PingAccess

Configuring access token attributes for superuser scope in PingFederate

A resource might require that the access token contains the scope superuser. Configure the superuser scope in PingFederate.

Steps

  1. Enable Expressions within PingFederate.

  2. Extend the Access Token Attribute Contract to include the value scope.

  3. Map the following value into the access token attribute contract.

    Contract Source Value

    scope

    Expression

    @com.pingidentity.sdk.oauth20.Scope@encode(#this.get("context.OAuthScopes").getValuesAsHashSet())

  4. Manage the OpenID Connect policy to add the following information:

    1. Attribute Contract— To extend the contract to include the scope attribute, select Override Default Delivery using the ID Token.

      This step is not applicable to PingFederate 9.0 and earlier. Instead, in the Manage Policy window, select the Include User Info in ID Token check box.

    2. Attribute Scopes— From the Scope list, select openid, and from the Attribute list, select scope.

      This feature does not exist in PingFederate versions earlier than 9.0. To work around this issue:

      1. Ensure PingAccess is configured to include profile in the list of Web Session scopes.

      2. In PingFederate, ensure the profile scope is defined in Scope Management.

      3. During authentication, the user must accept usage of the profile scope. If the user does not accept usage of the profile scope, then the web session scope rule will always fail for that user.

    3. Contract Fulfillment— Modify the scopeAttribute Contract to use Access Token as the Source with a Value of scope.