Implicit grant type

For any grant type, the application needs to send the authorization request to the PingOne for Enterprise authorization endpoint returned by the Discovery URL(https://sso.connect.pingidentity.com/sso/as/authorization.oauth2).

PingOne for Enterprise validates the redirect_uri parameter against the list of redirect URIs specified in the application’s configuration. You can find these URIs in the Authentication Flow section on the application summary page. If the redirect_uri is valid, PingOne for Enterprise sends the response to the specified redirect URI.

If your application uses an authorization implicit grant type, PingOne for Enterprise uses the following process to complete the authorization request:

The application sends an authorization request for an implicit grant type.

Here is an example of an authorization request URI:

https://sso.connect.pingidentity.com/sso/as/authorization.oauth2?client_id=5f65fdde-44e2-4d1c-be2b-41d5e0d6b903&response_type=token id_token&redirect_uri=https://localhost&scope=openid&nonce=123

The following table describes the parameters that make up the authorization request URI.

Parameter Description

client_id

Your client ID, assigned by PingOne for Enterprise. You can find this value on the Details tab.

scope

The user resources that can be accessed by the application. The openid scope is expected to be specified, either as the sole scope value or one of the scope values.

When openid is not specified and the response_type value indicates id_token, an id_token is not returned.

response_type

This can either be id_token, token (access token), or both. The token or tokens specified are returned in the response.

nonce

This is used to securely associate client_id with id_token.

For more information, see OpenID Connect Core 1.0 Nonce Implementation Notes.

The PingOne for Enterprise authorization endpoint returns the response_type value to the application.

If you included id_token and token in the authorization request, as in the example, an access token is returned with the id_token value in the response.

The HTTPS response will be similar to this:

https://localhost/#access_token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjdBOUMxMDA4REEzMzAwQTExMTYwQkQ1NUFEMUExOEFGQTQ3QzQ2QjEifQ.eyJhdHRydGVzdCI6Im1pbG8iLCJzdWIiOiJtaWxvIiwiaWRwaWQiOiIwYTI1ZTYwYS0xZGQ5LTRlZGMtYTg4ZS01OTJmNDUyYmEyYTQiLCJzY29wZSI6Im9wZW5pZCIsImlzcyI6Imh0dHBzOi8vc3NvLmNvbm5lY3QucGluZ2lkZW50aXR5LmNvbS81ZjY1ZmRkZS00NGUyLTRkMWMtYmUyYi00MWQ1ZTBkNmI5MDMiLCJncm91cHMiOlsiYWJjZGVmZzIxN0BkaXJlY3RvcnkiLCJhYmNkZWZnNTkzQGRpcmVjdG9yeSIsIlVzZXJzQGRpcmVjdG9yeSIsImFiY2RlZmc3ODJAZGlyZWN0b3J5IiwiYWJjZGVmZzUzNEBkaXJlY3RvcnkiLCJhYmNkZWZnNDc0QGRpcmVjdG9yeSIsImFiY2RlZmczMjNAZGlyZWN0b3J5IiwiYWJjZGVmZzI5MkBkaXJlY3RvcnkiLCJhYmNkZWZnMzUwQGRpcmVjdG9yeSIsImFiY2RlZmc5OTNAZGlyZWN0b3J5IiwiYWJjZGVmZzU0NkBkaXJlY3RvcnkiLCJhYmNkZWZnMjYxQGRpcmVjdG9yeSIsImFiY2RlZmcyODdAZGlyZWN0b3J5IiwiYWJjZGVmZzg3MUBkaXJlY3RvcnkiLCJhYmNkZWZnMzYzQGRpcmVjdG9yeSIsImFiY2RlZmc1NjlAZGlyZWN0b3J5IiwiYWJjZGVmZzg5MkBkaXJlY3RvcnkiLCJhYmNkZWZnMTc4QGRpcmVjdG9yeSIsImFiY2RlZmc0NjJAZGlyZWN0b3J5IiwiYWJjZGVmZzc0N0BkaXJlY3RvcnkiLCJhYmNkZWZnNzZAZGlyZWN0b3J5IiwiYWJjZGVmZzUxMkBkaXJlY3RvcnkiLCJhYmNkZWZnMjUzQGRpcmVjdG9yeSIsImFiY2RlZmczNUBkaXJlY3RvcnkiLCJhYmNkZWZnNDc2QGRpcmVjdG9yeSIsImFiY2RlZmc1MzZAZGlyZWN0b3J5IiwiYWJjZGVmZzg4M0BkaXJlY3RvcnkiLCJhYmNkZWZnMjI4QGRpcmVjdG9yeSIsImFiY2RlZmc5OTBAZGlyZWN0b3J5IiwiYWJjZGVmZzk0N0BkaXJlY3RvcnkiLCJhYmNkZWZnMzgyQGRpcmVjdG9yeSIsImFiY2RlZmc2OTNAZGlyZWN0b3J5IiwiYWJjZGVmZzY3OEBkaXJlY3RvcnkiLCJhYmNkZWZnMjI0QGRpcmVjdG9yeSIsImFiY2RlZmc5MjRAZGlyZWN0b3J5IiwiYWJjZGVmZzMxMEBkaXJlY3RvcnkiLCJhYmNkZWZnMzE2QGRpcmVjdG9yeSIsImFiY2RlZmc4NDZAZGlyZWN0b3J5IiwiYWJjZGVmZzk2MkBkaXJlY3RvcnkiLCJhYmNkZWZnMTg3QGRpcmVjdG9yeSIsImFiY2RlZmc2NjFAZGlyZWN0b3J5IiwiYWJjZGVmZzQ5M0BkaXJlY3RvcnkiLCJhYmNkZWZnODNAZGlyZWN0b3J5IiwiYWJjZGVmZzE3MkBkaXJlY3RvcnkiLCJhYmNkZWZnNzIyQGRpcmVjdG9yeSIsImFiY2RlZmcxNDBAZGlyZWN0b3J5IiwiYWJjZGVmZzM5NUBkaXJlY3RvcnkiLCJhYmNkZWZnNTU5QGRpcmVjdG9yeSIsImFiY2RlZmc5MkBkaXJlY3RvcnkiLCJhYmNkZWZnMTEzQGRpcmVjdG9yeSIsImFiY2RlZmc2OTFAZGlyZWN0b3J5IiwiYWJjZGVmZzgwNkBkaXJlY3RvcnkiLCJhYmNkZWZnNjk2QGRpcmVjdG9yeSIsImFiY2RlZmc5MDFAZGlyZWN0b3J5IiwiYWJjZGVmZzE1NkBkaXJlY3RvcnkiLCJhYmNkZWZnNTE2QGRpcmVjdG9yeSIsImFiY2RlZmc3ODVAZGlyZWN0b3J5IiwiYWJjZGVmZzEzM0BkaXJlY3RvcnkiLCJhYmNkZWZnNTQ4QGRpcmVjdG9yeSIsImFiY2RlZmcyODJAZGlyZWN0b3J5IiwiYWJjZGVmZzgyN0BkaXJlY3RvcnkiLCJhYmNkZWZnNTU2QGRpcmVjdG9yeSIsImFiY2RlZmc3ODlAZGlyZWN0b3J5IiwiYWJjZGVmZzkyOEBkaXJlY3RvcnkiLCJhYmNkZWZnNjk5QGRpcmVjdG9yeSIsImFiY2RlZmc0ODNAZGlyZWN0b3J5IiwiYWJjZGVmZzMzMUBkaXJlY3RvcnkiLCJhYmNkZWZnNTYxQGRpcmVjdG9yeSIsImFiY2RlZmc5NkBkaXJlY3RvcnkiLCJhYmNkZWZnNzRAZGlyZWN0b3J5IiwiYWJjZGVmZzk2OUBkaXJlY3RvcnkiLCJhYmNkZWZnOTgzQGRpcmVjdG9yeSIsImFiY2RlZmcxMjFAZGlyZWN0b3J5IiwiYWJjZGVmZzQ3M0BkaXJlY3RvcnkiLCJhYmNkZWZnMjY0QGRpcmVjdG9yeSIsImFiY2RlZmczNTJAZGlyZWN0b3J5IiwiYWJjZGVmZzEzOUBkaXJlY3RvcnkiLCJhYmNkZWZnMzdAZGlyZWN0b3J5IiwiYWJjZGVmZzQxNkBkaXJlY3RvcnkiLCJhYmNkZWZnOTU5QGRpcmVjdG9yeSIsImFiY2RlZmcxNjNAZGlyZWN0b3J5IiwiYWJjZGVmZzc1M0BkaXJlY3RvcnkiLCJhYmNkZWZnNjM3QGRpcmVjdG9yeSIsImFiY2RlZmcyMjlAZGlyZWN0b3J5IiwiYWJjZGVmZzI0MEBkaXJlY3RvcnkiLCJhYmNkZWZnODUwQGRpcmVjdG9yeSIsImFiY2RlZmc2MjNAZGlyZWN0b3J5IiwiYWJjZGVmZzM0NUBkaXJlY3RvcnkiLCJhYmNkZWZnNzM0QGRpcmVjdG9yeSIsImFiY2RlZmc4MzRAZGlyZWN0b3J5IiwiYWJjZGVmZzYyMEBkaXJlY3RvcnkiLCJhYmNkZWZnNzA4QGRpcmVjdG9yeSIsImFiY2RlZmcxODBAZGlyZWN0b3J5IiwiYWJjZGVmZzI0QGRpcmVjdG9yeSIsImFiY2RlZmcyMjJAZGlyZWN0b3J5IiwiYWJjZGVmZzQ4QGRpcmVjdG9yeSIsImFiY2RlZmc1NjRAZGlyZWN0b3J5IiwiYWJjZGVmZzUzOEBkaXJlY3RvcnkiLCJhYmNkZWZnNjI1QGRpcmVjdG9yeSIsImFiY2RlZmcyNThAZGlyZWN0b3J5IiwiYWJjZGVmZzI4MUBkaXJlY3RvcnkiLCJhYmNkZWZnNzY1QGRpcmVjdG9yeSIsImFiY2RlZmcxNjBAZGlyZWN0b3J5IiwiYWJjZGVmZzM0MkBkaXJlY3RvcnkiLCJhYmNkZWZnODg1QGRpcmVjdG9yeSIsImFiY2RlZmc0NjhAZGlyZWN0b3J5Il0sImV4cCI6MTY3OTQyMzg2NCwianRpIjoiSTBQVzU4T0p1clZiRzNBYUFJZ1l2c2Y4ZG5IZUJMN3J2LVJrbUlNa2w5MUZETmZHQnVCM1pSZ2FMQ1RRbWciLCJjbGllbnRfaWQiOiI1ZjY1ZmRkZS00NGUyLTRkMWMtYmUyYi00MWQ1ZTBkNmI5MDMifQ.ACzD2L1YMONzlV1OgpoVejFjbgg-4xBCiZ9mjwlFCRTe0oAykRnQkx52Y7rn-w7reDCUoF-7XjhQGYp4ttUiOFFHRjmAsVtFsLdcLSP3uCtsIU7-Hk45hZdNXkbdFg44GSRNQNegtJYI-YB0qv4_5rr-zVEJV_MR6ZRbUYre2lFiIMtj44CRCkeGA9_kajJY0rcumT9SlbFkNcz8axUSoYKK_D-Eh_pWY4-y54P1FLB0xQ-mwPl28K-DNcO3vxinlnh54X-Xt2Vn3qPBPHSf0wtvb-ko8lzw_dcZmWOjt-ZX8KOBbz3OgBMg2kbP6re0o2aB73gGxHyzwVsuUPhjUg&token_type=Bearer&id_token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjdBOUMxMDA4REEzMzAwQTExMTYwQkQ1NUFEMUExOEFGQTQ3QzQ2QjEifQ.eyJhdF9oYXNoIjoiNkUySFpDZjcteHNNV0VmdXpwZDA4ZyIsInN1YiI6Im1pbG8iLCJhdWQiOiI1ZjY1ZmRkZS00NGUyLTRkMWMtYmUyYi00MWQ1ZTBkNmI5MDMiLCJhY3IiOiJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YWM6Y2xhc3NlczpQYXNzd29yZCIsImlkcGlkIjoiMGEyNWU2MGEtMWRkOS00ZWRjLWE4OGUtNTkyZjQ1MmJhMmE0IiwiYXV0aF90aW1lIjoxNjc5NDIzMTkzLCJpc3MiOiJodHRwczovL3Nzby5jb25uZWN0LnBpbmdpZGVudGl0eS5jb20vNWY2NWZkZGUtNDRlMi00ZDFjLWJlMmItNDFkNWUwZDZiOTAzIiwiZXhwIjoxNjc5NDIzNTY0LCJpYXQiOjE2Nzk0MjMyNjQsIm5vbmNlIjoiMTIzIiwiZW1haWwiOiJtY2FyYm9sK21pbG9AcGluZ2lkZW50aXR5LmNvbSJ9.TsL5pvTDf4dN67pAmFl2Wj2pXav_wMFSfW0T6zTaVRlOalkRbMM3X1l2niXEap8pd7aL8UB9uNTGpGraxErn5Y5quuMm9UhAtTPg0i3kKNPpB7aEx2givttdfvfzbDxap1lXo574u9AdrlCSrebb1pcMWGxiLSQ6tvCX5dpDJ1nfYME8J2kFzWMc856MW2USlDh04ZZuKS7OxaVDd2NP4TSuXihkccC8KKkmIe-4t25ibfPSmFM9K87HOPCzHcce_mbk5lOWZo7HpTgCcTN_kakOrCgJYFv3XWPZXsVi2ACWcYjcE4T23WOhUWU4a30kJ1hh32elLn_Td6OMad9u2w

If an id_token was included in the authorization request, the application validates the id_token returned.

For more information, see the OpendID Connect Core 1.0 specifications.
The application can also optionally validate the token (access token) returned.

Use the PingOne for Enterprise introspection endpoint returned by the Discovery URL https://sso.connect.pingidentity.com/sso/as/introspect.oauth2 to validate the access token.

For access tokens that are signed rather than encrypted, you can also use the JWKS URI returned by the Discovery URL https://sso.connect.pingidentity.com/sso/as/jwks.

You can see your access token settings at Applications > My Applications > OAuth Settings.

For more information, see Configuring your OAuth settings.