# Ping Orchestration

> Use when designing, building, or advising on authentication flows or orchestration logic — DaVinci flows, PingOne Advanced Identity Cloud journeys, PingAM trees, login/registration/MFA/step-up/passwordless flows, scripted decision nodes, and social login. Ask one clarifying question about use case and platform before recommending journey vs DaVinci if either is unknown.

- Skill: `pingidentity/ping-orchestration` (Agent Skill, multi-file: 26 files)
- Install (CLI): `npx skillmds@latest add pingidentity/ping-orchestration`
- Raw SKILL.md: https://api.skillmd.com/api/skills/pingidentity/ping-orchestration/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: pingidentity (https://skillmd.com/u/pingidentity)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/pingidentity/ping-orchestration

---


# ping-orchestration

Design and build authentication flows, orchestration logic, and journey-based experiences across Ping Identity platforms. MCP tools handle execution; this skill supplies design patterns, node sequencing, branching logic, and platform-specific constraints.

**What this skill does for you:** Builds journeys and flows directly through MCP tools where they exist (AIC journeys); where a tool does not exist, it guides you through the design with node sequencing, branching logic, and platform constraints. Both modes are available — it uses whichever the platform supports for the task.

## Invocation

Invoke this skill explicitly with `/ping-orchestration` or by saying "use ping-orchestration to...".

## When to use this skill

Trigger on ANY question — including advisory, planning, and "what nodes do I need" requests, not just implementation — when the task involves:
- Building or designing a login, registration, recovery, MFA, or step-up journey in PingOne Advanced Identity Cloud (AIC) / PingAM
- Passwordless authentication flows (passkeys, FIDO2, magic links, biometric)
- Authenticator app login, push MFA, or TOTP enrollment flows
- Transaction approvals via email or push (CIBA / out-of-band step-up)
- Creating or designing a DaVinci flow for authentication, MFA, or orchestration
- Configuring a PingAM authentication tree or scripted decision node
- Planning or reviewing journey structure before implementation
- Deciding between inner journeys, scripted nodes, or DaVinci connectors
- Any question about designing, planning, or advising on authentication flows, journeys, or orchestration logic in PingOne Advanced Identity Cloud (AIC), PingOne / DaVinci, or PingAM

## When NOT to use this skill

- If the platform is not yet set up (no tenant, no realm, no app registered): use `ping-foundation` first
- If the task is **configuring the platform layer** (apps, directories, policies, branding): use `ping-foundation`
- If the task is **invoking a Universal Service** (Protect, Verify, IGA, Credentials) without needing flow design: use `ping-universal-services`
- If the task is **integrating the flow into an app or SDK**: use `ping-app-integration`
- If unsure which platform: use `ping-quickstart` first

## Multi-skill use cases

| Sequence | Skill |
|---|---|
| Before: tenant, realm, identity store, app configured | `ping-foundation` |
| After: risk scoring, MFA step-up, identity verification | `ping-universal-services` |
| After: wire flow into web, mobile, or SDK app | `ping-app-integration` |

---

## MCP execution

Scan available tools for MCP tools that can perform the required operation. If matching tools are available, run the MCP config preflight first, then use them. Otherwise, proceed with curated references. See `references/runtime/mcp-preflight.md` for MCP config and Cursor preflight steps.

## Routing — Step 1: Which platform?

| Platform signal | Branch |
|---|---|
| PingOne Advanced Identity Cloud (AIC), PingAM, identity cloud, ForgeRock lineage | [PingOne Advanced Identity Cloud](#pingone-advanced-identity-cloud) |
| PingOne + DaVinci | [PingOne / DaVinci](#pingone--davinci) |

---

## PingOne Advanced Identity Cloud

Sub-routing by task and journey use case: see `references/curated/pingone-st/routing-index.md`.

**Quick reference — node families:**

| Task | Reference |
|---|---|
| Journey design principles, patterns, resilience, security | `references/curated/pingone-st/journey-design-patterns.md` |
| Node composition rules, PageNode usage, child node gotchas | `references/curated/pingone-st/nodes/node-fundamentals.md` |
| Username/password, passthrough auth, session entry, lifecycle outcomes | `references/curated/pingone-st/nodes/basic-auth-nodes.md` |
| MFA: WebAuthn, OATH, push, OTP, recovery codes | `references/curated/pingone-st/nodes/mfa-nodes.md` |
| Risk scoring, lockout, CAPTCHA, auth level, PingOne Authorize | `references/curated/pingone-st/nodes/risk-management-nodes.md` |
| Registration, attributes, consent, KBA, T&C, social login, SelectIdP | `references/curated/pingone-st/nodes/identity-management-nodes.md` |
| Scripting, page composition, session, state, async, polling, LoginCount | `references/curated/pingone-st/nodes/utility-nodes.md` |
| SAML/OIDC federation, Twilio Verify, device/cookie/cert | `references/curated/pingone-st/nodes/federation-contextual-nodes.md` |

---

## PingOne / DaVinci

**Sub-routing by task:**

| Task | Reference |
|---|---|
| DaVinci flow concepts, connectors, variables, versioning | `references/curated/pingone-mt/davinci-overview.md` |
| DaVinci flow design patterns (login, registration, step-up, error) | `references/curated/pingone-mt/davinci-flow-patterns.md` |
| DaVinci registration + email verification + MFA enrollment/step-up | `references/curated/pingone-mt/davinci-registration-and-mfa.md` |

---

## Cross-platform orchestration patterns

| Task | Reference |
|---|---|
| Passkeys / passwordless / FIDO2 design across PingOne, PingOne Advanced Identity Cloud (AIC), Ping Software | `references/curated/cross-platform/passkeys-and-passwordless.md` |
| Promote journeys, scripts, themes, or DaVinci flows between dev/staging/production | `references/curated/cross-platform/journey-and-flow-promotion.md` |

---

## Retrieval escalation

Load 1–3 curated anchors for the detected platform/task; stop if sufficient.

## Cross-skill escalation

| If the task also involves... | Reference skill |
|---|---|
| Platform setup not yet complete | `ping-foundation` |
| Shared services (Protect, Verify, IGA, Credentials) within the flow | `ping-universal-services` |
| App/SDK code integration | `ping-app-integration` |
| Platform selection or orientation | `ping-quickstart` |