To complete the Dashboard's SSO authentication, configure the <pi_installation_path>/pingidentity/webgui/sso.properties file.
  1. To complete the Dashboard's SSO authentication, configure the <pi_installation_path>/pingidentity/webgui/sso.properties file. The following table describes the SSO properties.
    Property Mandatoy Description
    pi.webgui.sso.oidc.provider.issuer-uri Yes

    Configure the Issuer URI auto generate in PingOne for PingIntelligence Dashboard application.

    For more information, see step-6 in Configuring an OIDC Application in PingOne for PingIntelligence Dashboard.

    pi.webgui.sso.oidc.client.id Yes

    Configure the client ID. Make sure to configure the same value auto generated in PingOne for PingIntelligence Dashboard application. For more information, see step-6 in Configuring an OIDC Application in PingOne for PingIntelligence Dashboard.

    pi.webgui.sso.oidc.client.secret This is a required property only if the value of the property pi.webgui.sso.oidc.client.authentication-method is not set to NONE.

    Configure the client secret value in plain-text. Make sure to configure the same value auto generated in PingOne for PingIntelligence Dashboard application. For more information, see step-6 in Configuring an OIDC Application in PingOne for PingIntelligence Dashboard..

    pi.webgui.sso.oidc.client.authentication-method Yes
    Configure the PingOne OIDC application authentication method. The possible values are:
    • BASIC - Basic authentication header based client authentication
    • POST - Client credentials sent in POST body for authentication
    • NONE - Client does not authenticate itself
    The default value is BASIC.
    Note: If the Authentication method in the OIDC application created in PingOne is set to None, then use NONE for this property. If Authentication is set to Client Secret Basic, Client Secret Post use BASIC or POST.
    pi.webgui.sso.oidc.provider.user-uniqueid-claim-name Yes

    The value of this property should be sub. It defaults to the value of User ID in PingOne OIDC Attributes.

    pi.webgui.sso.oidc.provider.user-first-name-claim-name Yes

    The value of this property should be the PingOne OIDC Attribute value that holds the first name of the signed-on user.

    The default value for the claim is given_name.

    pi.webgui.sso.oidc.provider.user-last-name-claim-name Yes

    The value of this property should be the PingOne OIDC Attribute value that holds the last name of the signed-on user.

    The default value for the claim is family_name.

    pi.webgui.sso.oidc.provider.user-role-claim-name Yes

    The value of this property should be the PingOne OIDC Attribute value that holds the role of the signed-on user.

    The default value in Dashboard is role. Supported values for the Role claim are ADMIN and REGULAR.

    pi.webgui.sso.oidc.client.additional-scopes No

    Not applicable for PingOne SSO configuration

    The following is a sample snippet of sso.properties.

    
    #### PingIntelligence WebGUI SSO properties file
    # This is in standard java properties file format
    # comments are denoted by number sign (#) as the first non blank character
    # multiline values are ended with '\' as end of line
    							
    # OIDC Provider uri
    # WebGUI queries <issuer-uri>/.well-known/openid-configuration to get OIDC provider metadata
    # issuer ssl certificate is not trusted by default. So import issuer ssl certificate into config/webgui.jks
    # issuer should be reachable from both back-end and front-end
    pi.webgui.sso.oidc.provider.issuer-uri=https://auth.pingone.asia/7e49bb56-72f8-485d-810e-ae3d619ca670/as
    							
    							
    # OIDC Client id
    pi.webgui.sso.oidc.client.id=PingIntelligence
    							
    # OIDC Client secret
    # This can be empty
    pi.webgui.sso.oidc.client.secret=OBF:AES:BcB3MOE/K+VAa579oBpky4PrIo4z9LnI4vXsltqI=
    							
    							
    # OIDC Client authentication mode.
    # Valid values: BASIC, POST, and NONE
    pi.webgui.sso.oidc.client.authentication-method=BASIC
    							
    							
    # claim name for unique id of the user in UserInfo response
    # a new user is provisioned using this unique id value
    pi.webgui.sso.oidc.provider.user-uniqueid-claim-name=sub
    							
    							
    # claim name for first name of the user in UserInfo response
    # either first name or last name can be empty, but both should not be empty
    pi.webgui.sso.oidc.provider.user-first-name-claim-name=given_name
    							
    # claim name for last name of the user in UserInfo response
    # either first name or last name can be empty, but both should not be empty
    pi.webgui.sso.oidc.provider.user-last-name-claim-name=family_name
    							
    							
    # claim name for role of the user in UserInfo response
    # valid values for roles are ADMIN and REGULAR
    pi.webgui.sso.oidc.provider.user-role-claim-name=role
    							
    # additional scopes in authorization request
    # multiple scopes should be comma (,) separated
    # openid,profile scopes are always requested
    pi.webgui.sso.oidc.client.additional-scopes=exclusive
    							
Complete step 4- 6 Configuring SSO with PingOne.