Pega Cloud OIDC – Which Token Is Used for JWT Assertion?

General
, , ,
1

Hello,

We are migrating from Pega on-premises to Pega Cloud and implementing OIDC-based SSO.

During the SSO login flow, our IdP system returns an id_token, access_token, and refresh_token. We can access the id_token from the clipboard, while the access_token and refresh_token are stored encrypted in the Pega database and are not directly accessible or decryptable for use in downstream API calls during the case lifecycle.

For downstream API calls, we have configured the Authentication Profile with the following settings:

  • Grant Type: JWT Bearer

  • JWT Assertion Source: Use token from active SSO session

We would like to clarify the following:

  1. When Use token from active SSO session is selected, does Pega use the OIDC id_token or access_token as the JWT assertion when making the request to the IdP’s token endpoint?

  2. If Pega uses the id_token as the assertion, what is the purpose of the OIDC access_token and refresh_token that Pega stores encrypted in the database?

    • Are these tokens used internally by Pega, for example, for session validation or refreshing the SSO session/token?

    • Or are they retained primarily for audit/reference purposes?

We would appreciate confirmation of the above behavior, particularly which token Pega uses as the JWT Bearer assertion, before we request the IdP team to enable the JWT Bearer grant type for the relevant client_id.