# OpenID Connect (OIDC) Integration

Follow the steps documented below to integrate your Org with an OIDC-compliant Identity Provider (IdP) such as Ping for Single Sign On (SSO).

Important

Only users with "Organization Admin" privileges can configure SSO in the Web Console.

---

## Step 1: Create IdP in Web Console
- Log in to the **Web Console** as an **Organization Admin**.
- Navigate to **System → Identity Providers**.
- Click **New Identity Provider**.
- In the **IdP Configuration** tab, provide a **unique name** for the Identity Provider.
- Optionally, enter a **description** for reference.
- Select **OIDC** as the **Authentication Type**.
- Choose **Ping** as the **Provider Name**.
- Enter the **Domain** associated with the organization (for example, `mycompany.com`).
- Provide an **Admin Email ID** (for example, `admin@mycompany.com`).
- Provide a **Client ID**

The remaining fields: **Client Secret**, **OP Domain URL**, and **Group Attribute Name** must be populated after configuring the corresponding Ping application and retrieving these details from Ping.

Once these values are available, return to this page, complete the remaining fields, and then proceed with the setup.

Important

- Within an organization, both the **IdP Name** and **Domain** must be unique. A domain used in one organization can be reused in a different organization.
- The `Domain` and **Admin Email domain** must match. For example, if the domain is `mycompany.com`, the admin email should also belong to the same domain (e.g., `admin@mycompany.com`).

After completing the IdP configuration steps, the **Redirect URL** is generated in the Web Console. This Redirect URL must be added in the Ping Valid Redirect URIs field when creating the OIDC client.

---

## Step 2: Configure Ping App
- Login into the **Ping** console as an **Administrator**
- In the Ping Identity console, navigate to an existing environment or click on **Environment +** button to create a new one.

- Select **Create a Customer Solution** and click **Next**

- This page displays the list of available PingOne services that can be deployed as part of the environment. Click **Next** to continue.

- Provide a name for the environment, complete the required details, and click **Finish**.

- The newly created environment appears in the list. Select the environment and click **Manage Environment**.

- Inside the environment, navigate to **Applications**, where the list of default applications is displayed.
- Click **Application +** to create a new application and provide a name.
- Select **OIDC Web App** and click **Save**.

- Once saved, the application configuration becomes available, including the client ID, client secret, and other connection details.

## Step 3: Capture Client Credentials
- Enable or disable the OIDC application in the IdP by using the toggle next to the application name
- Retrieve the **Client ID**, **Client Secret**, and **OP Domain URL** (Issuer ID) from the PingOnce Config section, as shown below.

> 🚨 **Important:** Ensure that the **OP Domain URL** includes the protocol prefix — `http://` or `https://` — to make it a valid URL. The process cannot proceed without a properly formatted URL.

> **Note**: The OIDC discovery endpoint is also available in the connection details.

- Copy/paste those details into the Console and provide the **Group Attribute Name**.
- Click **Update & Continue**.

- From the SP Configuration page, copy the **Redirect URL** from the console

- Paste the URL in the PingOne **Application -> Configuration** page
- Select the **Token Endpoint Authentication Method** to `Client Secret Post`, since the `client ID` and `Client Secret` are sent through the POST method.
- Click **Save**.

Once saved, the OIDC app is configured in PingOne.

---

## Step 5: Webhook Configuration (Optional)
In the Web Console, configure the webhook if required, and click **Save & Exit**.

Once the configuration is complete, a verification email is sent to the admin email ID specified on the IdP Configuration page. Complete the verification before users can log in with OIDC

> **Note**: On successful configuration, create a user and assign the user to the appropriate group in the IdP application.

---

## Troubleshooting
### Scenario 1: Missing Required Scopes or Group Attribute Mapping in PingOne
The IdP is configured in the Web Console, and the OIDC application is created in PingOne. However, required scopes such as email, profile, or the group attribute name configured in the Rafay console are not enabled or mapped in the PingOne application.

**_Resolution_**
- Open the **Application** in PingOne.
- Navigate to the **Scope** tab and edit the **Allowed Scopes**.
- Enable the **email** and **profile** scopes.
- Click **Save** to apply the changes.

If the group attribute name does not match between PingOne and the Web Console (as configured in Step 1), group-based access and role mapping will fail during authentication.
- Navigate to **Attribute Mappings**.
- Add or edit the **group attribute name** to match the value configured in the Rafay console.
- Map the attribute to **Group Names**.
- Click **Save**.