The most efficient and secure approach is a single policy with an AND condition. This ensures all three criteria (department, location, time) must be true simultaneously for access to be granted. It’s centralized, easier to audit, and performs better than multiple chained policies or the overhead of managing a dynamic group for a simple, static rule.

The ‘Token Issuer’ condition validates the `iss` claim in the JWT. If the policy is configured to only accept tokens from your internal PingFederate (`iss=https://your-pf.company.com`), tokens issued by the partner’s IdP will be rejected, even if they are otherwise valid. The correct fix would be to update the policy to also accept (and validate) tokens from the trusted partner’s issuer.

PingAccess is the policy enforcement point (PEP) and web access management component. In this scenario, it would be deployed as an agent (or proxy) in front of the legacy on-prem application. It would call out to the centralized PingOne policy decision point (PDP) to get access decisions, which it then enforces locally at the network edge.

‘Require Step Up Authentication’ is the precise action for this scenario. It challenges the user to re-authenticate, but with a stronger authentication method than their initial session used. The policy would be triggered by the high-value transaction resource, forcing the user to satisfy a more stringent authentication policy (e.g., 2FA) before the ‘Permit’ action is finally executed.

By default, multiple conditions within a single policy are combined with a logical AND. Therefore, for the policy to evaluate to true and trigger its associated action (e.g., Permit), the user must satisfy BOTH conditions simultaneously: be a member of the ‘Contractors-USA’ group AND have an IP address within the defined VPN range.

Policy Decision Logs (often accessible via the PingIdentity admin console or SIEM integration) are specifically designed for this purpose. They provide a forensic trace of a policy evaluation, listing the policy name, the user/subject, resource, environment context, the result of each condition check, and the final decision (Permit/Deny). System logs lack this structured detail.

Policy evaluation order is critical. A higher-priority policy with a ‘Deny’ action that matches the user/resource will stop evaluation, and your new ‘Permit’ policy will never be reached. The first troubleshooting step should be to review the policy priority list for the application to ensure your new policy is ordered correctly relative to any broader ‘Deny’ policies.

For restricting access based on the calling system’s network location (a common pattern for machine-to-machine or administrative access), an ‘Environment’ condition using the source IP address (or CIDR range) of the incoming request is the standard and most secure method. This ensures the API can only be invoked from the trusted network segment where the backend servers reside.

The ‘Require Re-authentication’ policy action, when configured with an appropriate time-based condition (e.g., ‘If the user’s session is older than 15 minutes’), will force the user to fully authenticate again before accessing the protected resource. This provides periodic re-validation of the user’s identity and credentials, meeting the requirement for re-evaluation independent of the overall session length.

The most efficient and secure approach is a single policy with an AND condition. This ensures all three criteria (department, location, time) must be true simultaneously for access to be granted. It’s centralized, easier to audit, and performs better than multiple chained policies or the overhead of managing a dynamic group for a simple, static rule.0