---
title: Configuring PingAccess to protect a web application
description: Add your PingFederate server certificate under Trusted Certificate Groups as described in Importing certificates and create a trusted certificate group.
component: solution-guides
page_id: solution-guides:data_and_application_security_use_cases:htg_connect_pf_pa_oidc_web_app
canonical_url: https://docs.pingidentity.com/solution-guides/data_and_application_security_use_cases/htg_connect_pf_pa_oidc_web_app.html
llms_txt: https://docs.pingidentity.com/solution-guides/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: April 29, 2024
section_ids:
  steps: Steps
---

# Configuring PingAccess to protect a web application

## Steps

1. Add your PingFederate server certificate under **Trusted Certificate Groups** as described in [Importing certificates and create a trusted certificate group](https://cdn-docs.pingidentity.com/archive/pdf/pingaccess/pingaccess-63.pdf#page=519).

2. Configure PingFederate runtime settings as described in [Configuring the token provider](https://cdn-docs.pingidentity.com/archive/pdf/pingaccess/pingaccess-63.pdf#page=520) using the following values.

   | Parameter                     | Value                                                              |
   | ----------------------------- | ------------------------------------------------------------------ |
   | **Host**                      | Enter your PingFederate host name.                                 |
   | **Port**                      | Enter your PingFederate port number.                               |
   | **Secure**                    | **Yes**                                                            |
   | **Trusted Certificate Group** | Select the group to which you added your PingFederate certificate. |
   | All other parameters          | Accept the defaults.                                               |

3. Configure PingFederate administration settings as described in [Configuring the token provider](https://cdn-docs.pingidentity.com/archive/pdf/pingaccess/pingaccess-63.pdf#page=520) using the following values.

   | Parameter                     | Value                                                              |
   | ----------------------------- | ------------------------------------------------------------------ |
   | **Host**                      | Enter your PingFederate host name.                                 |
   | **Port**                      | Enter your PingFederate port number.                               |
   | **Admin Username**            | Enter the login name for your PingFederate administrator.          |
   | **Admin Password**            | Enter the password for your PingFederate administrator.            |
   | **Secure**                    | **Yes**                                                            |
   | **Trusted Certificate Group** | Select the group to which you added your PingFederate certificate. |
   | All other parameters          | Accept the defaults.                                               |

4. Configure PingFederate OAuth server settings as described in [Configuring the token provider](https://cdn-docs.pingidentity.com/archive/pdf/pingaccess/pingaccess-63.pdf#page=520) using the following values.

   | Parameter                  | Value                     |
   | -------------------------- | ------------------------- |
   | **Client ID**              | **pa\_rs**                |
   | **Client Secret**          | Enter your client secret. |
   | **Subject Attribute Name** | **UserName**              |
   | All other parameters       | Accept the defaults.      |

5. Go to **Main → Sites → Sites** to add a site for PingFederate to protect.

   Detailed steps differ by deployment. For more information, see [Adding sites](https://cdn-docs.pingidentity.com/archive/pdf/pingaccess/pingaccess-63.pdf#page=256).

6. Add an identity mapping for your site as described in [Creating JWT identity mappings](https://cdn-docs.pingidentity.com/archive/pdf/pingaccess/pingaccess-63.pdf#page=304) using the following values.

   | Parameter            | Value                                                                                            |
   | -------------------- | ------------------------------------------------------------------------------------------------ |
   | **Name**             | Enter a name for the identity mapping.                                                           |
   | **Type**             | Select **Header Identity Mapping**, and create a sub attribute with a header name of **X-USER**. |
   | All other parameters | Accept the defaults.                                                                             |

7. Add a web session for your site as described in [Creating web sessions](https://cdn-docs.pingidentity.com/archive/pdf/pingaccess/pingaccess-63.pdf#page=308) using the following values.

   | Parameter                     | Value                                    |
   | ----------------------------- | ---------------------------------------- |
   | **Name**                      | Enter a name for your web session.       |
   | **Cookie Type**               | **Encrypted JWT**                        |
   | **Audience**                  | **global**                               |
   | **OpenID Connect Login Type** | **Code**                                 |
   | **Client ID**                 | **pa\_wam**                              |
   | **Client Secret**             | Enter your organization's client secret. |
   | All other parameters          | Accept the defaults.                     |

8. Add an application to protect within the site as described in [Adding application resources](https://cdn-docs.pingidentity.com/archive/pdf/pingaccess/pingaccess-63.pdf#page=245).

9. Enable your application.