> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.id.me/guides/iam-platforms/ping-identity/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.id.me/_mcp/server.

# Ping Identity

## Docs

- [PingFederate OIDC integration guide](https://docs.id.me/guides/iam-platforms/ping-identity/pingfederate.md): Configure PingFederate to use IDMe as an OpenID Connect identity provider for federated authentication.


> **Note:** This page contains both a page directory (above) and the landing page content (below). The page directory is generated for agent use and does not appear on the landing page.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.id.me/guides/iam-platforms/ping-identity/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.id.me/_mcp/server.

# PingOne OIDC integration guide

> Configure PingOne to use IDMe as an OpenID Connect identity provider for federated authentication.

## Overview

This guide provides steps to integrate PingOne with IDMe using the OpenID Connect (OIDC) protocol.

**Intended audience**\
Developers and IAM administrators responsible for configuring federation between PingOne and IDMe.

**What you will build**\
A federated authentication flow where PingOne delegates user authentication to IDMe.

**Result**\
A federated OIDC authentication flow where PingOne delegates authentication to IDMe.

**Identity proofing behavior**\
IDMe policy configurations drive authentication behavior, identity verification settings, and returned attributes.

## Authentication flow

The following steps outline the OIDC authentication flow between the user, PingOne, and IDMe:

The user navigates to the application and is redirected to PingOne

PingOne redirects the user to IDMe

The user completes authentication and identity verification at IDMe

IDMe redirects the user back to PingOne with an authorization code

PingOne exchanges the code for tokens

PingOne redirects the user to the target application with the final ID token

![Sequence diagram showing the 9-step authentication flow between a User, Target Application, PingOne, and IDMe: the user visits the app, is redirected to PingOne, selects "Sign in with IDMe," authenticates with IDMe, which returns an authorization code to PingOne, PingOne exchanges it for an ID token, validates the token and claims, issues a PingOne token to the Target Application, and the user is signed in.](/_fern-files/_img/5ba378b85547d0663c112437b2968eb718998025d4296547b3034f175754c215.webp)

## Prerequisites

* Active PingOne customer solution environment
* Access to PingOne with administrative permissions to manage identity providers, authentication policies, and application configurations
* An IDMe sandbox account for testing your integration
* Understanding of [OIDC flows](/guides/oidc/overview) and terminology
* An application to test the sign-in flow

## Environments

IDMe provides two environments:

#### Sandbox

api.idmelabs.com

#### Production

api.id.me

> **Note**
>
> All IDMe OIDC and SAML endpoints are derived from the base URL above. For production, replace the sandbox base URL in every IDMe endpoint you configure.

### Examples

* OIDC issuer (Sandbox): `https://api.idmelabs.com/oidc`
* OIDC issuer (Production): `https://api.id.me/oidc`
* SAML metadata URL (Sandbox): `https://api.idmelabs.com/saml/metadata`
* SAML metadata URL (Production): `https://api.id.me/saml/metadata`

## Configure PingOne

### Configure IDMe as an OIDC External IdP

In the left-hand column, go to **Integrations** > **External IdPs**

Select the **blue plus sign** to add a provider

![Select the blue plus sign to add a provider](/_fern-files/_img/796b34c20b4f931f61c122b24cac86aaf50b0788f1419832c565c5ed799a20e8.webp)

Under the **Custom** section on the right, choose **OIDC** and select **Next**

Enter a **Name** such as `ID.me` and optionally add a Description

Set **Population** to **Default** (or the designated population for IDMe users)

Add the **Sign in with IDMe** button by selecting **Upload Custom Image** and uploading the IDMe logo

> **Note**
>
> You would not use this button to test the flow in this guide, but it is good practice to add this when possible for future use cases.

Configure the connection using the Client ID and Client Secret provided by your IDMe Solution Consultant

| Field              | Value                                                            |
| ------------------ | ---------------------------------------------------------------- |
| Client ID          | The Client ID provided by your IDMe Solution Consultant          |
| Client Secret      | The Client Secret provided by your IDMe Solution Consultant      |
| Discovery Endpoint | `https://api.idmelabs.com/oidc/.well-known/openid-configuration` |
| Issuer             | `https://api.idmelabs.com/oidc`                                  |
| Scopes             | `openid`                                                         |

![Screenshot of step 3 of 4 in PingOne's "Add Identity Provider: Custom OpenID Connect" wizard, showing the Configure Connection form filled out with a Client ID, masked Client Secret, and IDMe Labs OIDC endpoints for discovery, authorization, token, and user info. Token authentication is set to Client Secret Basic, scope is "openid," and PKCE is disabled.](/_fern-files/_img/273887b654104f0b73a94c954bd9a3acb71b27a0715beebdcf9ea82e260486f2.webp)

Select **Next**

On the **Map Attributes** page, select **Add** and map the following attributes:

* **Email Address**: `providerAttributes.email`
* **Family Name**: `providerAttributes.lname`
* **Given Name**: `providerAttributes.fname`

![Screenshot of the "Edit Attribute Mapping" dialog in PingOne for an IDMe External IDP, showing four mapped attributes — Username, Email Address, Family Name, and Given Name — each mapped to the corresponding IDMe providerAttributes field, all with Update Condition set to "Empty Only."](/_fern-files/_img/fa6ea61f96f2cc636b471f22faf0dcd2d695c9e90f3a40d24d814b7d60b4dacc.webp)

Select **Save**

### Configure authentication policies

Navigate to **Authentication** > **Policies** > **Authentication**

Select **Add Policy**

![Screenshot of the Authentication Policies page header in PingOne, showing a search bar and an "Add Policy" button.](/_fern-files/_img/cc1dbb4d7b384f456630ea6dd43fb529525f5e4f3f47ec62cd1070d07d570c6e.webp)

Enter `IDmeAuth` for the **Policy Name**

Select **External Identity Provider** for the **Step Type**

Select **IDMe** for the **External Identity Provider**

Select **Save**

![Screenshot of the "IDmeAuth" authentication policy configuration in PingOne, showing an External Identity Provider step set to IDMe, required when last sign-on is older than 30 minutes, with registration disabled and Required Authentication Level set to Optional.](/_fern-files/_img/b17275cf3b1987bf7df67d84d7d149f65465117b4bfb7fb30b19d81d424c5f53.webp)

Select **Add Policy** again to create a verification policy

Enter `IDmeVerification` for the **Policy Name**

Select **External Identity Provider** for the **Step Type**

Select **IDMe** for the **External Identity Provider**

Input the **Required Authentication Level** to the proper AuthnContext (e.g., `ial2`)

Select **Save**

### Define the RP/SP configurations within your application

Navigate to **Applications** > **Applications** > **\[Desired Application]** > **Policies**

Select the **Edit** icon

![Screenshot of the Policies tab for the "Getting Started Application" in PingOne, showing two assigned PingOne Policies — IDmeAuth and IDmeVerification. To add or change policies, click the edit icon (white pencil in a blue circle) in the top-right of the image.](/_fern-files/_img/675ab0dcaf5c6c789c8441ec8e0837ead0716468a303bbd54b16f63433ac3623.webp)

Select **DaVinci Policies**

Select the **PingOne Policies** tab

Select **Deselect all other Policies**

Check the boxes for both **IDmeAuth** and **IDmeVerification**

Select **Save**

## Configure IDMe

This portion of the configuration is completed by an IDMe Solution Consultant. You will need to provide the following information to complete the setup:

**Redirect URIs**

The Redirect URI for your PingOne External Identity Provider. This is typically generated by PingOne after creating the provider.

**Policy handle name**

Confirm the IDMe policy handle (e.g., `ial2` or `teacher`).

## Test the integration

You can test the integration by constructing an authorization URL with the appropriate ACR values to signal required assurance levels.

### Authentication at the front door

Update the following placeholders in the URL template below:

* `AUDIENCE_ID`: Your PingOne environment ID
* `CLIENT_ID`: Your PingOne Application Client ID
* `REDIRECT_URI`: Your Application Redirect URI

**`Example`**

```text Example wordWrap
https://auth.pingone.com/AUDIENCE_ID/as/authorize?client_id=CLIENT_ID&redirect_uri=REDIRECT_URI&scope=openid&response_type=code&acr_values=IDmeAuth
```

Paste the modified URL into your browser

Verify you are redirected to the IDMe sign-in page

### Step-up authentication or verification

Update the following placeholders in the URL template below:

* `AUDIENCE_ID`: Your PingOne environment ID
* `CLIENT_ID`: Your PingOne Application Client ID
* `REDIRECT_URI`: Your Application Redirect URI

**`Example`**

```text Example wordWrap
https://auth.pingone.com/AUDIENCE_ID/as/authorize?client_id=CLIENT_ID&redirect_uri=REDIRECT_URI&scope=openid&response_type=code&acr_values=IDmeVerification
```

Paste the modified URL into your browser

Verify you are redirected to the IDMe verification flow