Enabling passwordless authentication in a PingFederate authentication policy
About this task
To enable passwordless authentication in a PingFederate authentication policy:
Steps
-
Optional: Create a policy contract:
-
Go to Authentication → Policies → Policy Contracts.
-
Click Create New Contract.
-
Give the policy contract an appropriate name for the storage of attribute data. Click Next.
-
Specify any additional attributes if required outside of the
subject
attribute to be reused later within OAuth-OpenID Connect (OIDC) or SAML-WS-Federation processing. Click Next. -
On the Summary page, click Save.
-
-
Create a local identity profile (LIP):
-
Go to Authentication → Policies → Local Identity Profiles.
-
Click Create New Profile.
-
On the Profile Info tab, in the Local Identity Profile Name field, enter an appropriate name for the passwordless authentication processing.
-
In the Authentication Policy Contract list, select an appropriate policy contract. If you created a new one, specify the policy contract from step 1. Click Next.
-
For Authentication Sources, select Security Key and click Add. Click Next.
-
On the Summary page, click Save.
-
-
Add the LIP to an available HTML Form IdP Adapter:
-
Go to Authentication → Integration → IdP Adapters and select an available HTML Form IdP Adapter to use within PingFederate’s authentication policy that will contain a Passwordless Security Key option.
-
Click IdP Adapter.
-
Scroll down to the Local Identity Profile section, and in the list, select the LIP that you created in step 2.
-
Click Save.
-
-
Create an authentication policy:
-
Go to Authentication → Policies → Policies.
-
Click Add Policy.
-
Give the authentication policy an appropriate name for the passwordless authentication process that will be performed.
-
In the Policy list, select the HTML Form IDP Adapter that you added the LIP to in step 3.
-
Under the HTML Form IDP Adapter that you selected, click Rules and specify the appropriate values.
Case sensitivity is important.
-
Click Done.
-
For the Fail branch off of the HTML Form IDP Adapter, click Done.
-
For the Security Keybranch, select the PingID Adapter.
-
In the Fail branch off of the PingID Adapter, click Done.
-
For the Success branch of the PingID Adapter, select the policy contract that you specified in step 2d.
-
Perform the Contract Mapping to fulfill the Policy Contract Attributes. Click Done to return to the Policy tree when complete.
-
In the last Success branch (the branch where Security Key is not selected), select the PingID Adapter.
-
Under PingID Adapter, click Options.
-
Select the appropriate attribute to provide to PingID to verify the registration status of the user performing the transaction. Click Done.
-
For the Fail branch, click Done.
-
For the Success branch of the non-passwordless PingID flow, select the Policy Contract that you specified in step 2d.
-
Perform the Contract Mapping to fulfill the Policy Contract Attributes. Click Done to return to the Policy tree when complete.
-
Click Done to return to the main Policy list selection.
-
Move the authentication policy to the desired location in the list.
-
Click Save.
-