This article describes how to integrate PingFederate with RSA Cloud Access Service (CAS) using My Page SSO (OIDC).

Configure CAS

Perform these steps to configure CAS using My Page SSO (OIDC).
Procedure

1. Sign in to RSA Cloud Administration Console.
2. Navigate to Applications > Application Catalog and click Create From Template.
   
3. Click Select against OIDC.
   
4. On the Basic Information page, enter a name for the application in the Name field, and then click Next Step.
   
5. Choose your desired Access Policy for this application and click Next Step.
   
6. Under Connection Profile, provide the following details:
   1. Specify the Connection URL as follows: https://<pingfederate_host>:<pingfederate_port>/pingfederate/app
      • pingfederate_host: The hostname that the user will use to access the PingFederate console.
      • Pingfederate_port: The port on which the PingFederate console runs. The default value is 9999
   2. Authorization Server Issuer URL will be auto-populated. This URL is used on the PingFederate side to form the Callback URL, Token Endpoint URL, and Authorize Endpoint URL.
   3. Specify the Redirect URL as follows: https://<pf_admin_hostname>:<pf_admin_port>/pingfederate/app?service=finishsso 
   4. Provide a Client ID and make a note of its value, as it will be used in the PingFederate configuration.
   5. Select Client Authentication Method, the PingFederate console supports only three methods: 'CLIENT_SECRET_BASIC', 'CLIENT_ SECRET_POST', 'PRIVATE_KEY_JWT'.
   6. Provide a Client Secret or generate one.
      
      Provide the scope as 'openid' (Scopes should be added in advance. See the Notes section.) 
   7. Provide the claims as 'sub' and 'admin_role' (Claims should be added beforehand. See Notes section.)
      • sub is the email of the user.
      • admin_role is the role for the user.
        

7. Click Next Step.
8. On the Portal Display page, configure the portal display and other settings.
9. Click Save and Finish. 
10. Click Publish Changes.

Notes

To add scopes:

1. Navigate to Access > OIDC Settings > Scopes.
   
2. Add the openid as a scope and click Save Settings.
3. Add sub and admin_role as claims and click Save Settings.

Configure PingFederate

Perform these steps to configure PingFederate.
Procedure

You need to enable OIDC-based authentication for the administrative console by setting a property in the 'run.properties' file ('<pf_install>/pingfederate/bin/run.properties') and configuring other properties in the 'oidc.properties' file ('<pf_install/pingfederate/bin/oidc.properties'). 

1. Edit the 'run.properties' file and set the 'pf.console.authentication' property to 'OIDC'.
2. Edit the 'oidc.properties' file and modify the applicable properties accordingly.

3. Restart the PingFederate service.

The configuration is complete.