1. In the PingFederate administrator console, create a new SP connection:
    • For PingFederate 10.1 or later: go to Applications > Integration > SP Connections. Click Create Connection.
    • For PingFederate 10.0 or earlier: go to Identity Provider > SP Connections. Click Create Connection.
  2. Configure the basic connection details with the Dropbox quick connection template:
    1. On the Connection Template tab, click Use a template for this connection.
    2. In the Connection Template list, select Dropbox Provisioner.
    3. On the Metadata File row, upload the saml-metadata.xml file that you saved in Preparing the Dropbox SAML 2.0 metadata XML file. Click Next.
    4. On the Connection Type tab select the Browser SSO Profiles and Outbound Provisioning check boxes. Click Next.
    5. On the Connection Options tab, click Next.
    6. On the General Info tab, the default values are taken from the metadata file you uploaded earlier. Click Next.
  3. On the Browser SSO tab, configure browser single sign-on (SSO).

    For more information, see Configuring IdP Browser SSO in the PingFederate documentation.

    1. On the Browser SSO > SAML Profiles tab, select the IDP-Initiated SSO and SP-Initiated SSO check boxes.
    2. On the Browser SSO > Assertion Creation > Attribute Contracttab, in the SAML_SUBJECT row, select urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress in the Subject Name Format list.
    3. On the Browser SSO > Protocol Settings > Allowable SAML Bindings tab, select the Post and Redirect check boxes. Click Next.
  4. On the Browser SSO > Protocol Settings > Signature Policy tab, select the Always sign the SAML Assertion check box. Click Next.
  5. On the Credentials tab, configure the connection credentials as shown in Configuring credentials in the PingFederate documentation. Click Next.
  6. On the Outbound Provisioning tab, configure provisioning with the following details.

    For help, see Configuring outbound provisioning in the PingFederate documentation.

    1. On the Target tab, complete the fields as follows.
      Field Name Description

      OAuth 2 Access Token

      The OAuth 2.0 access token for authentication.

      To obtain the access token, you must first Obtain an App Key and Secret from Dropbox. When you have obtained the app key and secret from Dropbox, you can Generate Your OAuth 2.0 Access Token.

      User Create Enabled
      • True (default) — Users will be created in Dropbox through PingFederate.
      • False — Users will not be created in Dropbox.
        Note:

        The provisioner.log displays a warning within the create user workflow that the user was not created in Dropbox.

      User Update Enabled
      • True (default) — Users will be updated in Dropbox through PingFederate.
      • False — Users will not be updated in Dropbox.
        Note:

        The provisioner.log will display a warning within the update user workflow that the user was not updated in Dropbox.
    2. Optional: In the Provisioning Options section, customize the provisioning connector behavior by referring to . Click Next.
    3. On the Manage Channels > Attribute Mapping tab, at the bottom of the attribute list, click Refresh Fields to get fields and specifications from your Dropbox site.
    4. Complete the attribute mappings by referring to .

      For help, see Managing channels in the PingFederate documentation.

  7. On the Activation and Summary tab, above the Summary section, click the toggle to turn on the connection. Click Save.