PingOne Authentication (OIDC)

Ivanti Neurons currently offer the option of selecting PingOne as the external authentication provider for your tenant. This is a good choice if you want to centralize the end user log on experience, reduce the occurrence of password related calls to the help desk, and have granular controls over policies and audit trails.

Auto provisioning for users and groups is now managed through SCIM Provisioning. To configure SCIM Provisioning, refer to SCIM Provisioning - PingOne.
If you have already set up auto provisioning without SCIM, the existing setup will work as expected. You can continue to edit the default access control roles and disable auto provisioning.
Disabling auto-provisioning will not affect members already provisioned. Once disabled, Once disabled, you must set up auto-provisioning using SCIM Provisioning.

Configure & Enable External Authentication

  1. In Ivanti Neurons Platform navigate to Admin > Authentication.
    The Authentication page appears.
  2. In the External Authentication (SSO) section, click Configure & Enable.
    The Enable External Authentication (SSO) page appears.
  3. From the Provider drop-down select PingOne.
    The PingOne Configuration Settings appear.

Before you can continue with the Ivanti Neurons configuration you must first carry out some steps in the PingOne admin console.

Before you can continue with the Ivanti Neurons configuration you must first carry out the following steps in the PingOne admin console.

  1. Login to the PingOne admin console.
  2. Expand the Applications menu from the side navigation and select the Applications option.
    The Applications page appears.
  3. Select the + icon next to Applications, to add a new application.
    The New Application page appears.
  4. Enter an Application Name e.g. Ivanti Neurons.
  5. In the Applications Type section, select Native.
  6. Select Save.
    The New Application page appears.
  7. Select the Configuration tab.
  8. Select Edit.
  9. Under Response Type, enable Code, Token, and Token ID checkboxes.
  10. Under Grant type, enable Authorization Code with PKCE Enforcement as "OPTIONAL" and Implicit checkboxes.
  11. In Redirect URI paste the URI copied from the Ivanti Neurons platform > Authentication page.
  12. Set the Token Endpoint Authentication Method to Client Secret Post.
  13. In the Signoff URL paste the URL copied from the Ivanti Neurons platform > Authentication page.
  14. Select Save.
  15. Select the Resources tab.
  16. Select Edit.
  17. Add two new scopes; Email scope and Profile scope.
  18. Select Save.
  19. Set the new application toggle to Enable so that users have access to the application.
  20. Once enabled, select the Overview tab, all of the paths have been generated. You need to copy the following paths to input into Ivanti Neurons platform External Authentication Configuration:
    • Issuer ID
    • Client ID (expand General section for this)
    • Client Secret (expand General section for this)

    21. You need to record or copy the Issuer ID, Client ID and Client Secret ready to use in the next step of the setup in the Ivanti Neurons Platform.

PingOne setup is now complete and you can return to Ivanti Neurons Platform to continue setup.

Once you have created the PingOne application you can continue with the Ivanti Neurons Platform configuration.

  1. Return to the PingOne Configuration Settings page (Ivanti Neurons Platform > Authentication > External Authentication (SSO) > Configure and Enable.
  2. Enter the Issuer path, that was generated and copied/saved from PingOne.
  3. Enter the Client ID, that was generated and copied/saved from PingOne.
  4. Enter the Client secret value, that was generated and copied/saved from PingOne.
  5. Select Continue to display the Validate Connection Settings page.

You need to connect with your PingOne credentials to validate your connection settings.

  1. On the Validate Connection Settings page, click Validate Settings to access your organization's sign-in page via a new tab, enter your PingOne credentials and proceed to sign-in. If you are already signed in credentials are not required and the validation takes place automatically, so make sure you are signed in to the account you want to authenticate.
    You will receive a confirmation screen if login is successful.

    2. The PingOne username must exactly match your Ivanti Neurons username.

  2. Return to this tab (Validate Connection Settings).
  3. Select the check box I confirm I have successfully validated my connection settings to confirm you have logged in successfully.
  4. Click Continue to move on to convert Ivanti Neurons Platform accounts. The Enable Ivanti Neurons Platform accounts page displays.
  • E2018 Authentication failed: User failed to authenticate with PingOne. Check the username and password are correct and that the user has permissions on PingOne.
  • E2020 Unable to link to Neurons Platform user account: The PingOne user login, does not match with the Ivanti Neurons Platform user. The Ivanti Neurons Platform user account email address must match the email address used to login into PingOne.

PingOne is now configured, but it is not enabled.

To enable, you need to convert your Ivanti Neurons Platform accounts to use PingOne instead.

  1. On the Enable Ivanti Neurons Platform accounts page, click Sign Out & Enable.
    The Ivanti Neurons Sign In page appears.
  2. Select Sign In with PingOne and enter your PingOne credentials, the conversion will then be complete.
    All members will receive an email to confirm the account has been converted and that they must access the tenant with PingOne credentials going forward. If the member does not have PingOne credentials, they will not be able to access Ivanti Neurons.

External Authentication (SSO) will now display with an Enabled status.

Update Client Secret

If you want to update the PingOne client secret, you need to set a new one to continue using this authentication method.

  1. In Ivanti Neurons Platform navigate to Setup > Authentication.
  2. Click Actions and select Update client secret.
    The Update Client Secret page appears.
  3. Enter the new client secret from your PingOne application.
  4. Click Continue.
    The Validate Client Secret page appears.
  5. Click Validate Client Secret, this opens your PingOne sign in page.
    Enter your username and password, this will be the same as the sign-in credentials for the Ivanti Neurons Platform. When you sign-in the new client secret is validated. If successful, return to this wizard and continue to update the client secret. If it is unsuccessful, go back and check if the new client secret you entered is accurate. For other failure reasons see Validation Troubleshooting.
  6. Once you have successfully validated the new client secret, select the confirmation check box I confirm I have successfully validated my new client secret and click Continue.
  7. Click Save Changes to complete the process. This updates the client secret with immediate effect, you are not required to do anything further.