> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-platform/6/auth/sso-saml/configure-pingid/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Configure PingID SAML SSO

> Set up Single Sign-On with PingID multi-factor authentication

**PingID** is a multi-factor authentication (MFA) solution that integrates with existing identity systems to provide secure authentication and can also be used as part of a SAML SSO implementation that allows users to access multiple applications with a single set of credentials.

Key benefits of using PingID with SAML SSO:

* Stronger security through MFA.
* Centralized authentication management.
* Audit trails of authentication events.
* Compliance with organizational security and regulatory requirements.

## Before you begin

Beginning with the 2023.2 release, access management in Itential Platform was expanded to include [SAML SSO Authentication](/itential-platform/configure/auth/saml-sso/overview). Itential assumes the reader has completed the process of setting up SAML SSO Authentication in Itential Platform via Admin Essentials and has mapped their Identity Provider (**Admin Essentials > Authorization > Identity Providers**).

Keep in mind that each organization may have their PingID system configured differently and this guide is not all-inclusive of every system environment.

**Additional resources:**

* [Configuring a SAML Application](https://docs.pingidentity.com/solution-guides/workforce_use_cases/htg_config_saml_app.html) — a basic guide to configuring PingID as a SAML Identity Provider on the Ping Identity site.
* A short demo of how to set up PingID and a test application for SAML SSO:

## Add PingID attributes

#### Copy the Entity ID from PingID

Sign in to **PingID** and go to the Itential Platform application that was set up under **Applications**. Under **SAML Configuration**, copy the `Entity ID`. This will be used to satisfy the **Issuer** parameter.

![](/_fern-img/1b2c20299c1d4ead38c0f248bec4e81a0fa0cd84752b01b7e26489cd88c1e1ee.webp)

#### Paste the Entity ID into Itential Platform

Sign in to Itential Platform and navigate to **Admin Essentials > Authorization > Identity Providers > Configuration**. Paste the `Entity ID` into the **Issuer** field.

![](/_fern-img/a98f0b5c038aabc0ee1a0e6c935d60d082a61e3514ebe3231859a8b3ff0e039a.webp)

#### Copy the Single Signon Service key from PingID

In the PingID administrative console, go to **Applications > Configuration** and copy the **Single Signon Service** key. This will be used to satisfy the **Login URL** parameter on the Itential Platform Identity Providers Configuration form.

![](/_fern-img/76e598edbb576de556d36ac8b7bb6448ab719d30b55813b183b03caba72666f7.webp)

#### Upload the signing certificate and enter the Login URL

Download the `Signing Certificate` file from the PingID administrative console (**Applications > Configuration**). In Itential Platform, enter the Single Signon Service key in the **Login URL** field. Upload the certificate file to the Identity Providers Configuration form by drag-and-drop, or use the **Click to Browse** link to find and select the file.

![](/_fern-img/275e86d539d0aa57b8dc5744ab20f697a510d6f5f8c5a685ecf0778bf8b57ee2.webp)

#### Copy attribute mappings from PingID

In the PingID administrative console, go to **Applications > Attribute Mappings** and copy the Username, Group Names, and Email Addresses values from the **PingOne** column.

![](/_fern-img/1a9d74de5d2460fd3f1664a84da318fb76f6a7f1f1fef4b447d525b1e04923ee.webp)

#### Paste attribute mappings into Itential Platform

In Itential Platform, on the **Identity Providers > Configuration** tab, paste the PingID values into the corresponding fields:

* `Username` → **Username Attribute**
* `Group Names` → **Groups Attribute**
* `Email Addresses` → **Email Attribute**

![](/_fern-img/c537e0cc77adaeb9f0187181c0eeabf710dc01ecc6b19228b07308c3df281597.webp)

#### Save

Click **Save** at the top of the **Identity Providers** page (next to Test Connection) to retain all your inputs.

## Test the PingID configuration

To enable PingID in Itential Platform, you must test the configuration first. Click the **Test Connection** button at the top of the Identity Providers page (under the **Configuration** tab). This initiates SSO SAML authentication with PingID in a new tab and displays a message indicating whether the test was successful.

If the test is successful, all parameters are set correctly and you can close the tab. After a successful test connection, **Groups** from the authentication server display and can be mapped to Itential Platform groups and roles. Map at least the `pronghorn` admin group to provide permissions within Itential Platform.

![](/_fern-img/96fa9240e7d1077d24a0d4f0f25ec08499f37b49b22d4ba1ff89bbd1e7f0afa1.webp)

If the test is unsuccessful, there may be a problem with the parameters or certificate. Check your configured SAML settings to verify all attributes are mapped correctly.

![](/_fern-img/fe9e8dc0b5c629043397d93b4e13e4c258f6d5967ba7b6a5a9cbe947ac4ad332.webp)

## Enable PingID SSO

Navigate to **Admin Essentials > Authorization > Identity Providers**. Locate the PingID IdP and slide the toggle switch to **Enabled**.

Once PingID is enabled, the Itential Platform authentication method immediately switches to SSO SAML.

![](/_fern-img/9fffba277df9198dfe5d0e621f45788e47bb9fdf11a5fd468c54c775cf255d2d.webp)

> Set up Single Sign-On with PingID multi-factor authentication