PingOne

The PingOne cloud platform from PingIdentity provides SSO identity management. Cloudflare Access supports PingOne as an OIDC identity provider.

Set up PingOne as an OIDC provider

1. Create an application in PingOne

1. In your PingIdentity environment, go to Connections > Applications.

2. Select Add Application.

3. Enter an Application Name.

4. Select OIDC Web App and then Save.

5. Select Resource Access and add the email and profile scopes.

6. In the Configuration tab, select General.

7. Copy the Client ID, Client Secret, and Environment ID to a safe place. These IDs will be used in a later step to add PingOne to Cloudflare One.

8. In the Configuration tab, select the pencil icon.

9. In the Redirect URIs field, enter the following URL:

   https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback

   You can find your team name in Cloudflare One ↗ under Settings > Team name.

10. Select Save.

2. Add PingOne to Cloudflare One

1. In Cloudflare One ↗, go to Integrations > Identity providers.
2. Under Your identity providers, select Add new identity provider.
3. Select PingOne.
4. Input the Client ID, Client Secret, and Environment ID generated previously.
5. (Optional) Enable Proof of Key Exchange (PKCE) ↗. PKCE will be performed on all login attempts.
6. (Optional) To enable SCIM, refer to Synchronize users and groups.
7. (Optional) Under Optional configurations, enter custom OIDC claims that you wish to add to your users' identity.
8. Select Save.

You can now test your connection and create Access policies based on the configured login method.

Example API configuration

{
  "config": {
    "client_id": "<your client id>",
    "client_secret": "<your client secret>",
    "ping_env_id": "<your ping environment id>"
  },
  "type": "ping",
  "name": "my example idp"
}