DNS aliases you use for your SDK apps.

    This documentation assumes the following configuration:

    Property Values

    Accepted Origins

    https://localhost:8443

    Accepted Methods

    GET

    POST

    Accepted Headers

    accept-api-version

    x-requested-with

    content-type

    authorization

    if-match

    x-requested-platform

    iPlanetDirectoryPro [1]

    ch15fefc5407912 [2]

    Exposed Headers

    authorization

    content-type

  6. Click Create.

    PingAM displays the configuration of your new CORS filter.

  7. On the CORS filter configuration page:

    1. Ensure Enable the CORS filter is enabled.

    2. Set the Max Age property to 600

    3. Ensure Allow Credentials is enabled.

  8. Click Save Changes.

1. Cookie name value in PingAM servers.
2. In PingOne Advanced Identity Cloud tenants, go to Tenant Settings > Global Settings > Cookie to find this dynamic cookie name value.