PingFederate Server

Configuring a JWT Bearer Grant Processor Attribute Mapping Instance

When configuring an identity provider (IdP) connection for JSON Web Token (JWT) Bearer Grant Processors, you can determine which attributes the IdP sends in the JWT assertion.

The JWT Bearer Grant Processor connection type is used to configure single sign-on (SSO) from the macOS login. Learn more in Configuring Platform SSO for macOS in the PingOne documentation.

Before you begin

Before you configure a JWT Bearer Grant Processor IdP connection, you need to configure a JWT Bearer Grant Processor instance. Learn more in JWT Bearer Grant Processors.

Steps

Creating a JWT Bearer Grant Processor IdP Connection

  1. In the PingFederate admin console, go to Authentication > Integration > IdP Connections.

  2. Click Create a Connection.

  3. On the Connection Type tab, select JWT Bearer Grant Processor and select a JWT Bearer Grant Processor instance in the list.

  4. Click Next.

  5. In the General Info tab, provide the information for your IdP.

    Learn more in Identifying the partner

  6. In the Extended Properties tab, add extended properties to the IdP connection.

    Learn more in Populating extended property values for IdP connections.

  7. In the JWT Bearer Grant Processor Attribute Mapping tab, click Configure JWT Bearer Grant Processor Attribute Mapping.

Attribute Contract tab

  1. To add an attribute:

    1. In the Extend the Contract field, enter the attribute value.

    2. (Optional) To mask the values for this attribute returned from this connection in PingFederate logs, select Mask Values in Log.

    3. Click Add.

  2. When you’re done adding attributes, click Next.

Access Token Manager Mapping tab

  1. Click Create New Access Token Manager Mapping.

Access Token Manager tab

  1. To add an Access Token Manager, click Manage Access Token Management Instances.

    Learn more in Managing access token management instances.

  2. Click Next.

Data Store tab

Optionally set up datastore queries to supplement values returned from the access token attribute mapping source.

  1. (Optional) In the Active Data Store list, select an existing datastore connection, and then click Next.

    Learn more in Datastore query configuration.

  2. (Optional) To configure a datastore connection, click Manager Data Stores.

    Learn more in Managing datastores.

  3. Click Next.

Contract Fulfillment tab

Map values from the JWTs to the attributes defined for the attribute contract.

  1. For each JWT grant attribute, select the Source and Value for the attribute values.

  2. When you’re done, click Next.

The following table describes the available mappings for each Source value:

Source Value

Assertion

Populates with attributes from the JWT.

For example, to map the sub value from a JWT as the value of an attribute on the attribute contract, select Assertion as the Source and TOKEN_SUBJECT as the Value.

Context

Populates with the available context of the transaction.

Because the HTTP Request context value is retrieved as a Java object rather than text, use OGNL expressions to evaluate and return values. Learn more in the description for Expression.

Extended Client Metadata

Values are returned from the client record.

LDAP, JDBC, or Other

Populates with attributes you selected from the datastore. Select the preferred attribute from the list.

Expression

This option provides more complex mapping capabilities, such as transforming values into different formats.

Select Expressions in the Source list, click Edit under Actions, and compose your OGNL expressions.

All variables available for text entries are also available for expressions. Learn more in the description for Text.

Expressions aren’t enabled by default. Learn more about enabling and editing OGNL expressions in Attribute mapping expressions.

No Mapping

Select this option to ignore the Value field.

Text

When selected, the text you enter is used at runtime. You can mix text with references to any of the values from the SSO token, using the ${attribute} syntax.

When applicable, you can enter values from your datastore using the ${ds.<attribute>} syntax, where <attribute> is any attribute that you have selected from the datastore.

You can reference attribute values in the form of ${attributeName:-defaultValue}. The default value is optional. When specified, it’s used at runtime if the attribute value isn’t available. Don’t use the ${ and } in the default value.

Issuance Criteria tab

Individual attributes within policy contracts can further determine whether PingFederate approves or rejects requests. You can define those criteria to satisfy, or you can choose to skip this configuration.

  1. In the Source list, select a source for the criterion.

    The following table describes the Source options:

    Source Description

    Assertion

    Select to evaluate attributes from the IdP connection.

    Context

    Select to evaluate properties returned from the context of the transaction at runtime.

    Because the HTTP Request context value is retrieved as a Java object instead of text, attribute mapping expressions are more appropriate to evaluate and return values.

    Extended Properties

    Select to evaluate OAuth client metadata.

    JDBC, LDAP, or other types of datastore

    Select to evaluate attributes returned from a data source

    Mapped Attributes

    Select to evaluate the mapped attributes.

  2. In the Attribute Name list, select the attribute to evaluate.

  3. In the Condition list, select the comparison method.

    The available methods are:

    • equal to

    • equal to (case insensitive)

    • equal to DN

    • not equal to

    • not equal to (case insensitive)

    • not equal to DN

    • multi-value contains

    • multi-value contains (case insensitive)

    • multi-value contains DN

    • multi-value does not contain

    • multi-value does not contain (case insensitive)

    • multi-value does not contain DN

      The first six conditions are intended for single-value attributes. Use one of the multi-value …​ conditions for PingFederate to validate whether one of the attribute values matches the specified value. When an attribute has multiple values, using a single-value condition causes the criteria to fail.

  4. In the Value field, enter the comparison value.

    Values are compared verbatim. If you require complex evaluations, including conditional criteria or partial matching, define them using attribute expressions.

    Learn more in Attribute mapping expressions.

  5. If you want to use localized descriptions, enter a unique alias in the Error Result field, such as someIssuanceCriteriaFailed.

    1. Insert the same alias with the desired localized text in the applicable language resource files, located in the <pingfed-install>/pingfederate/server/default/conf/language-packs directory.

      If not defined, PingFederate returns ACCESS_DENIED when the criterion fails at runtime.

  6. Click Add.

  7. Repeat the previous steps for each issuance criterion you want to add.

  8. If you require complex evaluations, including conditional criteria or partial matching, define them using attribute mapping expressions.

    Learn more in Attribute mapping expressions.

    1. Click Show Advanced Criteria.

    2. In the Expression field, enter the required expressions.

    3. In the Error Result field, enter an error code or message.

      If the expressions resolve to a string value instead of true or false, the returned value overrides the Error Result field value.

    4. Click Add.

    5. Click Test, enter values in the applicable fields, and verify the results.

    6. Repeat the previous steps to add additional criteria using mapping expressions.

  9. Click Next.

Summary tabs

  1. Review your configuration, then click Save.

Activation & Summary tab

  1. Click Save.