---
title: Configuring an OAuth assertion grant IdP connection
description: An OAuth assertion grant connection uses a SAML bearer assertion or a JSON Web Token (JWT) bearer assertion to request an access token from the PingFederate OAuth authorization server (OAuth AS).
component: pingfederate
version: 13.1
page_id: pingfederate:administrators_reference_guide:pf_configuring_oauth_assertion_grant_idp_connection
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/pf_configuring_oauth_assertion_grant_idp_connection.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: August 12, 2026
page_aliases: ["help_idpconnectionconfigtasklet_oauthsamlgrantattributemappingstate.adoc"]
section_ids:
  steps: Steps
---

# Configuring an OAuth assertion grant IdP connection

An OAuth assertion grant connection uses a SAML bearer assertion or a JSON Web Token (JWT) *(tooltip: \<div class="paragraph">
\<p>An IETF standard container format for a JSON object used for the secure exchange of content, such as identity or entitlement information. You can find the industry standard in \<a href="https\://datatracker.ietf.org/doc/html/rfc7519">RFC 7519\</a>.\</p>
\</div>)* bearer assertion to request an access token *(tooltip: \<div class="paragraph">
\<p>A data object by which a client authenticates to a resource server and lays claim to authorizations for accessing particular resources.\</p>
\</div>)* from the PingFederate OAuth authorization server (OAuth AS) *(tooltip: \<div class="paragraph">
\<p>The authorizing service in an OAuth framework that issues and manages access tokens for clients to access protected resources.\</p>
\</div>)*.

You can configure an OAuth assertion grant connection with an identity provider (IdP) *(tooltip: \<div class="paragraph">
\<p>A service that manages identity information and provides authentication services to relying clients or SPs within a federated or distributed network.\</p>
\</div>)* partner either in conjunction with browser-based single sign-on (SSO) *(tooltip: \<div class="paragraph">
\<p>The process of authenticating an identity (signing on) at one website (usually with a user ID and password) and then accessing resources secured by other domains without reauthenticating.\</p>
\</div>)*, WS-Trust, or independently. This page covers configuring PingFederate as the receiving resource authorization server to accept the assertion. To configure PingFederate to issue an ID-JAG, see [Configuring SP connections for OAuth token exchange](pf_configuring_sp_connections_oauth_token_exchange.html).

For JWT bearer grant requests (`grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer`), PingFederate supports the following assertion types:

* A standard JWT, as defined in the [JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://tools.ietf.org/html/rfc7523) specification

* An Identity Assertion JWT (ID-JAG), which is issued through token exchange *(tooltip: \<div class="paragraph">
  \<p>The process by which a security token is exchanged for another security token.\</p>
  \</div>)*

Learn more about the JWT bearer grant type parameters in [OAuth grant type parameters](../developers_reference_guide/pf_oauth_grant_type_param.html).

For SAML bearer grant requests, learn more in the [Security Assertion Markup Language (SAML) 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants](https://tools.ietf.org/html/rfc7522) specification.

## Steps

1. In the PingFederate admin console, go to **Authentication > Integration > IdP Connections** and then click **Create Connection**.

2. On the **Connection Type** tab, select the **OAuth Assertion Grant** checkbox.

   |   |                                                                                                                                                                                                                              |
   | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   |   | You can also select other options, such as the **Browser SSO Profiles** checkbox. If you do, you're prompted to complete the required configuration. This topic focuses only on the **OAuth Assertion Grant** configuration. |

3. On the **General Info** tab, enter the required information. Learn more in [Identifying the partner](help_idpconnectionconfigtasklet_generalinfostate.html).

4. On the **OAuth Assertion Grant Attribute Mapping** tab, click **Configure OAuth Assertion Grant Attribute Mapping**.

5. Configure the attribute mapping for the values required by the access token manager and any issuance criteria. For an ID-JAG, map the assertion claims required by your local identity and access-token policies. Review the mappings and issuance criteria before saving the configuration.