PingOne third-party & OAuth apps security checks
OAuth grants, marketplace apps, integrations, plugins and automations with standing access to company data — the SaaS-to-SaaS supply chain.
On PingOne, Black Cat runs 4 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the PingOne connector needs.
Checks (4)
severity: high Application Risky Grant Type fix difficulty: medium #
Remove implicit and ROPC (password) grant types from PingOne applications
- Open PingOne admin console > Applications and select the flagged app
- In the OIDC/OAuth settings, remove the Implicit and Password grant types
- Migrate to Authorization Code with PKCE
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: medium Application Public Client Without Auth fix difficulty: medium #
Require client authentication on confidential PingOne applications
- Open PingOne admin console > Applications and select the flagged app
- Set a token endpoint authentication method other than NONE for confidential apps
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: medium Application Wildcard Redirect URI fix difficulty: easy #
Replace wildcard and insecure redirect URIs with exact HTTPS URIs
- Open PingOne admin console > Applications and select the flagged app
- Replace wildcard (*) and non-localhost http:// redirect URIs with exact https:// URIs
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: low Disabled Application Still Present fix difficulty: easy #
Remove stale disabled PingOne application registrations
- Open PingOne admin console > Applications and filter by disabled apps
- Confirm the registration is no longer needed
- Delete the application to reduce attack surface
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12