PingOne AIC is an identity and access management platform that helps organizations securely manage user identities, authentication, and access to applications. For more information refer to the PingOne AIC documentation.

Integration Method: API
Tables: User Inventory Info (5003)

This integration supports the following events.

This integration supports the following versions.

Note:

In the DataBee implementation, the Accept-API-Version header is not included. The API invokes the latest resource version by default.

Prerequisites

• The user should have access to the PingOne AIC Dashboard with Administrator privileges.

• The user should have access to the DataBee console.

Configuration Overview

1. Create a Service Account in PingOne Advanced Identity Cloud and generate its Service Account ID and private key (JWK) with the required scopes to access the APIs.

2. Add the PingOne Advanced Identity Cloud data feed in the DataBee console with the below parameters.

   DataBee Parameter	PingOne AIC Parameter
   API Base URL <instance>	Base URL
   Token URL <instance>	Base URL
   Audience <instance>	Base URL
   Issuer ID	Service Account ID
   Subject ID	Service Account ID
   Private Key	Private Key
   Realm Names	Realm names

PingOne AIC Configuration

1. Log in to the PingOne Advanced Identity Cloud admin dashboard. In the screenshot shown below, the highlighted URL represents the instance API URL. Save this URL for later use, as it will be required while configuring the data feed. The relevant part is highlighted in red.
    

2. For Realm Names, go to the top-left corner, click on the currently selected realm name and choose Switch realm....

   • From there, copy the realm names for which you want to fetch the managed users and use them while configuring the data feed for PingOne Advanced Identity Cloud.

   • Click Cancel.
      
      

Create a Service Account

1. Navigate to Profile > Tenant settings.
    

2. Under Tenant Settings, navigate to Global Settings, then scroll and click on Service Accounts.

   

3. Under Service Accounts, click on + New Service Account.

   

4. In the New Service Account page, provide the following details:

   1. Name: A human-readable name for the service account.

   2. Description (Optional): A brief description to help identify the purpose of the service account.
       

   3. Scopes: Select the required scopes fr:am:* and fr:idm:*.

   4. Click Save.
        

5. After clicking Save, the service account will be created successfully, and a confirmation window will appear.

   1. Click Copy next to the Service Account ID and save it for later use.

   2. Click Download Key to download the private key (JWK).

      Note:

      Securely store the downloaded key, as it will be required for authentication and it’s only appearing once, so keep it safe.

   3. Click Done to finish the process.
       

DataBee Configuration

1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
    

2. Search for the PingOne Advanced Identity Cloud and click it as shown below.
    

3. Click on the API Ingest option for the collection method.
    

4. Enter feed contact information, keep Entity Resolution checkbox checked if you want it else uncheck it and scroll down.

   

5. In the configuration section, confirm the following:

   • API Base URL: This is the base URL that DataBee will interact with
     Replace the <instance> with your instance value that was copied earlier.

   • Authorization Method: JWT Auth

   • Token URL: Replace the <instance> with your instance value that was copied earlier.

   • Issuer ID: Paste the service account ID that you copied earlier.

   • Subject ID: Paste the service account ID that you copied earlier.

   • Audience: Replace the <instance> with your instance value that was copied earlier.

   • Private key: Paste the content of the downloaded private key file.

   • Realm names: Enter the realm names (comma-separated) for which you want to fetch data.

   • Event Types: Preselected for all the event types that integration pulls.
      

6. Click on the Submit button.
    

Troubleshooting Tips

• Ensure the service account has the required scopes and make sure the correct private key has been pasted.

• Verify that the correct realm name is provided (comma-separated if multiple). An incorrect value may result in a wrong realm error.