About PingOne External Identity Providers
PingOne supports external identity providers. An external identity provider is a third-party provider that authenticates users in a PingOne environment. An authentication policy can include an External Identity Provider step. PingOne can then call a third-party provider, for example Persona, during authentication through OpenID Connect (OIDC).
When Persona is an external identity provider, your PingOne administrator can require a live identity verification. The employee must complete it before they can access sensitive applications, for example applications with production or financial data. The administrator can also require it before an account management action, for example a password reset. This helps to protect your workforce against social engineering, deepfakes, and account takeover at the most important moments.
Configure the Authentications product feature to get the client ID and client secret that you use below.
PingOne Configuration Guide
Do the steps below to configure Persona OIDC as an Identity Provider in PingOne.
1. Configure the Persona authentication template
In the Persona Dashboard, open your authentication template. Add the PingOne callback URL to its allowed redirect URIs:
- Allowed redirect URIs: The PingOne callback URL. When you add the identity provider in the next step, PingOne shows the exact value as the Callback URL in the connection details. The format is
https://auth.pingone.com/<environment ID>/rp/callback/openid_connect.<environment ID>is the ID of your PingOne environment.
2. Add Persona OIDC as an Identity Provider
In the PingOne admin console, navigate to:
- Integrations > External IdPs > + > Custom > OpenID Connect
General Settings
- Name:
Persona IDP(use a name that is different from “Persona IDV”)
OIDC Settings
- Client ID: get from Persona Dashboard in Authentications
- Client Secret: get from Persona Dashboard in Authentications
- Keep the default values for the other OIDC settings.
Endpoints
Paste the discovery document below into the endpoints step. PingOne gets it and automatically fills the rest of the form:
https://authenticate.withpersona.com/authenticate/oidc/.well-known/openid-configurationTo test with your sandbox environment, use this configuration instead: Openid Configuration
If you want to enter each endpoint manually, use the values below:
After you complete the form, save the identity provider. Then enable it from the External IdPs list.
3. Update Authentication Policies
Go to:
- Authentication > Policies > Authentication
- Create a new policy or edit an existing one. Add an External Identity Provider step.
- Select Persona IDP as the identity provider for that step.
Exclude at least one admin or group from the policy. As an alternative, set the scope of the step so it does not apply to your break-glass account. This keeps administrator access if Persona IDP is not available.
For tests, go to Applications > Applications and assign your policy to an app.
You assign the PingOne External Identity Provider policy step to each application. Thus, what the step requires of your employees depends on the app that you assign it to:
- If you protect the PingOne Self-Service app, employees must complete Persona IDV for account management actions, for example a password reset.
- If you protect a different app, employees must use Persona IDV as an authentication factor before they can access that app.
4. Configure Persona Marketplace Integration for Employee Data
Context
Persona requires API access to your PingOne environment to match IDV results to PingOne profiles.
During OIDC authentication, PingOne sends only the username of the user. This is the email address that the user signed in with. By default, Persona records it in the Persona account as the Reference ID.
The Persona Marketplace Integration uses this username to find the PingOne user. It can then get more attributes, for example first and last name.
Steps
- Do the steps in the Help Center guide.
- Add your PingOne credentials in the Persona Dashboard.
- Notify your Persona account team so they can finalize setup and enable profile comparison.
Related resources
- PingOne integration overview
- Using Persona Workflows to manage PingOne users, groups & populations
- How to configure Persona Authentications with OpenID Connect
- PingOne: External IdPs
- PingOne: Adding an identity provider - OIDC
Plans Explained
PingOne Integration by plan
| Startup Program | Essential Plan | Growth Plan | Enterprise Plan | |
|---|---|---|---|---|
| PingOne Integration | Not Available | Not Available | Limited | Available |