PingOne SAML

Each SSO Identity Provider requires specific information to create and configure a new Connection. Often, the information required to create a Connection will differ by Identity Provider.

To create a PingOne SAML Connection, you’ll need two pieces of information: an SP Metadata URL from WorkOS, and an IdP Metadata URL from PingOne.

WorkOS provides the SP Metadata URL. It is readily available in your Connection settings in the WorkOS Dashboard.

The SP Metadata link contains a metadata file the organization can use to set up the SAML integration. In PingOne’s case, the SP Metadata URL needs to be set by the organization when configuring your application in their PingOne instance.

Specifically, the SP Metadata URL will need to be set on the SAML Configuration page:

Next, provide the PingOne IdP Metadata URL.

Normally, this information will come from the organization's IT Management team when they set up your application’s SAML 2.0 configuration in their PingOne admin dashboard. However, should that not be the case during your setup, here’s how to obtain them:

In the PingOne Admin Console, select "Applications" (under "Connections") in the side menu. Then, select your application.

In the "Attribute Mapping" section of the PingOne SAML app, add the following field-value parameter pairs:

Users can automatically be assigned roles within your application by sending their group memberships. To enable this, set up a group attribute statement following the guidance below.

Select the + Add button once. To return the names of all groups a user is a member of, add "groups" in the "Attributes" column mapped to the "Group Names" PingOne attribute. Click "Save".

Users can automatically be assigned to roles within your application by sending their group memberships. To enable this, set up a group attribute statement following the guidance below.

Add a new groups attribute mapped to the "Group Names" PingOne attribute.

In the "Configuration" tab, copy the "IDP Metadata URL". You’ll need this in the next step. Enable the SAML app to allow users to authenticate.

Finally, upload the IdP Metadata URL you saved earlier in your WorkOS Connection settings. Your Connection will then be linked and good to go!