Configuration Guides

Configuring SAML SSO with UltiPro and PingFederate

Learn how to enable UltiPro sign-on from the PingFederate console (IdP-initiated sign-on) and direct UltiPro sign-on using PingFederate (SP-initiated sign-on).

Before you begin

  • Configure PingFederate to authenticate against an IdP or datastore containing the users requiring application access.

  • Populate UltiPro with at least one user to test access.

  • You must have administrative access to PingFederate.

Create a PingFederate SP connection for UltiPro

  1. Sign on to the PingFederate administrative console.

  2. Create an SP connection for UltiPro in Ping Federate:

    1. Configure using Browser SSO profile SAML 2.0.

    2. Set Partner’s Entity ID to placeholder.

      You’ll change this later.

    3. Enable the following SAML Profiles:

      • IdP-Initiated SSO

      • SP Initiated SSO

    4. In Assertion Creation: Authentication Source Mapping: Attribute Contract Fulfillment, map the SAML_SUBJECT.

    5. In Protocol Settings: Assertion Consumer Service URL, set Binding to POST, and set Endpoint URL to https://placeholder.

      You’ll change the Endpoint URL later.

    6. In Protocol Settings: Allowable SAML Bindings, enable POST.

    7. In Credentials: Digital Signature Settings, select the PingFederate signing certificate.

  3. Export the metadata for the newly created UltiPro SP connection.

  4. Export the signing certificate.

Add the PingFederate connection to UltiPro

  1. Contact UltiPro Customer Support and request that SAML 2 be enabled for your organization.

  2. Provide them with the downloaded PingFederate signing certificate and metadata.

  3. Request their ACS URL and EntityID values.

Update the ACS URL values in PingFederate

  1. Sign on to the PingFederate administrative console.

  2. Edit the SP connection for UltiPro.

  3. Set Partner’s Entity ID to the UltiPro Entity ID value.

  4. In Protocol Settings: Assertion Consumer Service URL, set Endpoint URL to the UltiPro Assertion Consumer Service URL value.

  5. Save the changes.

Test the PingFederate IdP-initiated SSO integration

  1. Go to the PingFederate SSO application endpoint for the UltiPro SP connection.

  2. Complete the PingFederate authentication.

    You’re redirected to your UltiPro domain.

Test the PingFederate SP-initiated SSO integration

  1. Go to your UltiPro application.

  2. After you’re redirected to PingFederate, enter your PingFederate username and password.

    You’re redirected back to UltiPro.