Kathy Khong Talks About Her Learning Journey as an Intern at Ping

Kathy Khong joined the Ping Internship program as a Software Engineer Intern, where she started to reflect on the role security plays in our everyday lives. With her own career experience combined with her personal experiences as an end user, she wanted to work towards finding ways to make authentication and verification seamless and simple for the end user. Through different projects—including working with DaVinci—Kathy was able to solve problems with clever solutions here at Ping. 

Read about her experience:

I am a Software Engineer Intern on the PingFederate team at Ping. The title sounds very fancy, but I honestly consider myself “a curious student who loves to learn new things.”

My previous co-op was in eCommerce and this term, I really wanted to further develop my skills in a different field. I've never really experienced working in development involving enterprise security. My co-op coordinator recommended that I take a look at Ping Identity, which I also came across Ping Identity when browsing internships and I think what stood out to me most was the subtleties of security and how it impacts people's lives. 

Being an end user myself, reflecting on my experiences—especially during a period when working from home is a norm, shopping online, accessing financial services from your own device, etc.—any small disruptions in the flow of the user experience can drive you away from a brand or a service. Seamless secure authentication and verification processes definitely impact the end user’s experience, and can therefore make or break a business. I was eager to learn more and be a part of the inner workings of these simple—yet, high-impact—solutions. 

My goals for this internship were simple: keep an open mind, constantly seek new challenges and learn from each of them.

The first challenge was presented to me right from the beginning when there were a whole lot of new terminologies that were thrown at me, i.e. “authentication,”  “authorization grant type,” “implicit grant type,” “IdPs,” “form adapters,” etc.). To cope with this, I made a glossary of the terms and corresponding definitions that I could quickly reference when I needed them. 

Additionally, I also wondered how I’d fit into this new role. Thankfully, I was immediately presented with many opportunities to interact with my team members on-site. Though I expected to be one of the only newbies, I was happy to learn that all of my team members were in the same boat—being exposed to identity and security for the first time since beginning their career in software development. 

It’s only been only three months, yet, I can say I was privileged to touch a few applications at Ping: User Utility Count, OAuth Playground, and DaVinci:

I started working on the User Count Utility (UCU). The UCU is a tool that provides our customers with the number of unique users that perform a sign-on transaction (SSO, STS, OAuth). The session aggregation logic used to identify unique users across apps have shown to incur performance issues for some of our customers and my responsibility was to add a mode that reports the user count on a per-application basis. This project was fairly independent so I had the opportunity to do quite a bit of self-learning since I did not have any prior experience with Apache Log4j. 

I submitted my code within the first two weeks and one of our QA engineers conducted tests with extensively large amounts of data on a Windows 2016 environment. 

Soon enough, I was told the pre-existing performance issue was still not resolved and CPU usages are still very high. I was alarmed because I seemed to have not properly completed the work assigned. Interestingly, my manager and tech lead were very supportive and encouraged me to look into the issue more. 

So, I analyzed the algorithm in order to see which object(s) were consuming more space than expected, while examining the time complexity for each algorithm. During this time, I had the chance to work with IntelliJ’s Profiler to see which methods in the code were causing high CPU usage and memory allocations. Fortunately, I had a mentor who was there to provide me support and suggestions with any questions I had. In the end, the UCU performance test showed CPU usages dropping to 50% and memory usages reduced by 10%.

This experience taught me that mistakes happen, and you can always learn something from them. It’s also okay to ask for help if and when you need it, but it’s important to also attempt to solve the problem yourself.

A month into my internship, I switched gears into working with the OAuth playground. I didn’t know anything about OAuth so it was a whole new learning experience for me. Here, I learned about clients, resources, authorization servers, resource owners and how they all connect. The OAuth Playground is essentially a “simulator” that allows our customers to experiment with different OAuth flows and OpenID Connect, acting as both a client and a resource server, can simulate authorization requests, handle responses, and validate tokens. 

To add to the learning curve, one of our senior development engineers then added JARM (JWT Secured Authorization Response Mode) support to the playground. The list of new terms just never ends! JARM—simply put—is another layer of security that our customers love. It provides benefits like signing and encryption and sender authentication along with protection from replay, credential leakage, and mix-up attacks. 

My role was to create the frontend components that showcase JARM. The code base for this application is mainly React and Javascript and I had zero experience with both but, in the spirit of “learning by doing”, I picked up React components and CSS, and was able to build the response decoder for the authorization and implicit grant types within a few days.

Just when I thought I was going to be doing more OAuth playground work, I was invited to a meeting with a bunch of interns for building DaVinci connectors. Though I had familiarized myself with Ping’s products, this was still new territory for me. 

DaVinci promotes identity orchestration where users can design their own automated workflows for different identity use cases in a no-code, drag-and-drop interface. We interns were given training videos on how to navigate the DaVinci platform and design our own flows. Orchestration is made easy with DaVinci. If you can whiteboard it, you can orchestrate it!

After completing the training, I was assigned to build a SendGrid connector. Twilio SendGrid is a cloud-based SMTP service that provides email delivery at scale, allowing you to send email without the cost and complexity of maintaining your own email servers. The SendGrid connector  enhances a registration flow by enabling multiple capabilities for contact creation and email delivery.

Having no experience in building connectors before, I was sitting on the edge of my seat until I was introduced to DaVinci’s Project generator. With DaVinci’s project generator, I just needed to specify the required properties (ie. email, address, name, etc.), define the capabilities for each API call, click “generate”, and the magic occurred; the JavaScript files were generated. All that's left was configuring the request and response. The best part was, I was able to deploy and test my connector immediately on the DaVinci canvas. 

DaVinci strives to eliminate complexity, enabling its users to focus on the business logic, security, user experience, and more. Anyone can create their own connector and design their own flows using this low-code orchestration.

Despite working independently from the PingFederate team, I attend the daily scrum meetings and often would go out for lunch with my team members, and play ping pong on our Happy Hour Fridays. Many team members would often ask me to share what I am working on so I feel very included. There was one time where our entire team went to Queen Elizabeth Park for disk golf. I realized I am horrible at disk golf but I had so much fun that day.

While working on DaVinci connectors, I had the opportunity to connect with a team of interns via Slack. Even though the team has members working in Denver, Austin, and Vancouver, we all were extremely active in providing support asynchronously whenever any member had difficulties. We even meet on Zoom to discuss projects, and occasionally, do a pet “show and tell”!

We’re always looking for talent at Ping! Interested in applying for Ping’s Intern program? We’d love to hear from you. See if we are hiring for interns near you, here!