config.cfg

# INI file syntax – name/value pairs
# Make sure to use uppercase letters for your config keys.
DEBUG = True
# Enable the development environment, including the interactive debugger and automatic reloader(but to get changes from this file server should be restarted)
ENV = 'development'
# Enable CSRF protection
WTF_CSRF_ENABLED = True

AUTH_URL = 'https://auth.pingone.com/'
API_URL = 'https://api.pingone.com/v1/'

ENVIRONMENT_ID = '<environment_id>'
CLIENT_ID = '<client_id>'
# Application’s client secret that is required only if the application’s TOKEN_AUTH_METHOD is set to client_secret_post.
CLIENT_SECRET = '<client_secret>'
OAUTH_REDIRECT_PATH = '</callback>'
# OIDC or P14C custom scopes, separated by a space which you want to request authorization for.
# p1:read:userPassword and p1:reset:userPassword - scopes required for changing user password
SCOPE = 'phone profile address email openid p1:read:userPassword p1:reset:userPassword'
MAX_AGE = 3600
PROMPT = 'login'

# Authorization grant types by which a client application obtains an authorization grant in the form of an access token
# Possible values:  authorization_code, implicit, and client_credentials. If not specified - authorization_code is used.
# GRANT_TYPE = 'implicit'

# Determines whether an access token, an authorization code, or a JSON Web Token is returned by the authorization server
# Possible values: token, id_token. The token value - to return an access token, and the id_token value  - to return a JWT containing a set of claims that represent the authentication state of an end user
# Is necessary only for the implicit GRANT_TYPE. For client_credentials or authorization_code grant types it is auto detected.
# RESPONSE_TYPE = 'token id_token'

# Token endpoint method, used by the client to obtain an access token by presenting its authorization grant.
# Possible values: client_secret_post, none, client_secret_basic
#
# Notes:
# - "CLIENT_SECRET" is required if the "TOKEN_AUTH_METHOD" is set to 'client_secret_post'
# - for client_credentials requests in which the application’s tokenEndpointAuthMethod attribute value is set
# to client_secret_basic, the client_id and client_secret attributes cannot be part of the request body.
# In these cases, the client_id and client_secret are passed in as a Base64 encoded authorization header in the request.
# And it must not be set to a value of 'none' for a client_credentials grant type.
TOKEN_AUTH_METHOD = 'client_secret_post'