Configuring PingFederate as the identity provider

The following task configures the PingFederate server as the identity provider (IdP) for the PingDirectory server.

Before you begin

Download the LDAPS certificate from the PingDirectory server. For more information, see Exporting certificates.

Steps

Sign on to the PingFederate administrative console.
Import the PingDirectory server LDAPS certificate:
1. Go to Security → Certificate & Key Management → Trusted CAs.
2. Click Import, click Choose File to browse to the certificate, click Next, and then click Save.
Add an Lightweight Directory Access Protocol (LDAP) datastore:
1. Go to System → Data Stores.
2. Click Add New Data Store.
3. Specify a Name for the data store.
4. Set Type to Directory (LDAP).
5. Click Next.
6. In the Hostname(s) field, enter the PingDirectory server host name and LDAPS port, separated by a colon (for example, 10.101.113.75:1636) and click Add.
7. Select the Use LDAPS check box.
8. Set LDAP Type to PingDirectory.
9. In the User DN field, enter one of the following values based on your PingDirectory configuration:
  - cn=dmanager
  - cn=Directory Manager
    
    These values are based on the assumption that Delegated Admin will run as the directory manager.
10. In the Password field, specify the root password.
11. Click Advanced and then Advanced LDAP Options.
  1. Select the Create New Connections If Necessary check box.
  2. Clear the Verify LDAPS Hostname check box.
  3. Click Done.
12. Click Test Connection.
13. Click Next.
14. Click Save.
Create the HTML form IdP Adapter.

The adapter authenticates users against the PingDirectory server.
1. Go to Authentication → IdP Adapters → Create New Instance
2. In the Instance Name field, enter a name such as PingDirectoryIdP.
3. Specify an Instance ID.
4. Set Type to HTML Form IdP Adapter.
5. Click Next.
6. Go to the bottom of the page and click Manage Password Credential Validators.
7. Create a validator to authenticate users against the PingDirectory server:
  1. Click Create New Instance.
  2. Specify an Instance Name.
  3. Specify an Instance ID.
  4. Set Type to LDAP User Name Password Credential Validator.
  5. Click Next.
  6. Specify an LDAP Datastore.
  7. Specify an Search Base.
  8. Enter the following text in the Search Filter field to use the email address or user name to sign on to the system.
    
    (|(uid=${username})(mail=${username}))
  9. Click Next and extend the contract with entryUUID and cn.
    
    These values are used later.
  10. Click Next, Done, or Save until you reach the Create Adapter Instance screen.
8. Add a new row to Password Credential Validators, choose the new LDAP Password Credential Validator, and click Update.
9. Go to the Extended Contract tab and extend the adapter contract with entryUUID and cn.
10. Go to the Adapter Attributes tab, select entryUUID for a pseudonym, and then click Next, Next, Done, and Save.
  
  For more information, see Configuring the LDAP Username Password Credential Validator.
Enable session tracking:
1. Go to Authentication → Sessions
2. Select the Track Adapter Sessions For Logout check box.
3. Select the Track Revoked Sessions On Logout check box.
4. Select the Enable Authentication Sessions For All Sources check box.
5. Click Save.