Connect Ping Identity

Work out which product you are connecting

Ask before you start. A PingOne setup can be completed by an administrator in a browser in fifteen minutes. A PingFederate change usually goes through a change window and may involve a network team, because the server is inside the customer's estate.

Before you start

• An organization in Paycux for the customer, with their email domain claimed.
• The ACS URL and entity ID from the Paycux connection.
• For PingOne, an administrator with rights to add applications in the relevant environment. Ping environments are separate, and configuring the wrong one is easy.
• For PingFederate, the customer's federation metadata URL, or an exported metadata file.

Create the application in PingOne

1. 1In the PingOne console open Connections, then Applications, and choose Add Application.
2. 2Give it a name and icon, choose SAML Application, and continue.
3. 3Select Manually enter, then paste the Paycux ACS URL into ACS URLs and the Paycux entity ID into Entity ID.
4. 4Set the subject NameID format to emailAddress and the assertion validity to the default unless the customer asks otherwise.
5. 5Save, then open the Configuration tab and download the signing certificate and the metadata.
6. 6Enable the application and assign the groups that should have access under the Access tab.

Map the attributes

Attribute mapping lives on its own tab. PingOne sends the subject by default and nothing else, so add the three fields your product needs to render a user list.

PingFederate, in outline

With PingFederate, your side of the exchange is unchanged: you supply an ACS URL and an entity ID, and you receive a sign-on URL and a signing certificate. The customer's team creates an SP connection, adds an attribute contract and configures an adapter to source those attributes from their directory.

The most useful thing you can give them is the metadata for your side and a clear attribute contract — the three or four claim names you expect, spelled exactly. Most delays here come from ambiguity, not difficulty.

1# Paycux baglantisinin bekledigi sozlesme
2SAML_SUBJECT   ->  kalici kullanici kimligi (e-posta degil)
3email          ->  birincil e-posta adresi
4firstName      ->  ad
5lastName       ->  soyad
6groups         ->  cok degerli, yalniz rol eslemesi gerekiyorsa
7 
8# Metadata URL ornegi (musteri tarafi)
9https://sso.foo-corp.example/pf/federation_metadata.ping?PartnerSpId=paycux

Finish the connection in Paycux

1. 1Upload the metadata file, or paste the single sign-on URL, issuer and certificate into the Paycux connection.
2. 2Run a test sign-in as an assigned user and read the returned profile.
3. 3Confirm the subject identifier is stable by signing in twice and comparing it.
4. 4Activate the connection.

Provisioning

1. 1Create a directory in Paycux for the same organization and copy the SCIM endpoint URL and bearer token.
2. 2In PingOne, open the application's Provisioning tab and add an outbound SCIM connection using those values.
3. 3Choose the population or groups to provision. Provisioning an entire environment is rarely what the customer wants.
4. 4Run the connection test before enabling, then turn provisioning on and watch the first sync in the provisioning log.

When it does not work

Related