MobileIron Integration Kit

Overview of the SSO flow

The following figure shows a basic single sign-on (SSO) scenario in which a PingFederate server authenticates users to an service provider (SP) application using the MobileIron Adapter and X.509 Adapter.

Diagram showing the SSO flow using the MobileIron Adapter.,role=

Description

  1. A user requests access to an SP resource through a device enrolled with MobileIron. The request is redirected to PingFederate to perform X.509 authentication.

  2. The browser requests the user’s X.509 certificate. The PingFederate X.509 Certificate Adapter validates that certificate against a list of issuers.

    If you didn’t specify any issuers during the adapter setup, the adapter uses the server’s list of trusted certificate authorities instead.

  3. During validation, the X.509 Certificate Adapter parses the device identifier from the certificate and passes it to the MobileIron Adapter.

  4. The MobileIron Adapter uses the device identifier to contact the MobileIron Device API to retrieve the device’s posture.

  5. The API returns the result of the authentication. If authentication was successful, the user is redirected to the requested resource.