PingOne

Editing an identity provider

Use the External IdPs page to edit an existing external identity provider (IdP).

Steps

  1. In the PingOne admin console, go to Integrations > External IdPs and browse for the IdP you want to edit.

  2. Click the IdP to open the details panel.

  3. On the Profile tab, click the Pencil icon () and enter or edit the following information:

    • Name: A unique identifier for the IdP.

    • Description (optional): A brief description of the IdP.

    • Population: A population that overrides the authentication policy’s registration population and enables just-in-time (JIT) registration from the IdP.

    • Account Linking Attribute (custom OpenID Connect (OIDC) and SAML IdPs only): Select the Override Default Account Linking Attribute checkbox to use a custom attribute.

      • In the Custom Account Linking Attribute field, enter the attribute you want to use for matching an external IdP account to a PingOne user. Choose an attribute that uniquely identifies each user and that users can’t change.

        It must begin with providerAttributes. and include an attribute name, such as providerAttributes.email.

        A mutable or non-unique value can cause PingOne to link an external IdP account to the wrong PingOne user, creating a risk of account takeover or impersonation.

      • Clear the checkbox to use the default attribute of providerAttributes.sub for OIDC or samlAssertion.subject for SAML.

      API endpoint details

      To retrieve a user’s linked external account identifier using the API, use the admin API endpoint: /users/{userId}/linkedAccounts. In the response, ._embedded.linkedAccounts[n].externalId identifies the external ID for a linked account, where:

      • The leading period (.) is the root of the JSON output. The linkedAccounts array is nested under the top-level _embedded member.

      • n is the array index, indicating the nth IdP the user is linked to and starting at 0.

      This value is different from the top-level .externalId member in the user record returned by the /user/{userId} endpoint. Learn more in Linked Accounts in the PingOne API documentation.

      PingOne records audit events in the Audit log for:

      • Account Linking Attribute changes.

      • A missing configured token claim or SAML attribute from the incoming assertion.

      • An inbound value it can’t use, such as a value of the wrong type or a multivalued SAML attribute.

      Learn more in Running an audit report and Audit Reporting Events in the PingOne API documentation. You can also subscribe to audit events with webhooks.

    • Sign-on Button (optional): An image to be used for the sign-on button that the end user will see. Use a 300 x 42 pixel image.

    • Icon (optional): A pictorial representation of the IdP. Use a file up to 1 MB in JPG, JPEG, GIF, or PNG format.

      You can’t change the Icon and Sign-on Button, in accordance with the provider’s brand standards.

  4. Click Save.

  5. If you edited Account Linking Attribute, select the checkbox in the confirmation modal and click Continue.

  6. On the Connection tab, click and enter or edit the information as needed.

    These values vary depending on the type of external IdP you’re editing.

    If you’re using a custom domain, you can toggle the view between the custom and original URLs. The original and custom URLs will continue to work. Learn more in Domains.

  7. Click Save.

  8. On the Attributes tab, click and enter or edit the attribute mappings, which define how the PingOne user attributes are mapped to IdP attributes. Learn more in Mapping attributes.

    • Enter the PingOne user profile attribute and the external IdP attribute. Learn more about attribute syntax in Identity provider attributes.

    • To add an attribute, click Add.

    • To use the advanced expression builder, click the Gear icon (). Learn more in Using the expression builder.

    • Select the update condition, which determines how PingOne updates its user directory with the values from the IdP. The options are:

      • Empty only: Update the PingOne attribute only if the existing attribute is empty.

      • Always: Always update the PingOne directory attribute.

  9. Click Save.

  10. To enable or disable an IdP, click the toggle in the External IdPs list.

    IdPs labeled with the Administrator IDP badge are used for authentication into the PingOne admin console and can’t be disabled or deleted.