Skip to main content
This guide explains how to obtain Idp_url, Org_alias, Token, and Use_base64_key from the PingID administration console and configure the Ping Identity connection in AirMDR.
PingID uses signed JWS request tokens rather than a conventional bearer-token or OAuth authentication flow.Each request uses:
  • org_alias to identify the PingID organization.
  • token to identify the PingID API client.
  • use_base64_key to create the cryptographic signature.
  • idp_url as the tenant-specific PingID API endpoint.
PingID uses HS256 to sign the request. PingID validates the client information and message signature before processing the request.Credential Reference
Ping Identity specifically identifies token, org_alias, and use_base64_key as values obtained from the PingID properties file. The idp_url in the file determines the PingID endpoint associated with the organization’s region.
Never include the token or use_base64_key in screenshots, tickets, chat messages, application logs, or public documentation.

​
Pre-requisites

An active PingID/PingOne organization with administrative access to the PingID admin portal.
Permission to access Setup → PingID → Client Integration and to generate or download a PingID properties file.
Ping Identity states that a PingID administrator requires appropriate administrative rights; the API documentation identifies Global Administrator as the administrator role with full account configuration permissions.

​
Setup Steps

1

Sign in to the PingID admin portal

  1. Sign in to your organization’s PingOne administration console.
  2. Select Setup.
  3. Select PingID or PingID Configuration, depending on the console.
  4. From the PingID administration portal, navigate to: Setup → PingID → Client Integration.
  5. Open Client Integration.
  6. Locate Integrate with PingFederate or Integrate with PingFederate and Other Clients.
    These navigation labels apply to the documented PingID administration interface. If your tenant displays a different interface, ask your PingID administrator to locate its properties-file management settings.
2

Generate and Download the Properties File

  1. In the relevant section, click Generate to create a credential set.
  2. Click Save to enable downloading.
  3. Locate the new entry and click Download.
  4. Save the properties file in an access-controlled location.
    (or)
    If an existing credential set is approved for this connection, download its file instead.
    This section supports up to five active properties files. If the limit is reached, identify an unused credential with its owner before revoking it.
    The properties file for Integrate with PingFederate and Other Clients provides broader permissions, including authentication, enrollment, and device-management operations. Restricted Windows/Mac or SSH properties files might not provide permissions required for management API operations.
3

Identify the required credentials

  1. Open the downloaded properties file using a secure text editor.
  2. The file contains entries similar to the following:
  3. Locate the following four properties:
    These are the values required by the AirMDR Ping Identity connector. Ping Identity’s API documentation confirms these values are supplied through the properties file.
    Copy only the value after the = character. Do not include the property name.
    Field-specific checks:
    • Idp_url: Use idp_url, including its path. Do not substitute admin_url or authenticator_url.
    • Org_alias: Use the file’s alias, rather than the organization’s display name.
    • Token: Copy the complete value without quotation marks or surrounding spaces.
    • Use_base64_key: Keep the key in Base64 form when entering it in AirMDR.
4

Obtain the Idp_url

  1. Locate: idp_url=https://<tenant>.pingidentity.com/pingid.
  2. Copy the complete URL after idp_url=. For example: https://<tenant>.pingidentity.com/pingid
  3. Enter this value in: AirMDR Integration Credentials page → +New Connection → Idp_url
    The idp_url identifies the PingID server used for API requests. The value is tenant and region specific. Ping Identity specifically recommends using the value contained in your organization’s properties file instead of manually constructing the endpoint.
5

Obtain the Org_alias

  1. Locate: org_alias=<ORGANIZATION_ALIAS>.
  2. Copy the value after org_alias=. For example: 12345-aaaa-bbbb-1234-87654321abcd
  3. Enter this value in: AirMDR Integration Credentials page → +New Connection → Org_alias.
    org_alias uniquely identifies the PingID organization associated with the API client and is included in the JWS request header.
6

Obtain the Token

  1. Locate: token=<PINGID_CLIENT_TOKEN>.
  2. Copy the value after token=. For example: c85c1234567890abcdef1234567894c1
  3. Enter this value in: AirMDR Integration Credentials page → +New Connection → Token.
    Treat the token as sensitive authentication configuration and do not expose it in documentation or logs.
    The token uniquely identifies the calling PingID API client. Multiple clients can exist for the same organization. 
7

Obtain the Use_base64_key

  1. Locate: use_base64_key=<BASE64_SIGNING_KEY>.
  2. Copy the value associated with use_base64_key. For example: APixxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7ct4z7LOM=
  3. Enter this value in: AirMDR Integration Credentials page → +New Connection → Use_base64_key.
    The use_base64_key is the secret used when generating the HMAC-SHA256 signature for PingID API requests. PingID validates the resulting signature before accepting the request.
    Enter the original Base64 key supplied by PingID. AirMDR should perform the signing operation internally; do not manually transform or decode the credential before entering it into the connector unless specifically required by the connector implementation.
8

Save the connector

  1. Verify the values entered in all required fields.
  2. Ensure that no leading or trailing spaces were copied with the credentials.
  3. Click Save.
    AirMDR stores the connector configuration and can use the supplied credentials for supported PingID operations.

​
Ping Identity Credential Reference Table

Use the following table when configuring the Ping Identity connector in AirMDR.
All four values should be copied from the same downloaded PingID properties file. Do not manually construct or modify these values.
Example properties file
Treat token and use_base64_key as sensitive credentials. Do not expose them in screenshots, logs, tickets, or public documentation.

​
Validate Connectivity

After configuring the Ping Identity connector, validate that AirMDR can reach the PingID service endpoint.
First validate the /heartbeat endpoint to confirm network connectivity. Then run a supported PingID API operation to confirm that the configured credentials are valid.
  1. Copy the hostname from the idp_url value in the downloaded pingid.properties file.
    Example: idp_url=https://idpxxxxx.pingidentity.com/pingid
  2. Append /heartbeat to the PingID URL.
  1. Run the following command from the system where connectivity must be verified:
  1. Verify that the endpoint returns an HTTP 200 response.
    Example: HTTP/1.1 200 OK
Ping Identity documents the /pingid/heartbeat endpoint specifically for verifying connectivity to the PingID server. If the request fails, verify that outbound TCP port 443 is permitted to the PingID hostname.
Use the hostname from your own idp_url. PingID endpoints can differ depending on the organization’s region.
A successful heartbeat confirms network connectivity only. It does not validate the org_alias, token, or use_base64_key.To fully validate the connector, execute a supported PingID API operation through AirMDR. PingID API requests use:
  • org_alias to identify the organization.
  • token to identify the API client.
  • use_base64_key to sign the request using HMAC SHA-256 (HS256).
  • idp_url as the API endpoint.
PingID rejects requests when the client token or signing information is invalid. For example, a read-only GetUserDetails operation can be used when an appropriate PingID username is available: POST <idp_url>/rest/4/getuserdetails/doA successful PingID operation returns an errorId of 200. 

​
Configure Ping Identity in AirMDR Integrations Dashboard

  1. Navigate to AirMDR, provide the credentials and click Login
  2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select ADMIN → Integrations.
  3. Use the search option, enter the keyword “PingID”, select the Connections tab, and click + New Connection button.
  4. Use the following values in the AirMDR integration configuration screen:
    1. In Remote Agent, select an AirMDR Remote Agent only when the PingID service must be accessed through an approved private network route, proxy, or controlled network environment. For standard publicly accessible PingID SaaS endpoints, leave this field unselected unless instructed otherwise by your AirMDR administrator.
    2. In Expiry, select the date on which AirMDR should treat the stored PingID credentials as expired, according to your organization’s credential-rotation policy.
    The Expiry date controls credential validity in AirMDR. It does not automatically rotate or revoke the PingID properties file or its associated credentials. Generate a new PingID properties file, update the Idp_url, Org_alias, Token, and Use_base64_key values in AirMDR, validate the connection, and then revoke the previous PingID properties file.
  5. Click Save.

​
Skills provided by this Integration

The Ping Identity integration provides investigation, containment, access-control, and recovery skills for managing PingID users and their registered MFA devices.
Use these skills to retrieve information without changing the PingID user or device configuration.
PingID’s GetUserDetails operation is part of the User Management API and returns user status and device details.
Use these skills when responding to a potentially compromised user account or MFA device.
PingID documents SuspendUser for temporarily preventing authentication and UnpairDevice as a device-management operation.
These skills modify the user’s authentication state and can affect the user’s ability to access applications protected by PingID.
PingID’s ToggleUserBypass operation changes whether a user is placed into bypass mode and is categorized by PingID as a user-status management operation.
Enabling MFA bypass reduces the authentication controls applied to the user. Restrict this action to authorized workflows and validate the intended user before execution.
Use this skill after the security condition that resulted in suspension has been investigated and resolved.
PingID specifies that a user suspended with SuspendUser can subsequently be reactivated using ActivateUser.
To view the details of Input Parameters and Output for the respective skills
  • Go to AirMDR → PingID Integration page.
  • Select the Skills tab and click on the required listed skills.

​
Permission Summary

Recommended configuration: Generate the PingID properties file from Setup → PingID → Client Integration → Integrate with PingFederate so that the AirMDR connector has the management capabilities required by these skills.

​
Additional Information

PingID explicitly rejects requests when required client/signature values are invalid.Troubleshooting TipPingID API responses contain a uniqueMsgId. Ping Identity documents this identifier as useful for identifying and troubleshooting individual transactions. Record the uniqueMsgId, timestamp, API operation, errorId, and errorMsg when escalating an issue.
Do not include the signing key or client credentials in a support ticket.
PingID MonitoringPingID provides activity and administrative reporting through the PingOne administration console.Navigate to: Dashboard → Reporting → ReportsAdministrators can use the PingID Admin Activity Report to review administrative activity. PingID reports can include timestamp, administrator, action, resource, status, IP address, and detailed messages.PingID activity reporting can also provide information about:
  • User creation, modification, and deletion.
  • Device pairing and unpairing.
  • Authentication activity.
  • Device lifecycle events.
  • SMS, voice, and email-related events where applicable.
Ping Identity also supports streaming PingID event information to third-party systems such as Splunk through its subscription capabilities. Recommended AirMDR Log LevelsIllustrative entries:
Never log token, use_base64_key, signed JWS values, or the complete properties file.
✅ Do
  • Restrict PingID properties-file access to authorized administrators.
  • Use credentials from the same properties file.
  • Treat token and use_base64_key as secrets.
  • Use the tenant-specific idp_url supplied by PingID.
  • Permit only required outbound HTTPS connectivity.
  • Rotate credentials according to organizational security policy.
  • Update AirMDR with the replacement credentials before revoking the previous properties file.
  • Review PingID activity and administrative reports regularly.
  • Remove downloaded properties files from temporary or unsecured locations after the credentials are configured.
❌ Don’t
  • Do not share the PingID properties file through email, Slack, or support tickets.
  • Do not expose use_base64_key in screenshots.
  • Do not store credentials in source-control repositories.
  • Do not copy idp_url from generic PingID API examples because the region or tenant can differ.
  • Do not combine token and use_base64_key values from different properties files.
  • Do not revoke an active properties file before deploying its replacement.
  • Do not enable verbose logging that exposes signed requests or authentication material.
  • 📧 Contact AirMDR Support through your designated support channel.
  • 🔁 Rotate credentials regularly. Recommended cadence: Every 90 days or as per internal security policy
  • 🔄 Reconnect in AirMDR immediately when API Keys are changed.
    Revoking a properties file immediately invalidates clients relying on that file. Verify that no production connector is still using it before revocation. 
    Recommended sequence:
    1. Navigate to Setup → PingID → Client Integration.
    2. Click Generate.
    3. Click Save.
    4. Download the new properties file.
    5. Extract the new idp_url, org_alias, token, and use_base64_key values.
    6. Update the AirMDR connector.
    7. Validate the integration.
    8. Revoke the previous properties file only after confirming the new configuration works.
Data FlowThe typical request flow is:
  1. AirMDR identifies the PingID tenant using idp_url.
  2. AirMDR constructs the PingID API request.
  3. org_alias and token identify the organization and API client.
  4. The request is signed using use_base64_key.
  5. PingID validates the signature.
  6. PingID processes the requested operation.
  7. PingID returns the API response.
PingID’s API uses JWS messages and HMAC-SHA256 signatures.Network RequirementsPing Identity documents regional PingID API domains for North America, Europe, and Australia and recommends using the idp_url from the organization’s own properties file. Example PingID API Request
AirMDR handles request construction and signing automatically. At the API level, a PingID call follows this pattern:
A PingID JWS header contains information similar to:
The JWS is signed using the use_base64_key.