PingAM (AM)

AM provides a service called access management, which manages access to resources, such as a web page, an application, or a web service, that are available over the network. Once it is set up, AM provides an infrastructure for managing users, roles, and access to resources. In this chapter, you manage access to a single web page.

AM centralizes access control by handling both authentication and authorization. Authentication is the process of identifying an individual, for example, by confirming a successful login. Authorization is the process of granting access to resources to authenticated individuals.

AM uses trees to provide fine-grained authentication. Authentication trees are made up of nodes, which allow multiple paths and decision points throughout the authentication flow. Each node performs a single task during authentication, such as collecting a username or making a simple decision. Authentication nodes can have multiple outcomes beyond just success or failure. AM lets you create complex yet customer-friendly authentication experiences by linking nodes together, creating loops, and nesting nodes within a tree.

AM centralizes authorization by letting you manage access policies separate from applications and resources. Instead of building an access policy into a web application, you install an agent with the web application to request policy decisions from AM. This approach avoids issues caused by embedding policy decisions into applications. If a policy changes or an issue is found after the application is deployed, you only have to change the policy definition in AM instead of deploying a new version of the application. AM makes the authorization decisions, and web and Java agents enforce the decisions on AM’s behalf.

Keep on reading to try AM’s access management capabilities by installing AM and configuring an authentication tree.