Configuring PingFederate for PingAuthorize

Go to System → OAuth Settings → Scope Management and create scopes.

In the Scope Value field, enter the email, openid, and profile scopes, clicking Add after each entry. Click Save.

Go to Applications → OAuth → Access Token Management and click Create New Instance.

On the Type tab, from the Type list, select JSON Web Tokens. From the Parent Instance list, select None. Click Next.

On the Instance Configuration tab, click Add a new row to 'Certificates' and add the previously imported signing certificate. Select the desired signing algorithm and token timeout, and then click Next.

On the Session Validation tab, enable the session validation options.

On the Access Token Attribute Contract tab, add the attributes to be included in the OAuth access token. This example extends the contract with cn, email, scope, sub, and uid attributes.

Click Next until you reach the Summary tab, and then click Save. Accept the default values for the Resources URIs and Access Control settings.

Go to Applications → OAuth → Access Token Mappings to create an Access Token Mapping in the Default context for the Access Token Manager you just created. Click Add Mapping, and then click Add Attribute Source.

From the Active Data Store list, select the PingDirectory data store that you created in step 2. Click Next.

On the LDAP Directory Search tab, in the Base DN field, enter the base DN for the PingDirectory data that provides your identities.

In the Attributes to return from search section, click Add Attribute and enter the attributes to be retrieved.

On the LDAP Filter tab, in the Filter field, enter uid=${USER_KEY} to match the PingDirectory sample data with the authenticating user information.

Click Next and Save on the Summary tab.

On the Contract Fulfillment tab, fulfill the contract with the LDAP attributes from the PingDirectory data store. Leave the remaining settings as their defaults and click Save.

Go to Applications → OAuth → OpenID Connect Policy Management and click Add Policy.

In the Manage Policy tab, from the Access Token Manager list, select the access token manager you previously created.

Ensure that the Include User Info in ID Token check box is selected. Click Next.

On the Attribute Contract tab, extend the policy contract with the email and name attributes. Click Next.

On the Attribute Scopes tab, map the previously defined email and profile scopes to the email and name ID token attributes. Click Next.

On the Contract Fulfillment tab, fulfill the contract with the values in the access token. Click Next until you reach the Summary tab, and then click Save.

Click Set as Default to set the newly created policy as the default policy.

Go to Applications → OAuth → Clients and click Add Client.

Go to Authentication → OAuth → IdP Adapter Grant Mapping and create a new Form Adapter Mapping, fulfilling the contracts for USER_NAME and USER_KEY with the username form field. Click Next and Save on the Summary tab.

Because this PingFederate instance uses a different domain from the Policy Editor, you must modify the PingFederate CORS settings. Go to System → OAuth Settings → Authorization Server Settings. In the Cross-Origin Resource Sharing Settings section, enter the domain for the Policy Editor in the Allowed Origin field. Click Add and then Save.

Result: