PingOne

Editing a resource

Use the Resources page to modify existing resources in PingOne.

You can enable an OIDC-based application to request scopes from multiple resources in a single request. Learn more about the Request scopes to access multiple resources option in Editing an application - OIDC.

Steps

  1. In the PingOne admin console, go to Applications > Resources and browse or search for the resource you want to edit.

    The results list updates as you enter the search query. The current resources are shown in the list.

  2. Click a resource entry to open the details panel for the resource.

  3. On the Overview tab, click the Pencil icon () and enter or edit the following:

    Field Description

    Resource Name

    A unique identifier for the resource.

    Audience (optional)

    The intended audience for the resource. If you don’t provide a value, PingOne defaults to the resource name.

    Description (optional)

    A brief description of the resource.

    Access token time to live (seconds)

    The maximum time, in seconds, that the access token will be valid for use in the application.

    Token Introspection Endpoint Authentication Method

    Specifies how to authenticate using the client credentials for the application to which the token was issued. You can select from:

    • None

    • Client secret basic

    • Client secret post

    • Client secret JWT

    • Private key JWT

      For Private key JWT, select JWKS URL or JWKS. Provide either the URL where PingOne can retrieve the JSON Web Key Set (JWKS) or the web key set itself.

  4. On the Attributes tab, map resource attributes to user attributes in PingOne.

    1. Enter a resource attribute and then select the corresponding PingOne attribute from the list.

      For example, you could map the OIDC family_name attribute to the PingOne Family Name attribute.

      Resources can use JSON attributes in their attribute mappings. You can use these attributes to pass complex information to applications through an access token. Learn more in Adding user attributes.

    2. (Optional) Click the Gear icon () to use advanced expressions. Learn more in Using the expression builder.

    3. (Optional) Select the Required checkbox to make the attribute required.

      For any attributes except the sub attribute

      If it can’t find a value for an attribute set as required, PingOne doesn’t issue an access token for the resource and instead issues an error message in the token response.

      For the sub attribute

      The following table lists how PingOne handles the sub attribute based on whether it’s set as required and what grant type the application is using:

      sub set as required? Application grant type If PingOne can’t find an attribute mapping value?

      Yes

      Any grant type requiring user interaction, such as authorization code

      PingOne doesn’t issue an access token for the resource and instead issues an error message in the token response.

      Yes

      Client credentials

      PingOne doesn’t issue an access token for the resource and instead issues an error message in the token response.

      No

      Any grant type requiring user interaction

      PingOne populates the sub attribute with the PingOne user ID of the authenticated user.

      No

      Client credentials

      PingOne returns an access token without including the sub attribute.

    4. To add more attributes, click Add and enter an attribute and the corresponding PingOne mapping. Learn more in Mapping attributes.

    5. To delete an attribute, click the Delete icon () for the appropriate attribute.

    6. Click Save.

  5. On the Scopes tab:

    1. Locate the scope you want to edit, and then click .

    2. Enter or edit the Scope Name and Description.

    3. To map attributes to the scope:

      1. Select the Enable Mapped Attributes checkbox.

      2. In the Mapped Attributes field, select attributes in the list as needed and click Save.

        If you select the Enable Mapped Attributes checkbox but don’t add any attributes, PingOne still includes the sub attribute in access tokens by default.

        Attributes set as Required are only enforced if the scope includes that attribute mapping. If the scope includes a required attribute but the attribute mapping returns no value, PingOne returns an error and doesn’t mint the access token. If the scope doesn’t include that attribute mapping, PingOne ignores the missing value and mints the access token.

        The standard access token claims, such as iss, exp, and aud, are always included and aren’t configurable.

        Example with multiple scopes

        When an access token request includes multiple scopes, PingOne includes the combination of attributes from those scopes for the custom resource. If any requested scope for that custom resource doesn’t use mapped attributes, PingOne includes all custom resource attributes.

        For example, suppose a custom resource has attributes sub, attrX1, attrX2, and attrX3 with the following scopes:

        • scope1: The Enable Mapped Attributes checkbox is selected with mapped attributes sub and attrX1.

        • scope2: The Enable Mapped Attributes checkbox is selected with mapped attributes sub and attrX2.

        • scope3: The Enable Mapped Attributes checkbox isn’t selected.

          The following table shows which attributes are included in the access token for each scope combination at runtime:

          Requested scopes Attributes included in the access token

          scope1

          sub, attrX1

          scope2

          sub, attrX2

          scope1 scope2

          sub, attrX1, attrX2

          scope3

          sub, attrX1, attrX2, attrX3

          scope1 scope3

          sub, attrX1, attrX2, attrX3

          scope2 scope3

          sub, attrX1, attrX2, attrX3

    4. To add a scope:

      1. Click Add Scope.

      2. Enter the Scope Name and Description.

      3. Add any mapped attributes to which you want the scope to have access.

    5. Click Save.

  6. (Optional) On the Permissions tab:

    1. Click the Include user permissions in Access Token toggle to include application permissions in access tokens created for this resource.

      To enable the Permissions tab, add PingOne Authorize to your environment.

      Permissions for the authenticated user will be included in the p1.permissions claim in the access token. Learn more in Application permissions.

    2. To add an application resource and permissions, click Add Permissions.

      Learn more in Adding application permissions.

    3. To edit an application resource, click next to the application resource.

      • Edit the application resource Name and Description.

      • To add a permission, click Add and enter an Action and Description for the permission.

      • Edit the Action and Description for existing permissions.

      • To delete a permission, click next to the permission.

    4. (Optional) To delete an application resource, click next to the application resource.

    5. Click Save.