---
title: 'Tutorial: How to Configure SAML with PingOne SSO'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-pingone/
product: Access Server Docs
description: This is a step-by-step guide for configuring SAML on Access Server with PingOne SSO.
---

# Tutorial: How to Configure SAML with PingOne SSO

## Overview

Access Server supports authentication using SAML with PingOne as the identity provider. You can configure this in PingOne with Access Server as your service provider.

The following steps walk you through enabling SAML authentication for users and groups from PingOne to Access Server.

## Prerequisites

You need the following to get started:

- A [PingOne account](https://www.pingidentity.com/en/platform/capabilities/single-sign-on.html).
- A deployed [Access Server](https://openvpn.net/quick-start-guide/).

> **Important**
>
> We recommend using all lowercase usernames when signing in with SAML.

## Step 1: Create the PingOne SAML application

With PingOne, you must create a custom SAML application.

First, gather information about your Access Server as the service provider (SP).

1. Sign in to your Access Server Admin Web UI.
2. Select **Authentication → SAML**.
3. You'll need the following information:
   1. **SP Identity**.
   2. **SP ACS**.

Now that you have your SP information, you can create a new PingOne SAML app and enter that information during app creation:

1. Sign in to your PingOne admin portal.
2. Under **Applications**, click **Applications**.
3. Click + to add a new SSO app.
4. Provide a name under **Application Name**.
5. Click **SAML Application** under **Application Type**.
6. Click **Configure**.
7. Under **SAML Configuration**, click **Manually Enter**.
8. Use the SP information from Access Server to enter the following into the PingOne app:
   1. **ACS URLs:** Enter the Access Server **SP ACS**.
   2. **Entity ID:** Enter the Access Server **SP Identity**.
9. Click **Save**.
10. Under **Attribute Mappings**, click the **Pencil** icon.
11. Under **PingOne Mappings**, select **Email Address**.
12. Click **Save**.
13. Enable the PingOne SAML App by clicking on the Toggle next to the SAML App.

## Step 2: Copy or download the PingOne metadata

The simplest way to set up PingOne SAML for Access Server is to provide the metadata to Access Server. You can download a metadata XML file or copy over the data for a manual configuration.

### Option 1: Download the PingOne metadata file for automatic configuration

1. With your new app, click the **Configuration** tab.
2. Under **Connection Details**, click **Download Metadata**.

### Option 2: Copy the PingOne SAML data for manual configuration

1. With your new app, click the **Configuration** tab.
2. Copy the contents in **Issuer ID**, **Single Signon Service**, and click **Download Signing Certificate** to download the certificate in PEM format (.crt file)

## Step 3: Configure PingOne SAML data with Access Server

Now that you have the metadata, you can provide it to your Access Server through the Admin Web UI to automatically configure SAML by following option one.

If you copied the SAML data, follow the steps in option two to paste it into the **SAML** tab in your Access Server Admin Web UI.

### Option 1: Upload the PingOne metadata file in the Admin Web UI.

Provide the downloaded metadata XML file to your Access Server through the Admin Web UI to automatically configure SAML:

1. Sign in to the Admin Web UI.
2. Select **Authentication**.
3. Select the **SAML** tab.
4. Set **Enable SAML authentication** to **Enabled**.
5. Under **Configure Identity Provider (IdP)**, Select **Configure using metadata URL/file**.
   - The **Configure using metadata** modal displays.
6. Click **Click to upload** to select your XML file or drag and drop it into the modal window.
   - The Identity Provider data populates the corresponding fields.
7. Select **Save** and **Restart**.

### Option 2: Manually configure PingOne SAML

1. Sign in to the Admin Web UI.
2. Select **Authentication**.
3. Select the **SAML** tab.
4. Set **Enable SAML authentication** to **Enabled**.
5. Under **Configure Identity Provider (IdP)**, manually enter the Auth0 configuration data into the appropriate fields:
   - Paste the PingOne **Issuer ID** into Access Server’s **IdP Entity ID**.
   - Paste the PingOne **Single Signon Service** into Access Server’s **SSO (Single Sign-On) Endpoint**.
   - Paste the PingOne **certificate.crt** into Access Server’s **Certificate (PEM format)**.
6. Select **Save** and **Restart**.

## Step 4: Assign SAML as user authentication

You can now enable SAML as the [global default authentication](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-default-auth.md) or for [specific groups and users](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-users-groups.md).

## Optional: Map SAML group access control

You can automate group assignments for access control rules using a post-authentication Python script.

Refer to the steps in this tutorial:

- [Tutorial: How to Set Up SAML Group Mapping with a Post-Auth Script](https://openvpn.net/as-docs/v3/tutorials/tutorial--post-auth-saml-group-mapping.md)

---

Prev: [Tutorial: How to Configure SAML with AWS](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-aws.md)
Next: [Tutorial: How to Configure SAML with PingFederate SSO](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-pingfederate-sso.md)
Index: https://openvpn.net/as-docs/llms.txt