PingOne Advanced Identity Cloud

Remote consent service

The remote consent service is an example remote consent service (RCS) that lets you demonstrate and test remote consent.

The example RCS isn’t intended for use in production environments because you can’t configure the encryption and signing algorithms. The example is intended only to demonstrate how you can configure Advanced Identity Cloud to use a custom RCS.

Find information about configuring remote consent in production environments in Remote consent.

Configure the RCS

  1. In the Advanced Identity Cloud admin console, go to vpn_key Authorization > Remote Consent Service.

  2. If the service isn’t already enabled, click Enable Remote Consent Service.

  3. Configure the following settings:

    Client Name

    The name used to identify this OAuth 2.0 RCS when referenced from other services.

    Authorization Server jwk_uri

    The jwk_uri for retrieving the authorization server signing and encryption keys.

    JWK Store Cache Timeout (in minutes)

    The cache timeout for the JWK store of the authorization server, in minutes.

    JWK Store Cache Miss Cache Time (in minutes)

    The length of time a cache miss is cached, in minutes.

    Consent Response Time Limit (in minutes)

    The time limit set on the consent response JWT before it expires, in minutes.

  4. Click Save.

Test the example RCS

The following example uses the same Advanced Identity Cloud tenant as both the authorization server and the consent service.

  1. In the Advanced Identity Cloud admin console, go to vpn_key Authorization > Remote Consent Service and configure the RCS as follows:

    1. In Client Name, enter the agent ID of the remote consent agent profile.

      For example, myRCSAgent.

    2. In Authorization Server jwk_uri, enter the URI where the RCS retrieves the keys the authorization server uses to sign and encrypt the consent request. These keys include:

      • The public signing key the RCS uses to verify the signature of the consent request.

      • The public encryption key for the consent response, so that the response can be encrypted (if encryption is enabled).

      The default JWKs URI for remote consent clients is /oauth2/consent_agents/jwk_uri.

      For example, https://<tenant-env-fqdn>/am/oauth2/realms/root/realms/alpha/consent_agents/jwk_uri.

    3. Click Save.

  2. Map the following secret labels to ESV secrets:

    • am.services.oauth2.remote.consent.response.signing.RSA: rsajwtsigningkey

    • am.services.oauth2.remote.consent.request.encryption: test

    These keys must match the configuration of the RCS agent profile you create in the next step.

  3. Create a remote consent agent profile by performing the steps in Remote consent agent profile.

    The example RCS provides an /oauth2/consent/jwk_uri path to supply its public keys to the authorization server. Enter https://<tenant-env-fqdn>/am/oauth2/consent/jwk_uri in the Json Web Key URI field for this example.

  4. Enable remote consent on the OAuth 2.0 provider by performing the steps in Use the profile.

  5. Test your configuration.

    Perform an OAuth 2.0 flow that requires consent. Advanced Identity Cloud renders the consent page using the example RCS.

Delete the RCS

Deleting the service removes all the RCS configuration.

To delete the service:

  1. In the Advanced Identity Cloud admin console, go to vpn_key Authorization > Remote Consent Service.

  2. At the bottom of the page, click Delete Remote Consent Service.