If you chose OIDC mode when you set up the PingAuthorize Policy Editor, you must configure an OIDC provider, such as PingFederate or PingOne, to accept sign-on requests from the PingAuthorize Policy Editor.

If you're using another OIDC provider, see the provider's documentation for specific client configuration steps. The following steps show the general procedure:

  1. Use the following configuration values to create an OAuth 2 client that represents the PingAuthorize Policy Editor.
    OAuth 2 client configuration Configuration value

    Client ID


    Redirect URI


    Grant type

    Authorization Code with PKCE

    Response type



    • openid
    • email
    • profile

    Refresh tokens


    Client authentication on the token endpoint


    The Policy Editor doesn't have access to the client secret and doesn't send credentials to the token endpoint.

    Return ID token on refresh grant


    Always re-roll refresh tokens



    When an authentication token expires, the Policy Editor performs a silent renewal, triggering a background process to retrieve a new token from the OIDC provider. For this process to work, you must configure your OIDC provider to issue refresh tokens in the following manner:

    • Issue an id_token as part of the refresh grant.
    • Re-roll the refresh token after each use. The Policy Editor will not use refresh tokens more than once.

    Because these constraints apply to silent renewal, a misconfiguration of the previous items will still allow you to sign on. After your token expires, though, the application will eject you from your session and redirect you to the sign-on screen. This could cause you to lose unsaved changes in the Policy Editor.

  2. Configure the access tokens and ID tokens issued for the OAuth 2 client with the following claims:
    • sub
    • name
    • email
  3. Configure the OIDC provider to accept a cross-origin resource sharing (CORS) origin that matches the PingAuthorize Policy Editor's scheme, public host, and port, such as https://<host>:<port>.
  4. Configure the OIDC provider to issue tokens to the PingAuthorize Policy Editor only when the authenticated user is authorized to administer policies according to your organization's access rules.

    Sign the tokens with a signing algorithm of RSA using SHA-256.

    For PingFederate, this level of authorization is controlled with issuance criteria. For more information, see the PingFederate documentation.