PingFederate Server

Configuring an OAuth assertion grant IdP connection

An OAuth assertion grant connection uses a SAML bearer assertion or a JSON Web Token (JWT) bearer assertion to request an access token from the PingFederate OAuth authorization server (OAuth AS).

You can configure an OAuth assertion grant connection with an identity provider (IdP) partner either in conjunction with browser-based single sign-on (SSO), WS-Trust, or independently. This page covers configuring PingFederate as the receiving resource authorization server to accept the assertion. To configure PingFederate to issue an ID-JAG, see Configuring SP connections for OAuth token exchange.

For JWT bearer grant requests (grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer), PingFederate supports the following assertion types:

Learn more about the JWT bearer grant type parameters in OAuth grant type parameters.

For SAML bearer grant requests, learn more in the Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants specification.

Steps

  1. In the PingFederate admin console, go to Authentication > Integration > IdP Connections and then click Create Connection.

  2. On the Connection Type tab, select the OAuth Assertion Grant checkbox.

    You can also select other options, such as the Browser SSO Profiles checkbox. If you do, you’re prompted to complete the required configuration. This topic focuses only on the OAuth Assertion Grant configuration.

  3. On the General Info tab, enter the required information. Learn more in Identifying the partner.

  4. On the OAuth Assertion Grant Attribute Mapping tab, click Configure OAuth Assertion Grant Attribute Mapping.

  5. Configure the attribute mapping for the values required by the access token manager and any issuance criteria. For an ID-JAG, map the assertion claims required by your local identity and access-token policies. Review the mappings and issuance criteria before saving the configuration.