Connect Ping — PingOne (identity audit)

A read-only Worker application scoped to one environment — Identity Data Read Only + Configuration Read Only, nothing writable.

1. 1PingOne setup for the Cybermatic scanner. This setup creates a read-only Worker application scoped to one PingOne environment. It is intended for PingOne cloud environments — not a standalone, self-hosted PingFederate deployment. Before you start — make sure your PingOne administrator account can: • Create applications in the target environment. • Assign administrator roles to Worker applications. • View client credentials. PingOne Worker applications have no administrator roles by default. You can assign only roles that your administrator account is authorized to assign. You will collect four items: 1. Environment ID 2. Client ID 3. Client Secret 4. PingOne region Treat the Client Secret like a password. Do not email it, place it in a ticket, or store it in an unprotected document.
2. 2Step 1 — Select the correct PingOne environment. 1. Sign in to the PingOne administrative console. 2. Use the environment selector near the top of the console. 3. Select the environment that Cybermatic should scan, such as: Production Workforce Employee Identity Customer Identity 4. Verify the selected environment name before continuing. The Worker application and its permissions will be associated with this environment. PingOne environments are separate administrative domains containing their own users, applications, services, and configurations. Do not create the Worker application in the Administrators environment unless that is specifically the environment you need audited.
3. 3Step 2 — Create the Worker application. 1. In the left navigation, select Applications. 2. Select Applications again from the submenu. 3. Select the + icon beside the Applications heading. 4. Enter: Application Name: Cybermatic Scanner Description: Read-only Worker application used by Cybermatic to audit PingOne identities, MFA coverage, administrator roles, and stale accounts. Application Type: Worker 5. Select Save. PingOne identifies a Worker application as a userless service application that authenticates to PingOne APIs as itself rather than as an individual user. Enable the application — after saving: 1. Return to Applications → Applications if necessary. 2. Search for Cybermatic Scanner. 3. Open the application. 4. Locate the application status toggle. 5. Change the status to Enabled. The application must be enabled before PingOne can issue it an access token.
4. 4Step 3 — Assign the minimum read-only roles. 1. Open the Cybermatic Scanner application. 2. Select Roles. 3. Select Administrator Roles. Depending on your PingOne configuration, you might see only a single Roles tab instead of separate application and administrator role tabs. 4. Select Grant Roles. 5. Open the Available Responsibilities tab. 6. Find: Identity Data Read Only 7. Expand the role if necessary. 8. Select the checkbox for the exact environment Cybermatic will audit. 9. Make sure you do not select: • The entire organization • Other production environments • Unrelated sandbox environments 10. Also find: Configuration Read Only 11. Expand the role if necessary. 12. Select the checkbox for the exact environment Cybermatic will audit. 13. Again, do not select the entire organization, other production environments, or unrelated sandbox environments. 14. Select Save. Recommended role configuration — use: • Required: Identity Data Read Only • Required: Configuration Read Only Do not grant: • Identity Data Admin • Environment Admin • Organization Admin • Client Application Developer • Help Desk Admin Those roles provide write or operational permissions that a read-only scanner should not require.
5. 5Step 4 — Collect the Environment ID. 1. Keep the Cybermatic Scanner application open. 2. Select the Configuration tab. 3. Locate Environment ID. 4. Select the copy icon. 5. Temporarily paste it into a secure password manager or other approved secret-management location. The Environment ID is a UUID similar to: 12345678-abcd-4321-abcd-1234567890ab Do not copy: • Application ID • Organization ID • Population ID Cybermatic specifically needs the Environment ID shown on the Worker application's Configuration tab. PingOne also displays the Client ID and Client Secret on that tab.
6. 6Step 5 — Collect the Client ID. On the same Configuration tab: 1. Locate Client ID. 2. Select the copy icon. 3. Store it temporarily with the Environment ID. The Client ID identifies the Worker application itself. It is not the same as the Environment ID. Label the values clearly: Environment ID: Client ID: Client Secret: Region:
7. 7Step 6 — Reveal and securely copy the Client Secret. 1. Locate Client Secret on the Configuration tab. 2. Select the eye or reveal icon. 3. Copy the complete secret. 4. Store it only in an approved secret-management location. 5. Do not take a screenshot of the page. PingOne specifically warns that the Client Secret must be protected and stored securely. The same Configuration page provides options to generate a new secret and revoke the previous secret when rotation is required. Do not select Generate New Secret unless you intentionally want to rotate the credentials. Generating a new secret may cause an existing integration to stop working after the previous secret is revoked or expires.
8. 8Step 7 — Add the connection in Cybermatic. In a separate browser tab: 1. Sign in to Cybermatic. 2. Open Connections. 3. Find the Identity providers section. 4. Select Ping (PingOne). 5. Enter the collected values: Environment ID — the PingOne Environment ID from the Configuration tab Region — the region matching the PingOne console hostname Client ID — the Cybermatic Scanner Worker application's Client ID Client Secret — the Cybermatic Scanner Worker application's Client Secret 6. Check for leading or trailing spaces in every field. 7. Select Connect. Cybermatic authenticates using the OAuth client-credentials flow and begins its first scan.
9. 9What Cybermatic checks. • Every active user appears on the Identities page with their MFA status — with a Critical finding for any admin-role holder without MFA. • Administrator role assignments across the environment. • Active accounts with no sign-on for 90+ days. All reads use the environment-scoped Management API; nothing can be changed.
10. 10Troubleshooting. "Ping auth failed: 401/400" — wrong client secret, disabled application, or the Environment ID doesn't match the region selected; re-check all three on the app's Configuration tab. Cybermatic supports both of PingOne's token endpoint authentication methods (Client Secret Basic and Client Secret Post), so the app's Token Endpoint Auth Method setting can be left at its default. "Ping auth failed: 404" — the environment ID wasn't found in the selected region; the region is visible in your console URL (pingone.com / .eu / .asia / .ca). "Ping: the Worker application isn't allowed to read users…" — the Identity Data Read Only role was granted for a different environment. Role grants in PingOne are per-environment: on the Worker app's Roles tab, the grant must name the same environment as the Environment ID you connected. Users exist but the connected environment shows none — PingOne accounts often contain multiple environments (trials create an Administrators environment plus your own). Confirm your users appear under Directory → Users while the SAME environment is selected in the console's environment switcher, and that its ID matches the one connected to Cybermatic. Multiple environments? Connect each one separately — each counts as one identity-provider seat.

Tip: Role grants in PingOne are per-environment — the single most common setup mistake is granting the roles in one environment while connecting another's ID. When in doubt, the environment switcher at the top of the console is the source of truth.