This article describes how to integrate PingFederate with RSA Cloud Access Service (CAS) using Relying Party (OIDC).

Configure CAS

Perform these steps to configure CAS as a Relying Party to PingFederate using OIDC.
Procedure

4. Sign in to RSA Cloud Administration Console.
5. Click Authentication Clients > Relying Parties.
   
6. On the My Relying Parties page, click Add a Relying Party.
7. On the Relying Party Catalog page, click Add for Generic OIDC.
   
8. On the Basic Information page, enter the name for the Service Provider in the Name field.
   
9. Click Next Step.
10. On the Authentication page, choose RSA manages all authentication.
11. In the Primary Authentication Method list, select your desired login method as either Password or SecurID.
12. In the Access Policy list, select a policy that was previously configured.
    
13. Click Next Step.
14. Under Connection Profile, provide the following details:
    1. Authorization Server Issuer URL will be auto-populated. This URL is used on the PingFederate side to form the Callback URL, Token Endpoint URL, and Authorize Endpoint URL.
    2. Specify the Redirect URL as follows: https://<pf_admin_hostname>:<pf_admin_port>/pingfederate/app?service=finishsso 
    3. Provide a Client ID and note its value, as it will be used in the PingFederate configuration.
    4. Select Client Authentication Method, the PingFederate console supports only three methods: 'CLIENT_SECRET_BASIC', 'CLIENT_ SECRET_POST', 'PRIVATE_KEY_JWT'.
    5. Provide a Client Secret or generate one.
       
    6. Provide the scope as 'openid' (Scopes should be added in advance. See the Notes section.) 
    7. Provide the claims as 'sub' and 'admin_role' (Claims should be added in advance. See the Notes section.)
       • sub is the email of the user.
       • admin_role is the user's role.
         
15. Click Save and Finish.
16. Click Publish Changes.

Notes

To add scopes:

1. Navigate to Access > OIDC Settings > Scopes.
   
2. Add the openid as a scope and click Save Settings.
3. Add sub and admin_role as claims and click Save Settings.

Configure PingFederate

Perform these steps to configure PingFederate.
Procedure

You need to enable OIDC-based authentication for the administrative console by setting a property in the 'run.properties' file ('<pf_install>/pingfederate/bin/run.properties') and configuring other properties in the 'oidc.properties' file ('<pf_install/pingfederate/bin/oidc.properties'). 

1. Edit the 'run.properties' file and set the 'pf.console.authentication' property to 'OIDC'.
2. Edit the 'oidc.properties' file and modify the applicable properties accordingly.

3. Restart the PingFederate service.

The configuration is complete.