---
title: Single sign-on with OpenID Connect
description: This example sets up ForgeRock Identity Cloud as an OpenID Connect identity provider, and Identity Gateway as a relying party.
component: pinggateway
version: 2023.11
page_id: pinggateway:identity-cloud-guide:oidc
canonical_url: https://docs.pingidentity.com/pinggateway/2026/aic/oidc.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2024-09-18T11:50:37Z
keywords: ["Single sign-on (SSO)", "Security", "Authenticate", "OAuth 2.0", "OpenID Connect (OIDC)"]
superseded_by: https://docs.pingidentity.com/pinggateway/2026/aic/oidc.html
---

# Single sign-on with OpenID Connect

This example sets up ForgeRock Identity Cloud as an OpenID Connect identity provider, and Identity Gateway as a relying party.

For more information about Identity Gateway and OpenID Connect, refer to [OpenID Connect](../gateway-guide/oidc.html).

Before you start, prepare Identity Cloud, IG, and the sample application as described in [Example installation for this guide](preface.html#preface-examples).

1. Set up Identity Cloud:

   1. Log in to the Identity Cloud admin UI as an administrator.

   2. Make sure you are managing the `alpha` realm. If not, click the current realm at the top of the screen, and switch realm.

   3. Go to [icon: group, set=material, size=inline] Identities > Manage > [icon: settings_system_daydream, set=material, size=inline] Alpha realm - Users, and add a user with the following values:

      * Username: `demo`

      * First name: `demo`

      * Last name: `user`

      * Email Address: `demo@example.com`

      * Password: `Ch4ng3!t`

   4. Go to [icon: th, set=fa]Applications > [icon: plus, set=fa]Custom Application > OIDC - OpenId Connect > Web and add a web application with the following values:

      * Name: `oidc_client`

      * Owners: `demo user`

      * Client Secret: `password`

      * Sign On > Sign-in URLs: `http://ig.example.com:8080/home/id_token/callback`

      * Sign On > Grant Types: `Authorization Code`

      * Sign On > Scopes: `openid`, `profile`, `email`

      * Show advanced settings > Authentication > Implied Consent: `On`

   For more information, refer to Identity Cloud's [Application management](https://docs.pingidentity.com/pingoneaic/latest/app-management/applications.html).

2. Set up Identity Gateway:

   1. Set an environment variable for the `oidc_client` password, and then restart IG:

      ```bash
      $ export OIDC_SECRET_ID='cGFzc3dvcmQ='
      ```

   1) Add the following route to IG to serve the sample application .css and other static resources:

      * Linux

      * Windows

      ```
      $HOME/.openig/config/routes/00-static-resources.json
      ```

      ```
      %appdata%\OpenIG\config\routes\00-static-resources.json
      ```

      ```json
      {
        "name" : "00-static-resources",
        "baseURI" : "http://app.example.com:8081",
        "condition": "${find(request.uri.path,'^/css') or matchesWithRegex(request.uri.path, '^/.*\\\\.ico$') or matchesWithRegex(request.uri.path, '^/.*\\\\.gif$')}",
        "handler": "ReverseProxyHandler"
      }
      ```

   2) Add the following route to Identity Gateway, replacing the value for the property `amInstanceUrl`:

      * Linux

      * Windows

      ```
      $HOME/.openig/config/routes/oidc-idc.json
      ```

      ```
      %appdata%\OpenIG\config\routes\oidc-idc.json
      ```

      ```json
      {
        "name": "oidc-idc",
        "baseURI": "http://app.example.com:8081",
        "condition": "${find(request.uri.path, '^/home/id_token')}",
        "properties": {
          "amInstanceUrl": "https://myTenant.forgeblocks.com/am"
        },
        "heap": [
          {
            "name": "SystemAndEnvSecretStore-1",
            "type": "SystemAndEnvSecretStore"
          },
          {
            "name": "AuthenticatedRegistrationHandler-1",
            "type": "Chain",
            "config": {
              "filters": [
                {
                  "name": "ClientSecretBasicAuthenticationFilter-1",
                  "type": "ClientSecretBasicAuthenticationFilter",
                  "config": {
                    "clientId": "oidc_client",
                    "clientSecretId": "oidc.secret.id",
                    "secretsProvider": "SystemAndEnvSecretStore-1"
                  }
                }
              ],
              "handler": "ForgeRockClientHandler"
            }
          }
        ],
        "handler": {
          "type": "Chain",
          "config": {
            "filters": [
              {
                "name": "AuthorizationCodeOAuth2ClientFilter-1",
                "type": "AuthorizationCodeOAuth2ClientFilter",
                "config": {
                  "clientEndpoint": "/home/id_token",
                  "failureHandler": {
                    "type": "StaticResponseHandler",
                    "config": {
                      "status": 500,
                      "headers": {
                        "Content-Type": [
                          "text/plain"
                        ]
                      },
                      "entity": "Error in OAuth 2.0 setup."
                    }
                  },
                  "registrations": [
                    {
                      "name": "oauth2-client",
                      "type": "ClientRegistration",
                      "config": {
                        "clientId": "oidc_client",
                        "issuer": {
                          "name": "Issuer",
                          "type": "Issuer",
                          "config": {
                            "wellKnownEndpoint": "&{amInstanceUrl}/oauth2/realms/alpha/.well-known/openid-configuration"
                          }
                        },
                        "scopes": [
                          "openid",
                          "profile",
                          "email"
                        ],
                        "authenticatedRegistrationHandler": "AuthenticatedRegistrationHandler-1"
                      }
                    }
                  ],
                  "requireHttps": false,
                  "cacheExpiration": "disabled"
                }
              }
            ],
            "handler": "ReverseProxyHandler"
          }
        }
      }
      ```

      Notice the following features of the route compared to `07-openid.json` in [Use AM as a single OpenID Connect provider](../gateway-guide/oidc.html#oidc-am), where Access Management is running locally:

      * The ClientRegistration `wellKnownEndpoint` points to Identity Cloud.

3. Test the setup:

   1. Go to <http://ig.example.com:8080/home/id_token>. The Identity Cloud login page is displayed.

   2. Log in to Identity Cloud as user `demo`, password `Ch4ng3!t`. The home page of the sample application is displayed.