Installation and Deployment

The following provides an overview of the prerequisites and steps to install, deploy, and verify the components used for the FIDO Pre-reg integration with PingOne PingID/Ping AIC as IdP.

API Versions

The methods for initiating enrollment credentials and shipment requests for pre-pre-enrolled YubiKeys depend on how your FIDO Pre-reg solution is set up in your IT environment, and the API versions that are implemented in your environment.

The different API versions support different pre-enrollment features, for example shipment-only requests, or multiple keys, multiple credentials, and multiple IdPs in the same request. For more information, see API Version and Feature Support (FIDO Connector Integration Guide).

FIDO Connector Installation

The FIDO Connector is available as a Docker image, together with an ARM template, provided by Yubico. The following components are used in a reference implementation:

  • Azure Subscription: An active subscription and appropriate permissions.
  • Azure Container Apps: For hosting the FIDO Connector Docker image.
  • Azure Key Vault: For storing API tokens and client secrets.
  • Azure Logic App: For sending PIN notification emails to the end user.
  • Azure Storage Account: For temporary tracking of shipment and credential requests.

When deploying the FIDO Connector, users must have sufficient permissions in both Azure and Microsoft Entra ID to be able to deploy. Resource Group Owner is the recommended baseline.

To allow for the FIDO Connector to connect and authenticate with the Yubico services, an API token is created in the Yubico Customer portal, and stored in Azure Key Vault.

In order for the FIDO Connector to connect and authenticate with Entra ID, an application is registered in the customer’s Entra ID tenant. The appropriate app permissions are provided, and a client secret is created and stored in Azure Key Vault.

Prerequisites

Ensure you have the items listed below before starting the implementation procedure.

Provided by Yubico:

  • A Yubico subscription plan. For questions about Yubico subscription services, contact your Yubico sales representative.
  • Yubico Customer Portal access with FIDO Pre-reg enabled. This is provided during onboarding of your organization.
  • Customization ID (CID), Product ID, and Inventory ID for the YubiKey delivery.
  • An ARM (Azure Resource Manager) template JSON file and a Docker image for deploying components in Azure.
  • Credentials for the Yubico container registry for the FIDO Connector app.
  • An Azure Resource Group permissions template.
  • PingOne Ping AIC Journey configuration templates.

Provided by customer:

  • A PingOne PingID or PingOne AIC instance with FIDO2 passkeys/security keys support.
  • An Azure Portal Subscription with a Resource group supporting the Container app, Azure table, Key Vault, and Logic App resource types.
  • An Office 365 License or another preferred email service to send PINs to end users.
  • A defined method for sourcing shipping addresses for the YubiKey recipients.
  • A defined preference for how recipients will receive YubiKey PINs, for example via email.
  • Sufficient permissions in PingOne PingID/AIC, Azure, and Microsoft Entra ID. The following administrative roles are required:
    • Authentication Policy Administrator role in PingOne PingID/AIC.
    • Application Administrator role in PingOne PingID/AIC.
    • Application Administrator role in Microsoft Entra ID.
    • Authentication Policy Administrator role in Microsoft Entra ID.
    • Global Administrator role in Microsoft Entra ID.
    • Privileged Role Administrator role in Azure.

Implementation Steps

The following steps lets you set up the FIDO Pre-reg integration to be able to request credentials and pre-enrolled YubiKey shipments from your organization’s IT environment:

  1. Configure PingOne for policy authentication and on-behalf of registration, either one of the following:
  2. Configure Microsoft Entra ID to enable container authentication.
  3. Deploy Azure components such as Resource group and ARM template.
  4. Test and verify the deployment using a FIDO Connector test client.
  5. Request credentials and/or shipment of one or more physical YubiKeys.

The sections in the following describe each step in detail.