Tutorial: How to Configure SAML with PingOne SSO
Overview
Access Server 2.11 and newer supports authentication using SAML with PingOne as the identity provider. You can configure this in PingOne with Access Server as your service provider.
The following steps walk you through enabling SAML authentication for users and groups from PingOne to Access Server.
A deployed Access Server.
You need the following to get started:
With PingOne, you must create a custom SAML application.
First, gather information about your Access Server as the service provider (SP).
Sign in to your Access Server Admin Web UI.
Select Authentication → SAML.
You'll need the following information:
SP Identity.
SP ACS.
Now that you have your SP information, you can create a new PingOne SAML app and enter that information during app creation:
Sign in to your PingOne admin portal.
Under Applications, click Applications.
Click + to add a new SSO app.
Provide a name under Application Name.
Click SAML Application under Application Type.
Click Configure.
Under SAML Configuration, click Manually Enter.
Use the SP information from Access Server to enter the following into the PingOne app:
ACS URLs: Enter the Access Server SP ACS.
Entity ID: Enter the Access Server SP Identity.
Click Save.
Under Attribute Mappings, click the Pencil icon.
Under PingOne Mappings, select Email Address.
Click Save.
Enable the PingOne SAML App by clicking on the Toggle next to the SAML App.
The simplest way to set up PingOne SAML for Access Server is to provide the metadata to Access Server. You can download a metadata XML file or copy over the data for a manual configuration.
Option 1: Download the PingOne metadata file for automatic configuration
With your new app, click the Configuration tab.
Under Connection Details, click Download Metadata.
Option 2: Copy the PingOne SAML data for manual configuration
With your new app, click the Configuration tab.
Copy the contents in Issuer ID, Single Signon Service, and click Download Signing Certificate to download the certificate in PEM format (.crt file)
Now that you have the metadata, you can provide it to your Access Server through the Admin Web UI to automatically configure SAML by following option one.
If you copied the SAML data, follow the steps in option two to paste it into the SAML page for Access Server.
Option 1: Upload the PingOne metadata file in the Admin Web UI.
Provide the downloaded metadata XML file to your Access Server through the Admin Web UI to automatically configure SAML:
Sign in to your Access Server Admin Web UI.
Click Authentication > SAML.
Click Configure Identity Provider (IdP) Automatically via Metadata to expand the section.
In the field Select IdP Metadata, click Choose File to upload the XML file you downloaded from PingOne, then click Upload and Update Running Server.
The IdP fields are now populated under Configure Identity Provider (IdP) Manually.
Option 2: Manually configure PingOne SAML
Sign in to your Access Server Admin Web UI.
Click Authentication > SAML.
Click Configure Identity Provider (IdP) Manually to expand the section.
Paste the following from PingOne into the Access Server fields:
Access Server Sign On Endpoint: PingOne Single Signon Service.
Access Server IdP EntityID: PingOne's Issuer ID.
Access Server Certificate (PEM format): PingOne's certificate.crt.
Once you’ve provided the SAML configuration for your IdP, you can enable it for users.
Sign in to the Admin Web UI.
Select Authentication → SAML.
Select the toggle to turn on Enable SAML authentication.
Select Save Settings and Update Running Server.
You can now enable SAML as the global default authentication or for specific groups and users.