Setting up SSO to PingAccess
To set up single sign-on (SSO) access from the admin console to PingAccess, configure PingOne and PingAccess, and then test the sign-on experience.
Ensure that you have:
-
A licensed version of PingAccess
-
A licensed version of PingOne
See the following topics:
Configuring PingOne for SSO in PingAccess
About this task
To configure PingOne for SSO in PingAccess:
Steps
-
In PingOne, create a new connection:
-
Go to Applications → Applications, and click the icon.
Result:
The Add Application panel opens.
-
In the Add Application section, enter the following information:
-
Application name:
the PingOne administration console SSO PingAccess
(or another name that helps you recognize this connection). -
Description (Optional): Enter a brief description of this application that distinguishes it from others.
-
-
In the Choose Application Type section, select OIDC Web App, and then click Save.
-
In the application details panel, click the Configuration tab, and then click the Pencil icon.
-
Locate the Redirect URIs field and enter the appropriate URL.
Example:
For example,
https://<FQDNofPAServer>:9000/pa/oidc/cb
, where <FQDNofServer> is the machine name or fully qualified domain name of your PingAccess server, such ashttps://localhost:9000/pa/oidc/cb
. -
Click Save.
-
Click the Resources tab, and then click the Pencilicon.
-
In the Scopes list, click or search the Profile scope to add it to the Selected Scopes section.
-
Click Save.
-
Click the Attribute Mapping tab, and then click the Pencil icon.
-
Click the Add button and add the following attribute mappings.
Attributes PingOne PingOneMapping PingFed Admin Roles
pf_admin_roles
-
Click the Advanced Configurations button.
-
For the attributes you just mapped, click the Required check box.
-
Click Save.
-
-
To enable the application, click the toggle switch to the on (blue) position.
-
Add a new PingFederate administrator and define their role and responsibilities.
If you already added an administrator when you set up SSO to PingFederate (Configuring PingOne, step 5), skip this step.
-
Go to Directory → Users, and click the icon.
-
On the Add User panel, enter a user name for the PingFederate administrator that has the
fullAdmin
role. -
Click Save.
-
In the user details panel, click the Roles → Administrator Roles tab, and then click the Grant Roles button.
-
In Available Responsibilities, click PingFederate Administrator and select checkboxes for the organizations and environments where the administrator should have this role.
-
Click PingFederate User Administrator and select checkboxes for the organizations and environments where the administrator should have this role.
-
Click Save.
-
In the More Options menu (three dots), click Reset Password.
-
Select Force password reset on next sign on.
-
Click Save.
-
-
Select Applications → Applications and locate the application you created earlier.
-
Click the application entry to open the details panel.
-
Click the Configurations tab and review the configuration information.
You need this configuration property information to configure PingAccess for SSO, so you might want to keep this browser window open.
Next steps
To continue the configuration, see Configuring PingAccess.
Configuring PingAccess
After configuring PingOne for SSO, configure PingAccess.
Steps
-
In PingAccess, go to Settings → System → Token Provider.
-
On the Token Provider page, complete the Issuer URL field with the issuer URL for the connection you created in PingOne.
Result:
You see this URL on the Applications page in PingOne.
-
Go to Settings → Admin UI Authentication → Authentication Method
-
On the Authentication Method page, select the Single Sign-On option and complete the fields with the following information:
-
In the OpenID Connect Login Type field, select the Code option.
-
In the Client ID field, enter the client ID for the connection you created in PingOne.
-
In the Client Credentials Type field, select Secret and enter the client secret for the connection you created in PingOne. Click Save and Close.
-
-
Restart PingAccess.
Next steps
To test the sign-on experience, see Testing the sign-on experience to PingAccess.
Testing the sign-on experience to PingAccess
After configuring PingOne and PingAccess, test SSO to PingAccess.
Steps
-
In PingOne, click the Ping Identity logo.
Result:
The admin console home page displays the environments to which you have access.
-
Click the environment to open the details pane.
-
Click Manage Environment to go to the Overview page for the environment.
-
In the Services section, click the PingAccess icon.
Result:
The PingAccess admin console opens.
If the OpenID Connect token provider is unreachable, define a fallback administrator authentication method. In the
/<PA_HOME>/conf/run.properties
file, set theadmin.auth
property tonative
. Restart PingAccess.