When does class start/end?
Class hours may vary, please reach out to contact@ascendientlearning.com if you have any questions.
PingAM: Administration
The aim of this course is to showcase the key features and capabilities of the versatile and powerful access management solution in a Ping Identity environment. Skills Gained Upon completion of this...
Read More
$3,375 USD
Duration
3 days
Course Code
PAM-400
Available Formats
Classroom, Virtual
Overview
Course Description
The aim of this course is to showcase the key features and capabilities of the versatile and powerful access management solution in a Ping Identity environment.
Skills Gained
Upon completion of this course, you should be able to:
- Start with an unprotected website and end up with a fully functional access management solution where every user trying to access the website is redirected to PingAM (AM) for authentication
- Improve access management security in Ping Access Management (PingAM or AM) with multi-factor authentication (MFA), context-based risk analysis, and continuous risk checking
- Implement OAuth 2.0 (OAuth2) based protocols; namely, OAuth2 and OpenID Connect 1.0 (OIDC), to enable low-level devices and mobile applications to make requests that access resources belonging to a subscriber. Ping Identity Access Management (PingAM or AM) can be configured to function as an OIDC client and delegate authentication to social media OIDC providers
- Introduce SAML2 with AM as an identity provider (IdP) and AM as a service provider (SP)
Who Can Benefit
The target audiences for this course include:
- Ping Access Management Administrators
- System Integrators
- System Consultants
- System Architects
- System Developers
Prerequisites
The following are the prerequisites for successfully completing this course:
- Completion of the Introduction to PingAM On Demand course
- Completion of the PingAM Getting Started On Demand course
Course Details
Course Details
Chapter 1: Enhancing Intelligent Access
Start with an unprotected website and end up with a fully functional access management solution where every user trying to access the website is redirected to PingAM (AM) for authentication.
Lesson 1: Reviewing Authentication Mechanisms
Explore the AM admin UI, view the role of cookies used during and after authentication, and describe authentication trees and nodes:
- Describe the course lab environment
- Access the lab environment
- Examine the initial AM installation
- Review AM authentication
- Review sessions
- Review realms
- Configure a realm and test default authentication
- Review authentication trees and nodes
- Create a login tree
- Test the login tree
Lesson 2: Protecting a Website With PingGateway
Protect a website by integrating PingGateway with AM:
- Present AM edge clients
- Describe PingGateway functionality as an edge client
- Review the FEC website protected by PingGateway
- Integrate the FEC website with AM
- Observe the PingGateway token cookie
- (Optional) Review PingGateway configuration
- Authenticate identities with AM
- Create an authentication tree with an LDAP Decision node
- Integrate identities in AM with an identity store
- Integrate an identity store with AM
Lesson 3: Controlling Access
Create security policies to control which users can access specific areas of the website:
- Describe entitlements with AM authorization
- Define AM policy components
- Define policy environment conditions and response attributes
- Describe the process of policy evaluation
- Implement access control on a website
Chapter 2: Improving Access Management Security
Improve access management security in Ping Access Management (PingAM or AM) with multi-factor authentication (MFA), context-based risk analysis, and continuous risk checking.
Lesson 1: Increasing Authentication Security
Increase authentication security using MFA:
- Describe MFA
- Register a device
- Include recovery codes
- Examine OATH authentication
- Implement TOTP authentication
- (Optional) Implement HOTP authentication
- Examine Push notification authentication
- (Optional) Implement Push notification authentication
- Implement passwordless WebAuthn
- (Optional) Implement passwordless WebAuthn
- Examine HOTP authentication using email or SMS
- (Optional) Implement HOTP authentication using email or SMS
Lesson 2: Modifying the Authentication Journey Based on Context
Describe how AM can take into account the context of an authentication request in order to make access decisions:
- Introduce context-based risk analysis
- Describe device profile nodes
- Determine the risk based on the context
- Implement a browser context change script
- Lock and unlock accounts
- Implement account lockout
Lesson 3: Checking Risk Continuously
Review the AM tools used to check the risk level of requests continuously:
- Introduce continuous contextual authorization
- Describe step-up authentication
- Implement step-up authentication flow
- Describe transactional authorization
- Implement transactional authorization
- Prevent users from bypassing the default tree
Chapter 3: Extending Services Using OAuth2-Based Protocols
Implement OAuth 2.0 (OAuth2) based protocols; namely, OAuth2 and OpenID Connect 1.0 (OIDC), to enable low-level devices and mobile applications to make requests that access resources belonging to a subscriber. Ping Identity Access Management (PingAM or AM) can be configured to function as an OIDC client and delegate authentication to social media OIDC providers.
Lesson 1: Integrating Applications With OAuth2
Integrate clients using OAuth2 by demonstrating the use of the OAuth2 Device Code grant type flow with AM configured as the OAuth2 authorization server (AS):
- Discuss OAuth2 concepts
- Describe OAuth2 tokens and codes
- Describe refresh tokens, macaroons, and token modification
- Request OAuth2 access tokens with OAuth2 grant types
- Explain OAuth2 scopes and consent
- Configure OAuth2 in AM
- Configure AM as an OAuth2 provider
- Configure AM with an OAuth2 client
- Test the OAuth2 Device Code grant type flow
Lesson 2: Integrating Applications With OIDC
Integrate an application using OIDC and the Authorization grant type flow with AM as an OIDC provider:
- Introduce OIDC
- Describe OIDC tokens
- Explain OIDC scopes and claims
- List OIDC grant types
- Create and use an OIDC script
- Create an OIDC claims script
- Register an OIDC client and configure the OAuth2 Provider settings
- Test the OIDC Authorization Code grant type flow
Lesson 3: Authenticating OAuth2 Clients With JWT Profiles, mTLS, and PoP
Identify OAuth2 client authentication methods, authenticate a client with mTLS, and obtain a certificate-bound access token for proof-of-possession:
- Examine OAuth2 client authentication
- Examine OAuth2 client authentication using JWT profiles
- Examine OAuth2 client authentication using mTLS
- Authenticate an OAuth2 client using mTLS
- Examine certificate-bound PoP when mTLS is configured
- Obtain a certificate-bound access token
Lesson 4: Transforming OAuth2 Tokens
Request and obtain security tokens from an OAuth2 authorization server, including security tokens that employ impersonation and delegation semantics:
- Describe OAuth2 token exchange
- Explain token exchange types and purpose for exchange
- Describe token scopes and claims
- Implement a token exchange impersonation pattern
- Implement a token exchange delegation pattern
- Configure token exchange in AM
- Configure AM for token exchange
- Test token exchange flows
Lesson 5: (Optional) Implementing Social Authentication
Provide a way for users to register and authenticate to AM using a social account:
- Delegate registration and authentication to social media providers
- Implement social registration and authentication with Google
Chapter 4: Federating Across Entities Using SAML2
Introduce SAML2 with AM as an identity provider (IdP) and AM as a service provider (SP).
Lesson 1: Introducing AM as a SAML2 Identity Provider
Explain the role of AM as a SAML2 IdP and perform a basic hosted IdP configuration:
- Discuss SAML2 entities and federation concepts
- Explain the SAML2 flow from the IdP point of view
- Configure AM as a hosted IdP and export metadata
Lesson 2: Introducing AM as a SAML2 Service Provider
Explain the role of AM as a SAML2 SP and perform a simple integrated-mode configuration:
- Explain the SSO flow from the SP point of view
- Describe the metadata content and purpose
- Configure AM as a hosted SP and create a simple SAML2 tree
Schedule
3 options available
-
Sep 14, 2026 - Sep 18, 2026 (5 days)
Live Virtual | 9:00AM – 5:00PM EDT Language English Select from 1 option(s) below Live Virtual | 9:00AM – 5:00PM EDT- Enroll
- Enroll Add to quote
-
Oct 26, 2026 - Oct 30, 2026 (5 days)
Live Virtual | 9:00AM – 5:00PM EDT Language English Select from 1 option(s) below Live Virtual | 9:00AM – 5:00PM EDT- Enroll
- Enroll Add to quote
-
Dec 7, 2026 - Dec 11, 2026 (5 days)
Live Virtual | 9:00AM – 5:00PM PST Language English Select from 1 option(s) below Live Virtual | 9:00AM – 5:00PM PST- Enroll
- Enroll Add to quote
FAQ
Does the course schedule include a Lunchbreak?
Classes typically include a 1-hour lunch break around midday. However, the exact break times and duration can vary depending on the specific class. Your instructor will provide detailed information at the start of the course.
What languages are used to deliver training?
Most courses are conducted in English, unless otherwise specified. Some courses will have the word "FRENCH" marked in red beside the scheduled date(s) indicating the language of instruction.
What does GTR stand for?
GTR stands for Guaranteed to Run; if you see a course with this status, it means this event is confirmed to run. View our GTR page to see our full list of Guaranteed to Run courses.
How do I find an Ascendient Learning training location?
We have training locations across the United States and Canada - View a complete list of classroom training locations.
Which delivery formats are available?
At Ascendient Learning, we offer training that is Instructor-Led, Online, Virtual, and Self-Paced.
Does Ascendient Learning deliver group training?
Yes, we provide training for groups, individuals and private on sites. View our group training page for more information.
What does vendor-authorized training mean?
As a vendor-authorized training partner, we offer a curriculum that our partners have vetted. We use the same course materials and facilitate the same labs as our vendor-delivered training. These courses are considered the gold standard and, as such, are priced accordingly.
Is the training too basic, or will you go deep into technology?
It depends on your requirements, your role in your company, and your depth of knowledge. The good news about many of our learning paths, you can start from the fundamentals to highly specialized training.
How up-to-date are your courses and support materials?
We continuously work with our vendors to evaluate and refresh course material to reflect the latest training courses and best practices.
Are your instructors seasoned trainers who have deep knowledge of the training topic?
Ascendient Learning instructors have an average of 27 years of practical IT experience and have also served as consultants for an average of 15 years. To stay current, instructors spend at least 25 percent of their time learning new, emerging technologies and courses.
Do you provide hands-on training and exercises in an actual lab environment?
Lab access is dependent on the vendor and the type of training you sign up for. However, many of our top vendors will provide lab access to students to test and practice. The course description will specify lab access.
Will you customize the training for our company’s specific needs and goals?
We will work with you to identify training needs and areas of growth. We offer a variety of training methods, such as private group training, on-site of your choice, and virtually. We provide courses and certifications that are aligned with your business goals.
How do I get started with certification?
Getting started on a certification pathway depends on your goals and the vendor you choose to get certified in. Many vendors offer entry-level IT certification to advanced IT certification that can boost your career. To get access to certification vouchers and discounts, please contact info@ascendientlearning.com.
Will I get access to content after I complete a course?
You will get access to the PDF of course books and guides, but access to the recording and slides will depend on the vendor and type of training you receive.
How do I request a W9 for Ascendient Learning?
View our filing status and how to request a W9.
Reviews
Concise and good to follow along. Although it is a lot to take in under a short period of time.
This was effective way to provide a ton of information in a short time period.
it was good and very informative. Instructure covered everything in detail.
Instructor, Training material & span of the training is neatly planned.
ExitCertified gave a great course on AWS that covered all of the basics in depth with good lab materials.
