Most OAuth and OpenID Connect use cases require the client application to authenticate successfully before its requests can be processed further.

As an OAuth AS, PingFederate supports the following client authentication schemes:

  • Client secret for HTTP Basic authentication.
  • Client TLS certificate for mutual TLS authentication.
  • Private key JWT for the private_key_jwt client authentication method, as defined in the OpenID Connect specification.
  • None when authentication is not required.

When deployed as an OpenID Connect Relying Party (RP), PingFederate can authenticate via client secret and private key JWT. It can also handle the scenario where authentication is not required.