Configure PingOne to Recognize a New Orchestrator Machine
Note:
The following steps are valid for PingOne SAML setup. Please note that the procedure is a broad description of a sample configuration. For a fully detailed how-to, visit the official PingOne Documentation.
- Log in to the PingOne Administrator Console.
- On the Applications tab, click + Add Application. A new window opens.
- Select WEB APP, and click the Configure button in the SAML box.
- On the Create App Profile page, enter an application name in the dedicated field, and click the Next button.
- On the Configure SAML page, specify the ACS URL by filling in the URL of the Orchestrator instance plus the suffix
identity/Saml2/Acs
. For instance:https://orchestratorURL/identity/Saml2/Acs
. Keep in mind that the ACS is case sensitive. - Scroll down the Configure SAML page, and set the Entity ID to
https://orchestratorURL
. - On the same page, select HTTP Redirect as your SLO binding.
- In the Assertion Validity Duration field, enter the desired validity period in seconds, and press Next.
- On the Map Attributes page, map the following attribute:
Email Address =http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
- Click Save and open the app from the Connections tab.
- In the newly opened window, copy the Single SignOn URL.
Set Orchestrator/Identity Server to Use PingOne Authentication
- Define a user in Orchestrator and have a valid email address set on the Users page.
- Import the signing certificate provided by the Identity Provider to the Windows certificate store using Microsoft Management Console. See here how to do that.
- Make sure that the following configuration is present in Identity Server's SAML2 settings within the External Providers page (read here how to access Identity Server):
- Select the Enabled check box.
- Set the Service Provider Entity ID parameter to
https://orchestratorURL
. - Set the Identity Provider Entity ID parameter to the value obtained by configuring PingOne authentication.
- Set the Single Sign-On Service URL parameter to the value obtained by configuring PingOne authentication.
- Select the Allow unsolicited authentication response check box.
- Set the Return URL parameter to
https://orchestratorURL/identity/externalidentity/saml2redirectcallback
. - Set the External user mapping strategy parameter to
By user e-mail
. - Set the SAML binding type parameter to
HTTP redirect
. - In the Signing Certificate section, set the Store name parameter to
My
from the drop-box. - Set the Store location parameter to
LocalMachine
. - Set the Thumbprint parameter to the thumbprint value provided in the Windows certificate store. Details here.
Note:
Replace all occurrences of
https://orchestratorURL
with the URL of your Orchestrator instance.Make sure that the URL of the Orchestrator instance does not contain a trailing slash. Always fill it in as
https://orchestratorURL
, nothttps://orchestratorURL/
.
- Click Save to save the changes to the external identity provider settings.
- Restart the IIS server after performing any configuration changes within Identity Server.
Updated 2 years ago