PingFederate

Prerequisites

Complete the preparation checklist.

Application setup

In the PingFederate administrative console > Applications > OAuth > Clients, create a client. Set Redirection URIs to https://api.<platform-host>/identity/callback, enable Authorization Code and Refresh Token, and require S256 PKCE. Select Client Secret Basic (client_secret_basic) and the OpenID Connect policy for Istari. Set Post-Logout Redirect URIs to https://<platform-host> and any other approved frontend addresses and apply the configuration to each server using the normal deployment process.

Use your Istari domain for <platform-host>. For a custom API hostname or base URL, use the configured callback address.

If Post-Logout Redirect URIs is hidden, enable the server's Track User Sessions for Logout setting. See Configuring OAuth clients.

Collected values

Collect the client ID and secret. Fetch the public server's OpenID configuration and copy its issuer field; the administration-console address may differ. Configure the policy to emit a permanent directory identifier as sub, never a reusable email or username. Collect the test person's stable subject and the policy governing email_verified.

Installation configuration

istari-values.yaml (excerpt)

identity:
  oidc:
    provider: pingfederate
    issuer: "https://<pingfederate-host>"
    clientId: "<client-id>"
    clientAuthMethod: client_secret_basic
    scopes: "openid profile email offline_access"
  idpMigration:
    enabled: false

Store ISTARI_DIGITAL_IDENTITY_SERVICE_OIDC_CLIENT_SECRET in the Identity Service Secret. Set ISTARI_DIGITAL_IDENTITY_SERVICE_ENROLLMENT_POLICY=pre-registered-only.

Account preparation

Pre-register for pingfederate before sign-in or import authoritative sub mappings. The migration hook recipe seeds pending registrations for existing Zitadel users. Email claiming requires a trusted verified-email assertion. Directory groups and roles do not select an Istari tenant; each person's existing Istari membership does.

See account import commands and administrator setup.

Verification

Check the exact issuer, fixed sub, client-secret-basic authentication, and verified-email policy. Test prepared and refused accounts, refresh, logout returns, and the shared migration continuity checks.

Limitations

This integration requires client_secret_basic. Group and role synchronization, SAML, and SCIM are not supported.