Authentication demonstrations are difficult to record reliably. A live flow depends on cookies, existing sessions, certificate trust, test passwords, and network timing. It can also expose credentials or tokens in a recording. For this project, I built a deterministic presentation that explains the real behavior without depending on live secrets. The implementation is available at github.com/darkedges/pingfedonetap. ## The storyboard The 16:9 tour contains six timed scenes: 1. A fresh visitor sees no unsolicited account popup. 2. The visitor starts an interactive PingFederate login. 3. The OIDC callback establishes the application session. 4. Application-only logout clears local state. 5. The chooser displays two remembered accounts. 6. Selecting the second account reuses the PingFederate session without a password prompt. The presentation uses mock credentials and token summaries. It demonstrates state transitions but never handles a real password, authorization code, or token. make demo-tour The page supports autoplay, looping, playback speed, hidden controls, Space to pause, and R to restart. This makes it useful both for rehearsal and automated capture. ## Generate a timed AI voiceover The narration uses the Apache-2.0 licensed `hexgrad/Kokoro-82M` model from Hugging Face. The selected `af_heart` voice is clear for short technical narration. The source script is a JSON file with a start time, scene label, and sentence for each cue. The generator synthesizes every sentence, measures its actual duration, and fails if it would overlap the next cue. make voiceover The output is: artifacts/one-tap-demo-voiceover.wav ### Solving PyTorch memory growth An early implementation kept one Kokoro pipeline alive while generating all six sentences. On a constrained Windows development machine, CPU memory grew until PyTorch failed during a later cue. The final generator starts one worker process per cue. Each worker loads the model, writes a temporary floating-point WAV, and exits. Process termination returns PyTorch's working memory to the operating system before the next cue starts. The parent process then validates timing and mixes the small audio segments into a 34-second, 24 kHz PCM WAV. This approach is slower, but its memory behavior is predictable. ## Record the browser automatically Playwright opens a headless Chromium context with both viewport and recording size fixed at 1280 x 720. Autoplay is disabled so the recorder controls the exact start. The capture process: 1. Opens the presentation and verifies the stage dimensions. 2. Waits for the page to settle. 3. Presses R to start the tour. 4. Waits until the tour marks the final scene complete. 5. Holds the final signed-in frame until the 34-second narration ends. 6. Closes the browser context so Playwright finalizes the WebM. 7. Trims browser setup frames. ## Mux a delivery-ready MP4 The project uses `imageio-ffmpeg`, whose platform wheel includes an FFmpeg executable. FFmpeg converts the silent VP8 WebM to H.264 and adds the WAV as AAC audio. The complete pipeline is one command: make demo-video It produces: artifacts/one-tap-demo-screen.webm artifacts/one-tap-demo-final.mp4 The final file is 1280 x 720, 30 frames per second, 34 seconds long, with H.264 video, AAC audio, and the MP4 metadata moved to the front for progressive web playback. ## Why keep the deterministic tour separate The narrated presentation is not a replacement for integration tests. The live demo still verifies the adapter endpoint, cookie decoding, OIDC callback, PKCE, and session behavior. The deterministic tour has a different purpose: it makes the explanation repeatable, safe to publish, and easy to regenerate after a UI change. That separation produced a better test tool and a better communication tool. Repository: https://github.com/darkedges/pingfedonetap Watch the published demo: https://youtu.be/KuVNjWiZrAk # Playwright #Python #AI #FFmpeg #PingFederate #DevOps

The account chooser needs more than a widget and a Java adapter. PingFederate must have a complete authentication policy, a credential validator, a reusable authentication session, and an OIDC client. This article makes that environment repeatable with Docker, Terraform, and Make. Source: github.com/darkedges/pingfedonetap ## Bake the adapter into the PingFederate image The Maven build produces the adapter JAR. A PowerShell staging script creates a server profile overlay with this structure: docker/pingfederate-profile/ instance/server/default/ deploy/one-tap-status-adapter.jar conf/template/one-tap-status-template.html conf/language-packs/one-tap-status-template.properties The Dockerfile copies that overlay to `/opt/in/` in the official PingFederate image. At startup, the Ping container downloads Ping Identity's getting-started profile and merges the local overlay into the runtime under `/opt/out/instance`. The important point is that the JAR is part of the image input. It is not copied manually into a running container. make docker-image ## Keep license credentials out of source The container obtains its development license at startup. Put the Ping DevOps credentials in environment variables or an ignored `.env` file: PING_IDENTITY_DEVOPS_USER=replace-me PING_IDENTITY_DEVOPS_KEY=replace-me ONE_TAP_ALLOWED_ORIGINS=http://localhost:8080 Do not commit these values. The credentials are needed when the container starts, not when the image is built. make docker-up make docker-logs ## Provision the authentication chain The Terraform configuration creates: * A Simple Username Password Credential Validator for disposable test users. * An HTML Form IdP Adapter backed by that validator. * An Identifier First Adapter that remembers up to five identifiers for 30 days. * The custom One Tap status adapter with an exact origin allowlist. * An enabled IdP authentication policy. * An authentication-session policy for the HTML Form adapter. * OAuth and OIDC mappings. * A public OIDC client restricted to Authorization Code with PKCE. The interactive policy is intentionally simple: Identifier First Success: pass subject as incoming username HTML Form Success: complete authentication Failure: fail Failure: fail The status adapter is not part of this tree. Adding a status-only adapter to the interactive policy would leave authentication in progress and prevent the flow from completing. ## Why the authentication-session policy matters Remembering an identifier does not remove the password requirement. The HTML Form adapter must also have a reusable PingFederate authentication session. The local policy uses: Persistent session: true Idle timeout: 60 minutes Maximum timeout: 480 minutes Device type: private After the first successful password authentication, a later OIDC request can reuse this session. That is what lets the remembered-account selection finish without prompting for the password again. ## Configure a browser public client correctly The demo client uses these settings: Client ID: one-tap-demo Grant: Authorization Code Client authentication: none PKCE: required Scope: openid Redirect URI: http://localhost:8080/callback.html Redirect URIs are exact matches. A different port, path, or trailing slash must be registered explicitly. The callback validates the OIDC state and exchanges the code with the PKCE verifier. The demo shows only a sanitized result and does not retain the code, verifier, access token, or ID token. ## Apply the configuration Ping DevOps license credentials and Terraform administrative credentials are different concerns. Set the provider credentials in the current shell, then use an ignored `terraform.tfvars` for test users and local options. make terraform-init make terraform-plan make terraform-apply make demo-up Open `http://localhost:8080` after trusting the local development certificate for `https://localhost:9031`. ## Production boundaries This environment is a local demonstration. For a real deployment: * Store Terraform state in an encrypted, access-controlled backend. * Use an enterprise credential validator rather than local test users. * Remove development TLS trust overrides. * Validate ID token signatures and claims in a backend. * Use production origins and exact redirect URIs. * Define explicit identity provider logout behavior separately from application logout. In part 3, we will turn the working flow into a deterministic narrated video with Kokoro, Playwright, and FFmpeg. Repository: https://github.com/darkedges/pingfedonetap Video demo: https://youtu.be/KuVNjWiZrAk # Terraform #Docker #OIDC #PingFederate #DevOps

In modern microservices architectures, machine identity is just as critical as human identity. When...

I wanted one clean deployment path for local testing and real cluster rollout, so I packaged the same...