Ping Identity

---
name: ping-identity
description: "Expert agent for Ping Identity platform. Provides deep expertise in PingOne cloud, PingFederate, PingAccess, PingDirectory, DaVinci orchestration, PingOne Protect, and PingOne Neo decentralized identity. WHEN: \"Ping Identity\", \"PingFederate\", \"PingOne\", \"PingAccess\", \"PingDirectory\", \"DaVinci\", \"PingOne Protect\", \"PingOne Neo\", \"Ping SSO\", \"Ping federation\"."
license: MIT
---

# Ping Identity

This skill covers the Ping Identity platform. It has deep knowledge of PingOne (cloud platform), PingFederate (on-premises federation), PingAccess (API gateway), PingDirectory (LDAP), DaVinci (no-code orchestration), PingOne Protect (risk assessment), and PingOne Neo (decentralized identity).

## Identity and Scope

Ping Identity provides enterprise identity solutions across cloud and on-premises:
- **PingOne** -- Cloud-native identity platform (IdP, SSO, MFA, directory)
- **PingFederate** -- On-premises/hybrid federation server (SAML, OIDC, WS-Fed)
- **PingAccess** -- API and application access gateway (reverse proxy with identity-aware policies)
- **PingDirectory** -- High-performance LDAP directory server
- **DaVinci** -- No-code identity orchestration (drag-and-drop flow builder)
- **PingOne Protect** -- Risk assessment and fraud prevention (device intelligence, behavioral analytics)
- **PingOne Neo** -- Decentralized identity (verifiable credentials, digital wallets)

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **Federation** -- PingFederate configuration, SAML/OIDC setup, partner connections
   - **Cloud identity** -- PingOne platform, cloud SSO, MFA policies
   - **API security** -- PingAccess, OAuth token validation, API gateway policies
   - **Directory** -- PingDirectory, LDAP, high-performance directory needs
   - **Orchestration** -- DaVinci flows, complex authentication journeys
   - **Risk/Fraud** -- PingOne Protect, device fingerprinting, risk signals
   - **Decentralized identity** -- PingOne Neo, verifiable credentials

2. **Identify deployment model:**
   - **PingOne Cloud** -- Fully managed SaaS
   - **Self-managed** -- PingFederate, PingAccess, PingDirectory on-premises or in customer cloud
   - **Hybrid** -- PingOne cloud + self-managed components connected

3. **Analyze** -- Apply Ping Identity-specific reasoning. Consider the Ping product suite's modular architecture and how components interact.

4. **Recommend** -- Provide actionable guidance with configuration examples and architectural patterns.

## Core Expertise

### PingOne Platform

Cloud-native identity services:

**Core services:**
- **PingOne SSO** -- Cloud SSO with SAML and OIDC support
- **PingOne MFA** -- Multi-factor authentication (push, TOTP, FIDO2, email, SMS)
- **PingOne Directory** -- Cloud directory (replacement for on-prem LDAP in cloud-first scenarios)
- **PingOne Authorize** -- Dynamic, policy-based authorization
- **PingOne Credentials** -- Verifiable credential issuance

**Environment model:**
```
PingOne Organization
  |-- Environment: Production (PRODUCTION type)
  |     |-- Populations (user groups)
  |     |-- Applications (SAML, OIDC clients)
  |     |-- Policies (sign-on, MFA, password)
  |-- Environment: Staging (SANDBOX type)
  |-- Environment: Development (SANDBOX type)
```

**PingOne APIs:**
```bash
# Authenticate and get management token
TOKEN=$(curl -s -X POST "https://auth.pingone.com/$ENV_ID/as/token" \
  -d "grant_type=client_credentials" \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" | jq -r '.access_token')

# Create a user
curl -X POST "https://api.pingone.com/v1/environments/$ENV_ID/users" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email":"jdoe@example.com","name":{"given":"John","family":"Doe"},"username":"jdoe"}'

# Create an OIDC application
curl -X POST "https://api.pingone.com/v1/environments/$ENV_ID/applications" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"My App","type":"WEB_APP","protocol":"OPENID_CONNECT"}'
```

### PingFederate

Enterprise-grade federation server for on-premises and hybrid deployments:

**Key capabilities:**
- SAML 2.0, OIDC, OAuth 2.0, WS-Federation, WS-Trust
- Hundreds of SP and IdP connections
- Attribute sources (LDAP, JDBC, custom data stores)
- Authentication policies and selectors
- Cluster-capable for HA (active-active)

**Architecture:**
```
External Partners           |  DMZ             |  Internal Network
                            |                  |
Partner IdP/SP ----SAML---->| PingFederate    |---> PingDirectory (LDAP)
                            | (port 9031)      |---> Database (JDBC)
Internal Apps <---OIDC------| PingFederate    |---> Active Directory
                            | (port 9031)      |
Admin Console               | (port 9999)      |
```

**Connection types:**
- **SP Connection** -- PingFederate acts as IdP, issues tokens to the SP
- **IdP Connection** -- PingFederate acts as SP, receives tokens from external IdP
- **OAuth Client** -- Application registered for OAuth 2.0/OIDC flows
- **Token Exchange** -- Exchange one token type for another (RFC 8693)

**Adapter model:**
- **IdP Adapters** -- Authenticate users (HTML Form, Kerberos, Certificate, RADIUS, custom)
- **SP Adapters** -- Deliver identity to the application (OpenToken, OIDC, custom)
- **Authentication Policy** -- Chain adapters with decision logic (if Kerberos fails, fallback to form)

### PingAccess

Identity-aware reverse proxy and API gateway:

- **Web session management** -- Create and manage sessions for web applications
- **Token mediation** -- Validate OAuth tokens, inject identity headers
- **Policy enforcement** -- URL-based access policies (path, method, user attributes)
- **Rate limiting** -- Protect backend services from abuse
- **Deployment models:** Reverse proxy, agent-based (Apache/IIS modules)

**Use case pattern:**
```
Client --> PingAccess (reverse proxy)
             |-- Validates OAuth access token (from PingFederate)
             |-- Evaluates access policy (user role, path, method)
             |-- Injects identity headers (X-User-ID, X-Roles)
             |-- Forwards request to backend application
```

### PingDirectory

High-performance LDAP directory:

- **Performance** -- Millions of entries, thousands of operations per second
- **Replication** -- Multi-master replication across data centers
- **Consent management** -- Built-in GDPR consent tracking per attribute
- **SCIM 2.0** -- Native SCIM endpoint for modern provisioning
- **Data governance** -- Field-level encryption, access logging, data masking
- **Backend:** Java-based, tunable JVM configuration

**When to use PingDirectory vs. AD DS:**
- PingDirectory: high-performance LDAP for applications, cloud-native, SCIM-native, consent management
- AD DS: Windows authentication, Group Policy, Kerberos, Windows device management

### DaVinci

No-code identity orchestration platform:

**Core concept:** Visual flow builder where identity journeys are composed of drag-and-drop connectors.

**Connectors (200+):**
- PingOne SSO, PingOne MFA, PingOne Protect
- External IdPs (Okta, Entra ID, social providers)
- Communication (email, SMS, push notification)
- Data stores (HTTP, LDAP, databases)
- Logic (branching, loops, variables, error handling)
- Custom (webhook, REST API)

**Flow examples:**
- **Progressive profiling** -- Collect user information over multiple sessions
- **Step-up authentication** -- MFA only when accessing sensitive resources
- **Self-service registration** -- Sign-up with email verification, identity proofing, MFA enrollment
- **Account recovery** -- Knowledge-based, email, or phone-based recovery with risk checks
- **B2B onboarding** -- Organization creation, admin invitation, IdP configuration

**DaVinci vs. PingFederate authentication policies:**
- DaVinci: visual, no-code, faster iteration, cloud-only
- PingFederate: XML/config-based, more complex, supports on-premises

### PingOne Protect

Risk assessment and fraud prevention:

**Risk signals:**
- **Device intelligence** -- Device fingerprinting, device reputation, jailbreak/root detection
- **Behavioral analytics** -- Typing patterns, mouse movement, navigation patterns
- **IP intelligence** -- IP reputation, geo-location, VPN/proxy detection, impossible travel
- **Bot detection** -- Automated request detection

**Integration pattern:**
```
User interacts with application
  --> PingOne Protect SDK collects signals (client-side)
  --> Signals sent to PingOne Protect API for evaluation
  --> Risk score returned (LOW, MEDIUM, HIGH)
  --> Application or DaVinci flow adjusts authentication requirements based on risk
```

**Risk-based policies:**
- Low risk: passwordless authentication, skip MFA
- Medium risk: require MFA
- High risk: block access, require identity verification

### PingOne Neo

Decentralized identity and verifiable credentials:

- **Digital wallet** -- Mobile app for storing verifiable credentials
- **Credential issuance** -- Issue W3C Verifiable Credentials (employee badge, certification, access pass)
- **Credential verification** -- Verify credentials presented by users
- **Standards:** W3C Verifiable Credentials, DID (Decentralized Identifiers)
- **Use cases:** Employee onboarding, age verification, professional certifications, government ID

## Common Pitfalls

1. **PingFederate certificate management** -- PingFederate uses multiple keystores (SSL server cert, signing certs, partner certs). Track expiration dates across all keystores.
2. **Connection configuration drift** -- PingFederate with hundreds of connections is hard to manage. Use the Admin API and configuration management tools.
3. **PingAccess session vs. token** -- PingAccess can use both session cookies and OAuth tokens. Understand which model your application expects.
4. **DaVinci flow complexity** -- Complex DaVinci flows can be hard to debug. Use the built-in flow debugger and test incrementally.
5. **PingDirectory sizing** -- Heap size must accommodate the entry cache. Under-provisioned JVM heap causes severe performance degradation.
6. **Mixing cloud and self-managed without clear boundaries** -- Define clearly which component handles authentication, authorization, and session management.