Ping SSO Setup

This guide walks you through configuring Ping Identity as a Single Sign-On (SSO) provider for CLEAR using OpenID Connect (OIDC). It also includes optional steps to enable SCIM provisioning for automated user and role management.

---

Prerequisites

Before you begin, ensure you have:

• A Ping Identity tenant with admin access
• A CLEAR organization with admin access
• A Ping Environment ID
• Ability to create applications, groups, and users in Ping
• Access to the CLEAR dashboard

Helpful references:

• PingOne URLs: https://support.pingidentity.com/s/article/How-to-find-your-PingOne-URLs

---

Step 1: Register the SSO Application in Ping

Sign in to Ping

1. Go to https://console.pingone.com/?env=<environmentID>
2. Log in using your Ping administrator account.

Replace <environmentID> with your actual Ping environment ID.

---

Create a New Application

1. From the Ping dashboard, select Applications
2. Click the + (Add Application) button
3. Enter:

• Application Name
• (Optional) Description

4. Select OIDC Web App
5. Click Save

---

Configure Redirect URI

1. Open the Configuration tab
2. Click the pencil icon to edit
3. Leave all defaults except:

• Add the Redirect URI:

  https://verified.clearme.com/UserBackend/callback/oauth

4. Click Save

---

Step 2: Gather Required Ping Credentials

From the application’s General section, copy the following:

• Client ID
• Client Secret
• Ping Environment ID

You will need these values when configuring SSO in CLEAR.

---

Step 3: Configure Ping SSO in CLEAR

This step is completed in the CLEAR dashboard.

1. Log in to the CLEAR dashboard: https://verified.clearme.com/dashboard
2. Navigate to:

• User Management
• Single Sign-On (SSO)

3. Select Ping Identity

---

Enter OIDC Configuration

Provide the following values from Ping:

• Client ID
• Client Secret
• Ping Environment ID

OIDC Discovery Endpoint

https://auth.pingone.com/<environment_id>/as/.well-known/openid-configuration

Click Get URI endpoints to auto-populate:

• Authorization Endpoint
• Token Endpoint
• Userinfo Endpoint

If the discovered host does not end in pingone.com, contact CLEAR Solutions Engineering to allowlist it.

Click Publish to save.

---

Ensure Users Exist in CLEAR

Users must exist in CLEAR with the appropriate roles. This can be done by:

• Manually adding users in User Management, or
• Using SCIM provisioning (covered here)

---

Step 4: Create Groups in Ping (Optional but Recommended)

Groups are used for both SSO access and SCIM provisioning.

Create a Group

1. Navigate to Directory → Groups
2. Click +
3. Enter:
   • Group Name
   • Description
4. Save the group

---

Assign Users to the Group

1. Go to Directory → Users
2. Create or select a user
3. Assign the user to the SSO / SCIM group

---

Assign Group to the Application

1. Open Applications
2. Select your SSO application
3. Open Access
4. Assign the group
5. Save changes

---

Enable the Application

Toggle the application ON to activate SSO.

---

Step 5: Test SSO Login

1. Navigate to the CLEAR dashboard: https://verified.clearme.com/dashboard
2. Initiate login
3. You should be redirected to Ping for authentication
4. Upon success, you’ll be returned to CLEAR

Once authenticated, users will not be prompted again until the token expires.

---

Troubleshooting

• Ensure Redirect URI matches exactly
• Verify users exist and have roles
• Confirm SCIM token is valid
• Validate OIDC endpoints are reachable
• Ensure hosts are not blocked by allowlists