Integrate an application

The PingOne SSO for SaaS Apps OAuth endpoints for OpenID Connect (OIDC) applications are available at https://sso.connect.pingidentity.com/client_id/.well-known/openid-configuration, where client_id is the Client ID entry in the Details section of the summary page for the application.

For more information, see Integrating an OIDC application.

The PingOne SSO for SaaS Apps REST service uses HTTP Basic authentication. When calling the REST API you need to authenticate to PingOne SSO for SaaS Apps using these credentials (Base64-encoded) in the Basic authentication header:

When the single sign-on (SSO) process begins from the identity bridge side, the user authentication to the identity bridge is already done. You just need to create a session for the user when they return to your application with a secure token from PingOne SSO for SaaS Apps. Your application makes a REST call to the PingOne SSO for SaaS Apps REST service using this token. This completes the PingOne SSO for SaaS Apps token exchange that authenticates the user and returns the user attributes. The SSO session for the user is then initiated.

Here’s a sequence diagram illustrating these steps:

For IdP-initiated SSO, start with Process the PingOne SSO for SaaS Apps token exchange.

When you begin the SSO process from your side, as a Service Provider (SP), you need to:

So, what you need to know about are HTTP redirects and how to create user sessions within your application.

After a user is authenticated through PingOne SSO for SaaS Apps, the user arrives at your application via an HTTP redirect with a security token. Your application makes a REST call to the PingOne SSO for SaaS Apps REST service using this token. This completes the PingOne SSO for SaaS Apps token exchange that authenticates the user and returns the user attributes.

Here’s a sequence diagram illustrating these steps:

After you’ve determined that a user accessing your application is trying to perform SSO, you redirect that user’s browser to PingOne SSO for SaaS Apps using an HTTP 302 redirect. PingOne SSO for SaaS Apps needs to know a few things to successfully process an SSO request:

For SP-initiated SSO, start with Redirect users to PingOne SSO for SaaS Apps (SP-initiated SSO).

After authenticating, the user returns to your application with a token. We create this token as a one-time secret between you, the user, and PingOne SSO for SaaS Apps.

The token exchange is a one-time only REST call. After the first call, the token expires. Subsequent calls using this token will return HTTP 404.

You use the PingOne SSO for SaaS Apps REST API to make a REST call and initiate the token exchange. Our Token Resolution Service will process the exchange and we will return the set of attributes for the user.

The PingOne SSO for SaaS Apps token exchange process is secured at each stage:

Your REST call needs to:

For more information, see Process the PingOne SSO for SaaS Apps token exchange.

HTTP status codes are likely familiar to you. Status codes that can be returned to you include: