PingOne
PingOne
Single sign-on (SAML 2.0)
In the portal, choose PingOne under Enterprise SSO and Start with PingOne. Then, in PingOne:
- In the PingOne admin console, go to Applications → Applications and click the + icon.
- Enter an Application Name, choose the SAML application type, and click Configure.
- Choose Import from URL with our metadata URL below, or Manually Enter the ACS URLs and Entity ID, then Save.
- On the Configuration tab, set Subject NameID format to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress and map Email Address to the subject on Attribute Mappings.
- Turn the application on, then copy the IDP Metadata URL from the Overview tab.
The values the portal shows
| PingOne field | Value |
|---|---|
| Import from URL, optional | The portal's SP metadata URL (https://…/sso/saml/…/metadata) |
| ACS URLs | The portal's ACS URL (https://…/sso/saml/…/acs) |
| Entity ID | The portal's entity ID (https://…/sso/saml/…) |
| Subject NameID format (Configuration) | urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress |
| SLO Endpoint (Configuration), optional | The portal's Single Logout URL (https://…/sso/saml/…/slo) |
What to bring back
Copy IDP Metadata URL — the URL, or the XML — and paste it into the portal's Metadata URL or XML. Prefer the URL.
The assertion must be signed, and must carry the person's email address as an attribute or as a NameID in the emailAddress format. See Any SAML 2.0 provider for the details.
PingOne's own guide: https://docs.pingidentity.com/pingone/applications/p1_applications_add_applications.html.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Directory Sync (SCIM)
In the portal, choose PingOne under Directory sync and Create directory; copy the bearer token now, it is shown once. Then, in PingOne:
- Go to Integrations → Provisioning, click + and New Connection, then select Identity Store and the SCIM Outbound tile.
- Enter the SCIM Base URL below, set Authentication Method to OAuth 2 Bearer Token, paste the token below into OAuth Access Token, set Auth Type Header to Bearer, and click Test connection.
- Choose the user actions to allow, save, and turn the connection on.
- Click + and New Rule, choose PingOne as Source, select this connection and set the user filter and groups.
The values the portal shows
| PingOne field | Value |
|---|---|
| SCIM Base URL | The portal's SCIM base URL (https://…/scim/v2) |
| Authentication Method | OAuth 2 Bearer Token |
| OAuth Access Token | The bearer token the portal shows once |
| Auth Type Header | Bearer |
PingOne's own guide: https://docs.pingidentity.com/pingone/integrations/p1_create_scim_connection.html.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.
- Directory Sync — the portal's SCIM setup.