Set Up Ping Identity Single Sign On (SSO)

This article provides steps for configuring Ping Identity SSO in Cloud Control Center.

 

Three main components are required to successfully configure SSO using Ping Identity.

1. Adding Elisity Cloud Control Center Application in Ping

2. Create and Assign User Roles

3. Configure Ping SSO with Cloud Control Center (Two Methods)

Cloud Control Center supports up to 10 SSO providers. To connect more than one Ping Identity environment, repeat this setup for each environment and add each environment as a separate SSO provider. For more information, see Configure Multiple SSO Identity Provider Connections.

Adding Cloud Control Center as an Application in Ping Identity

First, login to your Ping Identity console. Go to Connections -> Applications and click the add application icon. ( + ) Give your application a name such as "Elisity CCC" and optionally add a description. Select OIDC Web App as your Application Type and click save. 

 

 

After saving, go back to the Applications Panel and Click on your newly added Elisity CCC application, and select the configuration panel. We need to copy and save three credentials that we will use later. Locate and copy the following into your notepad:

URL: Issuer and General: Client ID and Client Secret

 

 

Next, scroll back up to the top of the configuration panel and click the edit icon.

 

 

Make sure that your application configuration matches below.

 

Configuring Supported User Roles in Ping

Go to Identities -> Groups and add user groups to define the roles you want to use for signing in to Cloud Control Center. Our two standard groups are the following:

You can choose to add users to these groups now, or later on.

Next, go to Connections -> Applications and select the Cloud Control Center Application Registration we created earlier.  

Go to attribute mappings, and edit a custom attribute using the pencil icon.

 

 

Add the following Attribute Mapping:

• •  Attribute: UserRole - PingOneMapping: Group Names 

Next, go to the "Access" tab in the same window, and click the pencil icon.

Apply the following settings:

• Must have admin access: Unchecked 
• Select: User is a member of any applied group
• Select: appropriate groups - TenantAdmin, TenantUser, etc  

Configure Ping SSO in Cloud Control Center

Method 1: Using the Discovery Endpoint for Ping SSO

Before using this method, you need to ensure that your Elisity Application and User Roles are already created in Ping SSO. If they are not, navigate to the respective sections to fulfill these requirements first.

Step 1. Sign in to Cloud Control Center (CCC) with an admin account that has permissions to make SSO configuration changes. Navigate to Settings > Administration, select the SSO Configuration tab and click + Add SSO Provider.

Step 2. Leave Use Discovery Endpoint turned on. In Discovery Endpoint, enter the Issuer URL that you copied in Adding Cloud Control Center as an Application in Ping Identity with /.well-known/openid-configuration appended, and click Discover. For example, if the Issuer URL is https://<Ping-Domain>/idp, the discovery endpoint is https://<Ping-Domain>/idp/.well-known/openid-configuration. When the message "Discovery endpoint is successful" appears, the Metadata fields are filled in. Expand Metadata to verify the values.

Step 3. In Name, enter the name users see on the login page, up to 60 characters (for example, your organization name).

Step 4. Enter the Client ID and Client Secret that you copied from the Elisity CCC application in Ping Identity. Keep the default Scopes (openid, email, profile and offline_access).

Step 5. Click Add. The Connection created dialog displays the provider's Redirect URL. Click Copy, and then click Done.

Register the copied Redirect URL in Ping Identity as described in Register the Redirect URL in Ping Identity. Users cannot sign in through this SSO provider until the Redirect URL is registered.

 

Method 2: Manually Entering Metadata

You can optionally choose to bypass the Discovery Endpoint method and manually enter all the required configurations in Cloud Control Center. On the Add SSO Provider page, turn off Use Discovery Endpoint and enter the following fields:

• Name: The name users see on the login page, up to 60 characters.
• Client ID: The unique identifier assigned to your application by the SSO provider. This value can be found by following the guide above.
• Client Secret: A confidential secret used by your application to authenticate with the SSO provider. This value can be found by following the guide above.
• Scopes: The OpenID Connect scopes requested from the SSO provider. Keep the defaults (openid, email, profile and offline_access).
• Token Endpoint: The URL used by the application to exchange an authorization code for an access token.
• Authorization Endpoint: The URL used to initiate the user authorization process.
• JSON Web Key Set: The URL pointing to a set of public keys used to verify the signature of JSON Web Tokens.
• User Information Endpoint: The URL from which the application can retrieve user profile information.
• Issuer: The URL that uniquely identifies the authorization server that issued the token. This value can be found by following the guide above.

Refer to Ping Identity documentation on how to retrieve the values for manual configuration that are not covered in this document.

Click Add, and then copy the Redirect URL from the Connection created dialog as described in Method 1.

 

Register the Redirect URL in Ping Identity

After you add the SSO provider in Cloud Control Center, register its Redirect URL in the Elisity CCC application in Ping Identity.

1. Go to Connections -> Applications and select the Elisity CCC application.
2. Open the configuration panel and click the edit icon.
3. In Redirect URIs, paste the Redirect URL that you copied from the Connection created dialog in Cloud Control Center.
4. Click Save.

To copy the Redirect URL again, open the Actions menu for the SSO provider on the SSO Configuration tab in Cloud Control Center and select View Redirect URL.

 

Create SSO Role Configurations in Cloud Control Center

Before you finish the integration, add the Key-Value to User Role mappings in Cloud Control Center. Ping Identity sends the user's group names in the UserRole attribute that you added to the attribute mappings in Configuring Supported User Roles in Ping, so the key is "UserRole" and the value type is User Groups. Any groups that are assigned to the Application Integration for Cloud Control Center (within Ping Identity) can be mapped to a role in Cloud Control Center. Role mappings apply only to the SSO provider they are configured on.

Step 1. On the SSO Configuration tab, open the Actions menu for your Ping Identity SSO provider and select Role Configuration.

Step 2. For any and every user group that you would like to map to a role in Cloud Control Center, click Add Role and enter the Key, Value and User Role. If you copied the syntax for the Key-Value pairs in this guide, the default User Roles should look exactly like this:

 

KEY	VALUE	USER ROLE (pre-defined)
UserRole	TenantAdmin	Tenant Admin
UserRole	TenantUser	Tenant User

 

Any additional user groups you would like to map to custom roles can also be configured here. They should use the same key (Key = "UserRole") unless you configured your key-value differently. Key and Value are case sensitive. The value field should also match exactly the syntax of user groups assigned to your CCC Application within your IDP. You can then assign to any custom role you have created to effectively enable Role-Based Access Control for Cloud Control Center. An example might look like this:

In this example, SSO users who are members of the NetworkAdmins group are assigned the Virtual-Edges-Only custom role, which restricts their access to ONLY the Virtual Edge page.

Step 3. Click Save Changes. The message "Role mappers have been updated successfully." confirms the change.

 

Ping SSO Integration Completed

You can now log in to Cloud Control Center using Ping Identity SSO for users who have the appropriate attributes applied. Click Log In With SSO and, when more than one SSO provider is configured, select this provider by name. Then enter your Ping Identity credentials.