PingIdentity

Set up Ping Identity for automated tests with TrustCloud!

Purpose

Once you set up your compliance program, TrustCloud TrustOps works to ensure that your systems remain compliant with your adopted controls. To do so, TrustCloud runs automated tests against systems in your product and business stack and verifies that they are properly configured.

This document outlines the steps you can take to grant TrustCloud access to only read metadata about the configuration settings for your Ping Identity instance so that TrustOps can validate and generate evidence for your compliance program.

Instructions to grant TrustCloud limited access to Ping Identity

1. Login to your PingIdentity console as a user that has an Administrator role.
2. Select the environment you want TrustCloud to monitor
   Within the environment list page, select the environment that you want TrustCloud to monitor
   
3. Navigate to the Applications section in the right side menu as highlighted in the image.
   Click on the + button to create the Application required for authorization. Set the Application name to TrustCloud, then select the Application Type as Worker. Next, click Save & save the Application.
   
4. Enable the TrustCloud application & navigate to the roles section
   Next you need to enable the application by clicking the slider as highlighted in the image. Then go to the Roles section and click Grant Roles.
   
5. Associate roles with the created application
   Select the role Identity Data Read Only & click Save. Ensure that you are doing this for the appropriate environment. The Identity Data Read Only role will allow TrustCloud to gain a read-only access to your PingIdentity environment.
   
   
6. Ensure the Open Id scope is granted
   Navigate to the resources section & ensure that the OpenID Connect scope is granted. This resource is expected to be selected by default.
   
7. Copy your environment domain from authorization URLs
   Navigate to the Configuration section & expand URLs. Take a note of your top-level domain as highlighted in the image. A domain can be either of – com, ca, eu, asia. You will be providing the domain info later.

   

8. Edit Application Authorization configuration
   Click on the Edit button in the upper right corner
   
9. Update the configuration settings for Authorization Application
   In the Response Type section, select Code. In the Grant Type section, select Authorization Code with the PKCE enforcement value as OPTIONAL & select Refresh Token with 180 days as the value for Refresh Duration & Refresh Token Rolling Duration.
   In the Redirect URIs section, update the url as https://app.trustcloud.ai/trustcloud/integrations.
   
   
10. Select Client Secret Basic in the Token Endpoint Authentication Method section
    
11. In the Request Parameter Signature Requirement section, select Default. Then in the Additional Refresh Token Replay Protection section, check the Enabled box. Click Save
    
    
12. Go to the Overview section
    Navigate to the Overview page & find the Environment ID, Client ID & Client Secret. Copy and save the credentials to use while configuring the PingIdentity integration in TrustCloud.
13. Provide the Environment ID, Client ID, Client Secret & applicable Environment Domain. The environment domain is typically the domain you see in your application url (.com, .eu, .ca, .asia).