PingFederate and NGinx integration and deployment options

Question

Some time before we started to look how to integrate PingFederate into our infrastructure.

Our initial use case is following: we are providing multy tenant access to our application and different companies might use different(their) Identity providers to access our application.

Right now flow is limited to this workflow: Mutiple Idp(s) to one SP

However in the future flow might be extended to Many-to-many relations

Currently we are using NGINX as Reverse Proxy and based on PingFed documentation it's totally difficult to understand deployment options that we have right now.

Based on diagram that was taken from this guide

It's more or less clear how this integration works for apache httpd. Mainly there is apache PingFed Agent that works with SSO flows on apache and mainly it validates "session" or initiate SSO flow.

    Processing Steps
1. A user attempts to access a resource on the Apache server protected by the PingFederate
Apache Agent.
2. The user is redirected to the PingFederate server for authentication.
(If an OpenToken session already exists, the user is granted immediate access.)
3. The PingFederate server redirects the user’s browser to an IdP for authentication using either the
SAML or WS-Federation protocols. The IdP partner authenticates the user and returns a SAML
assertion.
4. PingFederate validates the assertion and creates an OpenToken for the user including any
configured attributes. PingFederate then redirects the browser, including the OpenToken, back to
the Apache Agent.
5. The Agent verifies the OpenToken and grants access to the protected resource. The User ID and
any attributes from the OpenToken are exposed to the resource as HTTP Request Headers or Apache Environment Variables.

And mainly on Step 5 apache agent passes information about User to the actual application using Request Headers or Apache Environment Variables.

Based on all info mentioned above here is 2 questions:

1. How to make similar deployment for PingFed and NGINX (for option that described in this question with apache httpd)?
2. Is it required to use Web Server(Reverse Proxy) together with PingFederate. Or Ping Federate can act also as WebServer? If yes probably some links and additional explanations are appreciated.

Answer 1

It worth to publish final ideas on solution and our observations

1. When we tried integrate PingFed we got an understanding that pingFed is very natively integrated with Ping Access. And Ping Access acts as Reverse proxy.

And the main idea that Authentication between PingAccess and PingFed is done using OpenId connect protocol. Authentication between PingFederate and Auth provider can be done by very different ways:

1. It can be SAML
2. It can be another SSO protool
3. Ping Fed can serve also login page and make authentication using some custom DB or LDAP

However Authentication flow for application will remain the same as PingFed is hiding this complexity