Step 3: Integrate PingFederate

This article describes how to integrate the PingFederate Identity Provider (IdP) with Axis Security using SAML.

Step 1: Create a SAML App in PingFederate

1. Go to Applications -> SP Connections.

2. Click Create Connection.

3. Select Do not use a template.

4. Click Next.

5. Click Browser SSO Files, and make sure the protocol is set to SAML 2.0.

7. Click Next.

8. Make sure the Browser SSO is checked.

9. Click Next.

10. Leave Metadata URL to None.

11. Click Next.

Step 2: Add PingFederate as an Identity Provider in Axis Security

To add PingFederate as an Identity Provider in Axis Security:

1. In the Axis Management Console, go to Settings -> Identity Providers.

2. Click on Add Identity Provider and select PingFederate.

3. Enter a Name for the IdP. Copy the SP Application ID and the SCIM Provisioning Token, and paste them into a text editor. You will need these details for Step 3: Finish Configuration in PingFederate.

4. In the Single Sign On URL field, paste the IdP SSO URL you obtained in step 1 (for example, https://ping.axisinternal.com:9031/idp/SSO.saml). Click Upload certificate and upload the certificate you obtained from Step 2.

5. Click on Submit

Step 3: Finish Configuration in PingFederate

1. In the General Info section, enter the Entity ID obtained from Axis. Add Connection Name and other optional information.

2. Click Next.

3. In the Browser SSO section, under Single Sign-on (SSO) profiles, click Configure Browser SSO.

4. In the SAML Profiles section, check the box for both IDP-INITIATED SSO and SP-INITIATED SSO.

5. Click Next.
6. In the Assertion Lifetime section, change the assertion lifetime if needed (optional), and click Next.

7. In the Assertion Creation section, click Configure Assertion Creation.

8. In the Identity Mapping section, select Standard.

9. Click Next.

10. In the Attribute Contact subsection, select a format for the SAML_SUBJECT with the value urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

11. In the Extend the Contract subsection, add the value "http://schemas.xmlsoap.org/claims/Group" with format urn:oasis:names:tc:SAML:2.0:attrname-format:basic, and click Add.

And then add the value "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" with format urn:oasis:names:tc:SAML:2.0:attrname-format:basic, and click Add.

12. Click Next.

13. In the Authentication Source Mapping section, click Map New Adapter Instance.

14. In the Adapter Instance section, choose the adapter that is connected to your data store.

15. Click Next.

16. In the Mapping Method, click Next.

📘

This is where we map what values are sent to Axis from PingFederate. They are all sources from Adapter but are configurable by the admin.

17. In the Attribute Contact Fulfillment section, set the following mappings:

18. Click Next.

19. In the Issuance Criteria section, click Next.

20. In the Summary section, click Done.

21. In the Authentication Source Mapping section, click Next.

22. In the Summary section, click Done.

23. In Assertion Creation section, click Next.

24. In Protocol Settings section, click Configure Protocol Settings.

25. In the Assertion Consumer Service URL section, under Binding, select POST, and under the Endpoint URL, paste the SP URL (ACS) that you obtained from Axis Management Console in step 2, and click Add.

26. Click Next.

27. In the Allowable SAML Bindings section, check only Post and Redirect options.

28. Click Next.
29. In the Signature Policy section, check ALWAYS SIGN ASSERTION, and click Next.

30. In the Encryption Policy section, select NONE, and click Next.

31. In the Summary section, click Done.

32. In the Protocol Settings section, click Next.

33. In the Summary section, click Done.

34. In the Browser SSO section, click Next.

35. In the Credentials section, click Configure Credentials.

36. In the Digital Signature Settings section, choose your signing certificate.

37. Check the INCLUDE THE CERTIFICATE IN THE SIGNATURE ELEMENT option. Click Next.

38. In the Summary section, click Done.

39. In the Credentials section, click Next.

40. In the Activation & Summary section, scroll to the bottom and click Save.