Design and build authentication journeys for PingOne Advanced Identity Cloud (AIC) and PingAM authentication trees. MCP tools handle journey creation and updates where available; this skill supplies node selection, sequencing, wiring, and platform constraints as design artifacts otherwise.
Scope
- Login, registration, recovery, MFA, step-up, passwordless, social login, and transaction-approval journeys.
- AIC journeys and PingAM authentication trees (shared node model).
- Scripted decision nodes, inner journeys, page composition, callback/collector sequencing, risk branches, session state, and assurance changes.
- Journey design, review, implementation, resilience, and promotion between environments.
MCP execution
Use available MCP execution tools for AIC journey operations (createJourney, updateJourneyNode) when present. Otherwise, produce the journey design, node sequencing, branching logic, and platform constraints as implementation artifacts without setup or tool-installation instructions.
When creating journeys with the createJourney MCP tool, read references/mcp-journey-authoring.md first — the PageNode child-node pattern has a known failure mode.
PingAM note
AIC and PingAM share the same node-and-tree model. Node guidance here is written against AIC; validate node availability and behavior against the PingAM documentation for the target release, and account for differences (realms, redirect validation, session settings).
Routing
Quick reference — node families:
| Task | Reference |
|---|---|
| Node composition rules, PageNode usage, child node gotchas | references/nodes/node-fundamentals.md |
| Username/password, passthrough auth, session entry, lifecycle outcomes | references/nodes/basic-auth-nodes.md |
| MFA: WebAuthn, OATH, push, OTP, recovery codes | references/nodes/mfa-nodes.md |
| Risk scoring, lockout, CAPTCHA, auth level, authorization signals | references/nodes/risk-management-nodes.md |
| Registration, attributes, consent, KBA, terms, social login, SelectIdP | references/nodes/identity-management-nodes.md |
| Scripting, page composition, session, state, async, polling, LoginCount | references/nodes/utility-nodes.md |
| SAML/OIDC federation, Twilio Verify, device/cookie/cert | references/nodes/federation-contextual-nodes.md |
Named journey scenarios: see references/routing-index.md — match the task to a use case first; use-case anchors are self-contained and include node guidance. If no use case matches, select 1–2 node-family anchors above.
Design and cross-cutting references:
| Task | Reference |
|---|---|
| Design checklist, AIC security lens, wiring invariants | references/design-notes.md |
| Passkey and passwordless journeys (registration, authentication, recovery) | references/passkey-journeys.md |
| Promoting journeys, scripts, themes between environments (ESVs, locks, rollback) | references/journey-promotion.md |
| MCP journey creation gotchas (PageNode two-step pattern) | references/mcp-journey-authoring.md |
| WebAuthn/passkeys on native mobile — AIC-side prerequisites | references/aic-config/webauthn-mobile-setup.md |