--- title: Configure social authentication description: Configure Advanced Identity Cloud social authentication with OAuth 2.0 or OIDC identity providers component: pingoneaic page_id: pingoneaic:authentication:social-authentication-configure canonical_url: https://docs.pingidentity.com/pingoneaic/authentication/social-authentication-configure.html llms_txt: https://docs.pingidentity.com/pingoneaic/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md keywords: ["Journeys", "Nodes & Trees", "Social Authentication", "OAuth 2.0", "OpenID Connect (OIDC)"] section_ids: social-authentication-configuration-prerequisites: Before you begin social-authentication-configuration-register: Register the application with the identity provider social-authentication-configuration-redirect-url: Redirect URL requirements social-authentication-configuration-provider-specific-settings: Provider-specific settings add_the_provider_to_advanced_identity_cloud: Add the provider to Advanced Identity Cloud verify_preconfigured_settings: Verify preconfigured settings --- # Configure social authentication Social authentication lets users sign on to your applications using their existing accounts from providers such as Google or Facebook. Advanced Identity Cloud can integrate with any OAuth 2.0 or OpenID Connect (OIDC) compliant identity provider. This page shows you how to register and configure an external social identity provider in Advanced Identity Cloud so that it can be used in your authentication journeys. ## Before you begin Before you can configure social authentication in Advanced Identity Cloud, you must: * Register a developer application with each social identity provider you want to support. This process will provide you with a *client ID* and *client secret*. * Review the provider's documentation for any provider-specific prerequisites, such as enabling required APIs, scopes, or permissions. ### Register the application with the identity provider Before you can add a social identity provider to Advanced Identity Cloud, you must register a developer application with each identity provider you want to support. During this process, you'll configure a redirect URL and obtain credentials. When you've finished, you should have at a minimum: * A client ID. * A client secret (for confidential clients). * The provider's endpoint URLs. * The redirect URL you configured at the provider. Learn more about [redirect URL requirements](#social-authentication-configuration-redirect-url). The provider's developer documentation describes their integration needs, as well as their API endpoints. For example, providers usually have different scopes that you can configure depending on your service's needs. OAuth 2.0 and OIDC-compliant providers display much of the information you need to configure the identity provider client in their `.well-known` endpoint. For example, the endpoint should expose their endpoint URLs, and the signing and encryption algorithms they support. Financial-grade providers might require additional security-related configuration, such as `acr` values or PKCE-related settings. | | | | - | --------------------------------------------------------------------------------------------------- | | | Keep the provider's developer documentation available because you'll need it during this procedure. | #### Redirect URL requirements A redirect URL is a path in Advanced Identity Cloud where the identity provider redirects the end user on successful authentication. Follow these requirements when configuring the redirect URL: * Set the redirect URL to your tenant's access management base URL. For example, `https:///am`. This is the path that the social identity provider redirects the user back to after successful authentication. * Don't add realm names, journey names, or other query parameters to the redirect URL. The hosted journey pages store the realm, journey, and authentication session in the browser's local storage so Advanced Identity Cloud can resume the correct flow after the provider redirects back. * The redirect URL registered with the social identity provider must exactly match the redirect URL configured in Advanced Identity Cloud. #### Provider-specific settings Some providers require you to enable a specific setting or API in their service: * Google Enable the `Gmail API` in the Google Cloud console. * Apple You must have access to the Apple Development Program (Enterprise program isn't eligible), and you must enable `Sign In With Apple` in the Apple Developer site. * LINE You must apply for permission for your LINE channel to access a user's email address using OIDC: 1. In the LINE Developers console, enable Email address permission. 2. Agree to the terms and conditions, and follow the steps to complete the application. 3. The console displays `Applied` when your application is accepted. If you don't have email permission, social registration fails with an `Invalid Attribute Syntax` error. ## Add the provider to Advanced Identity Cloud | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Make sure the redirect URL, client secret, and requested scopes are aligned on both sides. You must follow the [redirect URL requirements](#social-authentication-configuration-redirect-url) exactly.If your journey expects an email address, request the email scope explicitly. Some providers don't return an email claim unless that scope is included.A mismatch in these values can cause redirect loops, failed token exchange, or missing claims during sign on. | To add the provider in Advanced Identity Cloud: 1. In the Advanced Identity Cloud admin console, go to Integrations > Identity Providers. 2. Click [icon: add, set=material, size=inline] New identity provider. Advanced Identity Cloud includes scripts and configurations for common identity providers. 3. In the New identity provider modal, select the required identity provider. If the required provider doesn't appear, select one of the following to add a custom identity provider: * OAuth2 * OpenID Connect 4. Click Next. 5. Enter the identity provider's required settings: Name, Client ID, the Redirect URL, and Scope Delimiter (usually an empty space). 6. (Optional) Click Show advanced settings and enter any additional provider-specific settings that are available during creation. Learn more about these fields in [Social identity provider settings](social-authentication-settings.html). 7. Click Save to save your changes and access all the configuration fields for the identity provider. 8. Provide the identity provider's remaining configuration details, and edit any required configuration details if needed. Learn more about each field in [Social identity provider settings](social-authentication-settings.html). 9. Click Save to save your changes. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | For OAuth 2.0 social identity providers, store the client secret in a secret store for greater security.Use the Client Secret Label Identifier to create a dynamic secret label to map to an alias for the secret.Learn more about secrets in [Use ESVs for signing and encryption keys](../tenants/esvs-signing-encryption.html). | Don't worry if some details are missing. You can edit the configuration later after saving the identity provider configuration for the first time. ### Verify preconfigured settings Advanced Identity Cloud preconfigures many of the required settings for the default providers, but you should verify that the settings for the provider haven't changed. Key preconfigured fields include: * The provider's URLs. For example, Authentication Endpoint URL, Access Token Endpoint URL, and User Profile Service URL. * The OAuth Scopes field. * The Well Known Endpoint for retrieving information about the provider. Leave this field empty for the `LINE (Browser)` configuration. * The provider's button and logo. Click Edit in the Button preview to configure the UI settings. * The script selected in the Transform Script list. This script is responsible for mapping attributes provided by the identity providers to a profile format compatible with Advanced Identity Cloud. Learn more in [Transform Script](social-authentication-settings.html#transform-script). | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Some features require choosing algorithms from those supported by the provider, as well as creating secrets. Consider the following points before configuring the provider:* Several capabilities in the identity provider client share the same secret IDs. For example, signing request objects and signing client authentication JWTs. * For these capabilities, the corresponding secrets are also not isolated per identity provider client within the realm.Therefore, ensure that you configure features requiring secrets in a way that they are compatible across clients in the same realm.Learn more in [/oauth2/connect/rp/jwk\_uri](../am-oidc1/managing-rp-jwk_uri.html). |