How to configure PingFederate for SSO

This topic details how to configure PingFederate for single sign-on (SSO).

IMPORTANT Before completing these steps, you will need to follow the steps in Prepare Venafi Platform for SAML SSO. You will need configuration information from the Venafi Service Provider Metadata XML file to complete this process.

PingFederate is an on-premise single sign-on (SSO) identity provider and directory service.

NOTE These instructions were written based on PingFederate 10.2 on Windows Server 2016. If your server or software version is different, you will need to make necessary adjustments.

You must have an existing functional PingFederate deployment to use these steps. These instructions detail how to add a new Application (Venafi Platform).

You will want to consult with your identity provider management team to determine who should be able to authenticate to Venafi Platform via Ping Federate. You'll need that information near the end of the procedure below.

IMPORTANT While Venafi makes an effort to provide accurate information on third-party integration steps, these steps may differ for your service provider, especially as identity providers release new updates. If you have questions about how to use this third-party integration, we recommend you start with the vendor's documentation and support teams. These instructions should be considered a template, not definitive steps. Your specific steps may vary, depending on how your organization integrates with each third-party platform.

To configure PingFederate for single sign-on

Log in to PingFederate on-premise, and open Applications.
From the side menu, click Integration > SP Connections.
Click Create Connection.

PingFederate does not support the Service Provider Metadata XML file, which is why you can't click Import Connection.

In the SP Connections section:

In the Connection Template tab

PingFederate SP Connections Template settings
Field	Value
Template	Do not use a template for this connection

In the Connection Type tab

PingFederate SP Connections Connection settings
Field	Value
Browser SSO Profiles	Checked
Protocol	SAML 2.0
WS-Trusts STS	Unchecked
Outbound Provisioning	Unchecked

Click Next.

In the Connection Options tab

PingFederate SP Connections Connection Options settings
Field	Value
Browser SSO	Checked
Attribute Query	Unchecked

Click Next.

In the Import Metadata tab

PingFederate SP Connections Metadata settings
Field	Value
Metadata	File (radio button)

Then click Choose File, and select the Service Provider Metadata XML file you saved from Venafi Platform, then click Next.

In the Metadata Summary tab

PingFederate SP Connections Metadata Summary
Field	Value
Entity ID	This field will contain the FQDN obtained from the XML file.

Click Next.

In the General Info tab

PingFederate SP Connections General Info settings
Field	Value
Partner's Entity ID	This field will contain the EntityID from the XML file.
Connection Name	This field will contain the Entity ID from the XML file. You can customize this, if you prefer.
Base URL	This field will contain the URL from the XML file.

Click Next.

In the Browser SSO tab, click Configure Browser SSO.

In the SAML Profiles sub-tab,
- Check - IDP-INITIATED SSO (only works if Venafi Platform is reachable by IP address or FQDN)
- Check - SP-INITIATED SSO.
- Unchecked - IDP-INITIATED SLO.
- Unchecked - SP-INITIATED SLO.
In the Assertion Lifetime sub-tab, leave default settings.

In the Assertion Creation sub-tab, click Configure Assertion Creation.

On Identity Mapping, select STANDARD.
On Attribute Contract select the following from the SAML_Subject dropdown: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

On Authentication Source Mapping, click Map New Adapter Instance.

For Adapter Instance, select FederateUsers.
For Mapping Method, select Use only the Adapter Contract values in the SAML assertion.

For Attribute Contract Fulfillment:

PingFederate Attribute Contract Fulfillment
Attribute	Source	Value
SAML_SUBJECT	Adapter	username

For Issuance Criteria, leave empty.
For Summary, review, then click Done.

You'll be taken back to the Authentication Source Mapping page. Click Next.

On Summary, review, then click Done.

You'll be taken back to the Assertion Creation sub-tab. Click Next.

In the Protocol Settings sub-tab, click Configure Protocol Settings.

On Assertion Customer Service URL, accept the default settings.

On Allowable SAML Bindings:

PingFederate Allowable SAML Bindings
Field	Setting
Artifact	Unchecked
Post	Checked
Redirect	Checked
SOAP	Unchecked

On Signature Policy:

PingFederate Signature Policy
Field	Setting
Require Authn Requests...	Unchecked
Always sign assertion	Checked
Sign Response as required	Checked

On Encryption Policy, accept the default settings (none).
On Protocol Settings Summary, review, then click Done.

You'll be taken back to the Protocol Settings page. Click Next.

In the Summary sub-tab, review, then click Done.

You'll be taken back to the Browser SSO tab. Click Next.

In the Credentials tab, click Configure Credentials.

In the Digital Security Settings sub-tab:

PingFederate Digital Security settings
Field	Value
Signing Certificate	Select any; If none exist, click Manage Certificates to either create one or import one for use.
Signing Algorithm	RSA SHA256

In the Summary sub-tab, review, then click Done.

You'll be taken back to the Credentials tab. Click Next.

In the Activation and Summary tab, review your selections, then click Save.

You'll be taken back to the SP Connections section, where you can see the newly-created connection.

In the SP Connections section, locate your newly-created connection, then click Select Action > Export Metadata.
On the Metadata Signing sub-tab, select any signing certificate, and select the RSA SHA256 signing algorithm, then click Next.
On the Export & Sumary sub-tab, click Export. We refer to this file as the IDP Metadata XML file in our documentation.

You'll need to save this to your Venafi Platform server, in a place you can find it later.

You are ready to finish configuring SSO in Venafi Configuration Console. See Importing Identity Provider Metadata XML into Venafi Configuration Console for SAML.