PingFederate
PingFederate
Single sign-on (SAML 2.0)
In the portal, choose PingFederate under Enterprise SSO and Start with PingFederate. Then, in PingFederate:
- In PingFederate, go to Applications → Integration → SP Connections and click Create Connection.
- Choose "Do not use a template for this connection", select Browser SSO Profiles with protocol SAML 2.0, and keep Browser SSO selected.
- On Import Metadata, load our metadata URL below — or enter our entity ID in Partner’s Entity ID (Connection ID) by hand.
- In Configure Browser SSO, select SP-Initiated SSO, choose Standard identity mapping, and fulfil SAML_SUBJECT from the adapter's mail attribute.
- In Protocol Settings, add an Assertion Consumer Service URL with Binding POST and our ACS URL as the Endpoint URL.
- Choose the signing certificate, activate the connection and save, then export its metadata under System → Protocol Metadata → Metadata Export.
The values the portal shows
| PingFederate field | Value |
|---|---|
| Metadata URL (Import Metadata → URL (add it under Manage Partner Metadata URLs)), optional | The portal's SP metadata URL (https://…/sso/saml/…/metadata) |
| Partner’s Entity ID (Connection ID) (General Info) | The portal's entity ID (https://…/sso/saml/…) |
| Endpoint URL (Protocol Settings → Assertion Consumer Service URL (Binding: POST)) | The portal's ACS URL (https://…/sso/saml/…/acs) |
| SAML_SUBJECT (Attribute Contract Fulfillment (Source: Adapter)) | mail |
| Endpoint URL (Protocol Settings → SLO Service URLs), optional | The portal's Single Logout URL (https://…/sso/saml/…/slo) |
What to bring back
Get Metadata Export and paste the XML into the portal's Metadata URL or XML.
The assertion must be signed, and must carry the person's email address as an attribute or as a NameID in the emailAddress format. See Any SAML 2.0 provider for the details.
PingFederate's own guide: https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_accessing_sp_connections.html.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Directory Sync (SCIM)
In the portal, choose PingFederate under Directory sync and Create directory; copy the bearer token now, it is shown once. Then, in PingFederate:
- Deploy the SCIM Provisioner add-on and choose a Provisioning Data Store — the built-in provisioner cannot use our bearer token.
- Create an SP connection from the SCIM Provisioner template with connection type Outbound Provisioning.
- On the Target screen, enter the SCIM URL below, choose SCIM Version 2.0 and OAuth 2 Bearer Token, and paste the token below into Access Token.
- Map attributes under Manage Channels, then activate the connection and save.
The values the portal shows
| PingFederate field | Value |
|---|---|
| SCIM URL (Outbound Provisioning → Target) | The portal's SCIM base URL (https://…/scim/v2) |
| SCIM Version (Outbound Provisioning → Target) | 2.0 |
| Authentication Methods (Outbound Provisioning → Target) | OAuth 2 Bearer Token |
| Access Token (Outbound Provisioning → Target) | The bearer token the portal shows once |
PingFederate's own guide: https://docs.pingidentity.com/integrations/scim/pf_scim_connector.html.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.
- Directory Sync — the portal's SCIM setup.