Integrating with PingOne

Create an Application

1. Log on to the PingOne admin console as an administrator for your PingOne environment.

2. Expand and select Applications in the left menu and then click + to add an application.

   

3. Define the application's parameters:

   • Application Name - enter a name for your application

   • Description - enter a brief description for your application (optional)

   • Application Type - select Worker

   For further information, go to Applications | PingOne Documentation.

4. Click Save.

   

5. Select Roles in the application's top menu.

6. Click Grant Roles.

   

7. Add the following roles for your environment:

   • Environment Admin

   • Identify Data Admin

   For further information, go to Configuring roles for a worker application | PingOne Documentation.

8. Click Save.

   

9. Select Overview in the application's top menu.

   

10. Click Protocol - OpenID Connect.

    

11. Scroll down to the Token Endpoint Authentication Method section and select Client Secret Post as the method.

    For further information, go to Token endpoint authentication methods | PingOne Documentation

    

12. Click Save.

    

13. Make a note of the:

    • Environment ID

    • Client ID

    • Client Secret

    Note: This information is required when configuring the connection to PingOne in Customer Central.

14. Enable the application by toggling the button in the application's menu bar.

Define the Authentication Policies

1. Log on to the PingOne admin console as an administrator for your PingOne environment.

2. Expand Authentication in the left menu to display the Policies menu.

3. Select FIDO and either select an existing policy or create a new one with the following configuration:

   Parameter	Value
   Relying Party ID	PingOne
   Discoverable Credentials	Required
   Authenticator Attachment	Both
   User Verification	Preferred Enforce during authentication
   Backup Eligibility	Disallow Enforce during authentication
   User Display Name	Attributes: Email Address Name (Given, Family) Username Additional Display Information: Include Environment Name Include Organization Name
   Attestation Request	Attestation Type - Direct Attestation Requirements - Allow Specific Authenticators

   

   For further information, go to FIDO policies | PingOne Documentation.

4. Select MFA and either select an existing policy or create a new one with the following configuration:

   Parameter	Value
   Allowed Authentication Methods	FIDO2
   FIDO Policy	The FIDO policy created above
   Allow Pairing	Enabled

   

   For further information, go to MFA policies | PingOne Documentation.

5. Select Authentication and either select an existing policy or create a new one with the following configuration:

   Parameter	Value
   STEP TYPE	Multi-factor Authentication
   MFA Policy	The MFA policy created above

   

   For further information, go to Adding a multi-factor authentication or PingID step | PingOne Documentation.

6. Enable the authentication policy for the application:

   1. Expand and select Applications in the left menu and then select the application you created above.

      

   2. Select Policies in the application's menu bar and click Add Policies.

      

   3. In the PingOne Policies tab, select the Authentication with MFA policy you created above and click Save.

Configure the Connection to PingOne

Before you can provision and enroll FIDO devices for your users, you must configure the connection between your PingOne application and Customer Central.

1. Sign in to Customer Central.

2. Expand Service Settings in the left menu and select Directory Configuration.

   

3. Click NEW.

   

4. Select PingOne as the directory type and click CONTINUE.

   

5. Enter a Configuration name for the configuration.

6. Enter the following information obtained in Create an Application:

   • Environment ID - the unique identifier that represents your organization's PingOne instance

   • Application (client) ID - the unique identifier that PingOne assigned to your Passkey Management application when you registered it

   • Secret - the client secret credential used by your Passkey Management application to identify itself when requesting a token

7. Click ADD.

   

   Customer Central verifies that the configuration is correct and displays a success message when complete.

   Customer Central is now connected to your PingOne application and your users are available for provisioning.

   

Test a Connection

1. Sign in to Customer Central.

2. Expand Service Settings in the left menu and select Directory Configuration.

   

3. Click the menu icon for the configuration and select Test Connection.

   • Success:

     

   • Failure - verify your configuration and try again

     

Edit a Configuration

1. Sign in to Customer Central.

2. Expand Service Settings in the left menu and select Directory Configuration.

   

3. Click the menu icon for the configuration and select Edit.

   

   Note: The UPDATE button is unavailable until you have entered the required information.

   You can update the:

   • Configuration Name

   • Application (client) ID - the unique identifier that assigned to your Passkey Management application when you registered it

   • Secret - the client secret credential used by your Passkey Management application to identify itself when requesting a token

     Note: For Microsoft Entra ID applications, the secret’s Value is only displayed when the secret is generated and cannot be displayed again.

     If you do not know the secret's value, you must generate a new secret.

4. Edit the configuration as required and click UPDATE.

Delete a Configuration

1. Sign in to Customer Central.

2. Expand Service Settings in the left menu and select Directory Configuration.

   

3. Click the menu icon for the configuration and select Delete.

   

4. Enter permanently delete in the field and click CONFIRM.