Supported client metadata

client_name

A descriptive name for the client instance. This name appears when the user is prompted for authorization.

token_endpoint_auth_method

The client authentication method.

PingFederate accepts the following values:

tls_client_auth_subject_dn

The subject DN of the client certificate.

This field is required if tls_client_auth is the value of the token_endpoint_auth_method parameter.

token_endpoint_auth_signing_alg

The signing algorithm that the client must use to sign the JSON Web Token (JWT) for client authentication.

This field applies only when the token_endpoint_auth_method parameter is provided with a value of private_key_jwt or client_secret_jwt.

For private_key_jwt, PingFederate accepts the following values:

For client_secret_jwt, PingFederate accepts the following values:

If this parameter is not provided, the client can use any of the supported signing algorithms.

request_object_signing_alg

The signing algorithm that the client must use to sign its request objects for transmission of request parameters.

Applicable only when the client might send its authorization requests using request objects.

PingFederate accepts the following values:

When this parameter is not provided, the client can use any of the supported signing algorithms.

For more information about request objects, see RFC 9101: JWT Secured Authorization Request (JAR).

jwks_uri, and jwks

The URL of the JSON Web Key Set (JWKS) or the actual JWKS from the client.

If the client is configured to use the private_key_jwt or client_secret_jwt client authentication method, to transmit request parameters in signed request objects, or to transmit CIBA request parameters in signed request objects, only one of the previous values is required for PingFederate to verify the authenticity of the JWTs.

Either value can be defined even if the client is not configured to use JWTs for authentication or transmission of request parameters. This flexibility allows the client to transmit request parameters in signed request objects for some requests and without the use of signed request objects for some other transactions.

If the client signs its JWTs using an RSASSA-PSS signing algorithm, PingFederate must be deployed to run in a Java 8 or Java 11 runtime environment, or integrated with a hardware security module (HSM) and a static-key configuration for OAuth and OpenID Connect. For more information on HSM integration and static keys, see Supported hardware security modules and Keys for OAuth and OpenID Connect, respectively.

If the client is configured to encrypt ID tokens using an asymmetric encryption algorithm, either the JWKS URL or the actual JWKS must be provided. See the ID Token Key Management Encryption Algorithm setting.

redirect_uris

An array of one or more redirection

URIs where the OAuth AS may redirect the resource owner’s user agent after authorization is obtained.

The authorization code and implicit grant types require at least one redirection URI.

logo_uri

The location of the logo used on user-facing OAuth grant authorization and revocation pages. For best results with the installed HTML templates, the recommended size is 72 x 72 pixels.

scope

A space-separated list of one or more scopes, which a client can request.

grant_types

An array of one or more grant types, which a client can request.

PingFederate accepts the following values:

For more information about each grant type, see Grant types.

response_types

An array of one or more response types, which a client can request.

PingFederate accepts the following values:

For more information about these response types, see Definitions of Multiple-Valued Response Type Combinations.

If one or more response types are specified, the resulting client is only allowed to send one of the specified response types at runtime. Requests from this client with other response types will be rejected.

Response type and grant type parameters must be provided in tandem because certain response types require one or more grant types, and vice versa. The following table provides a summary of their relationship.

id_token_signed_response_alg

The JSON Web Signature (JWS) algorithm required for the OpenID Connect (OIDC) tokens. Allowed values:

id_token_encrypted_response_alg

The algorithm used to encrypt or otherwise determine the value of the content encryption key.

Allowed values:

id_token_encrypted_response_enc

The content encryption algorithm used to perform authenticated encryption on the plain text payload of the token.

Required if an algorithm is provided through the id_token_encrypted_response_alg parameter.

Allowed values:

introspection_signing_alg_values (optional)

The JSON Web Signature (JWS) algorithm used to sign the token introspection response.

Allowed values:

The default value is RS256. None is not an allowed value.

introspection_encryption_alg_values (optional)

The JSON Web Encryption (JWE) algorithm used to encrypt the content-encryption key of the token introspection response. Allowed Values:

If asymmetric type, a JWKS or JWKS URL is required and must be valid.

If symmetric type, the reversible secret is required.

introspection_encryption_enc_values

The JSON Web Encryption (JWE) content-encryption algorithm for the token introspection response. Allowed values:

backchannel_token_delivery_mode

The token delivery method that the client supports. PingFederate supports poll and ping.

Set to poll if the client can check for the authorization results periodically at the token endpoint.

Set to ping if the client prefers to wait for a ping callback message from PingFederate as a signal that the authorization result is ready for pickup.

If this parameter is not provided and the CIBA grant type is enabled, the poll method is assumed.

backchannel_client_notification_endpoint

The client’s notification endpoint, to which PingFederate sends its ping call back messages.

Required only if ping is the configured token delivery method.

backchannel_authentication_request_signing_alg

The signing algorithm that the client must use to sign its request objects for transmission of request parameters.

PingFederate accepts the following values:

If this parameter is not provided and the CIBA grant type is enabled, the client can use any of the allowed signing algorithms.

backchannel_user_code_parameter

Indicates whether the client supports user code.

The purpose of this code is to authorize the transmission of an authentication request to the user’s authentication device.

A valid value is either true or false.

If this parameter is not provided and the CIBA grant type is enabled, user code support is not enabled.

sector_identifier_uri

A URL using the HTTPS scheme that references a JSON file containing an array of redirect_uri values. For more information, see .net/specs/openid-connect-registration-1_0.html//[].

subject_type

The type of subject used by the sector identifier, such as public or pairwise.