PingOne

Adding a trusted issuer

Define external authorization servers as Trusted Issuers in PingOne whose signed JSON Web Tokens (JWTs) you want to accept during OAuth 2.0 token exchange. Trusted issuers can include another PingOne environment, another Ping Identity product, or a third-party solution.

Before you begin

To add a trusted issuer, you must have:

  • The Environment Admin role or a custom role with equivalent permissions (such as trustedIssuers:create:trustedIssuer). Learn more in Administrator Roles.

  • The issuer URL for your external authorization server. You’ll enter the URL in PingOne.

  • The JSON Web Key Set (JWKS) URL or JWKS for the external issuer. You’ll enter the URL or the JWKS itself in PingOne.

Steps

  1. In the PingOne admin console, go to Integrations > Trusted Issuers and click the icon.

  2. Enter the following:

    1. Name: A unique name for the issuer.

    2. Description (optional): A brief description of the issuer.

    3. Issuer: Enter the URL that identifies the external token issuer.

    4. JSON Web Key Set Method: Enter either the URL where PingOne can retrieve the JWKS or the web key set itself. You can paste the JSON in one line or multiple lines.

    5. Audiences (optional): Enter accepted audience values for incoming tokens from this issuer. When defined, at least one value in the incoming token’s aud array must match a configured audience.

      If left blank, PingOne accepts any aud value for tokens from this issuer.

      Click Add to add additional audiences.

    6. Advanced Settings: Enter or edit the following optional settings:

      1. Require Expiration Claim: Select the checkbox for PingOne to reject tokens missing the exp claim. The exp claim sets a timestamp when the token is no longer valid.

      2. Require Issued-at Claim: Select the checkbox for PingOne to reject tokens missing the iat claim. The iat claim sets the timestamp when the token was created.

      3. Require Not-before Claim: Select the checkbox for PingOne to reject tokens missing the nbf claim. The nbf claim sets the timestamp before which the token isn’t accepted for processing.

      4. Clock Skew Tolerance: Set the allowed clock discrepancies (0 - 60 seconds) between the external issuer and PingOne when validating token expiration and time-based claims.

      5. Max Future Validity: Set the maximum time a token’s expiration can be set in the future (maximum 30 days). PingOne rejects tokens exceeding this maximum. Values can be in seconds, minutes, hours, or days. If set to 0, any future date is valid.

  3. Click Save.

Next steps