1. Click Identity Provider > Adapters to open the Manage IdP Adapter Instances screen.
  2. On the Manage IdP Adapter Instances screen, click Create New Instance to start the Create Adapter Instance configuration wizard.
  3. On the Type screen, configure the basics of this adapter instance.
    1. Enter the required information and select the adapter type from the list.
    2. Optional: Select a Parent Instance from the list.
      This is useful when you are creating an instance that is similar to an existing instance. The child instance inherits the configuration of its parent. In addition, you have the option to override one or more settings during the rest of the setup. Select the Override ... check box and make the adjustments as needed in one or more subsequent screens.
  4. On the IdP Adapter screen, configure your OpenToken IdP Adapter instance.

    These values are dependent on your developer's implementation.

    Refer to the on-screen field descriptions and the following table for more information.

    Field Description

    Confirm Password


    The password to use for generating the encryption key. It is also known as the shared secret.
    Authentication Service


    The URL to which the user is redirected for an SSO event. This URL is part of an external application, which performs user authentication.

    Click Show Advanced Fields to review the following settings. Modify as needed.

    Transport Mode How the token is transported to and from the application, either via a query parameter, a cookie (default), or as a form POST.
    Token Name


    The name of the cookie or query parameter that contains the token. This name must be unique for each adapter instance. Override the default value (opentoken) as needed.
    Cipher Suite The algorithm, cipher mode, and key size that should be used for encrypting the token. The default selected value is AES-128/CBC.
    Logout Service The URL to which the user is redirected for a single-logout event. This URL is part of an external application, which terminates the user session.
    Cookie Domain The server domain; for example, example.com. If no domain is specified, the value is obtained from the request.
    Cookie Path The path for the cookie that contains the token.
    Token Lifetime


    The duration (in seconds) for which the token is valid. Valid range is 1 to 28800. The default value is 300 (5 minutes).
    Session Lifetime


    The duration (in seconds) for which the token may be re-issued without authentication. Valid range is 1 to 259200. The default value is 43200 (12 hours).
    Not Before Tolerance


    The amount of time (in seconds) to allow for clock skew between servers. Valid range is 0 to 3600. The default value is 0.
    Force SunJCE Provider If selected, the SunJCE provider is forced for encryption and decryption.
    Use Verbose Error Messages If selected, use verbose TokenException messages.
    Obfuscate Password If selected (the default), the password is obfuscated and password-strength validation is applied. Clearing the check box allows backward compatibility with previous OpenToken agents.
    Session Cookie If selected, OpenToken is set as a session cookie (rather than a persistent cookie). Applies only if the Transport Mode field is set as Cookie. The check box is not selected by default.
    Secure Cookie If selected, the OpenToken cookie is set only if the request is on a secure channel (https). Applies only if the Transport Mode field is set to Cookie. The check box is not selected by default.
    Delete Cookie If selected, the token cookie is deleted immediately after consumption. Applies only if the Transport Mode field is set to Cookie. The check box is not selected by default.
    Replay Prevention Selecting this option is recommended only if Query Parameter is the chosen token transport mode and form POST is used by an associated connection to send the SAML assertion. If selected, PingFederate ensures that the token can be used only once. The check box is not selected by default.

    Selecting this option may affect resource utilization and performance.

    Skip Malformed Attribute Detection If not selected (the default), it prevents insecure content from affecting the security of your application and the agent. We recommend to update your applications with the latest version of the agent. We recommend not to change the value of this flag.
  5. On the Actions screen, click Download under Action Invocation Link, and then click Export to save the properties file.
    The values in the resulting file, agent-config.txt, represent the console configuration and are used by the IdP application. Refer to the documentation of your respective integration kit for more information.
  6. On the Extended Contract screen, configure additional attributes for this adapter instance as needed.
    The OpenToken IdP Adapter contract includes one core attribute: subject.

    Note that the OpenToken IdP Adapter always extends the core contract with an attribute userId as well and fulfills it with the value of subject for backward compatibility reason.

  7. On the Adapter Attributes screen, configure the pseudonym and masking options.

    The Override Attributes check box in this screen reflects the status of the override option in the Extended Contract screen.

    1. Select the check box under Pseudonym for the user identifier of the adapter and optionally for the other attributes, if available.
      This selection is used if any of your SP partners use pseudonyms for account linking.

      A selection is required regardless of whether you use pseudonyms for account linking. This allows account linking to be used later without having to delete and reconfigure the adapter. Ensure that you choose at least one attribute that is unique for each user (for example, email) to prevent the same pseudonym from being assigned to multiple users.

    2. Select the check box under Mask Log Values for any attributes that you want PingFederate to mask their values in its logs at runtime.
    3. Select the Mask all OGNL-expression generated log values check box, if OGNL expressions might be used to map derived values into outgoing assertions and you want those values masked
  8. Optional: On the Adapter Contract Mapping screen, configure the adapter contract for this instance with the following optional workflows:
    • Configure one or more data sources for datastore queries.
    • Fulfill adapter contract with values from the adapter (the default), datastore queries (if configured), context of the request, text, or expressions (if enabled).
    • Set up the Token Authorization framework to validate one or more criteria prior to the issuance of the adapter contract.
  9. On the Summary screen, review your configuration, modify as needed, and click Done to exit the Create Adapter Instance workflow.
  10. On the Manage IdP Adapter Instances screen, click Save to retain the configuration of the adapter instance.
    If you want to exit without saving the configuration, click Cancel.