---
title: Configuring a SDG CTS SP Adapter instance
description: Configure the SDG CTS SP Adapter to determine how PingFederate communicates with your service provider (SP) application.
component: sdg
page_id: sdg:sdg_cts_integration_kit:pf_sdg_cts_ik_configuring_sp_adapter_instance
canonical_url: https://docs.pingidentity.com/integrations/sdg/sdg_cts_integration_kit/pf_sdg_cts_ik_configuring_sp_adapter_instance.html
llms_txt: https://docs.pingidentity.com/integrations/sdg/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: October 22, 2026
section_ids:
  steps: Steps
---

# Configuring a SDG CTS SP Adapter instance

Configure the SDG CTS SP Adapter to determine how PingFederate communicates with your service provider (SP) application.

## Steps

1. In the PingFederate admin console, go to **Applications > Integration > SP Adapters**.

2. Click **Create New Instance**.

3. On the **Type** tab, set the basic adapter instance attributes.

   1. In the **Instance Name** field, enter a name for the adapter instance.

   2. In the **Instance ID** field, enter a unique identifier for the adapter instance.

   3. In the **Type** list, select **SDG CTS SP Adapter**. Click **Next**.

4. (Optional) On the **Instance Configuration** tab, in the **Protected Resource Mapping Table** section, define conditions that the SAML assertion has to meet for the user to get access to a protected resource.

   |   |                                                                                                                                                                                                                                                                                                                                                                                                                                 |
   | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   |   | The SDG Conversion Token Service allows you to grant permissions to specific realms in specific domains by defining the resource, instance, and action fields. These values are defined in your CTS Agent Config Object (ACO) settings.Learn more in the SDG Conversion Token Service Install and Configuration Guide included in the [Conversion Token Service Overview](https://sdgc.com/conversion-token-service/) download. |

   1. Click **Add a new row to 'Protected Resource Mapping Table'**.

   2. In the **Auth Context** field, enter the authentication context that has to exist in the SAML assertion, such as `Password` or `MobileTwoFactorContract`.

      You can find the complete list of authentication contexts in the [Authentication Context for the OASIS Security Assertion Markup Language (SAML) 2.0](http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf) \[PDF] in the OASIS Open documentation.

   3. (Optional) In the **Attribute Filter** field, enter an attribute that has to exist in the assertion, such as `${organization}='WidgetCo'`.

      |   |                                                                                                                                                                         |
      | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      |   | You can use `AND` and `OR` operators to include multiple attributes or create simple rules. For example, `${organization}='WidgetCo' OR ${organization}='WidgetCoLtd'`. |

   4. In the **Resource** field, enter the name of the resource that the user can access when the assertion meets the **Auth Context** and **Attribute Filters** conditions.

      For example, `/partner_application/partner_landing.html`.

   5. In the **Instance** field, enter the value of the `AgentName` parameter associated with the default CTS Agent Config Object.

      For example, `partner_site_agent`.

   6. In the **Action** field, enter the action, such as `GET`, `POST`, or `PUT`.

   7. In the **Action** column, click **Update**.

   8. To add more attributes, repeat steps a - g.

5. On the **Instance Configuration** tab, configure the adapter instance by referring to [SDG CTS SP Adapter settings reference](pf_sdg_cts_ik_sp_adapter_settings_reference.html).

6. Click **Next**.

7. (Optional) On the **Actions** tab, if you set **Send Extended Attributes** to **OpenToken**, click **Download**, and then click **Export**. Save `agent-config.txt`.

   You can use this file to decode the OpenToken token that contains the extended attributes.

8. On the **Extended Contract** tab, add any attributes that you expect to retrieve other than the SAML subject. Click **Next**.

9. On the **Target App Info** tab, enter the basic information about your SP application. Click **Next**.

10. On the **Summary** tab, click **Save**.

11. Create an IdP connection using this SDG CTS SP Adapter instance.

    Learn more in the [Service provider SSO configuration](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_servic_provid_sso_config.html) in the PingFederate documentation.