# Ping Identity

Learn how to configure Ping Identity as an identity provider (IdP) to work with Pomerium.

While we do our best to keep our documentation up to date, changes to third-party systems are outside of our control. Refer to [Adding an application](https://docs.pingidentity.com/r/en-us/pingone/p1_add_app_worker) from Ping's documentation as needed, or [let us know](https://github.com/pomerium/documentation/issues/new?assignees=\&labels=\&template=doc-error.md) if we need to update this page.

## Before you start

To complete this guide:

- Install [Pomerium](https://www.pomerium.com/docs/get-started/quickstart.md).
- Create a free [PingOne account](https://www.pingidentity.com/en/try-ping.html). (This guide uses a [PingOne for Workforce](https://www.pingidentity.com/en/platform/solutions/pingone-for-workforce.html) account.)

## Configure PingOne

After creating a PingOne account and signing in, you'll be directed to the PingOne console.

### Create an OIDC web app

In the PingOne console:

1. From the **Applications** sidebar menu, select **Applications** and create a new application (**+**).
2. Enter an **Application Name** and an optional description or logo.
3. Select **OIDC web app** and **Save**.

\[Create a new OIDC web app in the PingOne console]

### Configure the OIDC web app

To configure your OIDC web app:

1. Select the **Configuration** tab, then select the edit icon.
2. In the **Redirect URIs** field, enter your [authenticate service URL](https://www.pomerium.com/docs/reference/service-urls.md#authenticate-service-url) with the `/oauth2/callback` path appended to it.
3. Select **Save**.

\[Entering the Pomerium authenticate service URL with the oauth2 callback path in PingOne console]

Next, configure attribute mappings:

1. Select the **Attribute Mappings** tab, then select the edit icon.
2. Select **+Add**.
3. In the **Attributes** field, enter **email**.
4. In the **PingOne Mappings** dropdown menu, select **Email Address**.
5. Select **Save**.

\[Entering attribute mappings in PingOne]

Enable the OIDC web app with the toggle button:

\[Enable the OIDC web app in the Ping console]

Save the following details from the **Configuration** tab (you need these to configure Pomerium):

- **Client ID**
- **Client Secret**
- **Issuer** URL

## Configure Pomerium

Update your Pomerium configuration to use Ping as the IdP:

**Zero:**

\[Configuring PingOne as and IdP in Pomerium Zero]

**Core:**

```yaml
idp_provider: 'ping'
idp_provider_url: 'https://auth.pingone.com/720dbe8a-83ed-48e1-9988-9928301ae668/as'
idp_client_id: 'CLIENT_ID'
idp_client_secret: 'CLIENT_SECRET'
```

**Enterprise:**

See [Groups - Directory Sync](#configure-groups) below for Enterprise configuration steps.

## Configure Groups

**Custom Claim (Zero, Core):**

### Custom Claim (Zero, Core)

A `groups` claim can be added to tokens returned from Ping by adding the claim to the "Attribute Mappings":

\[Ping Attribute Mappings]

Now, when a user signs in their token will include a custom `groups` claim that contains groups they are a member of. You can use the `claim` PPL criterion in your authorization policy:

```yaml
allow:
  and:
    - claim/groups: 49dfb9e6-f81f-4a1c-b4a3-d0122ebe4aab
```

The `groups` claim contains group IDs, not group names.

**Directory Sync (Enterprise):**

### Directory Sync (Enterprise)

[Directory Sync](https://www.pomerium.com/docs/integrations/user-standing/directory-sync.md) is a feature available only in Pomerium Enterprise.

#### Create a Ping Worker application

In order for Pomerium to validate group membership, you need to configure a [Worker application](https://docs.pingidentity.com/pingone/applications/p1_edit_application_worker.html).

In the PingOne console:

1. From the **Applications** sidebar menu, select **Applications** and create a new application (**+**).
2. Enter an **Application Name** and an optional description or logo.
3. Select **Worker** and **Save**.

\[Add a Worker app in PingOne]

In the **Overview** tab, save the following configuration details:

- **Client ID**
- **Client Secret**
- **Environment ID**

#### Configure Pomerium Enterprise Console

In the Enterprise console:

1. Select **Settings**.
2. Select **Identity Providers**.
3. Select **Ping** and enter the Client ID, Client Secret, and Environment ID.

\[Configuring Ping IdP in Pomerium Enterprise]