Sign-on (login)

The PingOne Advanced Identity Cloud sign-on flow is designed for self-service, as demonstrated in the Login journey template. This journey lets end users sign on using their Advanced Identity Cloud credentials and increments the login counter. A separate retry-limit counter tracks failed authentications and locks the end-user account if the number of retries exceeds a specified limit. End users who successfully authenticate are sent through a separate progressive profile journey.

The Login journey template can be extended to include other features, such as support for identity providers. Learn more in Social authentication.

The following nodes are associated with sign-on journeys:

Platform Username node: The Platform Username node is used in both sign-on and registration journeys. It collects the end user’s username.
Platform Password node: The Platform Password node is used in both sign-on and registration journeys. It collects the end user’s password.
Identity Store Decision node: The Identity Store Decision node takes a username and password and validates they match an existing end user in the identity store.
Retry Limit Decision node: The Retry Limit Decision node tracks failed authentications. If the number of failed authentications is below a specified Retry Limit, the end user can attempt authentication again. Otherwise, the node forwards to the Account Lockout node to lock the end-user account.
Account Lockout node: The Account Lockout node sets the lock state of the end-user account. In this case, it is configured to lock the account. The node can also be used in a separate unlock journey to unlock the end-user account.

Calling a login self-service endpoint returns a JSON object containing callbacks for each of the nodes included in the journey.

Sample JSON callbacks

{
  "authId": "<omitted for length>",
  "callbacks": [
    {
      "type": "ValidatedCreateUsernameCallback",
      "output": [
        {
          "name": "policies",
          "value": {}
        },
        {
          "name": "failedPolicies",
          "value": []
        },
        {
          "name": "validateOnly",
          "value": false
        },
        {
          "name": "prompt",
          "value": "Username"
        }
      ],
      "input": [
        {
          "name": "IDToken1",
          "value": ""
        },
        {
          "name": "IDToken1validateOnly",
          "value": false
        }
      ],
      "_id": 0
    },
    {
      "type": "ValidatedCreatePasswordCallback",
      "output": [
        {
          "name": "echoOn",
          "value": false
        },
        {
          "name": "policies",
          "value": {}
        },
        {
          "name": "failedPolicies",
          "value": []
        },
        {
          "name": "validateOnly",
          "value": false
        },
        {
          "name": "prompt",
          "value": "Password"
        }
      ],
      "input": [
        {
          "name": "IDToken2",
          "value": ""
        },
        {
          "name": "IDToken2validateOnly",
          "value": false
        }
      ],
      "_id": 1
    }
  ],
  "header": "Sign In",
  "description": "New here? <a href=\"#/service/Registration\">Create an account</a><br><a href=\"#/service/ForgottenUsername\">Forgot username?</a> <a href=\"#/service/ResetPassword\">Forgot password?</a>"
}

PingOne Advanced Identity Cloud

Sign-on (login)

Example login REST output