---
title: Configuring PingAccess for SSO
description: Instructions for configuring PingCentral to use SSO to access PingAccess.
component: pingcentral
version: 3.2
page_id: pingcentral:pingcentral_for_iam_administrators:pingcentral_installing_configuring/pingcentral_pa_sso
canonical_url: https://docs.pingidentity.com/pingcentral/3.2/pingcentral_for_iam_administrators/pingcentral_installing_configuring/pingcentral_pa_sso.html
llms_txt: https://docs.pingidentity.com/pingcentral/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: October 15, 2025
section_ids:
  about-this-task: About this task
  steps: Steps
---

# Configuring PingAccess for SSO

## About this task

To use SSO to access PingAccess from PingCentral:

## Steps

1. Configure a new PingFederate client:

   1. In PingFederate, go to **Applications → OAuth → Clients**.

   2. On the **Manage Client** tab, complete these fields:

      * **Client ID**: Enter a unique identifier for the client.

      * **Name**: Enter a name for the client.

      * **Description**: Enter a description of the client.

        Learn more in [Defining the access token attribute contract](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_defining_access_token_attribute_contract.html) in the PingFederate documentation.

        ![In this example, the Client ID and Name field are completed and the Client Secret option is selected.](../_images/eqf1656367100432.jpg)

   3. In the **Client Authentication** field, select **Client Secret**.

   4. In the **Client Secret** field, you can:

      | Option                       | Description                                                                                                                                        |
      | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Create or generate a secret. | Choose from:- To create a strong, random alphanumeric string, click **Generate Secret**.

      - Manually enter a secret.                               |
      | Modify an existing secret.   | 1. Select the **Change Secret** check box.

      2. Click **Generate Secret** to create a strong random alphanumeric string or manually enter a secret. |

   5. In the **Grant Types** field, select the **Client Credentials** and **Access Token Validation (Client is a Resource Server)** options.

   6. In the **Default Access Token Manager** field, select **JSON Web Tokens** . Click **Save**.

   7. Access the PingFederate `<pf_install>/pingfederate/bin/run.properties` file, and ensure that this property is set: `pf.admin.api.authentication=OAuth2`.

   8. Access the PingFederate `<pf_install>/pingfederate/bin/oauth2.properties` file, and ensure that the following properties are set.

      | Property                  | Description                                                                                                                                                                                                                                                                |
      | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | `client.id`               | The unique client identifier defined in step 2.                                                                                                                                                                                                                            |
      | `client.secret`           | The client secret defined in step 4.                                                                                                                                                                                                                                       |
      | `introspection.endpoint`  | This URL specifies where PingFederate validates the authentication token.For example, `https://<PF_RUNTIME_HOST>:<PF_RUNTIME_PORT>/as/introspect.oauth2`                                                                                                                   |
      | `required.scopes`         | Use any of the scopes defined in PingFederate.Go to **System → OAuth Settings → Scope Management** to see a list of available scopes.For details, see [Scopes](https://docs.pingidentity.com/csh?Product=pf-latest\&context=pf_scopes) in the *PingFederate Server* guide. |
      | `username.attribute.name` | The value mapped to the **Username** attribute defined on the **Contract Fulfillment** tab.                                                                                                                                                                                |
      | `role.attribute.name`     | The value mapped to the **admin_role** attribute defined on the **Contract Fulfillment** tab.                                                                                                                                                                              |

2. Configure PingAccess:

   1. In PingAccess, go to **System → System Settings → Admin Authentication**.

   2. On the **Admin API OAuth** tab, select **Enable** and complete these fields as shown in the example:

      * **Client ID**: Enter the unique client identifier for the new client.

      * **Client Secret**: Enter the client secret defined for the new client.

      * **Scope**: Enter the scopes set as required scopes for the new client.

      * **Subject Attribute Name**: Enter the name of an access token attribute that you want to use as the **Subject** field in audit log entries for the admin API.

        ![In this example, the Admin API OAuth - Enabled tab is displayed in PingAccess.](../_images/apr1656367152907.jpg)

   3. Click **Save**.

3. Configure PingCentral:

   1. In PingCentral, to connect to the new PingFederate client, go to **Environments → Add Environments**.

   2. On the **Connect to Instances** page, scroll down and select **PingAccess**.

   3. Complete the following fields using the properties you just set in PingAccess.

      ![In this example, the Connect to Instances page in PingCentral is displayed.](../_images/pdd1656368680536.jpg)

      * **PingAccess Admin**: Enter the link to access PingAccess.

      * **Authentication Method**: Select **Native** or**OAuth2**.

      * **Token Endpoint URL**: Enter the token endpoint URL, which is available here in PingFederate:`https://<PF_RUNTIME_HOST>:<PF_RUNTIME_PORT>/.well-known/openid-configuration`.

      * **Client ID**: Enter the unique identifier for the new client.

      * **Client Secret**: Enter the client secret defined for the new client.

      * **Scopes**: Enter the scopes set as required scopes for the new client.

   4. Click **Next**.