PingDirectory

Changing the default OIDC grant type

To change the Delegated Admin application’s default OpenID Connect (OIDC) grant type, use the PingFederate admin console and the Delegated Admin config.js file.

To improve authentication security, switch your default OIDC grant type to Authorization Code with Require Proof Key for Code Exchange (PKCE). The Authorization Code with PKCE grant type hides access tokens during authentication with JavaScript applications. In comparison, the Implicit grant type displays access tokens in the URL redirect during OIDC authentication.

We deprecated support for the Implicit grant type and will remove it in a future release. Use the Authorization Code with PKCE grant type instead. Learn more about OAuth grant types in the OAuth documentation.

The following example changes the default OIDC grant type from Implicit to Authorization Code with Require Proof Key for Code Exchange (PKCE).

Steps

  1. In the PingFederate admin console, go to Applications > OAuth > Clients.

  2. From the Clients list, select the dadmin client.

  3. In the Allowed Grant Types section:

    1. Select the Authorization Code checkbox.

    2. Clear the Implicit checkbox.

    3. Select the Require Proof Key for Code Exchange (PKCE) checkbox.

    4. Click Save.

  4. From your <server-root> directory, open the Delegated Admin application’s config.js file and set the AUTHENTICATE_WITH_PKCE variable to true.

    Example:

    /*
 * Indicates if this app should authenticate using the 'Authorization Code with PKCE' OAuth grant.
 * If true, the 'Authorization Code with PKCE grant will be used. If false, the 'Implicit' grant
 * will be used. * DEFAULT: window.AUTHENTICATE_WITH_PKCE = true;
 */
window.AUTHENTICATE_WITH_PKCE = true;

    If you don’t already have the AUTHENTICATE_WITH_PKCE variable in your config.js file, you must add it.