PingFederate IdP Adapter Authenticator

This authenticator allows the Curity Identity Server to integrate with applications built as PingFederate IdP Adapters using the Agentless Integration Kit.

This authenticator can be seen as the counterpart to the PingFederate authenticator. The IdP Application is in charge of authenticating the user in any means necessary, and submitting the authentication attributes to the DropOff endpoint of the authenticator using a back channel. The authenticator creates and responds with a REF-code. The IdP Application appends the REF-code in the query string, and redirects the user to the callback endpoint. The authenticator matches the REF to the attributes and creates the SSO session based on it.

Authentication Flow

../../_images/ping_idp_app_authenticator.png
  1. The OAuth client initiates the flow by making any supported protocol start request
  2. The browser is redirected the login web application. The application authenticates the user, and posts the authentication attributes to the DropOff endpoint in a POST message
  3. The authenticator responds with a REF, as a reference to the attributes.
  4. The application redirects back to the authenticator with the REF in a query parameter.
  5. the Curity Identity Server responds to the client

Configuration

The following configuration options are available

Setting Description
IdP Application URL The URL to the IdP Application
Username The username to use for basic authentication against the DropOff endpoint
Password The password to use for basic authentication against the DropOff endpoint