Which two protocols does PingAccess use for authentication and authorization? (Choose 2 answers.)

PingAccess is a modern access security solution designed to protect web applications and APIs. Its core functionality is built upon the OAuth 2.0 and OpenID Connect (OIDC) standards. It acts as an OAuth 2.0 Resource Server, validating access tokens to enforce authorization policies and protect resources. For user authentication and session management, PingAccess functions as an OIDC Relying Party, leveraging an identity provider (like PingFederate) to authenticate users and establish secure sessions based on the identity information contained within an ID Token. These two protocols work together to provide a comprehensive authentication and authorization framework.

A. SAML: While PingAccess can integrate into a SAML-based SSO environment (typically via PingFederate), its native and primary protocol for creating modern web sessions is OIDC, not SAML.

B. WS-Fed: This is a legacy federation protocol. PingAccess is built on modern standards and does not use WS-Fed for its core authentication or authorization mechanisms.

C. WS-Trust: This is part of the WS-Federation protocol suite and is not a protocol directly used by PingAccess for its primary functions of authentication and authorization.

1. Ping Identity Documentation, PingAccess 7.3 Administrator's Guide:

Section: "About PingAccess", Page 10.

Content: "PingAccess is a reverse-proxy that protects web applications and APIs by applying security policies to client requests. It works with your identity provider to grant access to protected resources based on OAuth 2.0 and OpenID Connect (OIDC) standards." This statement explicitly names both protocols as the foundation for PingAccess's operation.

2. Ping Identity Documentation, PingAccess 7.3 Administrator's Guide:

Section: "PingAccess for APIs", Page 12.

Content: "When a client application attempts to access a protected API, it must present a valid OAuth 2.0 access token... PingAccess validates the access token with the OAuth Authorization Server..." This confirms the use of OAuth 2.0 for authorization.

3. Ping Identity Documentation, PingAccess 7.3 Administrator's Guide:

Section: "PingAccess for web applications", Page 11.

Content: "When a user attempts to access a protected web application, PingAccess redirects the user's browser to the OpenID Provider (OP) to authenticate. After successful authentication, the OP provides an ID token..." This confirms the use of OIDC for authentication.