DEV Community

Cover image for Building One Tap for PingFederate, Part 2: Docker, Terraform, and OIDC with PKCE
DarkEdges
DarkEdges

Posted on

Building One Tap for PingFederate, Part 2: Docker, Terraform, and OIDC with PKCE

#terraform #docker #oidc #pingidentity

The account chooser needs more than a widget and a Java adapter. PingFederate
must have a complete authentication policy, a credential validator, a reusable
authentication session, and an OIDC client. This article makes that environment
repeatable with Docker, Terraform, and Make.

Source: github.com/darkedges/pingfedonetap

Bake the adapter into the PingFederate image

The Maven build produces the adapter JAR. A PowerShell staging script creates a
server profile overlay with this structure:

docker/pingfederate-profile/
  instance/server/default/
    deploy/one-tap-status-adapter.jar
    conf/template/one-tap-status-template.html
    conf/language-packs/one-tap-status-template.properties
Enter fullscreen mode Exit fullscreen mode

The Dockerfile copies that overlay to /opt/in/ in the official
PingFederate image. At startup, the Ping container downloads Ping Identity's
getting-started profile and merges the local overlay into the runtime under
/opt/out/instance.

The important point is that the JAR is part of the image input. It is not
copied manually into a running container.

make docker-image
Enter fullscreen mode Exit fullscreen mode

Keep license credentials out of source

The container obtains its development license at startup. Put the Ping DevOps
credentials in environment variables or an ignored .env file:

PING_IDENTITY_DEVOPS_USER=replace-me
PING_IDENTITY_DEVOPS_KEY=replace-me
ONE_TAP_ALLOWED_ORIGINS=http://localhost:8080
Enter fullscreen mode Exit fullscreen mode

Do not commit these values. The credentials are needed when the container
starts, not when the image is built.

make docker-up
make docker-logs
Enter fullscreen mode Exit fullscreen mode

Provision the authentication chain

The Terraform configuration creates:

  • A Simple Username Password Credential Validator for disposable test users.
  • An HTML Form IdP Adapter backed by that validator.
  • An Identifier First Adapter that remembers up to five identifiers for 30 days.
  • The custom One Tap status adapter with an exact origin allowlist.
  • An enabled IdP authentication policy.
  • An authentication-session policy for the HTML Form adapter.
  • OAuth and OIDC mappings.
  • A public OIDC client restricted to Authorization Code with PKCE.

The interactive policy is intentionally simple:

Identifier First
  Success: pass subject as incoming username
    HTML Form
      Success: complete authentication
      Failure: fail
  Failure: fail
Enter fullscreen mode Exit fullscreen mode

The status adapter is not part of this tree. Adding a status-only adapter to the
interactive policy would leave authentication in progress and prevent the flow
from completing.

Why the authentication-session policy matters

Remembering an identifier does not remove the password requirement. The HTML
Form adapter must also have a reusable PingFederate authentication session.

The local policy uses:

Persistent session: true
Idle timeout: 60 minutes
Maximum timeout: 480 minutes
Device type: private
Enter fullscreen mode Exit fullscreen mode

After the first successful password authentication, a later OIDC request can
reuse this session. That is what lets the remembered-account selection finish
without prompting for the password again.

Configure a browser public client correctly

The demo client uses these settings:

Client ID: one-tap-demo
Grant: Authorization Code
Client authentication: none
PKCE: required
Scope: openid
Redirect URI: http://localhost:8080/callback.html
Enter fullscreen mode Exit fullscreen mode

Redirect URIs are exact matches. A different port, path, or trailing slash must
be registered explicitly.

The callback validates the OIDC state and exchanges the code with the PKCE
verifier. The demo shows only a sanitized result and does not retain the code,
verifier, access token, or ID token.

Apply the configuration

Ping DevOps license credentials and Terraform administrative credentials are
different concerns. Set the provider credentials in the current shell, then
use an ignored terraform.tfvars for test users and local options.

make terraform-init
make terraform-plan
make terraform-apply
make demo-up
Enter fullscreen mode Exit fullscreen mode

Open http://localhost:8080 after trusting the local development certificate
for https://localhost:9031.

Production boundaries

This environment is a local demonstration. For a real deployment:

  • Store Terraform state in an encrypted, access-controlled backend.
  • Use an enterprise credential validator rather than local test users.
  • Remove development TLS trust overrides.
  • Validate ID token signatures and claims in a backend.
  • Use production origins and exact redirect URIs.
  • Define explicit identity provider logout behavior separately from application logout.

In part 3, we will turn the working flow into a deterministic narrated video
with Kokoro, Playwright, and FFmpeg.

Repository: https://github.com/darkedges/pingfedonetap

Video demo: https://youtu.be/KuVNjWiZrAk

Terraform #Docker #OIDC #PingFederate #DevOps

Top comments (0)