Use Cases

Protecting PingAccess resources through external IdPs with PingFederate acting as an SP (leveraging FedHub)

Before you begin

Components

  • PingFederate 10.3

  • PingAccess 6.3

About this task

Follow these steps to connect PingFederate as an SP to external IdP and configure an SP connection to bridge the IdP connection for the Federation Hub flow.

Steps

  1. In PingFederate admin console, from Authentication → Integration → IdP Connections, click Create Connection.

  2. Connect and configure PingFederate as the service provider (SP) to your external identity provider (IdP)

  3. Create a new authentication policy contract with the attributes needed to be passed to PingAccess.

    If you have previously integrated PingFederate and PingAccess, bypass step 3.

    1. From Authentication → Policies → Policy Contracts, click Create New Contract.

    2. Configure the Contract Info and Contract Attributes tabs and then click Next. Click Done.

  4. Create a new IdP connection to the SP.

    If you created a test SP connection to have PingFederate function as the test IdP, configure the IdP connection to match the SP connection. Otherwise, configure the IdP connection to match your external SP.

    1. From Authentication → Integration → IdP Connections, click Create Connection.

    2. On the Connection Type screen, select the Browser SSO Profiles check box. Click Next.

    3. On the Connection Options screen, select the Browser SSO and OAuth Attribute Mapping check boxes. Click Next.

    4. Configure the General Info screen. Click Next.

    5. On the Browser SSO screen, click Configure Browser SSO.

    6. On the SAML Profiles screen, select the IDP-Initiated SSO andSP-Initiated SSO check boxes. Click Next.

    7. On the User-Session Created screen, click Configure User-Session Creation.

      Result:

      The User-Session Creation window displays.

    8. On the Identity Mapping screen, select Account Mapping. Click Next.

    9. On the Attribute Contract screen, configure the same attributes as Step 3. Click Next.

    10. On the Target Session Mapping screen, click Map New Authentication Policy.

      Result:

      The Authentication Policy Mapping window displays.

    11. From the Authentication Policy Contract menu, select the appropriate contract. Click Next.

    12. Configure the rest of the Authentication Policy Mapping screens. Click Done.

      Result:

      After clicking Done, the system will automatically return you to the User-Session Creation screen.

    13. Click Next and Done.

      Result:

      You return to the Browser SSO screen.

    14. On the OAuth Attribute Mappingtab, click Map to OAuth via Authentication Policy Contract and then select the appropriate contact from the Map to OAuth Via Authentication Policy Contract list. Click Next.

    15. Click Configure Protocol Settings.

      Result:

      The Protocol Settings screen displays.

    16. Configure the Protocol Settings tabs and then click Next. Click Done.

      Result:

      You automatically return to the Browser SSO tab on the IdP Connection window.

    17. On the Credentials screen, click Configure Credentials. Configure the credentials and then click Next. Click Done.

      Result:

      You automatically return to the Credentials tab on the IdP Connection window.

    18. On the Activation & Summary screen, click Save and then click Done.

  5. Configure the authentication policy contract mapping.

    If you are using an existing policy contract, bypass step 5.

    1. Go to Main → OAuth Server → Authentication Policy Contract Mapping.

    2. Click theAuthentication Policy Contract drop-down menu and select a policy contract. Click Add Mapping.

    3. Configure the mapping and then click Save. Click Done.

  6. Configure the access token mapping.

    1. From Applications → OAuth → Access Token Mappings, map the contract to the access token you are using for PingAccess.

      For more information about access token management creation, see Configuring an access token management instance.

  7. From Authentication → Policies → Policies, click Add Policy and configure a policy to invoke your IdP connection.

  8. From Authentication → Policies → Sessions, select the Enable Sessions check box for the session to be saved.

    The Enable Authentication Sessions for All Sources check box must be selected for the session to be saved.

  9. Click Save.