BX Health Demo - PingOne Customer Identity Access Management (CIAM) Demonstration

A ready-to-deploy demo environment showcasing Ping Identity's CIAM capabilities using PingOne. Three mock healthcare websites authenticate through PingOne, demonstrating:

• User Registration via PingOne self-service
• Adaptive MFA (configurable in PingOne policies)
• Single Sign-On (SSO) across separate applications

Architecture

Windows/Mac browser  --->  Ubuntu VM (nginx + static sites)
    https://IP1  ->  BX Health Patient Portal    (teal theme)
    https://IP2  ->  BX Health Scheduling        (green theme)
    https://IP3  ->  BX Health Bill Pay          (indigo theme)

Each site is a static HTML/CSS/JS app. Authentication is handled entirely client-side using OIDC Authorization Code flow with PKCE. No backend required.

Prerequisites

• Ubuntu VM (22.04+ recommended) with 3 available IP addresses on the same subnet
• Network access from your browser machine to the VM
• A PingOne account with an environment created

Quick Start

1. PingOne Setup

1. Log into PingOne Admin Console
2. Create (or use) an environment
3. Create 3 OIDC SPA applications: (OpenID Connect)
   • BX Health Portal (redirect: https://<IP1>/callback.html)
   • BX Health Scheduling (redirect: https://<IP2>/callback.html)
   • BX Health Bill Pay (redirect: https://<IP3>/callback.html)
4. For each app:
   • Set PKCE to S256 Required
   • Add sign-off URL: https://<IPx>/index.html
   • Note the Client ID
5. Enable self-registration: Go to Authentication > Policies > edit the default policy > enable Registration
6. Note your Environment ID (from Environment > Properties)

2. Configure

git clone https://github.com/sstrohmeyer/ping_demo.git
cd ping_demo
bash configure.sh

This will prompt for your PingOne Environment ID, the 3 Client IDs, and the IPs to use.

3. Deploy

sudo bash setup.sh

This binds the IPs, generates a self-signed SSL cert, deploys the sites to nginx, and starts everything.

4. Trust the Certificate

Copy /etc/ssl/bxhealth/bxhealth.crt to your browser machine and import it:

• Chrome/Edge (Windows): Import into certmgr.msc > Trusted Root Certification Authorities
• Chrome (Mac): Import into Keychain Access > System > Certificates, set to Always Trust
• Firefox: Either import via Settings > Certificates > Import, or set security.enterprise_roots.enabled = true in about:config to use the OS store

5. Demo

1. Open https://<IP1> — BX Health Portal landing page
2. Click Sign In — redirects to PingOne hosted login
3. After authenticating, you land on the dashboard
4. Click Schedule Appointment — navigates to https://<IP2>, already logged in (SSO)
5. Click Go to Bill Pay — navigates to https://<IP3>, also already logged in

How SSO Works

1. User authenticates at PingOne via the Portal app
2. PingOne creates a session cookie on auth.pingone.com
3. When the user navigates to Scheduling or Bill Pay, that site calls PingOne's authorize endpoint with prompt=none
4. Since a PingOne session already exists, tokens are returned silently — no login screen
5. The user appears instantly logged in on the second site

File Structure

ping_demo/
├── configure.sh              # Interactive config (run first)
├── setup.sh                  # Deployment script (run with sudo)
├── bx-health-portal/         # Patient Portal site
│   ├── index.html            # Landing page
│   ├── dashboard.html        # Post-login dashboard
│   ├── callback.html         # OIDC callback handler
│   ├── css/style.css         # Teal theme
│   ├── js/auth.js            # OIDC/PKCE library
│   ├── js/config.js          # PingOne config (reference)
│   └── img/                  # Logo + background
├── bx-health-scheduling/     # Scheduling site (green theme)
│   └── (same structure)
└── bx-health-billpay/        # Bill Pay site (indigo theme)
    └── (same structure)

Troubleshooting

Symptom	Cause	Fix
Default nginx page shows	Old nginx process has stale listeners	sudo systemctl stop nginx && sudo systemctl start nginx (full restart, not reload)
Buttons do nothing (no click response)	crypto.subtle unavailable (insecure context)	Auth.js includes a pure JS SHA-256 fallback; ensure you're on HTTPS
PING_CONFIG is not defined	External script blocked by browser	Config is inlined in HTML pages to avoid this
PingOne returns 403	Client ID mismatch or app not enabled	Verify client IDs and that the app is toggled ON in PingOne
Registration button shows login page	Self-registration not enabled	Enable in PingOne: Authentication > Policies > edit policy > enable Registration
Firefox cert warnings despite import	Firefox uses its own cert store	Set security.enterprise_roots.enabled = true in about:config, or import cert directly into Firefox
IP addresses not responding	IPs not bound to NIC	Run ip addr show to verify; IPs don't survive reboot unless added to netplan

Technical Notes

• Config inlining: PingOne config (PING_CONFIG) is declared inline in each HTML page rather than loaded from an external config.js. Browsers may block external script execution on self-signed certificate origins, even when the file is accessible. Inline scripts avoid this.
• PKCE fallback: The auth.js library includes a pure JavaScript SHA-256 implementation as a fallback for environments where crypto.subtle is unavailable (which happens when the browser treats the page as an insecure context despite HTTPS).
• nginx restart vs reload: After initial setup, always use stop + start rather than reload. A reload attempts to bind new listeners while old ones hold the ports, causing EADDRINUSE errors that fail silently.