In version 7.6.1 and above, you will be asked to enter Scope information into the system when configuring the Single Sign-On options. Below is a table listing the different scopes for different parts of the application.

Application	openid	email	profile	userinfo	offline_access	User.Read
Web	✓	✓	✓	✓
Windows Client	✓	✓	✓	✓
Mobile	✓	✓	✓	✓

Scopes are case sensitive and need to be separated by a space when entered into the system (e.g. openid email profile)

---

1. Configuring Web

To configure SSO:

1. Log in to PingOne.
2. Navigate to Applications.
3. Click Add.

4. Give a Name to the application.
5. Enter a Description.

6. Select OIDC Web App from the options.

7. Click Save.

8. Go to Configuration tab
9. Click Edit.

10. Update the Response Types and Guest Types:

• • • Code
    • Token
    • ID Token
    • Authorization Code (Optional)
    • Implicit
    • Client Credentials
    • Refresh Tokens (30 days refresh)

11. Specify the Redirect and Signoff URLs.
12. Set Token Endpoint Authentication Method as Client Secret Post.

All Web Client URL with available databases that users are able to access must be added to ‘Redirect URIs'.

13. Set Token Endpoint Authentication Method to None.
14. Add a Sign Off URL (e.g. https://example.ideagenplc.com/IQM/).
15. Click Save.

16. Go to Resources.

17. Click Add.

18. Set Resource Name and Audience to upn.

19. Click Next.
20. Click Add.

21. Set the attributes:

• • • upn to Email Address (this is embedded into the upn into Access Token)
    • family_name to Family Name
    • given_name to Given Name
    • username to Username

22. Click Next.

23. Click Add Scope.
24. Set Scope Name to userinfo.

25. Click Save.
26. Go back to Applications.
27. Click on the created application.

28. Go to the Resources tab.
29. Click Edit for Allowed Scopes.

31. Select email, profile and userinfo.
32. Verify selected scopes.

32. Click Save.

33. Turn on the Application by activating the toggle.

1. Configuring Windows

To configure SSO:

1. Log in to PingOne.
2. Go to Applications.
3. Click Add.

4. Give the Native SSO as a Name to the application.
5. Enter a Description.

6. Select Native.

7. Click Save.

8. Edit the configuration.
9. Untick Token and ID Token for Response Type.

10. Check Authorization Code for Grant Type.
11. Set PCKE Enforcement to REQUIRED.
12. Untick Implicit for GrantType.

13. Set the Redirect URLs.
    Make sure you add qpulsemobile://auth/ to support the mobile application.

14. Set Token Endpoint Authentication Method to None.

15. Click Save.
16. Switch to the Attributes Mappings tab.
17. Click Edit.

18. Click Add.

19. Set the attributes:

• upn to Email Address (this is embedded into the upn into Access Token)
• family_name to Family Name
• given_name to Given Name
• username to Username

20. Click Next.
21. Click Add Scope.
22. Set Scope Name to userinfo.

28. Click Save.
29. Click Add.

29. Enter a Resource Name.

30. Set Audience to upn.
31. Click Next.

32. Click Add.

33. Set the attributes:

• upn to Email Address (this is embedded into the upn into Access Token)
• family_name to Family Name
• given_name to Given Name
• username to Username

34. Click Next.
35. Click Save.
36. Go to the Resources tab.
37. Click Edit for Allowed Scopes.

38. Select email, profile, and userinfo.
39. Verify selected scopes.
40. Turn on the Application by activating the toggle.