Configuring the DaVinci module

PingOne Android

Configure DaVinci module for Android properties to connect to PingOne and step through an associated DaVinci flow.

There are two methods for configuring the DaVinci module:

Full configuration: Use the Kotlin builder DSL to access all available settings, including Android-specific options such as custom HTTP clients and storage configuration.
Common JSON configuration: Use a shared key-value structure that works identically across Android, iOS, and JavaScript, letting you load a single config file across platforms.

Full configuration

The following shows an example DaVinci module configuration, using the underlying Oidc module:

Configure DaVinci module connection properties

import com.pingidentity.davinci.DaVinci
import com.pingidentity.davinci.module.Oidc

val davinciClient = DaVinci {
    logger = Logger.STANDARD
    module(Oidc) {
        clientId = "6c7eb89a-66e9-ab12-cd34-eeaf795650b2"
        discoveryEndpoint = "https://auth.pingone.com/3072206d-c6ce-ch15-m0nd-f87e972c7cc3/" +
            "as/.well-known/openid-configuration"
        scopes = mutableSetOf("openid", "profile", "email", "address", "revoke")
        redirectUri = "com.example.demo://oauth2redirect"
        par = true
        additionalParameters = mapOf("customKey" to "customValue")
    }
}

Common JSON configuration

You can provide the same configuration as a JSON object, which lets you share a single config file across Android, iOS, and JavaScript.

Configure the DaVinci module from a JSON object

val davinciClient = DaVinci(buildJsonObject {
    put("timeout", 30000) // milliseconds
    put("log", "WARN")
    putJsonObject("oidc") {
        put("clientId", "6c7eb89a-66e9-ab12-cd34-eeaf795650b2")
        put("discoveryEndpoint",
            "https://auth.pingone.com/3072206d-c6ce-ch15-m0nd-f87e972c7cc3/as/.well-known/openid-configuration")
        putJsonArray("scopes") {
            add("openid"); add("profile"); add("email"); add("revoke")
        }
        put("redirectUri", "com.example.demo://oauth2redirect")
    }
}).getOrThrow()

Optionally, you can store this JSON in a file alongside your app and load it at runtime so the same file can be shared across platforms.

The JSON factory and the native DaVinci {} builder DSL are mutually exclusive, there is no combined form.

If you need Android-specific settings such as httpClient or storage configuration, use the native builder DSL for the entire configuration instead.

Configuration property reference

The following properties are available when configuring the DaVinci module for Android.

The JSON property column shows the equivalent key when using JSON configuration.

Property JSON property Description Required?

logger

log

Specify which logger the Orchestration SDK should use to output messages. Select from the built-in presets STANDARD (the default), WARN, or NONE.

You can also create and use your own logger implementation. Learn more in Customizing logging on Android.

In JSON configuration, use the log property at the root level.

timeout

A timeout, in seconds, for each request that communicates with the server.

Default is 30 seconds.

When using JSON configuration, specify timeout at the root level with the value in milliseconds:

{
  "timeout": 30000
}

acrValues

oidc.acrValues

Request which flow the PingOne server uses by adding an Authentication Context Class Reference (ACR) parameter.

Enter a single DaVinci policy by using its flow policy ID.

Example:

"d1210a6b0b2665dbaa5b652221badba2"

additionalParameters

oidc.additionalParameters

Add additional key-pair parameters as query strings to the initial OAuth 2.0 call to the /authorize endpoint.

For example, additionalParameters = mapOf("customKey" to "customValue")

You can access these additional OAuth 2.0 parameters in your DaVinci flows by using the authorizationRequest.<customParameter> property.

Learn more in Referencing PingOne data in the flow.

clientId

oidc.clientId

The client_id of the OAuth 2.0 client profile to use.

For example, 6c7eb89a-66e9-ab12-cd34-eeaf795650b2

Yes

discoveryEndpoint

oidc.discoveryEndpoint

Your PingOne server’s .well-known/openid-configuration endpoint.

Example:

https://auth.pingone.com/3072206d-c6ce-ch15-m0nd-f87e972c7cc3/as/.well-known/openid-configuration

Yes

par

oidc.par

Whether to use Pushed Authorization Requests (PAR) for communicating with the authorization server.

Learn more in Securing OIDC sign-on with Pushed Authorization Requests.

redirectUri

oidc.redirectUri

The redirect_uri as configured in the OAuth 2.0 client profile.

This value must match a value configured in your OAuth 2.0 client.

For example, com.example.demo://oauth2redirect.

Yes

scopes

oidc.scopes

A set of scopes to request when performing an OAuth 2.0 authorization flow.

For example, "openid", "profile", "email", "address", "revoke".

Yes

display

oidc.display

How the authorization server should display the authentication UI.

page: Full-page redirect (default).
popup: Pop-up window.
touch: Optimized for touch-based devices.
wap: Optimized for WAP/mobile browsers.

loginHint

oidc.loginHint

A hint to pre-populate the username field on the authorization server’s sign-on page.

For example, user@example.com

nonce

oidc.nonce

A value to associate with the ID token to prevent replay attacks.

If not set, the SDK generates a nonce automatically.

prompt

oidc.prompt

Controls whether the authorization server prompts the user for re-authentication or consent.

Select one of the following:

none: No UI; returns an error if interaction is required.
login: Force re-authentication.
consent: Request consent even if previously granted.
select_account: Prompt to select an account.

refreshThreshold

oidc.refreshThreshold

The number of seconds before token expiry at which the SDK proactively refreshes the token.

Defaults to 0, meaning the SDK refreshes only when the token has expired.

signOutRedirectUri

oidc.signOutRedirectUri

The URI to redirect to after sign-out.

Maps to the post_logout_redirect_uri parameter in the end-session request.

This value must be registered in your OAuth 2.0 client.

uiLocales

oidc.uiLocales

Space-separated BCP 47 language tags indicating the preferred display language for the authorization server’s UI.

For example, en-US fr

Orchestration SDKs

Configuring the DaVinci module

Full configuration

Common JSON configuration

Configuration property reference