Trusted issuers

Trusted issuers are third-party token issuer resources in PingOne that represent actual external JWT issuers that PingOne should trust. By specifying trusted issuers, the PingOne authorization server will accept third-party signed JWTs (as subject or actor tokens in a token exchange action) from the trusted issuer.

After you define trusted issuers, you can assign them to applications that are configured to use the token exchange grant type (urn:ietf:params:oauth:grant-type:token-exchange), using third-party signed JWTs as token-exchange inputs. In these cases, the subject_token_type and actor_token_typ parameter values in the token request must be set to urn:ietf:params:oauth:token-type:jwt.

To learn more about token exchange, refer to Use a trusted issuer JWT for token enrichment and Internet Engineering Task Force RFC 8693 OAuth 2.0 Token Exchange.

Trusted issuers data model

Property Type Required Mutable Description

Property	Type	Required	Mutable	Description
`audiences[]`	Array	Optional	Mutable	An array of audience values. If specified, at least one audience in the incoming token’s `aud` array must match one of the defined audiences. If not set, the incoming JWT `aud` claim is ignored.
`clockSkew`	Integer	Optional	Mutable	A value in seconds that compensates for small time synchronization discrepancies between different entities to protect against failed validation because of clock differences. The minimum value is 0; the maximum value is 60.
`createdAt`	Date	N/A	Read-only	The time the resource was created.
`description`	String	Optional	Mutable	A description of the trusted issuer.
`environment.id`	String	N/A	Immutable	The identifier of the environment resource referenced by this relationship.
`expRequired`	Boolean	Optional	Mutable	Indicates whether the `exp` (Expiration Time) token claim is required. The default value is `true`.
`iatRequired`	Boolean	Optional	Mutable	Indicates whether the `iat` (Issued At Time) token claim is required. The default value is `false`.
`id`	String	N/A	Immutable	The attribute’s unique identifier.
`issuer`	String	Required	Mutable	A URL (supports `https://` only) that identifies the trusted issuer.
`jwks`	String	Required/Optional	Mutable	A JWKS string that validates the signature of signed JWTs. This property is set in configurations where the `jwksurl` option is not set.
`jwksUrl`	String	Required/Optional	Mutable	A URL (supports `https://` only) that provides access to a JWKS string that validates the signature of signed JWTs. This property is set in configurations where the `jwks` option is not set.
`maxFutureValidity`	Integer	Optional	Mutable	Configures the token’s maximum amount of time (in seconds) on how far in the future the `exp` (Expiration Time) claim can be set. The minimum value is 0; the maximum value is 30 days.
`name`	String	Required	Mutable	The name of the trusted issuer.
`nbfRequired`	Boolean	Optional	Mutable	Indicates whether the `nbf` (Not Before Time) token claim is required. The default value is `false`.
`updatedAt`	Date	N/A	Read-only	The time the resource was last updated.

audiences[]

Array

Optional

Mutable

An array of audience values. If specified, at least one audience in the incoming token’s aud array must match one of the defined audiences. If not set, the incoming JWT aud claim is ignored.

clockSkew

Integer

Optional

Mutable

A value in seconds that compensates for small time synchronization discrepancies between different entities to protect against failed validation because of clock differences. The minimum value is 0; the maximum value is 60.

createdAt

Date

N/A

Read-only

The time the resource was created.

description

String

Optional

Mutable

A description of the trusted issuer.

environment.id

String

N/A

Immutable

The identifier of the environment resource referenced by this relationship.

expRequired

Boolean

Optional

Mutable

Indicates whether the exp (Expiration Time) token claim is required. The default value is true.

iatRequired

Boolean

Optional

Mutable

Indicates whether the iat (Issued At Time) token claim is required. The default value is false.

id

String

N/A

Immutable

The attribute’s unique identifier.

issuer

String

Required

Mutable

A URL (supports https:// only) that identifies the trusted issuer.

jwks

String

Required/Optional

Mutable

A JWKS string that validates the signature of signed JWTs. This property is set in configurations where the jwksurl option is not set.

jwksUrl

String

Required/Optional

Mutable

A URL (supports https:// only) that provides access to a JWKS string that validates the signature of signed JWTs. This property is set in configurations where the jwks option is not set.

maxFutureValidity

Integer

Optional

Mutable

Configures the token’s maximum amount of time (in seconds) on how far in the future the exp (Expiration Time) claim can be set. The minimum value is 0; the maximum value is 30 days.

name

String

Required

Mutable

The name of the trusted issuer.

nbfRequired

Boolean

Optional

Mutable

Indicates whether the nbf (Not Before Time) token claim is required. The default value is false.

updatedAt

Date

N/A

Read-only

The time the resource was last updated.

Trusted issuers events generated

Refer to Audit Reporting Events for the events generated.

PingOne Platform APIs

Trusted issuers

Trusted issuers data model

Trusted issuers events generated