# Configure Persona as an Authentication Method in PingOne

> Add Persona as an OIDC identity provider in PingOne so authentication policies can require identity verification, with endpoints and policy setup steps.

Source: https://help.withpersona.com/articles/v3YUtVIxhlimNj47wKV7k2/
Section: Marketplace and 3rd-Party Integrations > Authentication > PingOne

## About OpenID Connect (OIDC) with Persona

Persona supports acting as an [OpenID Connect](https://openid.net/) (OIDC) Identity Provider (IdP) authenticator.

This allows Identity and Access Management (IAM) solutions, such as [PingOne](https://www.pingidentity.com/en/platform.html), to call Persona for identity verification as part of authentication flows (e.g. authentication policies).

For example, your PingOne administrator could require identity verification before an employee can access sensitive applications (such as those containing production or financial data), or before an employee can complete an account management action like a password reset.

ℹ️

<p>
  You'll need to configure the{' '}
  <a href="/articles/1Acdx2QDfwgE1q3DTVPqW4/">Authentications product feature</a> to obtain the
  client ID and client secret used below.
</p>

## PingOne Configuration Guide

Follow the steps below to configure Persona OIDC as an Identity Provider in PingOne.

### 1\. Add Persona OIDC as an Identity Provider

In the PingOne admin console, navigate to:

- **Integrations > External IdPs > + > Custom > OpenID Connect**

#### General Settings

- **Name:** `Persona IDP` (use a distinct name from “Persona IDV”)

#### OIDC Settings

- **Client ID:** _obtain from Persona Dashboard in Authentications_
- **Client Secret:** _obtain from Persona Dashboard in Authentications_
- Leave the remaining OIDC settings at their defaults.

#### Endpoints

Paste the discovery document below into the endpoints step; PingOne fetches it and autopopulates the rest of the form:

```text
https://authenticate.withpersona.com/authenticate/oidc/.well-known/openid-configuration
```

To test using your sandbox environment, use the following instead: [Openid Configuration](https://authenticate.withpersona.com/authenticate/oidc-sandbox/.well-known/openid-configuration)

If you'd rather enter the endpoints individually, use the values below:

| Endpoint      | URL                                                              |
| ------------- | ---------------------------------------------------------------- |
| Issuer        | https://authenticate.withpersona.com/authenticate/oidc           |
| Authorization | https://authenticate.withpersona.com/authenticate/oidc/authorize |
| Token         | https://authenticate.withpersona.com/authenticate/oidc/token     |
| JWKS          | https://authenticate.withpersona.com/authenticate/oidc/jwks      |
| Userinfo      | https://authenticate.withpersona.com/authenticate/oidc/userinfo  |

Save the identity provider once the form is filled in, then enable it from the External IdPs list.

## 2\. Update Authentication Policies

Navigate to:

- **Authentication > Policies > Authentication**
- Create a new policy or edit an existing one, and add an **External Identity Provider** step.
- Select **Persona IDP** as the identity provider for that step.

To preserve administrator access in case Persona IDP is unavailable, exclude at least one admin or group from the policy, or otherwise scope the step so it doesn't apply to your break-glass account.

For testing, go to **Applications > Applications** and assign your policy to an app.

## 3\. Configure Persona Marketplace Integration for Employee Data

### Context

To match IDV results to PingOne profiles, Persona requires API access to your PingOne environment.

The only data PingOne passes about the user during OIDC authentication is their **username**, which will be the email address they used to sign in. By default, this will be recorded in the Persona account as its Reference ID.

The Persona Marketplace Integration can retrieve additional attributes such as first and last name by looking up the PingOne user using the provided username.

### Steps

1.  Follow the [Help Center guide](https://help.withpersona.com/articles/3iqmK81Kb6LSLhvpaiqhtC/)
2.  Add your PingOne credentials in the Persona Dashboard
3.  Notify your Persona account team so they can finalize setup and enable profile comparison

## What gating an application does

PingOne's External Identity Provider policy step is assigned per application, so what it requires of your employees depends on which app you assign it to:

- Gating the **PingOne Self-Service** app requires Persona IDV to be completed for account management actions, such as a password reset.
- Gating any other app requires Persona IDV to be used as an authentication factor before employees can access that app.

## Plans Explained

### PingOne Integration by plan

|                     | Startup Program | Essential Plan | Growth Plan | Enterprise Plan |
| ------------------- | --------------- | -------------- | ----------- | --------------- |
| PingOne Integration | Not Available   | Not Available  | Limited     | Available       |

[Learn more about pricing and plans](https://withpersona.com/pricing?utm_source=product&utm_medium=referral&utm_audience=a&utm_campaign=cm_gen_ds_hc-plan-table).