Set up PingOne

Configure single sign-on (SSO) for your PCD environment using PingOne as a SAML 2.0 identity provider.

Configure single sign-on (SSO) for your PCD environment using PingOne. This integration allows users to authenticate to PCD using their existing PingOne credentials.

Prerequisites

Before you begin, ensure you have:

  • Administrative access to PingOne.

  • Administrative access to your PCD environment.

  • Your PCD domain FQDN (fully qualified domain name), without the region name.

  • Users created in PingOne who need access to PCD.

Step 1: Create a SAML application in PingOne

Create a new SAML application in PingOne to handle the SSO integration.

  1. Log in to PingOne.

  2. Navigate to Applications, and then select + to create a new application.

  3. Enter a unique name for the application.

  4. For application type, select SAML Application.

  1. For SAML Configuration method, select Manually Enter, and then configure the following fields.

Field
Value

ACS URLs

https://<DU_FQDN>/keystone

Entity ID

https://<DU_FQDN>/sso/IDP1/Shibboleth.sso/SAML2/POST

NOTE

Replace <DU_FQDN> with your actual domain FQDN without the region name. For example, use companyx instead of companyx-regionone.

  1. Save the application and enable it.

  1. On the application page, go to Attribute Mappings.

  2. Add the attributes required for PCD authentication and group membership. At minimum, configure attributes for the user's identifier, email, first name, last name, and group membership.

NOTE

The names you assign to each attribute. You will reference these names in the attribute map XML and SAML group configuration in PCD.

Step 2: Assign users and groups in PingOne

Create a group in PingOne, add users to the group, and assign the group to the SAML application.

  1. Navigate to Groups in PingOne.

  2. Create a new group and enter a name.

  3. Select the group you created, and then add the users who need access to PCD.

  4. Go to Applications, and then select the SAML application you created in Step 1.

  5. Go to the Access tab, and then select the edit option.

  6. Search for the group name, select it, and then select Save.

Step 3: Configure SSO settings in PCD

Configure your PCD environment to use the PingOne SSO integration.

  1. Log in to your PCD environment.

  2. Navigate to Settings > Enterprise SSO.

  3. On the Enterprise SSO page, enable SSO, and then configure the following settings.

    Field
    Description

    SSO Provider

    Select PingOne from the available options.

    Entity ID

    Copy the Issuer ID from the Connection Details section of your PingOne application Overview tab, and paste it here.

    SAML Metadata URL

    Copy the IDP Metadata URL from the Connection Details section of your PingOne application Overview tab, and paste it here.

    SSO Provider Attribute Map in XML

    Paste the attribute map XML that covers all attributes added to your PingOne application. See the sample in step 4.

  4. Construct the attribute map XML to cover all attributes added to the PingOne application. Use the following sample as a starting point.

  5. Paste the completed attribute map XML into the SSO Provider Attribute Map in XML field.

  6. Select Save.

Your PCD SSO connection to PingOne is now configured.

Step 4: Configure SAML groups in PCD

Set up SAML groups to manage user permissions and role assignments in PCD.

  1. On the Enterprise SSO page, select SAML Groups.

  2. Select Add Group.

  3. Configure the group settings.

    Field
    Description

    Name

    Enter a unique name for the group.

    Description

    Enter a brief description of the group.

    SAML Attribute Key for First Name

    Enter the attribute key for the user's first name (for example, firstname).

    SAML Attribute Key for Last Name

    Enter the attribute key for the user's last name (for example, lastname).

    SAML Attribute Key for Email

    Enter the attribute key for the user's email (for example, email).

NOTE

The attribute keys must match those configured in your attribute map XML and in your PingOne application's attribute mappings.

  1. For Username Attribute Mapping Template and Email Attribute Mapping Template, enter a template using the format {attributeKey}, where attributeKey corresponds to attributes configured in PingOne.

  2. Configure the group mapping.

    Field
    Description

    SAML Group Attribute

    Enter the group attribute name configured in your PingOne attribute mappings (for example, groupnames).

    Criteria

    Select Any one of.

    SAML Group Values

    Enter the name of the group configured in PingOne (for example, Admingroup).

  3. Under Tenants & Roles, assign the group to appropriate tenants and roles (Administrator or Self-Service User).

  4. Select Save.

Your SAML group is now configured in PCD.

Step 5: Test the SSO configuration

Verify that your PingOne SSO integration works correctly.

  1. Log out of your current PCD session.

  2. Open a new private or incognito browser window.

  3. Navigate to your PCD login page.

  4. Select Sign In with SSO.

  5. Complete the authentication process using your PingOne credentials.

  6. Verify you can access PCD resources according to your assigned role.

You have now successfully configured SSO integration between PCD and PingOne. Users can authenticate using their existing PingOne credentials and access PCD resources based on their assigned roles and permissions.

Last updated

Was this helpful?