Skip to main content

Log in with PingOne

This source lets users authenticate with their PingOne credentials by configuring PingOne as a federated identity provider using SAML or OpenID Connect (OIDC).

Preparation​

The following placeholders are used in this guide:

  • authentik.company is the FQDN of the authentik installation.

Configuration methods​

You can integrate PingOne with authentik using either SAML or OpenID Connect (OIDC). Select a tab below for the corresponding instructions.

SAML​

Export the authentik signing certificate​

PingOne needs the authentik certificate to verify signed requests from authentik and to encrypt assertions.

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to System > Certificates.
  3. Click the certificate you plan on using for signing (for example, the default authentik Self-signed Certificate).
  4. Click Download Certificate.

PingOne configuration​

Create a SAML application​

  1. Log in to the PingOne admin console.
  2. Navigate to Applications > Applications and click +.
  3. Set Application Name to authentik, select SAML Application as the application type, and then click Configure.
  4. Select Manually Enter and configure the following settings:
    • ACS URLs: https://authentik.company/source/saml/<pingone-slug>/acs/
    • Entity ID: https://authentik.company/source/saml/<pingone-slug>/metadata/
  5. Click Save.

Configure signing, encryption, and request verification​

  1. On the application's Configuration tab, click the Edit (pencil) icon.
  2. Configure the following settings:
    • Set Sign to Sign Assertion & Response.
    • Set Subject NameID Format to urn:oasis:names:tc:SAML:2.0:nameid-format:persistent. authentik requires the NameID to have an explicit format.
    • Under Encryption, select Enable Encryption, import the authentik certificate you exported earlier, and leave the algorithm on its default value.
    • Set SLO Endpoint to https://authentik.company/source/saml/<pingone-slug>/slo/.
    • Select Enforce Signed Authentication Request and import the authentik certificate you exported earlier as the Verification Certificate.
  3. Click Save.

Configure attribute mapping​

  1. On the application's Attribute Mappings tab, click the Edit (pencil) icon.
  2. Set the saml_subject attribute to Username.
  3. Click Save.

Download the PingOne signing certificate​

  1. On the application's Overview tab, under Connection Details, click Download Signing Certificate and select X509 PEM (.crt).
  2. Take note of the Single Signon Service and Single Logout Service URLs. These values are required in the next section.

Enable the application​

  1. Toggle on the switch in the top right of the application panel to enable the application.

authentik configuration​

Upload the PingOne certificate to authentik​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to System > Certificates and click Import Existing Certificate-Key Pair.
  3. Set Certificate Name to PingOne Signing Certificate.
  4. Paste the contents of the PingOne certificate you downloaded earlier into the Certificate field.
  5. Leave the Private Key field empty.
  6. Click Import Certificate-Key Pair.

Create a SAML source in authentik​

  1. Navigate to Directory > Federation and Social login and click New Source.
  2. Select SAML Source and configure the following settings:
    • Set Source Name to PingOne.
    • Set Slug to pingone. The slug must match the slug used in the PingOne ACS URLs and Entity ID fields.
    • Set SSO URL to the Single Signon Service URL from PingOne (for example, https://auth.pingone.com/<environment-id>/saml20/idp/sso).
    • Set SLO URL to the Single Logout Service URL from PingOne (for example, https://auth.pingone.com/<environment-id>/saml20/idp/slo).
    • Set Binding Type to Post-auto binding.
    • Set Signing keypair to an authentik certificate (for example, the default authentik Self-signed Certificate).
    • Set Verification Certificate to the PingOne certificate you uploaded earlier.
    • Enable Verify Assertion Signature.
    • Under Advanced protocol settings, set Encryption Certificate to the authentik certificate you exported earlier (for example, the default authentik Self-signed Certificate).
  3. Click Finish.
Display new source on login screen

For instructions on how to display the new source on the authentik login page, refer to the Add sources to default login page documentation.

Embed new source in flow Enterprise

For instructions on embedding the new source within a flow, such as an authorization flow, refer to the Source Stage documentation.

Source property mappings​

Source property mappings allow you to modify or gather extra information from sources. See the overview for more information.

Resources​