---
title: 'Tutorial: How to Configure SAML with PingFederate SSO'
canonical: https://openvpn.net/as-docs/tutorials/saml-pingfederate-sso/
product: Access Server Docs
description: This is a step-by-step guide for configuring SAML on Access Server with PingFederate SSO.
---

# Tutorial: How to Configure SAML with PingFederate SSO

## Overview

Access Server 2.11 and newer supports SAML authentication with PingFederate SSO as the identity provider. You can configure this in PingFederate with Access Server as your service provider.

The following steps walk you through enabling SAML authentication for users and groups from PingFederate SSO to Access Server.

## Prerequisites

You need the following to get started:

- An installed PingFederate server.
- A deployed [Access Server](https://openvpn.net/quick-start-guide/).

## Step 1: Create the PingFederate SAML application

With PingFederate, you must create a custom SAML application.

First, gather information about your Access Server as the service provider (SP).

1. Sign in to your Access Server Admin Web UI.
2. Select **Authentication → SAML**.
3. You'll need the following information:
   1. **SP Identity**.
   2. **SP ACS**.

Now that you have your SP information, you can create a new PingFederate SAML app and enter that information during app creation.

### Create a new SP connection

1. Sign in to your PingFederate admin portal.
2. Go to **Applications → Applications → SP Connections**.
3. Click **Create Connection**.
4. On the **Connection Template** tab, click **Do not use a template for this connection**, and click **Next**.
5. On the **Connection Type** tab, select the **Browser SSO Profiles** checkbox.
6. For **Protocol**, select **SAML 2.0**, and click **Next**.
7. On the **Connection options** tab, leave **Browser SSO** selected, and click **Next**.

### Enter the Access Server SP data

1. On the **Import metadata** tab, leave **None** selected and click **Next**.
2. On the **General Info** tab, use the SP information from Access Server to enter the following:
   - **PARTNER'S ENTITY ID:** Enter the Access Server **SP Identity**.
   - **CONNECTION NAME:** Enter something meaningful (e.g., OpenVPN-AS).
   - **VIRTUAL SERVER IDS:** Leave this field empty.
   - **BASE URL:** Enter the Access Server **SP ACS**.
3. Click **Next** to proceed.

### Configure Browser SSO settings

1. On the **Browser SSO** tab, click **Configure Browser SSO**.
2. Select **IDP-INITIATED SSO** and **SP-INITIATED SSO**, and click **Next**.
3. Accept defaults on the **Assertion Lifetime** tab and click **Next**.

### Configure Assertion Creation

1. On the **Assertion Creation** tab, click **Configure Assertion Creation**.
2. Select **STANDARD**, and click **Next**.
3. On the **Attribute Contract** tab, ensure **SAML\_SUBJECT** uses `urn:oasis:names:tc:SAML1.1:nameid-format:unspecified`, then click **Next**.
4. On the **Authentication Source Mapping** tab, click **Map New Adapter Instance** and select your adapter.
   - For **Mapping Method**, select **Use only the adapter contract values in the SAML assertion**.
   - For **Attribute Contract Fulfillment**, set **Source** to **Adapter** and **Value** to **username**.
5. Click **Next** through the **Issuance Criteria** and **Summary** tabs.

### Configure Protocol Settings

1. On the **Protocol Settings** tab, click **Configure Protocol Settings**.
2. Set the **Binding** to **POST** and the **Endpoint URL** to `/saml/acs`.
3. Under **Signature Policy**, select **Always sign assertion** and **Sign response as required**.
4. Accept defaults on **Encryption Policy** and **Summary**, then click **Done**.

### Configure Credentials

1. Go to the **Credentials** tab and click **Configure Credentials**.
2. Under **Digital Signature Settings**, select a signing certificate, then click **Next → Done**.
3. Click **Next** through the remaining tabs until you reach **Activation & Summary**.
4. Click **Save** to finalize the connection.

### Export the PingFederate metadata

1. Return to the **SP Connections** list.
2. Click **Selection Action → Export Metadata** to download the PingFederate metadata file.

## Step 2: Configure PingFederate SAML data with Access Server

The simplest way to set up PingOne SAML for Access Server is to provide the metadata XML file.

### Upload the PingFederate metadata file in the Admin Web UI

Provide the downloaded metadata XML file to your Access Server through the Admin Web UI to automatically configure SAML:

1. Sign in to your Access Server Admin Web UI.
2. Click **Authentication \> SAML**.
3. Click **Configure Identity Provider (IdP) Automatically via Metadata** to expand the section.
4. Click **Choose File** for **Select IdP Metadata File**.
5. Select your PingFederate metadata XML file, click **Upload** and **Update Running Server**.
   - The IdP fields are now populated under **Configure Identity Provider (IdP) Manually**.

## Step 3: Assign SAML as user authentication

Once you’ve provided the SAML configuration for your IdP, you can enable it for users.

1. Sign in to the Admin Web UI.
2. Select **Authentication → SAML**.
3. Select the toggle to turn on **Enable SAML authentication**.
4. Select **Save Settings** and **Update Running Server**.

You can now enable SAML as the [global default authentication](https://openvpn.net/as-docs/tutorials/saml-default-auth.md) or for [specific groups and users](https://openvpn.net/as-docs/tutorials/saml-users-groups.md).

---

Prev: [Tutorial: How to Configure SAML with PingOne SSO](https://openvpn.net/as-docs/tutorials/saml-pingone.md)
Next: [Tutorial: Configure Access Server SAML Authentication with DUO MFA and your IdP](https://openvpn.net/as-docs/tutorials/saml-with-duo-mfa.md)
Index: https://openvpn.net/as-docs/llms.txt