When creating a Access Token Validator in PingDirectory Server, use the pingdirectory client ID and secret. PingDirectory Server uses an identity mapper to match the sub claim against the entryUUID attribute.

To configure PingDirectory Server as the token validator, perform the following steps:

  1. Sign on to the PingFederate administrative console.
  2. Go to APPLICATIONS > OAuth > Clients.
  3. Click Add Client.
  4. For both the Client ID and Name, specify pingdirectory.
  5. In the CLIENT AUTHENTICATION section, select CLIENT SECRET.
  6. In the CLIENT SECRET section, select CHANGE SECRET and then type or generate a secret.
  7. Copy the secret key.
  8. In the ALLOWED GRANT TYPES section, select Access Token Validation (Client is a Resource Server).
  9. Set DEFAULT ACCESS TOKEN MANAGER to Default.
  10. Click Save.