PingFederate - SAML Protocol

1. In the Ivanti Neurons Platform, navigate to Admin > Authentication.
   The Authentication page appears.

2. In the External Authentication (SSO) section, click Configure & Enable.
   The Enable External Authentication (SSO) page appears.

3. From the Provider drop-down, select PingFederate.

4. From the Sign-In Method drop-down, select Saml 2.0.

   PingFederateSAML 2.0 Configuration Settings appears. It is recommended to leave this tab open for future reference when configuring the details in PingFederateAdmin console.

1. Log in to the PingFederate Admin console.

2. From Applications, select SPConnections.

3. Click Create Connection.

4. In Connection Template, select DO NOT USE A TEMPLATE FOR THIS CONNECTION and click Next.

5. In Connection Type, select BROWSER SSO PROFILES since this setup requires browser access.

6. From PROTOCOL drop-down, select SAML 2.0 and click Next.

7. In Connection Options, select BROWSER SSO and click Next.

8. In Import Metadata, select None and click Next.

9. In General Info, enter the following details available in the Ivanti Neurons tab that was open:

   • PARTNER’S ENTITY ID (CONNECTION ID): Unique connection identifier (Entity ID).

   • CONNECTION NAME: Language identifier for this connection.

10. (Optional) Specify multiple virtual server IDs, using the Base URL for simplified partner endpoint configurations and click Next.

11. In Browser SSO, click Configure Browser SSO to set up or edit the configuration for secure browser-based SSO to the partner’s resources.

    1. In SAML Profiles, select SP-Initiated SSO to specify the types of messages exchanged between the Identity Provider and Service Provider, as well as the transport methods (bindings), and click Next.

    2. In Assertion Lifetime, set the validity time frame before and after issuance for assertion to the SP, and click Next.

    3. In Assertion Creation, click Configure Assertion Creation to set up SAML assertions for SSO access to your SP partner's site.

    1. In Identity Mapping, select Standard and click Next.

    2. In Attribute Contract, select SAML_SUBJECT and update the Extend the Contract fields with the following set of required user attributes that the server will send in the assertion:

       • email

       • given_name

       • family_name

    3. Click Next.

    4. In Authentication Source Mapping, click Map New Adapter Instance.

       1. In Adapter Instance, select PingOneIdpAdapter, and click Next.

       2. In Mapping Method, select USE ONLY THE ADAPTER CONTRACT VALUES IN THE SAML ASSERTION and click Next.

       3. In Attribute Contract Fulfillment, update the Attribute Contract as follows:

          • SAML_SUBJECT: Source - Adapter, Value - username

          • email: Source - Adapter, Value - email

          • family_name: Source - Adapter, Value - name.family

          • given_name: Source - Adapter, Value - name.given

       4. Click Next.

       5. In Issuance Criteria, update or leave the fields blank as required and click Next.

       6. Review the details in Summary and click Done.

    5. In Authentication Source Mapping, click Next.

    6. Review the details in Summary and click Done.

    4. In Assertion Creation, click Next.

    5. In Protocol Settings, click Configure Protocol Settings to set up SAML assertions for SSO access to your SP partner's site.

    1. In Assertion Consumer Service URL, copy the Assertion Customer Service URL from the Neurons Platform and paste it in the Endpoint URL field on the PingFederate Admin portal.

    2. Select POST from the Binding drop-down and click Add > Next.

    3. In Allowable SAML Bindings, select POST and click Next.

    4. In Signature Policy, select SIGN RESPONSE AS REQUIRED and click Next.

    5. In Encryption Policy, select NONE and click Next.

    6. Review the details in Summary and click Done.

    6. In Protocol Settings, click Next.

    7. Review the details in Summary and click Done.

12. In Browser SSO, click Next.

13. In Credentials, click Configure Credentials to set up Digital Signature settings.

    1. Select a certificate from SIGNING CERTIFICATE drop-down.

    2. Retain the field values of SECONDARY SIGNING CERTIFICATE and SIGNING ALGORITHM and click Next.

    3. Review the details in Summary and click Save.

14. In Credentials, click Next.

15. Review the details in Activation & Summary and click Done. The SP Connections page displays.

16. Click Select Action under Actions against the new connection configured > Export Metadata.

17. In Metadata Signing, select a certificate from SIGNING CERTIFICATE drop-down.

18. Select an algorithm from the SIGNING ALGORITHM drop-down and click Next.

19. Select Export. The metadata file is downloaded.

20. Navigate to Enable External Authentication page of Ivanti Neurons Platform that was open and click Select file.

21. Open the downloaded metadata file and click Upload.

22. Click Continue to validate the settings.

You must connect with your PingFederate credentials to validate your connection settings.

1. On the Validate Connection Settings page, click Validate Settings. A new tab opens on your organization’s sign-in page. Enter your PingFederate credentials and sign in.

2. Return to the Validate Connection Settings page and select the check box to confirm login success.
   PingFederate is now configured, but it is not enabled. To enable, you need to convert your Ivanti Neurons Platform accounts to PingFederate.

3. Click Continue to proceed to the Convert your Ivanti Neurons platform account page.

• E2018 Authentication failed: User failed to authenticate with PingFederate. Check that the username and password are correct, and that the user has permissions on the PingFederate SP Connection.

• E2019 Missing optional claims: Validation step failed because the additional optional claims were not present in the token returned to Ivanti Neurons Platform from PingFederate.

• E2020 Unable to link to Neurons Platform user account: The PingFederate user login, does not match with the Ivanti Neurons Platform user. The Ivanti Neurons Platform user account email address must match the email address used to login into PingFederate.

1. On the Convert your Ivanti Neurons platform account page, click Sign Out & Enable. Ivanti Neurons is signed-out.

2. Click Sign in with PingFederate and enter your PingFederate credentials to complete the process.

3. You can now view PingFederate application in Admin > Authentication with an Enabled status.    

4. Click Sign out from the Neurons platform.
   Now, when you sign back in, you are routed to PingFederate to choose the account and sign in with PingFederate credentials.

1. In Ivanti Neurons Platform navigate to Setup > Authentication.
   The Authentication Method page appears.

2. In the External Authentication (SSO) section, click Actions and select Enable auto provisioning.

3. From the Default roles drop-down, select the access control role that you want to be assigned to all new members.
   To set up Roles, go to Ivanti Neurons > Admin> Roles.

4. Click Enable Auto Provisioning to confirm the role selection and enable auto provisioning for all new members.