"Existing OIDC Provider" guide for PingFederate

[jdoylei]

It's helpful that Argo CD has many guides under User Management that are specific to individual existing OIDC providers like Okta. We're hoping to leverage OIDC support in our existing PingFederate system, either integrating Argo CD via Dex, or integrating Argo CD directly. I see there's not a guide specific to PingFederate (yet?). We'd appreciate any advice on this, particularly since we've used PingFederate as a SAML provider up until now, and OIDC is new territory for us, but we'd like to explore OIDC as a more current approach.

• Have other Argo CD users had success with PingFederate as Argo CD's OIDC provider?
• Did you use it from Argo CD directly, or use it via Dex?
• Any quirks to watch out for?

Thank you!

[shxpark]

Were you able to set this up? Trying to do something similar

[jdoylei]

Hi @shxpark - We integrated PingFederate as a SAML provider using Dex, and have been using it that way for a while. It would be nice to take SAML out of the equation and leverage OIDC, but we back-burnered looking at any Ping OIDC integration.

We basically ended up with a dex.config.yaml like:

logger:
  level: debug
  format: json
connectors:
  - type: saml
    id: saml
    name: "<Company name> Ping"
    config:
      entityIssuer: https://argocd-ui-x.xyz.com/api/dex/callback
      ssoURL: https://pingx.abc.com/idp/SSO.saml2
      caData: $zzz-pingx:PINGX.crt
      redirectURI: https://argocd-ui-x.xyz.com/api/dex/callback
      usernameAttr: User.mail
      emailAttr: User.mail
      groupsAttr: MemberOf
      nameIDPolicyFormat: unspecified

[jdoylei]

@jmohoric101 - Definitely, for SAML there's a lot of setup on the Ping Federate side. I should point out, we have been switching from Ping Federate to Ping One, which I believe has different configuration, but both work with Argo CD. On the Ping Federate side, I don't know that I can share what we configured, but I do know we needed to configure Argo CD as a new service provider, including:

• an HTML Adapter config with LDAP Directory Search, LDAP Filter, Attribute Contract Fulfillment
• a Kerberos Contract config with essentially the same information

That might have more to do with our particular LDAP setup and Kerberos usage - I'm not sure. Basically the Ping configuration was about making sure that the SAML response returned by Ping and POSTed back to Argo CD Dex had the correct SAML Attribute Statement, with the correct MemberOf attribute (containing LDAP groups relevant to Argo CD).

If you have any questions about the LDAP Directory Search, LDAP Filter, and Attribute Contract Fulfillment settings, I might be able to shed some light based on what we did, and what worked and didn't work. Those pieces were the trickiest part.