Island Enterprise Browser Device Trust Integration Kit

Overview of the SSO flow

The following figure illustrates a single sign-on (SSO) scenario in which PingFederate authenticates users to a protected resource using the Island Enterprise Browser Device Trust IdP Adapter.

A diagram illustrating a typical sign-on process leveraging the Island Enterprise Browser Device Trust Integration Kit.

Description

  1. A user initiates the sign-on process by requesting access to a protected resource.

  2. The Island Enterprise Browser Device Trust IdP Adapter determines if the incoming request is from the Island Enterprise browser.

    You can find more information about what happens with requests originating from any source in Using Island Device Signals.

  3. If Island Enterprise manages the user’s browser, the adapter makes a backend call to the Island Enterprise challenge API endpoint to generate a challenge.

  4. The adapter sends a 302 redirect to the PingFederate resume path with the challenge set in the response header.

  5. The Island Enterprise browser processes the challenge and sets the response in the resume path request header.

  6. The adapter finds the challenge response set by the browser and makes a backend call to the Island Enterprise verify challenge response API endpoint.

  7. The Island Enterprise verify challenge response API endpoint verifies the response.

  8. After successful verification, the adapter has access to the device signals from the browser.

  9. The adapter uses the decoded device signals to fulfill the core contract for the authentication policy for subsequent decision-making.