PingFederate SSO With SSOGEN

PingFederate SSO works with SSOGEN as a SAML provider or an OpenID Connect provider. Ping keeps the authentication, SSOGEN accepts the signed answer.

Try it on your systems

PingFederate SSO with SSOGEN means PingFederate authenticates the person and tells SSOGEN who signed in. SSOGEN then extends that one sign-in to every application it protects, including Oracle E-Business Suite, PeopleSoft and JD Edwards behind the SSOGEN Web Agent.

You register SSOGEN with Ping as a SAML service provider or as an OpenID Connect client. People enter nothing new. SSOGEN sends them to Ping, they sign in as they do for other Ping applications, and they return signed in.

This page lists what to check on the Ping side. The wizard is described field by field in the SAML guide and the OpenID Connect guide.

What SSOGEN needs from a Ping connection

Requirement	Why
Assertion signed	SSOGEN verifies the signature against the certificates in the metadata and cannot be told to skip it
Metadata for one connection	A document that describes more than one entity is refused
An HTTP-Redirect sign-in endpoint over https	SSOGEN reads it from the metadata
A signing certificate in the metadata	Without it SSOGEN cannot verify any assertion
A stable NameID	It becomes the username, and a change creates a second account
An email attribute	Otherwise the account has no email address

Set up the SAML connection

In SSOGEN, start Add SAML Provider and copy the SP entity ID, the ACS URL and the SP metadata URL. The SP metadata can also be downloaded from the provider’s page as sp-metadata.xml.
In PingFederate, create a service provider connection for SSOGEN using those values, with the HTTP-POST binding for the ACS.
Make the connection sign the assertion and send a NameID and an email attribute.
Export the identity provider metadata for that connection, and give it to SSOGEN by Metadata URL, upload or paste.
In SSOGEN, check the Mapping step against the attribute names Ping sends, then Create provider, Validate, Test and Activate.

Request binding and signed requests

Three switches on SSOGEN’s Review metadata step matter for Ping.

Send requests by HTTP-POST instead of redirect. Exists because some providers accept nothing else; set it together with Sign the SAML requests SSOGEN sends.
Sign the SAML requests SSOGEN sends. Turn it on only after PingFederate holds the certificate from SSOGEN’s metadata.
Force re-authentication at the identity provider. Sets ForceAuthn on every request; it deliberately defeats single sign-on, so use it only for sensitive access.

PingFederate rejects a request when it cannot verify the signature. Leave the first two switches off if Ping accepts unsigned redirect requests.

OpenID Connect with Ping

If your Ping setup offers OpenID Connect, register the client as follows.

Register a confidential web client with the authorization code flow.
Set the redirect URI to the value SSOGEN shows, and allow openid, profile and email.
Read the issuer from <issuer>/.well-known/openid-configuration and give SSOGEN exactly that value.
Store the client ID under Settings > Secrets and reference it from the wizard.

Errors and fixes

Message	Fix
That metadata publishes no HTTP-Redirect sign-in endpoint	Export metadata that lists a redirect single sign-on endpoint
That metadata publishes no signing certificate	Export the metadata again from the connection
The assertion carried no subject (NameID)	Send a NameID from the Ping connection
The provider did not send an attribute this connection requires	Add the attribute or fix the Mapping
The assertion is outside its validity window	Correct the clocks; a few minutes are allowed
The signing certificate in the metadata does not match the one configured	Ping rolled its certificate; read the metadata again

After activation, open the provider’s Configuration tab.

Sign-in domains. Add your email domains. A person who types an address at one of them then goes straight to Ping.
Sign-in order. Set it to control where Ping appears when several providers are offered.
Sign-out. Turn on Also sign out of this provider if signing out of SSOGEN should also end the Ping session.

Questions people ask

Is PingFederate the same as Ping Identity?

Ping Identity is the company and PingFederate is one of its products. SSOGEN connects to PingFederate through standard SAML 2.0 or OpenID Connect.

What happens when Ping replaces its signing certificate?

If you gave SSOGEN a Metadata URL, fetch it again, save a revision, then Validate, Test and Activate. Sign-in continues on the old configuration until you activate the new one.

Where to go next

SSOGEN has run in production since 2016. Get trial access to see PingFederate SSO with your own applications.

Other providers. Compare them on the hub.
Any provider. Use the SAML checklist.
Reference. Read the identity providers guide.

Shibboleth SSO with SSOGEN