Tutorial: How to Configure SAML with PingOne SSO
This is a step-by-step guide for configuring SAML on Access Server with PingOne SSO.
Overview
Access Server 2.11 and newer supports authentication using SAML with PingOne as the identity provider. You can configure this in PingOne with Access Server as your service provider.
The following steps walk you through enabling SAML authentication for users and groups from PingOne to Access Server.
You need the following to get started:
A deployed Access Server.
Important
We recommend using all lowercase usernames when signing in with SAML.
With PingOne, you must create a custom SAML application.
Now that you have your SP information, you can create a new PingOne SAML app and enter that information during app creation:
Sign in to your PingOne admin portal.
Under Applications, click Applications.
Click + to add a new SSO app.
Provide a name under Application Name.
Click SAML Application under Application Type.
Click Configure.
Under SAML Configuration, click Manually Enter.
Use the SP information from Access Server to enter the following into the PingOne app:
ACS URLs: Enter the Access Server SP ACS.
Entity ID: Enter the Access Server SP Identity.
Click Save.
Under Attribute Mappings, click the Pencil icon.
Under PingOne Mappings, select Email Address.
Click Save.
Enable the PingOne SAML App by clicking on the Toggle next to the SAML App.
The simplest way to set up PingOne SAML for Access Server is by providing metadata to Access Server. You can download a metadata XML file or copy over the data for a manual configuration.
Option 1: Download the PingOne metadata file for automatic configuration
With your new app, click the Configuration tab.
Under Connection Details, click Download Metadata.
Option 2: Copy the PingOne SAML data for manual configuration
With your new app, click the Configuration tab.
Copy the contents in Issuer ID, Single Signon Service, and click Download Signing Certificate to download the certificate in PEM format (.crt file)
Now that you have the metadata, you can provide it to your Access Server through the Admin Web UI to automatically configure SAML by following option one.
If you copied the SAML data, follow the steps in option two to paste it into the SAML page for Access Server.
Option 1: Upload the PingOne metadata file in the Admin Web UI.
Provide the downloaded metadata XML file to your Access Server through the Admin Web UI to automatically configure SAML:
Sign in to your Access Server Admin Web UI.
Click Authentication > SAML.
Click Configure Identity Provider (IdP) Automatically via Metadata to expand the section.
In the field Select IdP Metadata, click Choose File to upload the XML file you downloaded from PingOne, then click Upload and Update Running Server.
The IdP fields are now populated under Configure Identity Provider (IdP) Manually.
Option 2: Manually configure PingOne SAML
Sign in to your Access Server Admin Web UI.
Click Authentication > SAML.
Click Configure Identity Provider (IdP) Manually to expand the section.
Paste the following from PingOne into the Access Server fields:
Access Server Sign On Endpoint: PingOne Single Signon Service.
Access Server IdP EntityID: PingOne's Issuer ID.
Access Server Certificate (PEM format): PingOne's certificate.crt.