Configuring an OIDC provider for single sign-on requests from PingAuthorize

Go to System > OAuth Settings > Scope Management and create scopes.

In the Scope Value field, enter the email, openid, and profile scopes and click Add after each entry. Click Save.

Go to Applications > OAuth > Access Token Management and click Create New Instance.

On the Type tab, in the Type list, select JSON Web Tokens. In the Parent Instance list, select None. Click Next.

On the Instance Configuration tab, click Add a new row to 'Certificates' and add the previously imported signing certificate. Select the desired signing algorithm and token timeout, and then click Next.

On the Session Validation tab, enable the session validation options.

On the Access Token Attribute Contract tab, add the attributes to be included in the OAuth access token. This example extends the contract with cn, email, scope, sub, and uid attributes.

Click Next until you reach the Summary tab. Click Save. Accept the default values for the Resources URIs and Access Control settings.

Go to Applications > OAuth > Access Token Mappings to create an Access Token Mapping in the Default context for the Access Token Manager you just created. Click Add Mapping, and then click Add Attribute Source.

In the Active Data Store list, select the PingDirectory datastore that you created in step 2. Click Next.

On the LDAP Directory Search tab, in the Base DN field, enter the base DN for the PingDirectory data that provides your identities.

In the Attributes to return from search section, click Add Attribute and enter the attributes to be retrieved.

On the LDAP Filter tab, in the Filter field, enter uid=${USER_KEY} to match the PingDirectory sample data with the authenticating user information.

On the Summary tab, click Next and Save.

On the Contract Fulfillment tab, fulfill the contract with the LDAP attributes from the PingDirectory datastore. Leave the remaining settings as their defaults and click Save.

Go to Applications > OAuth > OpenID Connect Policy Management and click Add Policy.

On the Manage Policy tab, from the Access Token Manager list, select the access token manager you created previously.

Ensure that the Include User Info in ID Token checkbox is selected. Click Next.

On the Attribute Contract tab, extend the policy contract with the email and name attributes. Click Next.

On the Attribute Scopes tab, map the previously defined email and profile scopes to the email and name ID token attributes. Click Next.

On the Contract Fulfillment tab, fulfill the contract with the values in the access token. Click Next until you reach the Summary tab, and then click Save.

Click Set as Default to set the newly created policy as the default policy.

Go to Applications > OAuth > Clients and click Add Client.

Go to Authentication > OAuth > IdP Adapter Grant Mapping and create a new Form Adapter Mapping, fulfilling the contracts for USER_NAME and USER_KEY with the username form field. Click Next and Save on the Summary tab.

Because this PingFederate instance uses a different domain from the Policy Editor, you must modify the PingFederate CORS settings. Go to System > OAuth Settings > Authorization Server Settings. In the Cross-Origin Resource Sharing Settings section, enter the domain for the Policy Editor in the Allowed Origin field. Click Add and then Save.

Result

Stop the application.

$ bin/stop-server
The server was successfully stopped.

Re-run bin/setup to reconfigure the application.

Select OpenID Connect to configure the Policy Editor.

[/opt/{pingauthorize}-PAP]$ bin/setup

There is an existing configuration file at /config/configuration.yml. Overwrite? (yes /
no) [no]: yes
Detected valid license file in server root  {pingauthorize}.lic

 {pingauthorize}  Policy Editor
============================================

How would you like to configure the Policy Editor?

    1)  Quickstart (DEMO PURPOSES ONLY): This option configures the server with a form based authentication and
        generates a self-signed server certificate
    2)  OpenID Connect: This option configures the server to use an OpenID Connect provider such as PingFederate
    3)  Cancel the setup

Enter option [1]:  2

On which port should the Policy Editor listen for HTTPS communications? [9443]:

Enter the fully qualified host name or IP address that users' browsers will use to connect to this GUI [pap.example.com]: pap.example.com

Ensure that the PingFederate discovery endpoint uses the public DNS name of the PingFederate server. In this example, the Policy Editor uses a self-signed SSL certificate.

Enter the port of the OpenID Connect provider [9031]:

Enter the fully qualified host name or IP address of the OpenID Connect provider [pap.example.com]:  pf.example.com

Certificate server options:

    1)  Generate self-signed certificate (recommended for testing purposes only)
    2)  Use an existing certificate located on a Java Keystore (JKS)
    3)  Use an existing certificate located on a PKCS12 keystore

Enter option [1]:

There already exists a keystore at /config/keystore.p12. Do you want to delete it? (yes / no) [no]:  yes

Follow the remaining prompts.

   Setup Summary
=======================================
Host Name:        pap.example.com
Server Port:      9443
Secure Access:    Self-signed certificate
Admin Port:       9444
Periodic Backups: Enabled
Backup Schedule:  0 0 0 * * ?

Command-line arguments that would set up this server non-interactively:
    setup oidc --pkcs12KeyStorePath config/keystore.p12 --licenseKeyFile  {pingauthorize}.lic \
         --oidcHostname pf.example.com --oidcPort 9031 --certNickname server-cert --backupSchedule '0 0 0 * * ?' \
         --hostname pap.example.com --port 9443 --generateSelfSignedCertificate --adminPort 9444

What would you like to do?

    1)  Set up the server with the parameters above
    2)  Provide the setup parameters again
    3)  Cancel the setup

Enter option [1]:

Setup completed successfully

Please configure the following values
=============================================================================================
 {pingauthorize}  Server - Policy External Server
  Base URL:                                         https://pap.example.com:9443
  Shared Secret:                                    2222142a754f4838ad1e3dccb6e93940
  Trust Manager Provider:                           Blind Trust

PingFederate - OAuth Client Config
  Client ID:                                        pingauthorizepolicyeditor
  CORS Allowed Origin:                              https://pap.example.com:9443
  Redirect URL:                                     https://pap.example.com:9443/idp-callback

Please start the server by running bin/start-server

Restart the application by running bin/start-server.

Go to the Policy Editor, for example, https://pap.example.com:9443. Your browser should be redirected into the OAuth flow.

Click Click to Sign In.

Sign on with your user name and password.

Once authenticated, PingFederate will prompt the user with the scopes associated with the OAuth client. Check all of them to continue.

Result:

Create a file named create-policy-writer-group.ldif and add the following.

dn: ou=groups,dc=example,dc=com
objectclass: top
objectclass: organizationalunit
ou: groups

dn: cn=PolicyWriter,ou=groups,dc=example,dc=com
objectclass: top
objectclass: groupOfUniqueNames
cn: PolicyWriter
ou: groups
uniquemember: uid=user.20,ou=People,dc=example,dc=com

Use the PingDirectory ldapmodify tool to load the newly created ldif file.

/opt/PingDirectory/bin/ldapmodify -a -f create-policy-writer-group.ldif

In PingFederate, go to Applications > OAuth > Access Token Mappings.

Select the PingDirectory mapping from the list, and then on the Attribute Sources & User Lookup tab, select the PingDirectory source.

Click the LDAP Directory Search tab, and in the Root Object Class list, select Show All Attributes.

Add the isMemberOf attribute, and then click Done to return to Access Token Attribute Mapping.

Go to the Issuance Criteria tab and add a new row with the following values:

Click Save.

Result:

Sign on as user.0.

Result:

Sign on as user.20.

Result: