Ping SSO Configuration with OIDC

[stevenGravy]

Prerequisites:

• Existing Enterprise or Enterprise Cloud Teleport cluster
• PingIdentity admin access
• Users registered (recommend in groups)

Create OIDC Application in PingIdentity

1. Create OIDC Web Application under Connections -> Applications in pingone.com console.
2. Set the Token Auth Method as “Client Secret Post”
3. Set the Redirect URI with the Teleport dns address ex: https://teleport.example.com/v1/webapi/oidc/callback
4. Add Attributes and modify sub to Email Address. Include groups for mapping.

5. Enable OIDC Application
6. Confirm you have users with group assigned

Configure Teleport Auth Connector

Below is a sample Auth Connector YAML. Under management in the Web UI create
a new OIDC auth connector. Follow these steps to configure it.

1. Within the Web UI Go to Management -> Auth Connectors. Start creating a OIDC Auth Connector.
2. Replace the client_id and client_secret with the Ping OIDC Application values
3. Populate the issuer_url with Issuer URL from the Ping OIDC Application value.
4. Set provider: ping
5. Set prompt: none
6. Update the value to the user group.
7. Set scopes to openid and groups
8. Save

kind: oidc
metadata:
  name: pingoidc
spec:
  claims_to_roles:
  - claim: groups
    roles:
    - editor
    - auditor
    - access
    value: teleport
  client_id: <client-id>
  client_secret: <secret>
  display: Ping
  issuer_url: https://auth.pingone.com/12345/as
  prompt: none
  provider: ping
  redirect_url: https://teleport.example.com/v1/webapi/oidc/callback
  scope:
  - openid
  - groups
version: v2

Attempt to log in

Use Other sign in options on the Login page and choose Ping. You should log in if the values match or
you may need to review the audit log.

Check the Audit Logs and other troubleshooting as described here with any problems. https://goteleport.com/docs/access-controls/sso/#troubleshooting

If you want to make OIDC the default auth method see https://goteleport.com/docs/access-controls/sso/oidc/?scope=enterprise#enable-default-oidc-authentication