--- description: Configure the PingAuthorize Policy Editor to use PingFederate for authentication. component: pingauthorize version: 10.1 page_id: pingauthorize:installing_and_uninstalling_pingauthorize:paz_config_paz_authentication_pf canonical_url: https://docs.pingidentity.com/pingauthorize/10.1/installing_and_uninstalling_pingauthorize/paz_config_paz_authentication_pf.html section_ids: configuring-pingauthorize-policy-editor-to-use-pingfederate: Configuring PingAuthorize Policy Editor to use PingFederate before-you-begin: Before you begin about-this-task: About this task steps: Steps result: Result: --- # Configuring PingAuthorize Policy Editor to use PingFederate Configure the PingAuthorize Policy Editor to use PingFederate for authentication. ## Before you begin Configure PingFederate to handle OpenID Connect requests as described in [Configuring PingFederate for PingAuthorize](paz_config_pf_authentication_paz.html). ## About this task Reconfigure a manually installed PingAuthorize Policy Editor to use PingFederate for authentication. ## Steps 1. Add the certificate to the Java Trust Store. If the certificate chain added to PingFederate uses an intermediate certificate authority that is not trusted by the default Java trust store, you must add the certificate. Use the following command (root permissions are usually required). `$JAVA_HOME` must be defined as the installation location of the JVM on which the Policy Editor will run. ``` keytool -import \ -file /path/to/IntermediateCA.cer \ -keystore $JAVA_HOME/jre/lib/security/cacerts \ -storepass changeit ``` 2. Reconfigure PingAuthorize to point unauthenticated users to PingFederate. 1. Stop the application. ``` $ bin/stop-server The server was successfully stopped. ``` 2. Re-run `bin/setup` to reconfigure the application. 3. Select OpenID Connect to configure the Policy Editor. ``` [/opt/{pingauthorize}-PAP]$ bin/setup There is an existing configuration file at /config/configuration.yml. Overwrite? (yes / no) [no]: yes Detected valid license file in server root {pingauthorize}.lic {pingauthorize} Policy Editor ============================================ How would you like to configure the Policy Editor? 1) Quickstart (DEMO PURPOSES ONLY): This option configures the server with a form based authentication and generates a self-signed server certificate 2) OpenID Connect: This option configures the server to use an OpenID Connect provider such as PingFederate 3) Cancel the setup Enter option [1]: 2 On which port should the Policy Editor listen for HTTPS communications? [9443]: Enter the fully qualified host name or IP address that users' browsers will use to connect to this GUI [pap.example.com]: pap.example.com ``` 4. Ensure that the PingFederate discovery endpoint uses the public DNS name of the PingFederate server. In this example, the Policy Editor uses a self-signed SSL certificate. ``` Enter the port of the OpenID Connect provider [9031]: Enter the fully qualified host name or IP address of the OpenID Connect provider [pap.example.com]: pf.example.com Certificate server options: 1) Generate self-signed certificate (recommended for testing purposes only) 2) Use an existing certificate located on a Java Keystore (JKS) 3) Use an existing certificate located on a PKCS12 keystore Enter option [1]: There already exists a keystore at /config/keystore.p12. Do you want to delete it? (yes / no) [no]: yes ``` 5. Follow the remaining prompts. ``` Setup Summary ======================================= Host Name: pap.example.com Server Port: 9443 Secure Access: Self-signed certificate Admin Port: 9444 Periodic Backups: Enabled Backup Schedule: 0 0 0 * * ? Command-line arguments that would set up this server non-interactively: setup oidc --pkcs12KeyStorePath config/keystore.p12 --licenseKeyFile {pingauthorize}.lic \ --oidcHostname pf.example.com --oidcPort 9031 --certNickname server-cert --backupSchedule '0 0 0 * * ?' \ --hostname pap.example.com --port 9443 --generateSelfSignedCertificate --adminPort 9444 What would you like to do? 1) Set up the server with the parameters above 2) Provide the setup parameters again 3) Cancel the setup Enter option [1]: Setup completed successfully Please configure the following values ============================================================================================= {pingauthorize} Server - Policy External Server Base URL: https://pap.example.com:9443 Shared Secret: 2222142a754f4838ad1e3dccb6e93940 Trust Manager Provider: Blind Trust PingFederate - OAuth Client Config Client ID: pingauthorizepolicyeditor CORS Allowed Origin: https://pap.example.com:9443 Redirect URL: https://pap.example.com:9443/idp-callback Please start the server by running bin/start-server ``` 6. Restart the application by running `bin/start-server`. 3. Verify that you can log into the Policy Editor using OpenID Connect provided by PingFederate. 1. Go to the Policy Editor, for example, https\://pap.example.com:9443. Your browser should be redirected into the OAuth flow. 2. Click **Click to Sign In**. 3. Sign on with your user name and password. The sample configuration in this document creates an identity with the user name `user.20` and password `password`. 4. Once authenticated, PingFederate will prompt the user with the scopes associated with the OAuth client. Check all of them to continue. ![Screen capture of the Request for Approval window with all scope check boxes selected and the Allow button at the bottom center](_images/mey1576519666160.png) ### Result: You are now authenticated and authorized to view the Policy Editor.