PurpleID is a single, integrated platform that offers secure access to enterprise applications and information. PurpleID connects any workforce user, via any device, in any context, to the technologies/applications they need to do their most significant work.
To access PurpleID, go to https://purpleid.okta.com in any web browser (Internet Explorer, Firefox, Chrome, etc.).
PurpleID uses your FedEx Enterprise ID and Password. You must have an active CORP Active Directory account to access PurpleID. If you've forgotten your password, use the 'Forgot password' link at the bottom of the sign‐in page to generate a new one.
PurpleID supports the following Web Browsers: Internet Explorer, Firefox, Safari and Chrome.
If you cannot remember your FedEx enterprise password and need to reset it, click the 'Need help signing in?' and then 'Manage Password?' link on the PurpleID login screen. This will allow you to reset your password via multiple options.
Yes. The Okta Verify mobile device used to provide extra verification when signing into FedEx applications can be installed on a personal or corporate owned Android or iOS device.
Yes, PurpleID is a SaaS solution that is accessible from all FedEx regions and international locations.
Below are the steps to enroll Okta Verify on your new phone. Do not delete the app on your old phone yet.
a) Login to PurpleID on your computer – https://purpleid.okta.com
b) From the dashboard, click on your name with pull down menu and select ‘Settings’.
c) Click on "Edit Profile".
d) You might be challenged for password and MFA challenge. Complete your MFA with your old phone.
e) Click on ‘Remove’ next to ‘Okta Verify’ under the section - Extra Verification. At this point, you can uninstall the Okta Verify mobile app on your old phone.
f) On your new phone, install the 'Okta Verify' mobile app from public app stores. When you see a ‘Setup’ button, go ahead and click on 'Setup' and complete the registration on your new phone.
g) From this point, you will receive all your MFA prompts on your new phone.
If you have already wiped your old device or deleted Okta Verify app on your old device, please contact the Help Desk and they will be able to reset MFA on your PurpleID account.
Passwordless sign in is a new low friction experience that provides access to FedEx mobile apps from FedEx owned devices without entering a username and password. You simply respond to a push notification from Okta Verify on your device. See a demo here.
Yes. Entrust IdentityGuard mobile soft tokens will be replaced by Okta Verify which is a push notification-based service. Hardware tokens (key fob) will continue to be available for use cases where a smart phone-based solution is not practical. Solutions based on the FIDO/U2F spec, including Yubikey, are also being evaluated for use with PurpleID.
Yes. FedEx on-premise applications that are currently protected by WSSO will be gradually migrated to PurpleID. This will be accomplished by using an F5 Access Gateway component for those applications that don’t support modern authentication protocols such as SAML2 and Open ID Connect.
Yes. FedEx Cloud/SaaS applications will be gradually migrated to PurpleID. Information Security will work closely with the FedEx owners of Cloud/SaaS applications to make the migration as seamless as possible.
Please follow the support process documented here.
Applications using PurpleID / Okta from within PCF will be auto-configured with an OIDC client registration that will be stored within Hashicorp Vault, and out of the box authentication for employees / contractors will be provided. Authorization will be also be provided based on IMAGE managed AD groups. More information will be forthcoming soon as we're currently working on completing the integration, then publishing cookbook recipes and samples on how to consume it.
For more information on this topic - please refer to StackOverflow
Please follow the job-aid from here.
Please access the video from here.
Yes. The Okta Verify mobile device used to provide extra verification when signing into FedEx applications can be installed on a personal or corporate owned Android or iOS device.
The Okta Verify one-time passcode is always displayed in the mobile app (similar to Entrust soft token) and can be used in circumstances where you might not be able receive the push notification. You will notice there is a "Or enter code" link on the MFA prompt. This can be used to enter the Okta one-time passcode instead of responding to the push notification.
The reason you get two emails is that one confirms enrollment in Okta Verify one-time password (OTP) and the other confirms enrollment in Okta Verify Push Notification.
No. Do not uninstall/remove the Entrust IdentityGuard app from your phone. You will continue using Entrust IdentityGuard soft token until you are notified by email to begin using Okta Verify. Applications currently using Entrust IdentityGuard soft token (O365, VPN, PAM, PFC etc.) will be migrated to integrate with PurpleID and Okta Verify. Until all Entrust IdentityGuard dependent applications are migrated to PurpleID, please keep both the application installed on your phone.
Below are the steps to enroll Okta Verify on your new phone. Do not delete the app on your old phone yet.
a) Login to PurpleID on your computer – https://purpleid.okta.com
b) From the dashboard, click on your name with pull down menu and select ‘Settings’.
c) Click on "Edit Profile".
d) You might be challenged for password and MFA challenge. Complete your MFA with your old phone.
e) Click on ‘Remove’ next to ‘Okta Verify’ under the section - Extra Verification. At this point, you can uninstall the Okta Verify mobile app on your old phone.
f) On your new phone, install the 'Okta Verify' mobile app from public app stores. When you see a ‘Setup’ button, go ahead and click on 'Setup' and complete the registration on your new phone.
g) From this point, you will receive all your MFA prompts on your new phone.
If you have already wiped your old device or deleted Okta Verify app on your old device, please contact the Help Desk and they will be able to reset MFA on your PurpleID account.
Please follow the below instructions to fix the issue:
iOS Device
1. From the Home screen, tap Settings > General > Date & Time.
2. Tap the Set Automatically slider to turn it on.
Android Device
1. Tap Settings to open the Settings menu.
2. Tap General Management and then Date & Time.
3. Tap Automatic.
4. If this option is turned off, check that the correct Date, Time and Time Zone are selected.
Yes. Hardware tokens which are assigned to existing employee/vendor (ex: FedEx ID: 435687 enrolled with token serial number: 12345) can be re-assigned to new employee vendor (ex: FedEx ID: 8875564 can be assigned with the same token with serial number: 12345).
To re-assign hardware tokens from an existing user to new user, please contact purpleid@fedex.com with FedEx ID and token serial number details.
To create a new tab, click on the '+' sign next to the last tab. You will be asked to enter a new tab name (for example, "Collaboration" or “HR Apps”). Enter the new name of the tab and click save to create it. Once you have the tabs created, you can drag and drop the application icons between the tabs.
You can have up to five tabs.
To delete a tab, you will need to move all applications out of that tab into another one. Once the tab has been emptied you will see a Delete Tab option. Select that option and your tab will be deleted.
To change the order of your apps, click and hold on an app icon, then drag and drop the app to the location you would like it to be displayed.
To move an app from one tab to another, click and hold on the app icon, then drag and drop your app to the new tab.
At the top of your dashboard, you can find apps in the "Launch App" search bar. If you can't remember which tab your app is on, go to the Launch App search, type in the name of your app and select the name to open it when it appears.
To change your security image, login to PurpleID on a computer or mobile device. Click on your username in the top menu, and select the ‘Settings’ menu item.
Go to the Security Image section and select Edit. Select a new Security Image and click Save.
The security image is a cookie that is set when you log in. If the cookies in your browser have been cleared, you may not see the security image until the next time you log in. It is the same case if you are accessing PurpleID in private/incognito browser mode.
With Integrated Windows Authentication (IWA)/Desktop Single Sign-on (DSSO), users are automatically authenticated by PurpleID when signed in to Corporate Active Directory Windows network (corp.ds.fedex.com). Following authentication, users can access applications through PurpleID without entering additional usernames or passwords. DSSO provides a superior user experience as users only need to sign in a single time and don’t need separate credentials for each application they access through PurpleID.
In order for Desktop SSO to work correctly and provide seamless access to PurpleID integrated apps, add the PurpleID Okta tenant URL and the PurpleID Desktop SSO URL to your trusted zone:
1. On your Windows Control Panel, select Network and Internet > Internet Options > Security > Local Intranet > Sites > Advanced.
2. In the Add this website to the zone field, enter:
a. https://purpleid-iwa.secure.fedex.com
b. https://purpleid-iwa-stage.secure.fedex.com
c. https://purpleid.okta.com
d. https://purpleid-stage.oktapreview.com
e. https://purpleid.kerberos.okta.com
f. https://purpleid-stage.kerberos.oktapreview.com
3. Click Add.
4. Click OK twice to close Internet Options.
5. In Internet Explorer select Tools > Internet Options.
6. Click the Advanced tab, scroll down to the Security settings, and select Enable Integrated Windows Authentication.
7. Click OK.