---
title: 'Tutorial: How to Configure SAML with PingFederate SSO'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-pingfederate-sso/
product: Access Server Docs
description: This is a step-by-step guide for configuring SAML on Access Server with PingFederate SSO.
---

# Tutorial: How to Configure SAML with PingFederate SSO

## Overview

Access Server supports SAML authentication with PingFederate SSO as the identity provider. You can configure this in PingFederate with Access Server as your service provider.

The following steps walk you through enabling SAML authentication for users and groups from PingFederate SSO to Access Server.

## Prerequisites

You need the following to get started:

- An installed PingFederate server.
- A deployed [Access Server](https://openvpn.net/quick-start-guide/).

## Step 1: Create the PingFederate SAML application

With PingFederate, you must create a custom SAML application.

First, gather information about your Access Server as the service provider (SP).

1. Sign in to your Access Server Admin Web UI.
2. Select **Authentication → SAML**.
3. You'll need the following information:
   1. **SP Identity**.
   2. **SP ACS**.

Now that you have your SP information, you can create a new PingFederate SAML app and enter that information during app creation.

### Create a new SP connection

1. Sign in to your PingFederate admin portal.
2. Go to **Applications → Applications → SP Connections**.
3. Click **Create Connection**.
4. On the **Connection Template** tab, click **Do not use a template for this connection**, and click **Next**.
5. On the **Connection Type** tab, select the **Browser SSO Profiles** checkbox.
6. For **Protocol**, select **SAML 2.0**, and click **Next**.
7. On the **Connection options** tab, leave **Browser SSO** selected, and click **Next**.

### Enter the Access Server SP data

1. On the **Import metadata** tab, leave **None** selected and click **Next**.
2. On the **General Info** tab, use the SP information from Access Server to enter the following:
   - **PARTNER'S ENTITY ID:** Enter the Access Server **SP Identity**.
   - **CONNECTION NAME:** Enter something meaningful (e.g., OpenVPN-AS).
   - **VIRTUAL SERVER IDS:** Leave this field empty.
   - **BASE URL:** Enter the Access Server **SP ACS**.
3. Click **Next** to proceed.

### Configure Browser SSO settings

1. On the **Browser SSO** tab, click **Configure Browser SSO**.
2. Select **IDP-INITIATED SSO** and **SP-INITIATED SSO**, and click **Next**.
3. Accept defaults on the **Assertion Lifetime** tab and click **Next**.

### Configure Assertion Creation

1. On the **Assertion Creation** tab, click **Configure Assertion Creation**.
2. Select **STANDARD**, and click **Next**.
3. On the **Attribute Contract** tab, ensure **SAML\_SUBJECT** uses `urn:oasis:names:tc:SAML1.1:nameid-format:unspecified`, then click **Next**.
4. On the **Authentication Source Mapping** tab, click **Map New Adapter Instance** and select your adapter.
   - For **Mapping Method**, select **Use only the adapter contract values in the SAML assertion**.
   - For **Attribute Contract Fulfillment**, set **Source** to **Adapter** and **Value** to **username**.
5. Click **Next** through the **Issuance Criteria** and **Summary** tabs.

### Configure Protocol Settings

1. On the **Protocol Settings** tab, click **Configure Protocol Settings**.
2. Set the **Binding** to **POST** and the **Endpoint URL** to `/saml/acs`.
3. Under **Signature Policy**, select **Always sign assertion** and **Sign response as required**.
4. Accept defaults on **Encryption Policy** and **Summary**, then click **Done**.

### Configure Credentials

1. Go to the **Credentials** tab and click **Configure Credentials**.
2. Under **Digital Signature Settings**, select a signing certificate, then click **Next → Done**.
3. Click **Next** through the remaining tabs until you reach **Activation & Summary**.
4. Click **Save** to finalize the connection.

### Export the PingFederate metadata

1. Return to the **SP Connections** list.
2. Click **Selection Action → Export Metadata** to download the PingFederate metadata file.

## Step 2: Configure PingFederate SAML data with Access Server

The simplest way to set up PingOne SAML for Access Server is to provide the metadata XML file.

### Upload the PingFederate metadata file in the Admin Web UI

Provide the downloaded metadata XML file to your Access Server through the Admin Web UI to automatically configure SAML:

1. Sign in to your Access Server Admin Web UI.
2. Click **Authentication**.
3. Click the **SAML** tab.
4. Set **Enable SAML authentication** to **Enabled**.
5. Under **Configure Identity Provider**, click **Configure using metadata URL/file**.
   - The **Configure using metadata** modal displays.
6. Click **Click to upload** to select your XML file or drag and drop it onto the modal window.
   - The Identity Provider data populates the corresponding fields.
7. Click **Save** and **Restart**.

## Step 3: Assign SAML as user authentication

You can now enable SAML as the [global default authentication](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-default-auth.md) or for [specific groups and users](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-users-groups.md).

## Optional: Map SAML group access control

You can automate group assignments for access control rules using a post-authentication Python script.

Refer to the steps in this tutorial:

- [Tutorial: How to Set Up SAML Group Mapping with a Post-Auth Script](https://openvpn.net/as-docs/v3/tutorials/tutorial--post-auth-saml-group-mapping.md)

---

Prev: [Tutorial: How to Configure SAML with PingOne SSO](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-pingone.md)
Next: [Tutorial: Configure Access Server SAML Authentication with DUO MFA and your IdP](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-with-duo-mfa.md)
Index: https://openvpn.net/as-docs/llms.txt