The following table details the required and optional attributes to configure in the assertion attribute contract.

Attribute Name Description Required / Optional

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

Email address for user

Required

The following table details the environment-specific references used in this guide. Replace these references with the suitable value for your environment.

Reference Description

<tenant>

BambooHR Tenant name
  1. Create a PingOne application for BambooHR.
    1. Download the BambooHR metadata from https://<tenant>.bamboohr.com/saml/sp_metadata.php.
    2. Sign on to PingOne for Enterprise and go to Applications > Application Catalog.
    3. On the SAML tab, in the Add Application list, select Search Application Catalog. Screen capture of the PingOne My Applications page on the SAML tab. The Add Application list is expanded showing the options to Search Application Catalog, New SAML Application, and Request Ping Identity add a new application to the application catalog buttons.
    4. Search for BambooHR.
    5. Click the BambooHR row. Screen capture of the PingOne Application Catalog tab showing the search results for the BambooHR application.
    6. Click Setup.
    7. In the Signing Certificate list, select the appropriate signing certificate.Screen capture of the PingOne SSO Instructions fields for the Application Catalog with the Signing Certificate list available for selection.
    8. Review the steps, and make a note of the PingOne SaaS ID, IdP ID, Single Sign-On URL, and Issuer values.
    9. Click Continue to Next Step.
    10. Click Select File and upload the BambooHR metadata you downloaded.
      Note:

      If the upload fails, continue with the next steps and explicitly set the parameters based on the attributes in the metadata.

    11. Set the ACS URL to https://<tenant>.bamboohr.com/saml/consume.php.
    12. Set the Entity ID to BambooHR-SAML.Screen capture of the Connection Configuration fields for the Application Catalog. The ACS URL and Entity ID fields are highlighted in red.
    13. Click Continue to Next Step.
    14. In the Attribute Mapping section, in the Identity Bridge Attribute or Literal Value column of the SAML_SUBJECT row, select the attribute SAML_SUBJECT.Screen capture of the PingOne Attribute Mapping fields for the Application Catalog. The Identity Bridge Attribute or Literal Value list for the SAML SUBJECT attribute is highlighted in red.
    15. Click Continue to Next Step.
    16. Update the Name, Description, and Category fields as needed.Screen capture of the PingOne App Customization - BambooHR fields with the Icon, Name, Description, and Category fields displayed.
    17. Click Continue to Next Step.
    18. Add the user groups for the application.
      Screen capture of the PingOne Group Name section displaying all of the available user groups.
    19. Click Continue to Next Step.
    20. Review your settings.
      Screen capture of the PingOne Review Setup fields for the Application Catalog displaying the configured fields for review on the BambooHR application.
    21. Copy the Single Sign-On (SSO) URL value to a temporary location.
      Screen capture of the PingOne SSO URL fields with the SSO URL value saved to a temporary location.

      This is the IdP-initiated SSO URL that you can use for testing.

    22. On the Signing Certificate line, click Download.
      You use this in the BambooHR Cloud configuration.
    23. On the SAML Metadata line, click Download.
      You use this in the BambooHR Cloud configuration.
    24. Click Finish.
      Screen capture of the PingOne My Applications page on the SAML tab showing the available applications added to the user account.
  2. Configure the PingOne IDP connection for BambooHR:
    1. Sign on to BambooHR as a Full Admin administrator user.
    2. On the Settings page, click Apps.