PingID

With PingID, users can authenticate through the PingID mobile app.

Configuring PingID with Specops Authentication extends PingID's two-factor authentication system to Specops Authentication users.

Prerequisites

Before configuring the identity service, you need:

• Administrator privileges for your PingID account.

Configuring PingID

1. Log in to the Specops Authentication Web: https://login.specopssoft.com/authentication/admin
2. Select Identity Services in the left sidebar navigation, then select PingID.
3. Select Enable, then in the pop-up click Enable again. This will make the service available for use in Specops services.
4. In the PingID admin pages, locate the properties file for integrating with PingFederate and other clients. Click Generate if you need a new file for Specops Authentication, or use an existing one. Click Download to save the file.

5. Return to Specops Authentication Web and configure the settings for PingID:

   1. Click on the Select properties file field and navigate to where you saved the properties file.
   2. Select the file and click Open.
   3. Click Import to populate the fields with the values from the properties file.

   OR

   1. Open the properties file in an editor. Copy each value listed below from the file and paste it into the corresponding field on the PingID settings page in Specops Authentication Web:

      Value in properties file	Field in Specops Authentication Web
      idp_url	PingID API URL
      org_alias	Organization Alias
      use_base64_key	Base64 key
      token	Token

6. Click Test connection. If the connection was successful, a message saying Connection test successful will appear.

7. Select your desired setting for Auto-enroll users in Specops Authentication. Setting it to Yes will automatically enroll all users.
8. Select your desired setting for Apply PingID policies. For more information, see Applying PingID policies.
9. If the PingID username is stored in an Active Directory attribute other than userPrincipalName, enter that attribute’s name in the User attribute in Active Directory containing the PingID username field.
10. Click Save.

Applying PingID policies

PingID policies determine how users authenticate with PingID. For example, a policy can require number matching, allow only specific authentication methods, or deny or approve requests based on the user's location.

Set Apply PingID policies to one of the following:

• Yes: PingID applies policies to Specops Authentication, provided that your PingID configuration enforces policies. Your Default Policy applies unless an application-specific policy is configured. The applicable policy’s requirements, such as number matching, apply during sign-in, enrollment, password reset, and Secure Service Desk verifications. No additional configuration is needed in PingID to apply the Default Policy.
• No: PingID does not apply your policies to Specops Authentication, even if your PingID configuration enforces policies. Users verify their identity with their PingID device, but policy rules do not require number matching or automatically approve or deny requests.

Configuring policies for Specops Authentication only (optional)

If you want PingID rules for Specops Authentication that differ from your Default Policy, you can apply a policy to the relevant Specops Authentication application. For example, you can require number matching only for Secure Service Desk verifications. Without an application-specific policy, your Default Policy applies.

Specops Authentication identifies itself to PingID with one of two application IDs, depending on where the user verifies their identity. The IDs are shown in the following PingID settings in Specops Authentication Web:

Setting in Specops Authentication Web	Application ID	Used for
Sign-in, enrollment and password reset	specops-authentication-sign-in	Sign-in, enrollment, and password reset, where users verify their own identity.
Service Desk verification	specops-authentication-service-desk	Secure Service Desk verifications: from the Secure Service Desk, through the Secure Service Desk API, and through a browser link sent by the service desk agent.

Click the copy-to-clipboard icon next to an application ID to copy it.

To apply a policy to Specops Authentication, add a custom application in PingID with one of these application IDs, then configure the policy to apply to that application. To use different policies for sign-in and Secure Service Desk verifications, create a separate policy for each application ID.

Requiring number matching

With number matching, Specops Authentication displays a number when PingID sends a push notification. To approve the request, the user must select or enter the same number in the PingID mobile app. This helps prevent users from approving unexpected push notifications, for example during an MFA fatigue attack.

The number is displayed:

• During sign-in, enrollment, and password reset: on the page where the user waits for the push notification.
• In the Secure Service Desk: to the service desk agent, who reads the number to the user.
• Through the Secure Service Desk API: in the response, for the calling application to display.

To require number matching, set Apply PingID policies to Yes in Specops Authentication Web and allow number matching as an authentication method in your Default Policy or the policy configured for the relevant Specops Authentication application.

Note

Explicitly select number matching among the authentication methods allowed by the policy. A policy that allows all methods does not require number matching.

Depending on your PingID configuration, the user either selects the matching number from three options or enters it. A user who selects an option at random has a one-in-three chance of approving the request. For Secure Service Desk verifications, where the agent reads the number to the user, requiring the user to enter the number provides stronger protection.

Allowing enough time to read the number

During a Secure Service Desk verification, the user must wait for the agent to read the number before responding to the push notification. By default, PingID allows about 40 seconds for a request. If requests time out before the user can respond, increase the request timeout in your PingID configuration.

How Specops Authentication handles policy results

A PingID policy can return one of three results:

• Authenticate: PingID sends a push notification and, if number matching is required, Specops Authentication displays a number. The user approves the request in the PingID mobile app. If the user selects or enters the wrong number, verification fails and the user or service desk agent is notified.
• Deny: Verification fails. The user or service desk agent is informed that the organization's PingID policy does not allow the request.
• Approve: PingID approves the request without user interaction. During sign-in, enrollment, and password reset, the user is verified without a push notification. Secure Service Desk verifications do not accept this result, so verification fails. In the Secure Service Desk, the agent is instructed to ask the PingID administrator to require authentication for the application specops-authentication-service-desk. See Configuring policies for Specops Authentication only.

Warning

When a service desk agent verifies a user from the Secure Service Desk, the request comes from the agent's computer. PingID therefore evaluates the agent's location and IP address rather than the user's. A rule that automatically approves requests from your company network would approve every verification originating from that network. Secure Service Desk verifications therefore reject automatic approvals. If your Default Policy includes such a rule, configure a policy for specops-authentication-service-desk that requires user authentication.