Ping Identity SAML2 + SCIM

Introduction

Connect Flexopus with Ping Identity via a SAML2 for single sign on (SSO). With the integration, you can manage through your Ping Identity which users should have access to Flexopus and force them to use their Ping credentials for the login. Based on a SAML2 settings in Flexopus you can let the user profiles be created after the first successful SAML2 SSO login attempt to avoid a manual user creation process at Flexopus.

Ping Identity provides federated identity management and self-hosted identity access management (IAM) solutions to web identities and single sign-on solutions, being one of a number of organizations competing to provide standards to replace passwords for authenticating to web applications.

Setup Instruction Manual

Follow the step by step introduction manual to configure the integration. The manual also includes best practices and solution for some commonly made errors during the configuration. Still, if you need help with the setup, feel free to reach out to our support team via support@flexopus.com.

STEP 1 - Create SAML2 app

Go to your Ping Identity admin console and navigate to the Connectors tab

Select the Application menu point and click on the add button in the top to create a new application.

Enter the following parameters:
Name: Flexopus
Description: Desk Sharing Software
Select: SAML Application

On this SAML configuration page, you need to enter metadata URL of Flexopus. This URL can be found within Flexopus. Navigate in Flexopus as an administrator to Dashbaord > Settings > Authentication. Click in the Add provider button and select the SAML2 SSO option.

Copy the URL into Ping Identity and click on the import button.

The URL will be imported automatically on the next step. Click on Save

STEP 2 - Attribute mapping

As next, configure which attributes shall be exchanged between Flexopus and Ping. Set the attributes as listed below.

Once you configured the attributes, you will see the Connection Details. Copy the IDP Metadata URL.

Click on the toggle button in the top to activate the connection:

STEP 3 - Configure Flexopus

In Flexopus navigate to Dashboard > Settings > Authentication and select the created SAML2 Provider. Enable the SAML2 SSO and select paste the metadata URL in the configuration.

Enter the name of the SAML2 Login button, which will be displayed on the login page. Recommendation: SSO Login

(optional) Enable the synchronization of the fields that you configured in the SAML2 settings: jobtitle or department

In the security settings, set at the allowed domains for SSO a * (star) and press ENTER. By this, you allow every user to log in that is configured in your directory for the login.

By default, the SAML2 SSO user are registered after the first login attempt automatically. This is good for you, since you don't need to create the user profiles manually one by one before the first login, however you can disable this setting (not recommended).

STEP 3 - Configure who can log in

If you try to log in now into Flexopus, you will see an error message, since you did not configure who can or cannot log in from your Ping user directory. Assign a test user to the application and test the connection at Flexopus.

Open the settings and decide which user or group can log in into the application. It's recommended enabling the login for the whole organization in case you don't have any reasonable limitations in place. In this case, you don't need to maintain the user's access for the login, and you can reduce the number of possible support cases regarding the login configuration.

OPTIONAL - SCIM API

Optionally, you can also configure a user and group provisioning between Ping Identity and Flexopus via the SCIM API.

The following info and links may help you to configure SCIM:

For the SCIM connection, you need to install the SCIM Provisioner application of Ping Identity and configure the connection there.

Configuration of your on-premise SCIM Provisioner server can be found here: Connectors > PingFederate

Go to your Flexopus Dashboard as an administrator and visit the page Dashboard Settings > Integrations. Here you can see the Tenant URL and you can generate the SCIM API token.

SCIM connector base URL: https://{your-flexopus-domain}/api/scim/v2
Authentication Mode: HTTPS Header
Unique Identifier for users: upn
SCIM Version: 2.0

Flexopus only support the provisioning of flat groups.

Make sure that you do not sync more attributes than needed. The same attributes are need than the SAML2 attributes. Only one extension to added them: The DisplayName should be sent as one string  (firstname and lastname together)

You may also find additional information about SCIM in this article:

Azure Active Directory SCIM API

Introduction You can integrate with Microsoft Azure Active Directory (Azure AD) via federated authentication or using SCIM (System for Cross-domain Identity Management), allowing users to log in to Flexopus using their existing Azure AD credentials. Flexopus can be linked to an instance of Microsoft Azure Active Directory (Azure AD) via

Help Centerghost user

Trouble Shooting / FAQ

R0086

.