Azure

Configuring a password credential validator instance

Configure the Azure AD Password Credential Validator (PCV) to determine how PingFederate communicates with the Microsoft Graph API.

Steps

  1. Sign on to the PingFederate admin console and go to System > Password Credential Validators > Create New Instance.

  2. On the Type tab:

    1. In the Instance Name field, enter a descriptive name for the PCV instance.

    2. In the Instance ID field, enter a unique identifier for the PCV instance.

    3. In the Type list, select Azure AD Password Credential Validator <version>.

    4. Click Next.

    Example:

    Screen capture of the Create Credential Validator Instance Type tab showing the Instance Name, Instance ID, Type and Parent Instance fields.

  3. (Optional) On the Instance Configuration tab, in the Custom Parameters section, define any additional parameters to send in the Resource Owner Password Credentials (ROPC) request made to Microsoft.

    1. Click Add a new row to 'Custom Parameters'.

    2. In the Parameter Name field, enter the name of the request parameter you want to add to the ROPC request body.

      Example:

      nca

    3. In the Parameter Value field, enter the value you want to set for the named parameter.

    4. In the Action column, click Update.

    5. To add more attributes, repeat steps a - d.

  4. On the Instance Configuration tab, configure the rest of the adapter instance by referring to Azure AD PCV instance configuration settings reference, then click Next.

  5. On the Extended Contract tab, you can extend the attribute contract with any additional Azure AD attributes, including Azure AD custom properties. After you’ve done so, click Next.

    • Make sure to review the Known issues and limitations first.

    • If you’re upgrading from Azure AD Password Credential Validator 1.2 or earlier and used the objectID attribute in your extended contract, update this attribute to ID.

    The core contract contains the following attributes:

    Show or hide core contract attributes

    1. displayName

    2. givenName

    3. mail

    4. memberOf

    5. surname

    6. username

    7. userPrincipalName

  6. On the Summary tab, review your configuration, then click Save.

Next steps

Associate the PCV instance with an IdP adapter instance.