- PingFederate 10.3
- PingAccess 6.3
Follow these steps to connect PingFederate as an SP to external IdP and configure an SP connection to bridge the IdP connection for the Federation Hub flow.
- In PingFederate admin console, from , click Create Connection.
- Connect and configure PingFederate as the service provider (SP) to your external identity provider (IdP)
Create a new authentication policy contract with the attributes needed to be
passed to PingAccess.
If you have previously integrated PingFederate and PingAccess, bypass step 3.
- From Create New Contract. , click
- Configure the Contract Info and Contract Attributes tabs and then click Next. Click Done.
Create a new IdP connection to the SP.
If you created a test SP connection to have PingFederate function as the test IdP, configure the IdP connection to match the SP connection. Otherwise, configure the IdP connection to match your external SP.
- From Create Connection. , click
- On the Connection Type screen, select the Browser SSO Profiles check box. Click Next.
- On the Connection Options screen, select the Browser SSO and OAuth Attribute Mapping check boxes. Click Next.
- Configure the General Info screen. Click Next.
- On the Browser SSO screen, click Configure Browser SSO.
- On the SAML Profiles screen, select the IDP-Initiated SSO andSP-Initiated SSO check boxes. Click Next.
On the User-Session Created screen, click
Configure User-Session Creation.
The User-Session Creation window displays.
- On the Identity Mapping screen, select Account Mapping. Click Next.
- On the Attribute Contract screen, configure the same attributes as Step 3. Click Next.
On the Target Session Mapping screen, click
Map New Authentication Policy.
The Authentication Policy Mapping window displays.
- From the Authentication Policy Contract menu, select the appropriate contract. Click Next.
Configure the rest of the Authentication Policy Mapping screens. Click
After clicking Done, the system will automatically return you to the User-Session Creation screen.
Click Next and Done.
You return to the Browser SSO screen.
- On the OAuth Attribute Mapping tab, click Map to OAuth via Authentication Policy Contract and then select the appropriate contact from the Map to OAuth Via Authentication Policy Contract list. Click Next.
Click Configure Protocol Settings.
The Protocol Settings screen displays.
Configure the Protocol Settings tabs and then
click Next. Click
You automatically return to the Browser SSO tab on the IdP Connection window.
On the Credentials screen, click
Configure Credentials. Configure the
credentials and then click Next. Click
You automatically return to the Credentials tab on the IdP Connection window.
- On the Activation & Summary screen, click Save and then click Done.
Configure the authentication policy contract mapping.
Note: If you are using an existing policy contract, bypass step 5.
- Go to .
- Click theAuthentication Policy Contract drop-down menu and select a policy contract. Click Add Mapping.
- Configure the mapping and then click Save. Click Done.
Configure the access token mapping.
- From PingAccess. , map the contract to the access token you are using for
For more information about access token management creation, see Configuring an access token management instance.
- From Add Policy and configure a policy to invoke your IdP connection. , click
From Enable Sessions check box for
the session to be saved.
, select the Note:
The Enable Authentication Sessions for All Sources check box must be selected for the session to be saved.
- Click Save.