Skip to main content
Version: 11.3.0

PingOne DaVinci: OIDC Integration in CC

Integration Overview​

The PingOne DaVinci integration adds HYPR passwordless authentication to PingOne DaVinci identity orchestration journeys. The PingOne DaVinci HYPR Connector provides the communication layer between DaVinci and HYPR, so a DaVinci flow can invoke HYPR authentication at the point in a journey where you need it, receive the result, and branch on it.

With the connector in place, you can:

  • Add passwordless authentication to DaVinci authentication journeys.
  • Reduce or remove your reliance on password-based authentication.
  • Verify users through their HYPR enrolled devices and biometric authentication.
  • Build journeys that support passwordless login, step-up authentication, and risk-based authentication.
  • Keep orchestration centralized in DaVinci while HYPR performs the authentication.

Integration Architecture​

The user and the HYPR Mobile App both reach the Ping Cloud over HTTPS. Inside Ping Cloud, an application calls Ping DaVinci, which calls the HYPR Connector. The connector reaches the HYPR Control Center in the HYPR cloud tenant over HTTPS, and the HYPR Mobile App reaches the same Control Center directly.

Authentication Flow​

  1. The user starts an authentication request from an application integrated with PingOne DaVinci.

  2. DaVinci runs the configured authentication flow.

  3. The flow invokes the HYPR Connector at the authentication step.

  4. The HYPR Connector communicates with HYPR using the configured integration credentials.

  5. HYPR prompts the user to complete passwordless authentication on their enrolled device.

  6. HYPR returns the authentication result to DaVinci.

  7. DaVinci evaluates the result and continues the authentication journey.

  8. DaVinci completes the flow and returns the authentication response to the requesting application.

Prerequisites​

In PingOne DaVinci:

  • A DaVinci tenant in a running state.
  • Administrator access to the PingOne DaVinci Admin Console.
  • The ability to create connectors.
  • The ability to create and edit flows.

In the HYPR Control Center:

  • A Control Center tenant in a running state.
  • HYPR administrator access.
  • Integration creation enabled for your tenant.

Connecting PingOne DaVinci to HYPR​

  1. Go to the Integrations screen in the HYPR Control Center and click Add New Integration to show a list of available integration types.

    The Integrations screen in the HYPR Control Center with no integrations yet, showing the Add New Integration button.

  2. Select the PingOne DaVinci Identity Orchestration integration.

    The Add New Integrations screen, with PingOne DaVinci Identity Orchestration among the available identity provider tiles.

  3. To integrate HYPR and PingOne DaVinci, you just need to provide some basic information on the Integrations screen.

    The PingOne DaVinci integration setup screen, with fields for the application name and the OIDC redirect URL list.

    FieldValue
    PingOne DaVinci Application NameThe name you provide here will be used in four places:

    - For an application that HYPR auto-creates in the PingOne DaVinci Admin Console

    - For the web account name that users will see in the HYPR Mobile App

    - For the HYPR Device Manager page where users register their devices

    - For internal identification of this integration within the HYPR platform

    You can use any name you like, but it’s best to go with something that indicates the purpose of the application. For example:

    HYPRPingOneDaVinciSSO

    Note that any spaces or special characters will be automatically removed from the name you supply. The namespace is limited to 23 characters.
    OIDC Redirect URL ListThe OIDC URL where HYPR will redirect the authorization code.

  4. Click Add Integration to begin. If the action is successful, you’ll see the Integration Added confirmation dialog.

    The Integration Added confirmation dialog, offering Maybe Later and Enroll Myself.

  5. Click Maybe Later to exit back to the main PingOne DaVinci integration page.

    The main PingOne DaVinci integration page, showing the User Management, Audit Trail, Login Settings and Integration Settings tabs, the Enrolled and Pending filters with no users yet, an Enroll Users button, and the integration marked Disabled.

  6. Open the Integration Settings tab. In addition to the application name and OIDC redirect URL list you supplied, three fields now display, populated with values HYPR generates for this integration. You need all three when you configure the HYPR Connector in PingOne DaVinci, so leave this tab open or copy the values now. Each field has a copy icon beside it.

    The Integration Settings tab, showing the Integration Status panel with an Enable button above the application name, OIDC redirect URL list, OIDC client ID, OIDC client secret, and well-known endpoint URL fields.

    FieldValue
    OIDC Client IDThe client identifier HYPR generates for this integration.
    OIDC Client SecretThe client secret HYPR generates for this integration. Handle it as you would any other credential.
    Well-Known Endpoint URLThe OpenID Connect discovery endpoint HYPR generates for this integration. It incorporates your tenant address and the application name you supplied.
Integration Status

The Integration Status panel at the top of the Integration Settings tab shows the integration as Disabled until you enable it. Enabling it allows every user with a PingOne DaVinci account in your organization to authenticate with HYPR, and PingOne DaVinci can take a few minutes to reflect the change. See Enabling the Integration.

PingOne DaVinci HYPR Connector​

Using the values from the Integration Settings tab, complete the PingOne DaVinci HYPR Connector deployment by following the steps here. The sections below summarize the sequence and identify which HYPR values each DaVinci field takes.

Adding the Connector​

DaVinci connectors are added from the Connectors section and then configured as connector instances.

In the PingOne DaVinci Admin Console, go to Connectors > Add Connector, search for HYPR, then click Create.

Configuring the Connector Instance​

FieldValue
API URLThe address of your HYPR Control Center tenant.
Client IDThe OIDC Client ID from the Integration Settings tab.
Client SecretThe OIDC Client Secret from the Integration Settings tab.
ScopeThe OpenID Connect scopes the flow requests, for example openid email profile.
Supplying the discovery endpoint

The Well-Known Endpoint URL on the Integration Settings tab is this integration's OpenID Connect discovery document. HYPR builds it from your tenant address and the application name you supplied.

Where the connector asks for a discovery or well-known URL rather than a base address, supply that value.

Building the Authentication Flow​

  1. Import the Marketplace flow template. A DaVinci template provides a starting flow that you can modify. On import, DaVinci either creates or references the connector instances the template requires, depending on what already exists in your environment.

  2. Configure the HYPR Connector node. The connector exposes an authentication capability that accepts a username as input and returns the authentication and token response data.

    A three-node DaVinci flow: a sign-on form that gets the username, a HYPR authentication node running a verification workflow, and a final node that shows the MFA result.

  3. Customize the flow as needed. This step is optional.

Enrolling Yourself in the PingOne DaVinci Integration​

Before users can authenticate through this integration, they must be enrolled in HYPR. Enrollment establishes the user's identity, registers one or more trusted devices, and creates the cryptographic credentials that passwordless authentication requires.

The HYPR Connector does not enroll users. It relies on the enrollment state held by HYPR: during authentication, HYPR verifies that the user has an active enrollment and a registered device.

Follow the enrollment instructions in the main Integrations article. Adding yourself as an admin and adding other users to the integration are performed in the same manner.

No Sync in PingOne DaVinci

The PingOne DaVinci integration does not synchronize users from an identity provider, so there is no Sync Users option. Enroll users from the Send Manually tab, either one at a time or with Upload a CSV. Either method sends the user a Magic Link they use to complete enrollment.

The Enroll Users drawer on the Send Manually tab, with first name, last name, and email fields and an Upload CSV link for bulk delivery.

Validating the Integration​

Preparing a Test User​

  1. Create a HYPR user.

  2. Enroll the HYPR Mobile App for that user.

  3. Confirm the device registration.

  4. Assign the user to the PingOne DaVinci integration.

Running the Flow Test​

Run the DaVinci flow end to end: enter the username, follow the redirect to HYPR, complete authentication on the enrolled device, return to DaVinci, and confirm that the flow completes.

Logs and Audit Trail​

Authentication activity for the integration is recorded in its Audit Trail, which HYPR administrators can review in the Control Center. Open Integrations, click the PingOne DaVinci integration, then select the Audit Trail tab.

The Audit Trail tab of the PingOne DaVinci integration, with a date-range picker, a search box for users, machine, session, device and trace IDs, and a results area reporting no events for the selected range.

For the columns, filters, and export options, see Audit Trail.

Common Integration Features

For the shared Control Center integration experience — enabling and disabling the integration, user management, and Audit Trail detail — see the Integrations main page.

If you want to route sign-in attempts into a HYPR Affirm verification flow, configure the optional [Affirm] Authenticator in the integration's Login Settings (see Using Affirm as an Authenticator).