Unlock your full potential in IAM

This course provides a hands-on technical introduction to PingOne Advanced Identity Cloud Identity Governance (Identity Governance). Further information and guidance can be found in the documentation and knowledge base in the online repositories at: Backstage https://backstage.forgerock.com.

Note: This course is based on PingOne Advanced Identity Cloud (Advanced Identity Cloud) with the Identity Governance functionality added.

Upon completion of this course, you should be able to:

• Discover how to access, manage, and work with Identity Governance capabilities
• Create target applications and configure their mapping with Advanced Identity Cloud, reconcile entitlements from the applications, and provision accounts to the applications
• Create and manage workflows, access requests for resources (entitlements, applications, roles), forms for access requests, and governance glossary items
• Create and start scheduled and event-based certification campaigns to verify user access, and manage compliance by implementing Segregation of Duties (SoD) policies and rules

The following are the prerequisites for successfully completing this course:

• Completion of the Getting Started With PingOne Advanced Identity Cloud for Administrators course.
• Recommended completion of the PingOne Advanced Identity Cloud Administration course.
• Knowledge of basic Windows/PowerShell commands
• An understanding of HTTP and web applications
• A basic understanding of how directory servers function
• A basic understanding of REST
• A familiarity with the Advanced Identity Cloud admin and end-user UIs

Chapter 1: Introducing Identity Governance

Discover how to access, manage, and work Identity Governance capabilities.

Lesson 1: Introducing Identity Governance

Describe Identity Governance and the related capabilities available in Advanced Identity Cloud:

• Describe the purpose of Identity GovernanceIntroduce Identity Governance
• Access Advanced Identity CloudDescribe the course environment and architecture
• Access your CloudShare environment
• Access your Advanced Identity Cloud tenant
• Access and explore your PingOne tenant environment

Lesson 2: Onboarding Applications and Identities

Create applications for onboarding users:

• Explain Identity Governance terminology
• Describe application typesRegister and manage applications
• Connect an application with an identity source
• Configure application provisioning
• Onboard and provision users, roles, and entitlements
• Create a connector server in Advanced Identity Cloud
• Connect the RCS with Advanced Identity Cloud
• Customize the Advanced Identity Cloud user schema
• Register an authoritative application and onboard identities

Chapter 2: Managing Identity Lifecycle and Entitlements

Create target applications and configure their mapping with Advanced Identity Cloud, reconcile entitlements from the applications, and provision accounts to the applications.

Lesson 1: Reconciling Entitlements

Load and manage entitlements from target applications in Advanced Identity Cloud:

• Describe entitlements
• Manage entitlements
• Assign and revoke entitlements to/from users and roles
• Request access for an entitlement
• Reconcile entitlements from Active Directory (AD)
• Reconcile entitlements from PingOne

Lesson 2: Synchronizing Identity Data

Describe synchronization as a foundation of identity lifecycle management in Identity Governance, and provision and manage application accounts:

• Describe the need for synchronization
• Explore synchronization in Identity Governance
• Describe how changes are managed during synchronization
• Provision and manage application accounts
• Provision an account to AD
• Provision an account and entitlement to PingOne

Chapter 3: Creating and Managing Workflows and Access Requests

Create and manage workflows, access requests for resources (entitlements, applications, roles), forms for access requests, and governance glossary items.

Lesson 1: Managing Access Requests for Resources

Create, review, and manage access requests for resources, such as applications, entitlements, and roles:

• Explain access request conceptsAccess request administration
• Request access to resources
• Review and handle access requests
• Request to provision an AD account with entitlements
• Request to provision PingOne accounts with entitlements
• Define a conditional provisioning role
• Define and request a provisioning role

Lesson 2: Managing Glossary Items and Scopes

Create and manage governance glossary items and scopes to manage what can be requested:

• Describe the governance glossary
• Define and populate glossary attribute values
• Use glossary attribute values as filters
• Request access to entities for others
• Create scopes to control what can be requested
• Define glossary items for use in workflows and scopes
• Create access requests for others and add scopes

Lesson 3: Creating Workflows, Request Types, and Forms

Manage workflows, request types, and forms for customizing access requests, and schedule a task scanner job:

• Create and manage workflows
• Build a workflow with nodes
• Create and manage request types
• Create and manage forms for customized user-interaction
• Designing forms in the form editorCreate and manage a task scanner
• Create new workflows and update default workflows
• Create and manage forms to customize user interaction

Chapter 4: Managing Certifications and Compliance

Create and start scheduled and event-based certification campaigns to verify user access, and manage compliance by implementing SoD policies and rules.

Lesson 1: Configuring and Running Certifications

Prepare and perform certification of access to applications:

• Certify access in Identity Governance
• Create certification templates
• Configure the certification templateManage certification templates
• Create certification campaigns
• Perform access reviews
• Certify access based on events
• Configure and initiate entitlement certifications
• Certify entitlements for the certification campaign
• Configure an event that triggers certification
• Configure an event that initiates a workflow
• Manage approvals for triggered events

Lesson 2: Managing Compliance With SoD

Manage compliance and implement SoD policies:

• Describe SoDDefine policy rules
• Configure compliance policies
• Run compliance scans
• Manage violations and exceptions
• Create an SoD rule and policy
• Run a compliance scan
• Make a request that violates compliance

This course provides the foundation to design, build, and integrate identity orchestration flows using PingOne DaVinci (DaVinci). You will create user interactions, extend flows with APIs, and integrate these solutions into applications. You will also leverage core PingOne services like SSO, identity management, and analytics. Through hands-on labs and instruction, you will gain the skills to deploy real-world orchestration solutions with confidence.

Upon completion of this course, you should be able to:

• Build basic user interactions with DaVinci flows
• Integrate a DaVinci flow into an application
• Integrate PingOne single sign-on (SSO) and identities in DaVinci flows
• Build an authentication flow in DaVinci
• Provide custom analytics in a DaVinci flow

The following are the prerequisites for successfully completing this course:

• Basic understanding of JavaScript, HTML, CSS, and the PingOne Platform
• Completion of the Introduction to PingOne DaVinci course available at:
  • https://backstage.forgerock.com/university/ping/on-demand/category/PING

Chapter 1: Building Basic User Interactions With DaVinci Flows

Build basic user interactions with DaVinci flows.

Lesson 1: Defining the Basic Flow and Interaction Steps

Define the basic flow and provide an introduction to the foundational concepts of DaVinci:

• Introduce the PingOne Platform and DaVinci
• Access and launch the DaVinci admin console
• Understand Flows
• Build basic user interaction in a flow

Lesson 2: Using Functions and API Calls
Define the basic flow and provide an introduction to the foundational concepts of DaVinci:

• Extend DaVinci flows
• Verify the age of the user
• Make an API callCollect the user’s email and password
• Implement a robot check
• Document the flow

Lesson 3: Improving the User Experience
Use more advanced concepts in DaVinci to implement your flows:

• Improve the UI
• Convert user interactions to use HTML templates

Lesson 4: Using Variables and Form Validation
Expand further the functionality of your existing flow by using flow variables and improving interaction with the user:

• Incorporate variables
• Understand localizing flows
  
• Use flow variables and form validation
  
• Incorporate form validation
  
• Improve form validation inputs
  
• Troubleshoot issues

Lesson 5: Using Subflows to Manage Complexity
Externalize functionality that is often reused or complex to its own flow; for example, if the flow needed to connect to an API that isn’t available as a native connector, CRUD operations could be built in a new flow that could be leveraged by many:

• Create and use subflows
  
• Implement the subflow
  
• Replace the API call with the subflow

Chapter 2: Integrating a DaVinci Flow Into an Application

Integrate a DaVinci flow into an application.

Lesson 1: Integrating an Application to Launch a Flow
Integrate the flow into a web application which allows the application to provide the CSS (look and feel). Other flows can also be integrated to enable a richer user experience:

• Add a flow to a web application
  
• Create and customize the application

Lesson 2: Using a CSS in Flows vs Applications
Review how CSS is leveraged in a flow vs an application, and determine the advantages of leaving the presentation layer controlled by your application rather than using a CSS in your flow:

• Leverage a CSS
  
• Determine how a custom CSS in a flow is embedded with a web application

Lesson 3: Adding a Flow to an Existing Applicatio
Take the flow and integrate it into a web application:

• Embed flows using the widget method
  
• Import the DaVinci JavaScript library
  
• Create a JavaScript method to call the flow

Lesson 4: Integrating Non-UI Flows
Explore how DaVinci can accelerate development when integrating with backend services and APIs, enriching the overall user experience:

• Integrate a non-UI flow
  
• Build out your flow
  
• Integrate the flow

Lesson 5: Passing Data Into a Flow From an Application
Run through the process of passing data into a flow, whether it has user interaction or not:

• Enable dynamic flows
• Create and integrate a DaVinci subflow

Lesson 6: Performing A/B Testing
Define a flow that deals with age first, instead of name, during registration:

• Understand A/B testing
  
• Define a new flow
  
• Incorporate flow policies
  
• Build out a flow policy

Chapter 3: Integrating PingOne SSO and Identities in DaVinci Flows

Integrate PingOne SSO and identities in DaVinci flows.

Lesson 1: Setting Up Parallel Processing

Set up a flow that has two paths that execute in parallel and then come to their own conclusion:

• Implement parallel processing
  
• Leverage the PingOne Notification service

Lesson 2: Automating Flows With DaVinci Admin APIs

Learn how to manage DaVinci programmatically using the DaVinci Admin APIs:

• Understand DaVinci Admin APIs
  
• Explain administrator roles

Lesson 3: Creating Registered Accounts
Take the information collected during the registration process and create a user account in PingOne, which is the first step to expanding the capabilities of the application to support authentication:

• Create registered accounts
  
• Review your PingOne setup
  
• Build out a new registration flow
  
• Verify if an account already exists

Lesson 4: Verifying an Email Address

Establish a process to verify the email address of the user:

• Configure email verification
  
• Create an email verification subflow
  
• Complete the subflow

Chapter 4: Building an Authentication Flow in DaVinci

Build an authentication flow in DaVinci.

Lesson 1: Handling Authentication

Handle authentication for the application:

• Design and implement the authentication flow
  
• Design the flow logic
  
• Implement teleports for flow efficiency
  
• Authenticate and validate user identity

Lesson 2: Handling Forgotten Passwords

Handle forgotten password in the authentication flow:

• Manage password recovery flows
  
• Develop the end-to-end forgot password flow

Lesson 3: Adding an Authentication Method

Add another method of authentication, an email magic link, for the users of the application:

• Implement magic link authentication
  
• Add a magic link authentication method

Chapter 5: Providing Custom Analytics in a DaVinci Flow

Provide custom analytics in a DaVinci flow.

Lesson 1: Leveraging analytics to monitor flow usage

Implement custom analytics to track key business milestones and user behavior across DaVinci flows:

• Understand and apply flow analytics
  
• Configure authentication analysis