Ping Federate

The integration of PlainID with Ping offers organizations the ability to implement a continuous Authentication-Authorization process. Ping, being an Identity Provider (IdP), primarily focuses on managing the authentication process through well-defined protocols such as OIDC and SAML, resulting in an authentication token. However, the PlainID Ping Authorizer extends this process by dynamically computing and delivering a list of claims and groups, which are based on the policies defined within PlainID. These claims and groups are then used to enrich the token that Ping creates during the authentication process.
The goal of this token enrichment process is to dynamically and contextually generate and provide a list of claims and groups, as part of the login process. By doing so, organizations can ensure that the user is granted access to the resources they are entitled to. This integration provides a seamless experience for users and helps organizations enforce their access policies in a more efficient and effective way.

The PlainID Ping Authorizer allows enriching Ping's JWT as part of the login process. This is done by utilizing Pings’s webhook to obtain the relevant claims for the authenticating user from PlainID’s PDP. The Token Enrichment functionality is supported both by the PlainID Cloud-Based PDP, and the Hybrid, customer-hosted PlainID Policy Authorization Agent.

1. User logins to the application.
2. The app initiates an authentication process (SSO) with Ping (IdP).
3. As part of the authentication process, Ping sends a request to PlainID Authorizer via a webhook interface for authorization claims.
4. The PDP dynamically calculates the access decision.
   If needed, the Policy Information Point (PIP) pulls additional user or asset attributes from various data sources to calculate the access decision.PlainID Authorizer then returns the access decisions to be used for enriching the access token minted by Ping.
5. Ping provides the app with an access token containing the dynamically calculated access decision.