> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # PingOne OIDC > Learn how to configure PingOne OIDC for Infisical SSO. > [!NOTE] > > PingOne OIDC SSO is a paid feature. If you're using Infisical Cloud, then it is > available under the **Pro Tier**. If you're self-hosting Infisical, then you > should contact [sales@infisical.com](mailto:sales@infisical.com) to purchase a self-hosted license to use > it. > [!NOTE] > > SSO authentication requires [Email Domain Verification](https://infisical.com/docs/documentation/platform/email-domain.md). > You must verify your organization's email domain before users can log in via SSO. **1. Setup application in PingOne** 1.1. From the Application's Page, create a new OIDC Web App application. ![OIDC pingone create application](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/pingone-oidc/pingone-create-application.png) 1.2. Enable the application by pressing the "Enable" toggle. ![OIDC PingOne Enable Application](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/pingone-oidc/pingone-enable-application.png) 1.3. In the Application "Configuration" tab, press the "Edit" pencil icon to configure the application callback URI. ![OIDC PingOne Edit Application Configuration](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/pingone-oidc/pingone-edit-application-configuration.png) 1.4 Set the Redirect URL to `https://app.infisical.com/api/v1/sso/oidc/callback` and press the "Save" button. ![OIDC PingOne Edit Redirect URI](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/pingone-oidc/pingone-edit-application-redirect-uri.png) > [!NOTE] > > If you're self-hosting Infisical, then you will want to replace [https://app.infisical.com](https://app.infisical.com) with your own domain. 1.5 After configuring the redirect URL, go to the "Attribute Mappings" tab and press the "Edit" pencil icon to configure the attribute mappings. ![OIDC PingOne Edit Attribute Mappings](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/pingone-oidc/pingone-edit-application-attribute-mappings.png) 1.6 Map the following attributes: * `email` -> `Email Address` * `given_name` -> `Given Name` * `family_name` -> `Family Name` ![OIDC PingOne Edit Attribute Mappings](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/pingone-oidc/pingone-edit-application-attribute-mappings-2.png) Once done, press the "Save" button. > [!NOTE] > > Infisical takes a user's name from the `given_name` and `family_name` claims. If you map `name` in place of `given_name`, Infisical falls back to it and removes `family_name` from the end of it, so the surname isn't stored twice. See [General OIDC](https://infisical.com/docs/documentation/platform/sso/general-oidc/overview.md) for the exact fallback rules. **2. Retrieve Identity Provider (IdP) Information from PingOne** 2.1. Open the "Overview" tab and copy the **Client ID** and **Client Secret**. ![OIDC PingOne Application Credential](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/pingone-oidc/pingone-overview-credentials.png) 2.2. Still in the "Overview" tab, scroll down to the Connection Details section and retrieve the **OIDC Discovery Endpoint**. ![OIDC PingOne OIDC Discovery Endpoint](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/pingone-oidc/pingone-overview-oidc-discovery-endpoint.png) Keep these values handy as we will need them in the next steps. **3. Finish configuring OIDC in Infisical** 3.1. Back in Infisical, head to the **Single Sign-On (SSO)** page and select the **General** tab. Select **Connect** for **OIDC**. ![OIDC SSO Connect](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/connect-oidc.png) 3.2. For configuration type, select **Discovery URL**. Then, set **Discovery Document URL**, **Client ID**, and **Client Secret** from step 2.1 and 2.2. ![OIDC PingOne paste values into Infisical](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/pingone-oidc/infisical-configure-oidc.png) > [!NOTE] > > Currently, the following JWT signature algorithms are supported: RS256, RS512, HS256, and EdDSA Once you've done that, press **Update** to complete the required configuration. **4. Enable OIDC in Infisical** Enabling OIDC allows members in your organization to log into Infisical via PingOne ![OIDC PingOne enable OIDC](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/enable-oidc.png) **5. Enforce OIDC SSO in Infisical** Enforcing OIDC SSO ensures that members in your organization can only access Infisical by logging into the organization via PingOne. To enforce OIDC SSO, you're required to test out the OpenID connection by successfully authenticating at least one PingOne user with Infisical. Once you've completed this requirement, you can toggle the **Enforce OIDC SSO** button to enforce OIDC SSO. > [!WARNING] > > We recommend ensuring that your account is provisioned using the application in PingOne > prior to enforcing OIDC SSO to prevent any unintended issues. > [!NOTE] > > In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview.md#admin-login-portal) in the `/login/admin` path e.g. [https://app.infisical.com/login/admin](https://app.infisical.com/login/admin). > [!TIP] > > If you're only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](https://infisical.com/docs/documentation/platform/admin-panel/server-admin.md#default-organization) to expedite OIDC login. > [!NOTE] > > If you're configuring OIDC SSO on a self-hosted instance of Infisical, make > sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to > work: > > * `AUTH_SECRET`: A secret key used for signing and verifying JWT. This > can be a random 32-byte base64 string generated with `openssl rand -base64 > 32`. > > - `SITE_URL`: The absolute URL of your self-hosted instance of Infisical including the protocol (e.g. [https://app.infisical.com](https://app.infisical.com)) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.