--- title: Connecting OAuth 2.0 and OpenID Connect with PingAccess description: Sign on to your PingFederate administrative console. component: solution-guides page_id: solution-guides:data_and_application_security_use_cases:htg_connect_pf_pa_oidc_oauth2 canonical_url: https://docs.pingidentity.com/solution-guides/data_and_application_security_use_cases/htg_connect_pf_pa_oidc_oauth2.html llms_txt: https://docs.pingidentity.com/solution-guides/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: April 29, 2024 section_ids: steps: Steps --- # Connecting OAuth 2.0 and OpenID Connect with PingAccess ## Steps 1. Sign on to your PingFederate administrative console. 2. Enable OAuth 2.0 and OpenID Connect as described in [Configuring authorization server settings](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-103.pdf#page=488). Go to **Server Configuration → Server Settings → Roles & Protocols** and select **Enable OAuth 2.0 Authorization Server (AS) Role** and **OpenID Connect**. 3. Set up your IdP adapters for PingAccess. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Detailed steps differ by deployment. For more information, see [Managing IdP adapters](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-103.pdf#page=396). | 4. Configure scope values and scope descriptions for OAuth Authorization Server settings as described in [Defining Scopes](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-103.pdf#page=506) using the following values. | Scope Value | Scope Description | | ----------- | ----------------- | | **address** | address | | **email** | email | | **openid** | openid | | **phone** | phone | | **profile** | profile | | | | | - | ---------------------------------------------------------------------------------------- | | | In the **Default Scopes** field, enter a default scope description for your environment. | 5. Configure access token management for OAuth Authorization Server settings as described in [Configuring authorization server settings](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-103.pdf#page=488) using the following values. | Parameter | Value | | ----------------------------------- | --------------------------------------- | | **Instance Name** | GeneralAccessToken | | **Instance ID** | **GeneralAccessToken** | | **Type** | **Internally Managed Reference Tokens** | | **Instance Configuration** | Accept the defaults. | | **Session Validation** | | | **Access Token Attribute Contract** | **UserName** | | **Resource URIs** | Accept the defaults. | | **Access Control** | Accept the defaults. | 6. Configure your OpenID Connect policy as described in [Configuring OpenID Connect policies](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-103.pdf#page=587) using the following values. | Parameter | Value | | ------------------------------------------- | ---------------------- | | **Policy ID** | **OIDC** | | **Name** | **OIDC** | | **Access Token Manager** | **GeneralAccessToken** | | **Attribute Contract** | Accept the defaults. | | **Attribute Sources & Lookup** | Accept the defaults. | | **Contract Fulfillment Attribute Contract** | **sub** | | **Contract Fulfillment Source** | **Access Token** | | **Issuance Criteria** | Accept the defaults. | 7. Configure a PingAccess Resource Server OAuth client as described in [Configuring OAuth Clients](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-103.pdf#page=529) using the following values. | Parameter | Value | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Client ID** | **pa\_rs** | | **Name** | **PingAccess Resource Server** | | **Client Secret** | Generate a unique client secret. Although you can manually enter a client secret, allowing PingFederate to generate the secret provides better security. | | **Allowed Grant Types** | **Access Token Validation (Client is a Resource Server)** | | All other parameters | Accept the defaults. | 8. Configure a PingAccess Web Management OAuth client as described in [Configuring OAuth Clients](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-103.pdf#page=529) using the following values. | Parameter | Value | | --------------------------------- | ----------------------------------------------------------------------------------------------------- | | **Client ID** | **pa\_wam** | | **Name** | **PingAccess Web Management** | | **Client Authentication** | The client secret that you generated for the PingAccess Resource Server should fill in automatically. | | **Redirection URI** | https\://*\*:*\*/pa/oidc/cb | | **Bypass Authorization Approval** | **Bypass** | | **Allowed Grant Types** | **Authorization Code** | | All other parameters | Accept the defaults. | 9. Verify all client settings and click **Save** on the **Client Management** tab. 10. Configure your IdP adapters to work with OAuth as described in [Managing IdP adapter grant mapping](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-103.pdf#page=543) using the following values | Parameter | Value | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | **Source Adapter Instance** | Select the HTML Form adapter or adapters that you want to use for PingAccess. | | **Attribute Sources & User Lookup** | For each adapter, accept the defaults. | | **Contract Fulfillment** | For each adapter, select the adapter as your source and set your unique identifiers for **USER\_KEY** and **USER\_NAME**. | | **Issuance Criteria** | Accept the defaults. | 11. Map your address tokens for OAuth as described in [Managing access token mappings](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-103.pdf#page=564) using the following values. | Parameter | Value | | ----------------------------------- | ------------------------------------------------------------------------------------------------ | | **Attribute Sources & User Lookup** | Accept the defaults. | | **Contract Fulfillment** | For the username, select **Persistent Grant** as your source and set the value as **USER\_KEY**. | | **Issuance Criteria** | Accept the defaults. | 12. Verify your settings on the **Summary** tab, then click **Save**. 13. Export the SSL certificate to use for connecting securely with PingAccess as described in [Manage SSL server certificates](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-103.pdf#page=617).