A financial application should be prompted for step-up authentication on a URL that allows money transfers. A previous administrator configured rules…

In PingAccess, enforcing step-up authentication for a specific resource is achieved using an Authentication Requirements Rule. This rule type is designed to inspect the user's session context, which is typically provided by PingFederate in a web session token. The rule verifies if the session meets a pre-defined minimum authentication level or context.

If users are not being prompted for step-up, the issue lies either with the application of the rule or its configuration. The administrator must first verify that an Authentication Requirements Rule is correctly applied to the financial application's URL (B). Second, they must ensure the rule itself is configured with the appropriate minimum authentication level required for the sensitive money transfer operation (C).

A. A rejection handler executes after a rule fails to define the denial action; it does not perform the primary check for the authentication context.

D. Identity mappings are used to transform or add attributes for consumption by the backend application, not to enforce authentication policies on the resource.

E. Token validation confirms the integrity, issuer, and audience of the token itself, but it does not evaluate the business logic of whether the authentication level is sufficient for the resource.

1. PingAccess Administrator's Guide 7.3, Section: Authentication Requirements rule.

Page/Section: In the "Managing rules" chapter, the section "Authentication Requirements rule" states: "Use an Authentication Requirements rule to require that the user's session meets a minimum authentication level or contains a specific authentication context." This directly supports that this rule type is the correct mechanism (validating option B).

2. PingAccess Administrator's Guide 7.3, Section: Add an Authentication Requirements rule.

Page/Section: In the "Configuring rules" chapter, the section "Add an Authentication Requirements rule" details the configuration fields. It shows that the administrator must specify the "Authentication Requirement List" or "Authentication Requirement," which defines the minimum level the user's session must meet. This confirms the need to check the rule's internal configuration (validating option C).