--- title: Configure SP Browser SSO description: PingFederate supports multiple configurations for browser single sign-on (SSO) with different federation standards. You can configure these options from the Browser SSO tab. component: pingfederate version: 13.1 page_id: pingfederate:administrators_reference_guide:help_idpconnectionconfigtasklet_idpbrowserssostate canonical_url: https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/help_idpconnectionconfigtasklet_idpbrowserssostate.html llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: July 5, 2022 section_ids: saml-2-0-configuration-steps: SAML 2.0 configuration steps saml-1-x-configuration-steps: SAML 1.x configuration steps ws-federation-configuration-steps: WS-Federation configuration steps openid-connect-configuration-steps: OpenID Connect configuration steps --- # Configure SP Browser SSO PingFederate supports multiple configurations for browser single sign-on (SSO) with different federation standards. You can configure these options from the **Browser SSO** tab. Browser single sign-on (SSO) relies on a user's web browser and HTTP requests to broker identity-federation messaging in XML or JSON web tokens (JWT) between an identity provider (IdP) and a service provider (SP). In contrast, WS-Trust security token service (STS) messaging is typically application-driven across the back channel and does not require browser mediation. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Many steps involved in setting up a federation connection are protocol-independent; that is, they are required steps for all connections, regardless of the associated standards. For more information, see [Federation roles](../introduction_to_pingfederate/pf_fed_roles.html). Also, for any given connection, some configuration steps are required under the applicable protocol, while others are optional. Still others are required only based on certain selections. The administrative console determines the required and optional steps based on the protocol and dynamically presents additional requirements or options based on selections.The following sections provide sequential information about every step you might encounter while configuring browser-based SSO, regardless of the protocol you are using for a particular connection. | ## SAML 2.0 configuration steps * [Selecting SAML profiles](help_idpbrowserssotasklet_selectsamlprofilesstate.html) * [Configuring user-session creation](help_idpbrowserssotasklet_usersessioncreationstate.html) * [Choosing an identity mapping method for SP SSO](help_usersessioncreationtasklet_selectidpaccountlinkingstate.html) * [Defining an attribute contract](help_usersessioncreationtasklet_createattributecontractstate.html) * [Managing target session mappings](help_usersessioncreationtasklet_configadaptermappingstate.html) * [Configuring protocol settings](help_idpbrowserssotasklet_idpprotocolsettingsstate.html) * [Specifying SSO service URLs (SAML)](pf_specifying_sso_service_urls_saml.html) * [Defining SLO service URLs (SAML 2.0)](help_idpprotocolsettingstasklet_sloserviceurlconfigstate.html) * [Selecting allowable SAML bindings (SAML)](help_idpprotocolsettingstasklet_allowablesamlbindingsstate.html) * [Specifying an artifact lifetime (SAML 2.0)](help_idpprotocolsettingstasklet_configartifactlifetimestate.html) * [Defining artifact resolver locations (SAML)](pf_defining_artifact_resolver_locations_saml.html) * [Configuring default target URLs](help_idpprotocolsettingstasklet_defaulttargeturlstate.html) * [Overriding authentication context in an IdP connection](pf_overrid_auth_context_in_idp_connect.html) * [Configuring signature policy](help_idpprotocolsettingstasklet_idpsignaturepolicystate.html) * [Specifying XML encryption policy (for SAML 2.0)](help_idpprotocolsettingstasklet_selectidpxmlassertionencryptionstate.html) ## SAML 1.x configuration steps * [Selecting SAML profiles](help_idpbrowserssotasklet_selectsamlprofilesstate.html) * [Configuring user-session creation](help_idpbrowserssotasklet_usersessioncreationstate.html) * [Choosing an identity mapping method for SP SSO](help_usersessioncreationtasklet_selectidpaccountlinkingstate.html) * [Defining an attribute contract](help_usersessioncreationtasklet_createattributecontractstate.html) * [Managing target session mappings](help_usersessioncreationtasklet_configadaptermappingstate.html) * [Configuring protocol settings](help_idpbrowserssotasklet_idpprotocolsettingsstate.html) * [Specifying SSO service URLs (SAML)](pf_specifying_sso_service_urls_saml.html) * [Selecting allowable SAML bindings (SAML)](help_idpprotocolsettingstasklet_allowablesamlbindingsstate.html) * [Defining artifact resolver locations (SAML)](pf_defining_artifact_resolver_locations_saml.html) * [Configuring default target URLs](help_idpprotocolsettingstasklet_defaulttargeturlstate.html) * [Configuring signature policy](help_idpprotocolsettingstasklet_idpsignaturepolicystate.html) ## WS-Federation configuration steps * [Configuring user-session creation](help_idpbrowserssotasklet_usersessioncreationstate.html) * [Choosing an identity mapping method for SP SSO](help_usersessioncreationtasklet_selectidpaccountlinkingstate.html) * [Defining an attribute contract](help_usersessioncreationtasklet_createattributecontractstate.html) * [Managing target session mappings](help_usersessioncreationtasklet_configadaptermappingstate.html) * [Configuring protocol settings](help_idpbrowserssotasklet_idpprotocolsettingsstate.html) * [Specifying a service URL (WS-Federation)](help_idpprotocolsettingstasklet_wsfedserviceurlstate.html) * [Configuring default target URLs](help_idpprotocolsettingstasklet_defaulttargeturlstate.html) * [Configuring signature policy](help_idpprotocolsettingstasklet_idpsignaturepolicystate.html) ## OpenID Connect configuration steps * [Configuring user-session creation](help_idpbrowserssotasklet_usersessioncreationstate.html) * [Choosing an identity mapping method for SP SSO](help_usersessioncreationtasklet_selectidpaccountlinkingstate.html) * [Defining an attribute contract](help_usersessioncreationtasklet_createattributecontractstate.html) * [Managing target session mappings](help_usersessioncreationtasklet_configadaptermappingstate.html) * [Configuring protocol settings](help_idpbrowserssotasklet_idpprotocolsettingsstate.html) * [Configuring OpenID Provider information](help_idpprotocolsettingstasklet_openidprovidermetadatastate.html) * [Configuring default target URLs](help_idpprotocolsettingstasklet_defaulttargeturlstate.html) * [Overriding authentication context in an IdP connection](pf_overrid_auth_context_in_idp_connect.html) After configuring SSO settings, you will need to configure authentication credentials, the range of which depends on your SSO selections. For more information, see [Configuring security credentials](help_idpconnectionconfigtasklet_credentialsstate.html). Also, other configuration tasks might remain to be configured for new or modified connections, depending on the selected options on the **Connection Options** tab.