PingCentral

Configuring PingAccess for SSO

About this task

To use SSO to access PingAccess from PingCentral:

Steps

  1. Configure a new PingFederate client:

    1. In PingFederate, go to Applications → OAuth → Clients.

    2. On the Manage Client tab, complete these fields:

      • Client ID: Enter a unique identifier for the client.

      • Name: Enter a name for the client.

      • Description: Enter a description of the client.

    See Configuring OAuth clients in the PingFederate Server guide for details.

    In this example, the Client ID and Name field are completed and the Client Secret option is selected.

    1. In the Client Authentication field, select Client Secret.

    2. In the Client Secret field, you can:

      Option Description

      Create or generate a secret.

      Choose from:

      • To create a strong, random alphanumeric string, click Generate Secret.

      • Manually enter a secret.

      Modify an existing secret.

      1. Select the Change Secret check box.

      2. Click Generate Secret to create a strong random alphanumeric string or manually enter a secret.

    3. In the Grant Types field, select the Client Credentials and Access Token Validation (Client is a Resource Server) options.

    4. In the Default Access Token Manager field, select JSON Web Tokens . Click Save.

    5. Access the PingFederate <pf_install>/pingfederate/bin/run.properties file, and ensure that this property is set: pf.admin.api.authentication=OAuth2.

    6. Access the PingFederate <pf_install>/pingfederate/bin/oauth2.properties file, and ensure that the following properties are set.

      Property Description

      client.id

      The unique client identifier defined in step 2.

      client.secret

      The client secret defined in step 4.

      introspection.endpoint

      This URL specifies where PingFederate validates the authentication token.

      For example, https://<PF_RUNTIME_HOST>:<PF_RUNTIME_PORT>/as/introspect.oauth2

      required.scopes

      Use any of the scopes defined in PingFederate.

      Go to System → OAuth Settings → Scope Management to see a list of available scopes.

      For details, see Scopes in the PingFederate Server guide.

      username.attribute.name

      The value mapped to the Username attribute defined on the Contract Fulfillment tab.

      role.attribute.name

      The value mapped to the admin_role attribute defined on the Contract Fulfillment tab.

  2. Configure PingAccess:

    1. In PingAccess, go to System → System Settings → Admin Authentication.

    2. On the Admin API OAuth tab, select Enable and complete these fields as shown in the example:

      • Client ID: Enter the unique client identifier for the new client.

      • Client Secret: Enter the client secret defined for the new client.

      • Scope: Enter the scopes set as required scopes for the new client.

      • Subject Attribute Name: Enter the name of an access token attribute that you want to use as the Subject field in audit log entries for the admin API.

        In this example, the Admin API OAuth - Enabled tab is displayed in PingAccess.

    3. Click Save.

  3. Configure PingCentral:

    1. In PingCentral, to connect to the new PingFederate client, go to Environments → Add Environments.

    2. On the Connect to Instances page, scroll down and select PingAccess.

    3. Complete the following fields using the properties you just set in PingAccess.

    In this example, the Connect to Instances page in PingCentral is displayed.

    • PingAccess Admin: Enter the link to access PingAccess.

    • Authentication Method: Select Native orOAuth2.

    • Token Endpoint URL: Enter the token endpoint URL, which is available here in PingFederate:https://<PF_RUNTIME_HOST>:<PF_RUNTIME_PORT>/.well-known/openid-configuration.

    • Client ID: Enter the unique identifier for the new client.

    • Client Secret: Enter the client secret defined for the new client.

    • Scopes: Enter the scopes set as required scopes for the new client.

      1. Click Next.