--- title: Setting up a login form that validates credentials against AD in PingFederate description: Configure a login form in PingFederate using the HTML form adapter to validate credentials against Active Directory. component: solution-guides page_id: solution-guides:workforce_use_cases:htg_set_up_login_form_validating_creds_with_ad_pf canonical_url: https://docs.pingidentity.com/solution-guides/workforce_use_cases/htg_set_up_login_form_validating_creds_with_ad_pf.html llms_txt: https://docs.pingidentity.com/solution-guides/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: April 14, 2025 page_aliases: ["workforce_use_cases:htg_set_up_login_form_validating_creds_with_ad_pf_datastore.adoc", "workforce_use_cases:htg_set_up_login_form_validating_creds_with_ad_pf_pcv.adoc", "workforce_use_cases:htg_set_up_login_form_validating_creds_with_ad_pf_adapter.adoc"] section_ids: component: Component configure-login-form-validate-the-datastore: Configuring the datastore before-you-begin: Before you begin steps: Steps configure-the-password-cred-validator: Configuring the password credential validator before-you-begin-2: Before you begin steps-2: Steps choose-from: Choose from: configuring-the-idp-adapter: Configuring the IdP adapter before-you-begin-3: Before you begin about-this-task: About this task steps-3: Steps result: Result next-steps: Next steps --- # Setting up a login form that validates credentials against AD in PingFederate Configure a login form in PingFederate that validates credentials against Active Directory (AD). After completing these steps, the HTML form adapter is ready to use in either an [Authentication Policy](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-101.pdf#page=242) (page 242) or an [SP connection](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-101.pdf#page=398) (page 398). ## Component PingFederate 10.1 ## Configuring the datastore Configure a datastore in PingFederate. ### Before you begin * Install and run PingFederate. * Install Active Directory (AD). * Ensure the AD service account has permissions in all domains in that forest to read and access user data in all domains to which the agent connects. ### Steps 1. In the PingFederate administrative console, go to **System > Data & Credential Stores > Data Stores**. 2. Click **Add new Data Store**. 3. On the **Data Store Type** tab, in the **Name** field, enter a name. 4. In the **Type** list, select **Directory (LDAP)**. Click **Next**. ![Screen capture of the Data Store Type tab showing Active Directory Data Store in the Name field, and Directory (LDAP) selected from the Type list.](_images/vto1602268313849.png) 5. On the **LDAP Configuration** tab, in the **Hostname(s)** field, enter a name. 6. From the **LDAP Type** list, select **Active Directory**. 7. In the **User DN** and **Password** fields, enter the desired user distinguished name (DN) and password. 8. Select the **Use LDAPS** checkbox. Ping recommends that all LDAP connections be secured using LDAPS. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | To enable the password changes, password reset, or account unlock features in the HTML form adapter against Microsoft AD, you must secure the connection to your directory server using LDAPS. AD requires this level of security to allow password changes. | 9. Complete any other fields that can help configure the datastore connection according to your current architect posture. 10. To test the connection, click **Test Connection**. ![Screen capture of the LDAP Configuration tab and corresponding fields.](_images/kym1602268501749.png) 11. Click **Next**. 12. On the **Summary** tab, review your entries, and then click **Save**. ## Configuring the password credential validator Configure a password credential validator (PCV) in PingFederate. ### Before you begin * Install and run PingFederate. * Install Active Directory (AD). * [Configure the data store](#configure-login-form-validate-the-datastore). * Ensure the AD service account has permissions in all domains in that forest to read and access user data in all domains to which the agent connects. ### Steps 1. In the PingFederate administrative console, go to **System → Data & Credential Stores → Password Credential Validators**. 2. Click **Create New Instance**. 3. On the **Type** tab, in the **Instance Name** and **Instance ID** fields, enter a name and ID. 4. From the **Type** list, select **LDAP Username Password Credential Validator**. ![Screen capture of the Type tab showing the completed Instance Name and Instance ID fields. LDAP Username Password Credential Validator is selected from the Type list.](_images/oux1602268888684.png) 5. Click **Next**. 6. On the **Instance Configuration** tab, from the **LDAP Datastore Field Value** list, select **Active Directory Data Store**. 7. In the **Search Base Field Value** field, enter the location in the directory from which the LDAP search begins. 8. In the **Search Filter Field Value** field, enter an LDAP filter. You can use ${username} as part of the query. For example, for AD, sAMAccountName=${username}. 9. In the **Scope of Search** section, choose from: #### Choose from: * **One Level** * **Subtree** Choose **One Level** to search just the base distinguished name (DN), or choose **Subtree** to search organizational units nested under the base DN.![Screen capture of the Instance Configuration tab.](_images/slw1602268941097.png) 10. Click **Next**. 11. On the **Extended Contract** tab, confirm the default values and add additional attributes as needed. | | | | - | ---------------------------------------------------------------------------- | | | On this tab, you can also extend the attribute contract of the PCV instance. | ![Screen capture of the Extended Contract tab showing the default values.](_images/kda1602269015267.png) 12. Click **Next**. 13. On the **Summary** tab, confirm your entries, and then click **Save**. ## Configuring the IdP adapter Configure an identity provider (IdP) in PingFederate. ### Before you begin * Install and run PingFederate. * Install Active Directory (AD). * [Configure the data store](#configure-login-form-validate-the-datastore). * [Configure the password credential validator (PCV)](#configure-the-password-cred-validator). * Ensure the AD service account has permissions in all domains in that forest to read and access user data in all domains to which the agent connects. ### About this task The following steps are the minimum to set up an HTML adapter to validate against AD. ### Steps 1. In the PingFederate administrative console, go to **Authentication → Integration → IdP Adapters**. 2. Click **Create New Instance**. 3. On the **Type** tab, in the **Instance Name** and **Instance ID** fields, enter a name and ID. 4. From the **Type** list, select **HTML Form IdP Adapter**. ![Screen capture of the Type tab showing the completed Instance Name and Instance ID fields and HTML Form IdP Adapter selected from the Type list.](_images/anv1602269303714.png) 5. Click **Next**. 6. On the **Idp Adapter** tab, in the **Password Credential Validator Instance** section, click **Add a new row to 'Credential Validators'**. 7. From the **Password Credential Validator Instance** list, select the appropriate PCV, and then click **Update**. ![Screen capture of the IdP Adapter tab showing the corresponding fields.](_images/gjx1602269573655.png) 8. Review and modify any other fields as needed, and then click **Next**. Many fields have default values. Make adjustments as needed. 9. On the **Extended Contract** tab, confirm the default values and add additional attributes as needed. 10. Click **Next**. 11. On the **Adapter Attributes** tab, select the attributes to receive a pseudonym to uniquely identify a user and any attributes that must be masked in the log files. ![Screen capture of the Adapter Attributes tab showing the checkboxes to select to give attributes pseudonyms or mask log values.](_images/dxq1602269917079.png) 12. Click **Next**. 13. On the **Adapter Contract Mapping** tab, click **Configure Adapter Contract**. 14. On the **Attribute Sources & User Lookup** tab, fulfill the adapter contract with the adapter's default values, or use these values plus additional attributes retrieved from local data stores. 15. Click **Next**. 16. On the **Adapter Contract Fulfillment** tab, fulfill your adapter contract with values from the authentication adapter or with dynamic text values. By default, **Adapter** is selected from the **Source** lists. 17. Click **Next**. 18. On the **Issuance Criteria** tab, optionally create criteria for PingFederate to evaluate to determine whether users are authorized to access SP resources. Click **Next**. 19. On the **Summary** tab, confirm your entries, and then click **Done**. ![Screen capture of the Summary tab showing the selected entries.](_images/lqa1602270433807.png) 20. On the **Adapter Contract Mapping** tab, click **Next**. 21. On the **Summary** tab, review the IdP adapter instance settings, and then click **Save**. ### Result After completing these steps, the HTML form adapter is ready to use in either an [Authentication Policy](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_defining_auth_policies.html) or an [SP connection](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_sp_connect_management.html). ### Next steps Enter AD credentials (username and password) to test the configured adapter.