---
title: Setting up SSO for PingCentral
description: The single sign-on (SSO) method is significantly more secure than the password authentication method. At this time, OpenID Connect (OIDC) is used for SSO.
component: pingcentral
version: 1.12
page_id: pingcentral:pingcentral_for_iam_administrators:pingcentral_sso_pc
canonical_url: https://docs.pingidentity.com/pingcentral/3.2/pingcentral_for_iam_administrators/pingcentral_mng_users/pingcentral_mng_users.html
llms_txt: https://docs.pingidentity.com/pingcentral/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: October 19, 2023
superseded_by: https://docs.pingidentity.com/pingcentral/3.2/pingcentral_for_iam_administrators/pingcentral_mng_users/pingcentral_mng_users.html
---

# Setting up SSO for PingCentral

The single sign-on (SSO) *(tooltip: \<div class="paragraph">
\<p>The process of authenticating an identity (signing on) at one website (usually with a user ID and password) and then accessing resources secured by other domains without reauthenticating.\</p>
\</div>)* method is significantly more secure than the password authentication method. At this time, OpenID Connect (OIDC) *(tooltip: \<div class="paragraph">
\<p>An authentication protocol built on top of OAuth that authenticates users and enables clients (relying parties) of all types to request and receive information about authenticated sessions and users. OIDC is extensible, allowing clients to use optional features such as encryption of identity data, discovery of OpenID Providers (OAuth authorization servers), and session management.\</p>
\</div>)* is used for SSO.

To set up SSO:

1. [Configure SSO for PingCentral](pingcentral_conf_sso_pc.html)

2. [Configure the resource server](pingcentral_conf_resource_server.html)

3. [Configure the OpenID provider](pingcentral_conf_openid_provider.html)

|   |                                                                                                                                                                                                                                                                                     |
| - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | When SSO access to PingCentral is configured, administrators cannot assign applications to application owners before they access PingCentral. After application owners sign on to PingCentral, administrators can access their account information and assign applications to them. |

**Auto-provisioned users**

For each SSO user, a local PingCentral user is auto-provisioned the first time they sign on with information obtained from the subject (sub) claim provided by the OpenID provider.

The user's first name, last name, and role are also recorded. PingCentral derives the user's name from the `given_name` and `family_name` claims defined by the profile scope.

If first-time access to PingCentral is with API access using a bearer token, auto-provisioning occurs if the user's name and role are available. For performance reasons, subsequent bearer token access doesn't update the local user information, such as first name and last name.

Although PingCentral administrators can modify or delete auto-provisioned users, doing so results in the SSO user being auto-provisioned again. Because the provisioning process generates a new PingCentral user ID, any application associations with the previous user ID will be lost.