---
title: "Configuring Dashboard sso.properties for PingOne"
description: Configure the PingIntelligence Dashboard sso.properties for PingOne.
component: pingintelligence
version: 5.2
page_id: pingintelligence:pingintelligence_reference_guide:pingintelligence_configure_dashboard_p1
canonical_url: https://docs.pingidentity.com/pingintelligence/5.2/pingintelligence_reference_guide/pingintelligence_configure_dashboard_p1.html
revdate: April 24, 2024
section_ids:
about-this-task: About this task
steps: Steps
next-steps: Next steps
---
# Configuring Dashboard `sso.properties` for PingOne
Configure the PingIntelligence Dashboard `sso.properties` for PingOne.
## About this task
To complete the Dashboard's SSO authentication, configure the `/pingidentity/webgui/sso.properties` file.
## Steps
1. To complete the Dashboard's SSO authentication, configure the `/pingidentity/webgui/sso.properties` file.
The following table describes the SSO properties.
| Property | Mandatory | Description |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `pi.webgui.sso.oidc.provider.issuer-uri` | Yes | Configure the Issuer URI auto generate in PingOne for the PingIntelligence Dashboard application.For more information, see step 6 in [Configuring an OIDC application in PingOne for PingIntelligence Dashboard](pingintelligence_configure_oidc_app_p1.html). |
| `pi.webgui.sso.oidc.client.id` | Yes | Configure the client ID. Make sure to configure the same value auto generated in PingOne for the PingIntelligence Dashboard application. For more information, see step 6 in [Configuring an OIDC application in PingOne for PingIntelligence Dashboard](pingintelligence_configure_oidc_app_p1.html). |
| `pi.webgui.sso.oidc.client.secret` | This is a required property only if the value of the property`pi.webgui.sso.oidc.client.authentication-method` is not set to `NONE`. | Configure the client secret value in plain text. Make sure to configure the same value auto generated in PingOne for the PingIntelligence Dashboard application. For more information, see step-6 in [Configuring an OIDC application in PingOne for PingIntelligence Dashboard](pingintelligence_configure_oidc_app_p1.html). |
| `pi.webgui.sso.oidc.client.authentication-method` | Yes | Configure the PingOne OIDC application authentication method. The possible values are:- `BASIC` - Basic authentication header-based client authentication.
- `POST` - Client credentials sent in POST body for authentication.
- `NONE` - Client does not authenticate itself.The default value is `BASIC`.
If the Authentication method in the OIDC application created in PingOne is set to NONE, then use NONE for this property. If Authentication is set to Client Secret BASIC, Client Secret POST, use BASIC or POST. |
| `pi.webgui.sso.oidc.provider.user-uniqueid-claim-name` | Yes | The value of this property should be `sub`. It defaults to the value of User ID in PingOne OIDC Attributes. |
| `pi.webgui.sso.oidc.provider.user-first-name-claim-name` | Yes | The value of this property should be the PingOne OIDC Attribute value that holds the first name of the signed-on user.The default value for the claim is `given_name`. |
| `pi.webgui.sso.oidc.provider.user-last-name-claim-name` | Yes | The value of this property should be the PingOne OIDC Attribute value that holds the last name of the signed-on user.The default value for the claim is `family_name`. |
| `pi.webgui.sso.oidc.provider.user-role-claim-name` | Yes | The value of this property should be the PingOne OIDC Attribute value that holds the role of the signed-on user.The default value in Dashboard is `role`. Supported values for the Role claim are ADMIN and REGULAR. |
| `pi.webgui.sso.oidc.client.additional-scopes` | No | Not applicable for PingOne SSO configuration |
The following is a sample snippet of `sso.properties`.
```
## PingIntelligence WebGUI SSO properties file
# This is in standard java properties file format
# comments are denoted by number sign (#) as the first non blank character
# multiline values are ended with '\' as end of line
# OIDC Provider uri
# WebGUI queries /.well-known/openid-configuration to get OIDC provider metadata
# issuer ssl certificate is not trusted by default. So import issuer ssl certificate into config/webgui.jks
# issuer should be reachable from both back-end and front-end
pi.webgui.sso.oidc.provider.issuer-uri=https://auth.pingone.asia/7e49bb56-72f8-485d-810e-ae3d619ca670/as
# OIDC Client id
pi.webgui.sso.oidc.client.id=PingIntelligence
# OIDC Client secret
# This can be empty
pi.webgui.sso.oidc.client.secret=OBF:AES:BcB3MOE/K+VAa579oBpky4PrIo4z9LnI4vXsltqI=
# OIDC Client authentication mode.
# Valid values: BASIC, POST, and NONE
pi.webgui.sso.oidc.client.authentication-method=BASIC
# claim name for unique id of the user in UserInfo response
# a new user is provisioned using this unique id value
pi.webgui.sso.oidc.provider.user-uniqueid-claim-name=sub
# claim name for first name of the user in UserInfo response
# either first name or last name can be empty, but both should not be empty
pi.webgui.sso.oidc.provider.user-first-name-claim-name=given_name
# claim name for last name of the user in UserInfo response
# either first name or last name can be empty, but both should not be empty
pi.webgui.sso.oidc.provider.user-last-name-claim-name=family_name
# claim name for role of the user in UserInfo response
# valid values for roles are ADMIN and REGULAR
pi.webgui.sso.oidc.provider.user-role-claim-name=role
# additional scopes in authorization request
# multiple scopes should be comma (,) separated
# openid,profile scopes are always requested
pi.webgui.sso.oidc.client.additional-scopes=exclusive
```
## Next steps
Complete steps 4-6 [Configuring SSO with PingOne](pingintelligence_configure_sso_p1.html).