Configuring access token mapping - PingFederate - 11.2

PingFederate Server

bundle
pingfederate-112
ft:publication_title
PingFederate Server
Product_Version_ce
PingFederate 11.2
category
Administrator
Administratorguide
Audience
Capability
ContentType
DeploymentMethod
Guide
Product
Productdocumentation
SingleSignonSSO
Software
SystemAdministrator
pf-112
pingfederate
ContentType_ce
Guide
Guide > Administrator Guide
Product documentation

Map your policy contract context to the JWT access token manager.

  1. Go go Applications > OAuth > Access Token Mappings.
  2. On the Access Token Mappings page in the Context menu, select your policy contract.
  3. In the Access Token Manager menu, select your JWT ATM.
  4. Click Add Mapping.
  5. On the Attribute Sources & User Lookup tab, click Next.
  6. On the Contract Fulfillment tab, select a Source and a Value to map into the admin_role, iss, memberOf, and sub attributes in the Contract list.
    Screen capture of the Contract Fulfillment tab, on which you select a source and a value to map into the admin_role, iss, memberOf, and sub attributes.
    1. For the admin_role attribute, select Expression in the Source menu and, in the Value field, enter the following expression:
      #filter1 = "^pf_admins.*",
      #filter2 = "^pf_cryptoadmins.*",
      #filter3 = "^pf_useradmins.*",
      #role1 = "admin",
      #role2 = "cryptoadmin",
      #role3 = "useradmin",
      #role4 = "expressionadmin",
      
      #outboundattribute = new java.util.ArrayList(),
      
      #groups = #this.get("apc.memberOf")!=null?#this.get("apc.memberOf").getValues():{},
      
      #i = 0,
      
      #groups.{
      #group = #this,
      #group = new javax.naming.ldap.LdapName(#groups[#i]),
      #cn = #group.getRdn(#group.size() - 1).getValue().toString(),
      
      #cn.matches(#filter1)?#outboundattribute.add(#role1):null,
      #cn.matches(#filter1)?#outboundattribute.add(#role4):null,
      #cn.matches(#filter2)?#outboundattribute.add(#role2):null,
      #cn.matches(#filter3)?#outboundattribute.add(#role3):null,
      
      #i = #i + 1},
      
      #outboundattribute.size() > 0 ? new org.sourceid.saml20.adapter.attribute.AttributeValue(#outboundattribute):null
      Note:

      This example OGNL expression gets the memberOf value from the policy contract, looks for group distinguished name (DN)distinguished name (DN)DN A name uniquely identifying an object within the hierarchy of a directory tree. that match the filters, and assigns a role when a filter is matched. In the expression, anyone that is in the Admins group is assigned both the Admin and Expression Admin role, because the Expression Admin role requires the Admin role assignment. Using this expression to map roles allows you to control access with groups from your identity provider's data source. Match your filter values in the expression to the group names created in your LDAP directory to assign those roles.

    2. For the iss attribute, select Text in the Source menu, and enter a text string in the Value field.
      Note:

      Make a note of the text string. The value entered here is the issuer claim value and should identify the organization as the issuer.

    3. For the memberOf attribute, select Authentication Policy Contract in the Source menu, and memberOf in the Value menu.
    4. For the sub attribute, select Persistent Grant in the Source menu, and USER_KEY in the Value menu.
    5. Click Next.
  7. On the Issuance Criteria tab, click Next.
  8. On the Summary tab, review your mappings. Click Save.