About OpenID Connect (OIDC) with Persona
Persona supports acting as an OpenID Connect (OIDC) Identity Provider (IdP) authenticator.
This allows Identity and Access Management (IAM) solutions, such as PingOne, to call Persona for identity verification as part of authentication flows (e.g. authentication policies).
For example, your PingOne administrator could require identity verification before an employee can access sensitive applications (such as those containing production or financial data), or before an employee can complete an account management action like a password reset.
You'll need to configure the Authentications product feature to obtain the client ID and client secret used below.
PingOne Configuration Guide
Follow the steps below to configure Persona OIDC as an Identity Provider in PingOne.
1. Add Persona OIDC as an Identity Provider
In the PingOne admin console, navigate to:
- Integrations > External IdPs > + > Custom > OpenID Connect
General Settings
- Name:
Persona IDP(use a distinct name from “Persona IDV”)
OIDC Settings
- Client ID: obtain from Persona Dashboard in Authentications
- Client Secret: obtain from Persona Dashboard in Authentications
- Leave the remaining OIDC settings at their defaults.
Endpoints
Paste the discovery document below into the endpoints step; PingOne fetches it and autopopulates the rest of the form:
https://authenticate.withpersona.com/authenticate/oidc/.well-known/openid-configurationTo test using your sandbox environment, use the following instead: Openid Configuration
If you’d rather enter the endpoints individually, use the values below:
Save the identity provider once the form is filled in, then enable it from the External IdPs list.
2. Update Authentication Policies
Navigate to:
- Authentication > Policies > Authentication
- Create a new policy or edit an existing one, and add an External Identity Provider step.
- Select Persona IDP as the identity provider for that step.
To preserve administrator access in case Persona IDP is unavailable, exclude at least one admin or group from the policy, or otherwise scope the step so it doesn’t apply to your break-glass account.
For testing, go to Applications > Applications and assign your policy to an app.
3. Configure Persona Marketplace Integration for Employee Data
Context
To match IDV results to PingOne profiles, Persona requires API access to your PingOne environment.
The only data PingOne passes about the user during OIDC authentication is their username, which will be the email address they used to sign in. By default, this will be recorded in the Persona account as its Reference ID.
The Persona Marketplace Integration can retrieve additional attributes such as first and last name by looking up the PingOne user using the provided username.
Steps
- Follow the Help Center guide
- Add your PingOne credentials in the Persona Dashboard
- Notify your Persona account team so they can finalize setup and enable profile comparison
What gating an application does
PingOne’s External Identity Provider policy step is assigned per application, so what it requires of your employees depends on which app you assign it to:
- Gating the PingOne Self-Service app requires Persona IDV to be completed for account management actions, such as a password reset.
- Gating any other app requires Persona IDV to be used as an authentication factor before employees can access that app.