Ping MFA with Shibboleth IDP 5

Thu Aug 7 23:53:09 UTC 2025

I found some older documentation related to older versions of the IDP,
but it seems there have been enough changes in IDP 5 that these steps
won't work anymore.

Shibboleth Configuration to Redirect to PingOne MFA
1. Enable MFA Feature
Edit: conf/idp.properties

Add or update the following property:
idp.authn.flows = MFA

2. Configure the MFA Flow
Edit: conf/authn/mfa-authn-config.xml

Add the following TransitionMap bean:
<bean id="shibboleth.authn.MFA.TransitionMap" class="java.util.HashMap">
    <entry key="authn/Password">
        <value>authn/PingOne</value>
    </entry>
</bean>

3. Define PingOne MFA as an External Flow
Edit or create: conf/authn/external-authn-config.xml

Add:
<util:list id="shibboleth.authn.External.externalAuthnFlows">
    <value>PingOne</value>
</util:list>

Create the flow descriptor: flows/authn/external/PingOne/flow.xml
<flow xmlns="http://www.springframework.org/schema/webflow"
start-state="Redirect">
    <view-state id="Redirect" view="external-authn/pingone-mfa.jsp">
        <transition on="proceed" to="proceed"/>
    </view-state>
    <end-state id="proceed"/>
</flow>

4. Create the Redirect Page (JSP)
Create: views/external-authn/pingone-mfa.jsp

This page should automatically post a SAML AuthnRequest to PingOne:
<html>
<body onload="document.forms[0].submit()">
<form method="POST" action=" https://auth.pingone.com/<ID> /saml20/idp/sso">
    <input type="hidden" name="SAMLRequest" value="${samlRequest}"/>
    <input type="hidden" name="RelayState" value="${relayState}"/>
</form>
</body>
</html>

5. Define Flow in Shibboleth

Edit: conf/authn/general-authn.xml

Ensure PingOne is listed as a valid flow:
<util:list id="shibboleth.authn.flows">
    <value>External</value>
    <value>Password</value>
    <value>PingOne</value>
</util:list>

6. Metadata and Certificates
Edit: conf/metadata-providers.xml

Add PingOne's metadata:
<MetadataProvider id="PingOne" xsi:type="FilesystemMetadataProvider"
                  metadataFile="/opt/shibboleth-idp/metadata/pingone-sp.xml"
                  failFastInitialization="true">
    <MetadataFilter xsi:type="SignatureValidation"

certificateFile="/opt/shibboleth-idp/credentials/pingone.crt"
                    requireSignedRoot="true"/>
</MetadataProvider>

Flow Summary
1. User authenticates with Shibboleth using Password.
2. MFA flow transitions to PingOne external authentication.
3. The user is redirected to PingOne for MFA.
4. PingOne returns a SAML Response to Shibboleth.
5. Shibboleth finalizes authentication and releases assertion to the SP.

--

Thanks,

Dan

On Thu, Aug 7, 2025 at 6:26 PM Dan McLaughlin
<dmclaughlin at tech-consortium.com> wrote:
>
> Has anyone tried configuring Ping MFA with Shibboleth IDP 5?
>
>
> --
>
> Thanks,
>
> Dan