Configuring SSO with PingOne - PingIntelligence for APIs

Configuring SSO with PingOne - PingIntelligence for APIs - 4.4

PingIntelligence

bundle

pingintelligence-44

ft:publication_title

PingIntelligence

Product_Version_ce

PingIntelligence for APIs 4.4

category

APISecurity

AdvancedAPICybersecurity

Capability

Environment

Product

apisecurity

capability

linux

pi-44

pingintelligence

private

ContentType_ce

Page created: 24 Mar 2021 |

Page updated: 12 May 2021

| 2 min read

4.4 Capability API Security Advanced API Cybersecurity Linux On-Premises Operating System Hosting Environment PingIntelligence for APIs Product

This topic discusses steps involved in configuring single sign-on (SSO) to PingIntelligence for APIs Dashboard from PingOne. This feature is available in PingIntelligence for APIs 4.4.1 and later versions.

Verify the following prerequisites for SSO configuration:

An installed PingIntelligence for APIs Dashboard.
Access to the the PingOne administration console console. For more information, see Accessing the admin console home page.

SSO configuration for PingIntelligence Dashboard involves configuring both Dashboard and PingOne.

Create an OIDC (OpenID Connect) web application in PingOne to setup SSO to PingIntelligence Dashboard . To configure the OIDC application, complete the steps explained in Configuring an OIDC Application in PingOne for PingIntelligence Dashboard.
Set the value of pi.webgui.server.authentication-mode to sso in <pi_install_dir>/pingidentity/webgui/config/webgui.properties file.
```
### Authentication mode
# valid values: native, sso
pi.webgui.server.authentication-mode=sso
```
Note: PingIntelligence for APIs Dashboard provides two methods for user authentication: native or SSO. SSO authentication should be used only for production deployments. Use native authentication for PoC deployments.
Configure the <pi_install_dir>/pingidentity/webgui/sso.properties file to complete the PingIntelligence Dashboard's SSO authentication. For more information, see Configuring Dashboard sso.properties for PingOne.

Obfuscate keys added in SSO properties using the following commands.


# cd <pi_install_dir>/pingidentity/webgui
# ./bin/cli.sh obfuscate_keys

Restart the PingIntelligence Dashboard after configuring SSO in PingOne and PingIntelligence Dashboard. For more information, see Start and stop Dashboard.
When the PingIntelligence Dashboard is started successfully, access it using https://<pi_install_host>:8030. The Dashboard will start SSO Authentication, and a new session will get created for the logged-in users.

If the SSO authentication fails for any reason, PingIntelligence Dashboard shows the following error message.

Screenshot for PingIntelligence Dashboard SSO error

Note: Every PingIntelligence Dashboard SSO authentication event is attached with a unique ID, which is logged in <pi_install_dir>/pingidentity/webgui/logs/admin/sso.log. You can filter sso-event-ref = <unique ID> in the <pi_install_dir>/pingidentity/webgui/logs/admin/sso.log file to find the reason for SSO failure.