> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/authentication/oidc.md).

# OpenID Connect

OpenID Connect is a standard that extends OAuth 2.0 to add an identity layer. Prisma Cloud supports integration with any standard Open ID Connect (OIDC) provider that implements both OpenID connect core and OpenID connect discovery. Prisma Cloud supports the authorization code flow only.

This page includes instructions to integrate with the following providers:

* [PingOne](#pingone)
* [Okta](#okta)
* [Azure Active Directory](#azure-ad)

Use the **https\://\<CONSOLE>:\<PORT>/api/v1/authenticate/callback/oidc** URL only to configure the integration between services. The API is not included in [our reference guide](https://pan.dev/compute/api/) because the URL is only enabled as a configuration value.

## PingOne

Integrate with PingOne.

You need to configure Compute as an OIDC app. When configuring your app:

* The Start SSO URL must point to the **https\://\<CONSOLE>:\<PORT>/callback** URL.
* The Redirect URI must point to the **https\://\<CONSOLE>:\<PORT>/api/v1/authenticate/callback/oidc** URL.
* UserInfo must include `sub`, `idpid`, and `name`.
* All of the following scopes must be included for OpenID.
  * OpenID Connect (openid)
  * OpenID profile
  * OpenID Email
  * OpenID address
  * OpenID Phone
  * Groups

### Update Ping callback URL

Update the callback URL.

1. Log into the Ping web portal.
2. Click **Applications**, and then click the **OIDC** tab.
3. Click on the arrow button nest for your app.
4. Click on the pencil icon on the right side.
5. Click on **Authentication Flow**.
6. In **REDIRECT URIS**, enter the following URL to enable the service-to-service integration:

   **https\://\<CONSOLE>:\<PORT>/api/v1/authenticate/callback/oidc**.

### Create new user and join to group

1. In the Ping web portal, click **Users**, and then click the **Users** tab.
2. Click **Add users**, and choose the **Create New User** option.
3. Fill the fields for **Password**, **Username** (should be your email), **First Name**, **Last Name**, and **Email**.
4. In the **Membership** field, click **Add**, and choose a group.
5. Click **Save**.

## Okta

Integrate with Okta.

* Initiate Login URI (Okta) must point to **https\://\<CONSOLE>:\<PORT>/callback**.
* Redirect URI must point to the **https\://\<CONSOLE>:\<PORT>/api/v1/authenticate/callback/oidc** URL.
* UserInfo must include sub, idpid, name.
* Scopes:
  * All of the following scopes must be included for OpenID: OpenID Connect (openid), OpenID profile, OpenID Email, OpenID address, OpenID Phone, Groups.
  * All of the following scopes must be included for Okta: okta.groups.manage, okta.groups.read.

### Update Okta callback URL

Update the callback URL.

1. Log into Okta.
2. Click on **Applications** and click on your application.
3. Click the **General** tab, and then click **Edit**.
4. Update **Login redirect URIs**. Enter the following URL to enable the service-to-service integration:

   **https\://\<CONSOLE>:\<PORT>/api/v1/authenticate/callback/oidc**
5. Click **Save**.

### Configure Okta as an Identity Provider

Configure Okta as an identity provider in Prisma Cloud with the following steps.

1. Log into Prisma Cloud Console.
2. Go to **Manage > Authentication > Identity Providers > OpenID Connect**.
3. Enable OpenID Connect.
4. Fill in the settings.
   1. For **Client ID**, enter the client ID.
   2. For **Client Secret**, enter the client secret.
   3. For **Issuer URL**, enter:

      **<https://sso.connect.pingidentity.com/\\>\<CLIENT\_ID>**.
   4. For **Group scope**, select **groups**.
   5. (Optional) Enter your certificate.
   6. Click **Save**.

## Azure Active Directory (AD)

To integrate with Azure Active Directory (AD), you must register Prisma Cloud as an Open ID Connect (OIDC) application in Azure and configure Azure AD as an identity provider in Prisma Cloud.

1. Go to [your Azure console](https://portal.azure.com/#home).
2. Find the Azure AD service.
3. Click the **app registration** button and select **New registration**
4. Enter a name and select **Accounts in this organizational directory only** as the supported account type.
5. Under **Redirect URI** select **Web console URL** enter the following URL to enable the service-to-service integration: **https\://\<CONSOLE>:\<PORT>/api/v1/authenticate/callback/oidc**
6. Click on **Register the app**.
7. To add the secret for the client, go to **certificates & secrets**.
8. Add a new secret for the client, copy and store it for later use.

   You can only view the value of the secret when you create it. Copy and store the secret safely for later use.

### Configure Groups in Azure AD

1. To add the needed claim, go to **Token Configuration**.
   1. Select **Add group claim**
   2. Select the **Groups assigned to the application** option.
   3. Keep the default values and click **Add**.
   4. Click **Add optional claim** and select **Token type - ID**.
   5. Select the **email** and **preferred\_username** claims.
   6. Turn on the Microsoft Graph email permission, while saving these claims.

      <figure><img src="/files/jL8ZzwqBu4M0O3a3FEG6" alt="oidc optional claim"><figcaption></figcaption></figure>
2. Go to the **API permissions** and click **Add a permission**.
   1. Under **Microsoft API** select **Microsoft Graph**.
   2. Select **Delegated permissions**
   3. Select **email, openid, profile**.

      <figure><img src="/files/ZOlyGYQvMk7A3V1oBBUI" alt="oidc api permission"><figcaption></figcaption></figure>
3. To create the needed application group, go to **Groups** in the Azure AD console.
4. Create a new group and keep the default values.

### Assign the Created Group to the Prisma Cloud Console

1. Go to **Enterprise applications** in the Azure AD console.
2. Find the application you registered.
3. Click on **Properties** and check the **Assignment required** option.
4. Click on **Assign users and groups**.
5. Click add and select the previously created group.
6. Click add and select your user.
7. Go to **App registrations** in the Azure AD console.
8. Click on **Your owned registered app**.
9. Find the application you registered and click on **Endpoints**.
10. Open the OpenID Connect metadata JSON file.
11. Copy the value under Issuer URL from the JSON file, for example: **<https://login.microsoftonline.com/\\>\<TENANT\_ID>/v2.0**

### Configure Azure AD as an Identity Provider

After you register Prisma Cloud as an Open ID Connect (OIDC) application in Azure, complete the following steps to configure Azure AD as an identity provider.

1. Go to **Manage > Authentication > Identity Providers** in your Prisma Cloud Console.
2. Enable OpenID Connect.
3. Enter the following information in the settings fields.
   1. **Client ID**: Use the **Application (Client) ID** found in the Azure Console under **Azure AD > App registrations > Overview**.

      <figure><img src="/files/puhBaZ9v2enyZC3ieVNE" alt="oidc client id"><figcaption></figcaption></figure>
   2. **Client Secret**: The secret for the client that you created for the application and stored safely for later use.
   3. **Issuer URL**: The endpoint of the application registered in Azure AD, for example **<https://login.microsoftonline.com/\\>\<TENANT\_ID>/v2.0**
   4. **Group scope**: Leave this field blank.
   5. **Group claim**: Set this field to `groups`. This allows Prisma Cloud to populate the specific group names automatically.
   6. **User claim**: The optional claim for the user. Set this field to `preferred_username` for group based OIDC authentication, it is used for the audit logs.

      <figure><img src="/files/DP0ivUFEaqP1rHQ3v8XU" alt="oidc identity provider configuration"><figcaption></figcaption></figure>
4. Click **Save**.

## Prisma Cloud to OIDC user identity mapping

If you intend to use the group mapping method, skip to the [Prisma Cloud to OIDC provider group mapping](#group-mapping) task. Create a user for every user that should access Prisma Cloud. The Open ID Connect specification requires every username to match with a configured username in the Prisma Cloud database. Prisma Cloud uses attributes that come from OIDC to perform this match, for example you can use `sub`, `username` or `email`. You should use whichever value the provider is configured to send to Prisma Cloud when you configure users.

1. Go to **Manage > Authentication > Users**.
2. Click **Add User**.
3. Set **Username** to the GitHub user name.
4. Type a **Description** for the user.
5. Set **Auth method** to **OpenID Connect**.
6. Select a [role](/admin-guide/authentication/user-roles.md) for the user.
7. Click **Save**.
8. Test logging into Prisma Cloud Console.
   1. Logout of Prisma Cloud.
   2. On the login page, select **OpenID Connect**, and then click **Login**.

      <figure><img src="/files/6Uo0yBrZAQtiJ3VUYsjg" alt="oidc login"><figcaption></figcaption></figure>
   3. You’re redirected to your OIDC provider to authenticate.
   4. After successfully authenticating, you’re logged into Prisma Cloud Console.

## Prisma Cloud to OIDC provider group mapping

When you use groups to assign roles in Prisma Cloud you don’t have to create individual Prisma Cloud accounts for each user. The group value configured on the Compute side should reflect the name of the group scope in the OIDC provider. It might be something different than groups.

Groups can be associated and authenticated with by multiple identity providers. If you use Azure Active Directory (AAD), a user can’t be part of more than 200 groups at once.

1. Go to **Manage > Authentication > Groups**.
2. Click **Add Group**.
3. In **Name**, enter an OpenShift group name. For AAD use Azure Group’s **Object ID** as the group name.
4. In **Authentication method**, select **External Providers**.
5. In **Authentication Providers**, select **OpenID Connect group**.
6. Select a [role](/admin-guide/authentication/user-roles.md) for the members of the group.
7. Click **Save**.
8. Test logging into Prisma Cloud Console.
   1. Logout of Prisma Cloud.
   2. On the login page, select **OpenID Connect**, and then click **Login**.

      <figure><img src="/files/6Uo0yBrZAQtiJ3VUYsjg" alt="oidc login"><figcaption></figcaption></figure>
   3. You’re redirected to your OIDC provider to authenticate.
   4. After successfully authenticating, you’re logged into Prisma Cloud Console.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/authentication/oidc.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.