If you already have one or more identity providers configured through PingFederate (BYOIDP), your IdP records appear in Enterprise Console under Access Control > Identity providers. Each IdP shows its current status as Active (federation working) or Identity brokering (brokering not yet enabled). Starting with VantageCloud Enterprise 3.3, OpenID Connect IdPs require enabling Identity Brokering for users to access data plane services including Compute Engine.
Follow these steps to enable Identity Brokering.
- In the Enterprise homepage, click Enable brokering in the banner, or go to Access Control > Identity providers and locate the IdP showing the Identity brokering warning.
- A dialog box appears: "Enable identity brokering. Enable brokering for this OpenID Connect identity provider. You'll need to enable it separately for each OpenID Connect identity provider already set up to allow single sign-on through them." Click Enable to proceed, or Do not enable to defer.
- After enabling, you can edit the details of your identity provider screen.
- Enter your current client secret to re-authenticate the connection and click Continue.
- Verify or update the IdP URL, Client ID, and claims mapping (Subject, Username, Name, First_Name, Last_Name, Groups, Email). These fields pre-populate from your existing configuration. Update only if there are changes in your IdP application.
- Click Next.
- Edit group assignments, review or update the IdP groups assigned to each site:
- Use the icon to expand group assignments.
- Add or remove groups as needed (for example,. Nike_Analyst, DevOps).
- Click Save.