PingAuthorize

Creating a policy for permitted audiences

This tutorial describes how to create a policy for a REST service to control access based on an acceptable audience value.

About this task

An authorization server like PingFederate might set an audience field on the access tokens that it issues, naming one or more services that are allowed to accept the access token. A REST service can use the audience field to ensure that it does not accept access tokens that are intended for use with a different service.

As with the Permitted Clients policy, each rule in the Permitted Audiences policy defines an acceptable audience value.

Steps

  1. Go to Policies > Policies.

  2. Expand Global Decision Point and SCIM Policy Set.

  3. Highlight Token Policies and click and then Add Policy.

  4. For the name, replace Untitled with Permitted Audiences.

  5. From the Combining Algorithm list, select Unless one decision is permit, the decision will be deny.

  6. Click Add Rule.

  7. For the name, replace Untitled with Audience: https://example.com.

  8. From the Effect list, select Permit.

  9. In the Condition section:

    1. Click Comparison.

    2. From the Select an Attribute list, select HttpRequest.AccessToken.audience.

    3. From the middle, comparison-type list, select Equals.

    4. In the final field, enter https://example.com.

  10. Expand Statements.

  11. Click the Components tab, expand Statements, and drag Unauthorized Audience to the Statements box.

    Do not click Show Statements within the "Audience: https://example.com" rule.

  12. Click Save changes.

Result

The final configuration should resemble the following image.

Screen capture of the Permitted audiences policy configuration window with a perm rule configured as specified, and an Unauthorized Audience statement, flagged as Obligatory