# Ping Identity

{% hint style="info" %}
This feature is available in the **Premium plan and higher**.
{% endhint %}

{% hint style="danger" %}
**Remember to** [**grant your Ping Identity users access permissions**](#step-3-managing-user-access) **to GoodAccess. Users without them won't be able to log in.**
{% endhint %}

## Step 1 - Adding a new identity provider

[Log in to the GoodAccess **Control Panel**, and go to **Settings** > **SSO & Identity**.](https://app.goodaccess.com/sso-and-identity/)

Click **+ Add provider**, enter the **Provider name**, choose your **Identity Provider**, and click **Continue**.

## Step 2 - Setting up Single Sign-On with SAML

Log in to the Ping Identity Admin console, go to **Applications** > **Applications**, and click **(+)**.

Give the application a name, select **SAML Application**, and click **Configure**.

Select **Manually Enter**, and copy the details from GoodAccess - **(2) GoodAccess links**.

* **ACS URLs** - Assertion Consumer Service URL
* **Entity ID** - Entity ID

Return to GoodAccess, and click **Continue**.

Return to Ping Identity, and click **Save**.

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2FMsaI64Y2iMB613lthqWo%2FFeatures_SSO_Ping_Identity_01.png?alt=media&#x26;token=27e62f08-e8de-4a53-960a-a759e72c5359" alt="Ping Identity Admin console with key steps to creating a new SAML application."><figcaption><p>Creating a new SAML application</p></figcaption></figure>

### 1. Attribute Mappings

Go to **Attribute Mappings**, click the **Edit icon**, and add the following attributes:

| Attributes               | PingOne Mappings |
| ------------------------ | ---------------- |
| "email" (without quotes) | Email Address    |
| "name" (without quotes)  | Username         |

Check the **Required** boxes, and click **Save**.

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2FdrvONjQzigGFFe4lrnpO%2FFeatures_SSO_Ping_Identity_02.png?alt=media&#x26;token=1981c81a-6708-46f0-861d-7891d73a3351" alt="Ping Identity Admin console with key steps to setting up the &#x22;Attribute Mappings&#x22;."><figcaption><p>Setting up the Attribute Mappings</p></figcaption></figure>

### 2. Configuration

Go to **Configuration**, click **Download Metadata**, and open the file in a text editor (e.g. Notepad).

Copy the details to GoodAccess - **(3) Identity Provider links**, and click **Continue**.

* **Sign in URL** - Single Signon Service
* **Entity ID** - Issuer ID
* **X509 signing certificate** - Copy the certificate from the text editor

Don't forget to **Enable** the application.

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2FRX2KNW8ETBOMVdNNUhPs%2FFeatures_SSO_Ping_Identity_03.png?alt=media&#x26;token=92a88010-8092-4728-b6f6-ba608c99dabe" alt="Ping Identity Admin console with key steps to setting up GoodAccess."><figcaption><p>Setting up GoodAccess</p></figcaption></figure>

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2FoS9HUSW0Ky9OTgM8B52r%2FFeatures_SSO_Ping_Identity_04.png?alt=media&#x26;token=03e31260-13d9-4bc6-924e-83edcfbd3924" alt="Notepad with highlighted X509 signing certificate."><figcaption><p>Copying the certificate from the Notepad</p></figcaption></figure>

{% hint style="info" %}
If you don't want to setup SCIM, skip the next step in GoodAccess, and click **Submit** to finish the configuration.
{% endhint %}

You have now successfully set up your Ping Identity SSO with GoodAccess.

## Step 3 - Managing user access

{% hint style="danger" %}
**Please note:** If no groups are selected, **all users will have access**. To prevent unauthorized access, ensure you add at least one group, even when setting up SCIM.
{% endhint %}

{% hint style="warning" %}
If you are setting up SCIM, skip this section. User access for SCIM is managed separately—please refer to [#user-filter](#user-filter "mention") for details.
{% endhint %}

In the application, go to **Access**, and click the **Edit icon**.

Choose who should have access, and click **Save**.

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2Fa3MutzyVMclmYP4Lds6w%2FFeatures_SSO_Ping_Identity_05.png?alt=media&#x26;token=8814d3b1-8af2-469c-8d4f-78ca41b5e694" alt="Ping Identity Admin console with key steps to managing user access."><figcaption><p>Managing user access</p></figcaption></figure>

## Step 4 (optional) - Setting up SCIM

### 1. Provisioning Connection

Go to **Integrations** > **Provisioning**, click **(+)** to create a new connection, and select **Identity Store**.

Select **SCIM Outbound**, and click **Next**.

Give the connection a name, and click **Next**.

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2F6K2kCb7BXVeZgZkrS7sX%2FFeatures_SSO_Ping_Identity_05.png?alt=media&#x26;token=cb78eb52-a950-4950-ac23-73843a1bb111" alt="Ping Identity Admin console with key steps to creating a new provisioning connection."><figcaption><p>Creating a new provisioning connection</p></figcaption></figure>

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2FPYA56CA1d6vXeGsSOJVE%2FFeatures_SSO_Ping_Identity_06.png?alt=media&#x26;token=2da75b54-b8e4-4b0a-a910-19394c3cd159" alt="Ping Identity Admin console with key steps to creating a new provisioning connection."><figcaption><p>Creating a new provisioning connection</p></figcaption></figure>

#### Authentication

Copy the **URL** and **Token** from GoodAccess - **(4) User provisioning (SCIM)**.

* **SCIM BASE URL** - URL
* **SCIM Version** - 2.0
* **Authentication Method** - OAuth 2 Bearer Token
* **Oauth Access Token** - Token
* **Auth Type Header** - Bearer

Return to GoodAccess, and click **Submit**.

Return to Ping Identity, click **Test Connection**, and **Next**.

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2FJg9QQl5S0efMORKTPuy6%2FFeatures_SSO_Ping_Identity_07.png?alt=media&#x26;token=7369c5e4-2ec7-457d-af4a-a20118dc3558" alt="Ping Identity Admin console with key steps to setting up the &#x22;Authentication&#x22;."><figcaption><p>Setting up the Authentication</p></figcaption></figure>

#### Preferences

Select actions to allow, and click **Save**.

Don't forget to **Enable** the connection.

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2FaWJQdBomQHte43Za03i0%2FFeatures_SSO_Ping_Identity_08.png?alt=media&#x26;token=edbc189f-38d8-49fd-89cf-de618e08ce9b" alt="Ping Identity Admin console with key steps to setting up the &#x22;Preferences&#x22;."><figcaption><p>Setting up the Preferences</p></figcaption></figure>

### 2. Provisioning Rule

Go to **Integrations** > **Provisioning**, and click **(+)** to create a new rule.

Give the rule a name, and click **Create Rule**.

Click **(+)** to add your new connection as **Target**, and click **Save**.

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2FTS7uexQkC3LYnXUKWK9s%2FFeatures_SSO_Ping_Identity_09.png?alt=media&#x26;token=30a6b2d6-a918-4110-a9af-4283c4d42740" alt="Ping Identity Admin console with key steps to creating a new provisioning rule."><figcaption><p>Creating a new provisioning rule</p></figcaption></figure>

#### User Filter

Click the **Edit icon** to modify the user provisioning criteria.

For instance, you can use the **Group Names** attribute to provision users based on their membership in a specific group.

| Attribute   | Operator | Value   |
| ----------- | -------- | ------- |
| Group Names | Contains | Group 1 |
| Group Names | Contains | Group 2 |

Click **Save**.

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2FBOENE95WC9k8qfIFKEUO%2FFeatures_SSO_Ping_Identity_10.png?alt=media&#x26;token=a4d1dc62-370d-4728-9157-fd4e7eb37dd3" alt="Ping Identity Admin console with key steps to setting up the &#x22;User Filter&#x22;."><figcaption><p>Setting up the User Filter</p></figcaption></figure>

#### Attribute Mapping

Click the **Edit icon**, and edit the existing mapping and add a new one as follows:

| Identity Provider Directory | GoodAccess  |
| --------------------------- | ----------- |
| Email Address               | userName    |
| Username                    | displayName |

Click **Save**.

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2FEaAXCEasfTbHEgVGcnhI%2FFeatures_SSO_Ping_Identity_11.png?alt=media&#x26;token=7fb17a3b-54da-4f21-af9a-c70d14485b99" alt="Ping Identity Admin console with key steps to setting up the &#x22;Attribute Mapping&#x22;."><figcaption><p>Setting up the Attribute Mapping</p></figcaption></figure>

#### (optional) Group Provisioning

Click the **Edit icon**, and select groups you want to provision. Group memberships in GoodAccess are updated according to [#user-filter](#user-filter "mention") criteria.

Click **Save**.

Don't forget to **Enable** the rule.

<figure><img src="https://418253935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FiJ406Lpi9EKoWDi7GFL7%2Fuploads%2F5fUbAc6Jx7Flb4IqbLPp%2FFeatures_SSO_Ping_Identity_12.png?alt=media&#x26;token=58e8fd20-33c7-4903-b83e-e89a07a4a798" alt="Ping Identity Admin console with key steps to setting up the &#x22;Group Provisioning&#x22;."><figcaption><p>Setting up the Group Provisioning</p></figcaption></figure>

{% hint style="info" %}
The whole provisioning process will take around **20 minutes** to complete depending on the number of members and groups being added.
{% endhint %}

You have now successfully set up your Ping Identity SCIM with GoodAccess.