PingFederate: OAuth implementation approaches

Hello IAM Learners

It is common to use claims based authentication in recent times for any SSO integrations using OAuth/OpenID connect standards. 

For OAuth implementation in PingFederate, you could create multiple Access Token Manager and map it to adapter if you have multiple HTML adapters in the deployment, otherwise if you just single HTML Adapter used by all OAuth applications then you don't need any of these I am referring to below.

OAuth request coming from Application can be intercepted and processed in PingFederate using two approaches; OAuthSelector or HTTP Header selector. Both of these approaches requires to use Ping authentication policies.

OAuth Client Set Authentication Selector: All OAuth client IDs should be added in this selector as Client.   

HTTP Request Parameter Name: All OAuth client IDs should be added in this selector as parameter values.

There is another selector OAuth Scope Authentication Selector that will be used for OAuth implementations if you have a requirement to trigger the authentication flow based on client scope. 

 

Identifier First Adapter: PingFederate

Hello IAM Experts

Today, I would like to talk about Identifier First Adapter and how it can be addressed for variety of use cases.

Identifier First Adapter is available out-of-the-box in PingFederate 9.3 version and above. This adapter uses HTML template in the back-end which can be customized as per Org needs and it captures the user identifier (could be email or userid) and it uses two attributes Subject and Domain. 

Domain is typically the user email address. Additional attributes can be added to this adapter as needed. 

Some of the use cases:

1. This adapter can be used if the organization has a requirement to display separate branded login page based on email address or user domain.  
2. This adapter can be used if you need to separate the authentication flow or trigger additional security mechanism based on userid or email address. 

HTML template also uses velocity template which can be customized with HTML/JS as per Org needs.