--- title: Configuring the Access Token Manager for PingCentral description: The access token manager associated with the OpenID Connect (OIDC) Policy must support signed JSON Web Token (JWT) tokens. To validate the token signature, PingCentral must be able to access a JSON Web Key Set (JWKS) endpoint URL in PingFederate. See Configuring JSON-token management in the PingFederate Server guide for additional information. component: pingcentral version: 2.2 page_id: pingcentral:pingcentral_for_iam_administrators:pingcentral_conf_atms canonical_url: https://docs.pingidentity.com/pingcentral/2.2/pingcentral_for_iam_administrators/pingcentral_conf_atms.html llms_txt: https://docs.pingidentity.com/pingcentral/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: August 15, 2023 section_ids: about-this-task: About this task steps: Steps --- # Configuring the Access Token Manager for PingCentral ## About this task The access token manager associated with the OpenID Connect (OIDC) *(tooltip: \
\

An authentication protocol built on top of OAuth that authenticates users and enables clients (relying parties) of all types to request and receive information about authenticated sessions and users. OIDC is extensible, allowing clients to use optional features such as encryption of identity data, discovery of OpenID Providers (OAuth authorization servers), and session management.\

\
)* Policy must support signed JSON Web Token (JWT) *(tooltip: \
\

An IETF standard container format for a JSON object used for the secure exchange of content, such as identity or entitlement information. You can find the industry standard in \RFC 7519\.\

\
)* tokens. To validate the token signature, PingCentral must be able to access a JSON Web Key Set (JWKS) endpoint URL in PingFederate. See [Configuring JSON-token management](https://docs.pingidentity.com/bundle/pingfederate-110/page/srl1564002994713.html) in the *PingFederate Server* guide for additional information. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Signing certificates and JSON Web Encryption (JWE) *(tooltip: \
\

A signed and encrypted instance of a JSON Web Token (JWT) based on IETF standard syntax and used for the exchange of encrypted content.\

\
)* encryption (symmetric or asymmetric) are not currently supported. | ## Steps 1. In PingFederate, go to **Applications β†’ OAuth β†’ Access Token Management** and click **Create New Instance**. 2. On the **Instance Configuration** tab, add one or more symmetric keys, signing certificates, or both. 1. Click **Add a new row to…​** or click **Update** to modify an existing entry. | | | | - | ----------------------------------------------------------------------------------------------------------------- | | | The **Key ID** field values must be unique across all JSON-token management instances, including child instances. | 2. If you have not yet created or imported your certificate into PingFederate, click **Manage Signing Certificates** and complete the task. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | To use an RSA-based algorithm for JSON Web Signature (JWS) *(tooltip: \
\

A signed instance of a JSON Web Token (JWT) based on IETF standard syntax and used for the exchange of signed content.\

\
)*, the key size of the signing certificate must be at least 2,048 bits. For an EC-based JWS algorithm, the key size depends on the chosen algorithm. | 3. On the **Instance Configuration** tab, select the **Use Centralized Signing Key** option. ![This image displays this option with this description: "Select this option to use a centralized key when signing JWTs using an RSA-based or EC-based algorithm."](_images/ykq1601419120045.jpg) 4. Select **Show Advanced Fields** and specify the path in the **JWKS Endpoint Path** field. This setp is optional when an algorithm is selected in the JWE Algorithm list. ![This image displays this option with this description: Path on PingFederate server to publish a JWKS with the keys and certificates that the partners can use for signature verification. If specified, the path must begin with a forward slash, such as /oauth/jwks. The resulting URL is https://\:\/ext/\. The path must be unique across all plugin instances, including any child instances.](_images/gry1601419191138.jpg) | | | | - | ----------------------------------------------------------------------------------------------------------------------------------------------- | | | This path must be explicitly configured in PingCentral. See [Configuring resource server functionality](pingcentral_conf_resource_server.html). | 5. If you define either or both of the issuer or audience claim values within the access token manager, you can configure PingCentral to validate them. These claim values are also defined in the **Issuer Claim Value** and**Audience Claim Value** fields.