Configure PingFederate SAML SSO in an HA deployment
In a high availability (HA) deployment, users can reach Itential Platform through a load balancer virtual IP (VIP) or directly through an individual node. SAML SSO completes on a host only if PingFederate knows about that host. This page explains how Platform builds the SAML request, and how to configure PingFederate and the load balancer to match.
Before you begin
- Create and test the Identity Provider in Platform. See SAML SSO overview. Platform stores the SSO configuration in its shared database, so all nodes use the same certificate and settings. You don’t need to configure certificates per node.
- Make sure you have administrator access to PingFederate so you can edit the Service Provider (SP) connection.
- Use this page for PingFederate only. PingID is a different product with its own page.
How Platform builds the SAML request
Platform builds the Assertion Consumer Service (ACS) URL from the hostname the user used to reach it, and sends that URL in the SAML AuthnRequest.
The Issuer in the request is the value in the Issuer field of the Identity Provider in Platform. It’s the same for every host.
After authentication, the user returns to the host where they started. Session cookies are host-only, so a session created on the VIP isn’t valid on a node URL, and the reverse. This behavior is expected. Because the identity provider session is shared, a second login on another host doesn’t prompt for credentials again.
If PingFederate receives an ACS URL that isn’t registered on the SP connection, it falls back to the registered default URL. In an HA deployment, this sends every login back to a single host, regardless of where the user started.
Configure PingFederate
Use one SP connection for the whole deployment. Don’t create a separate connection for each node.
Register an ACS URL for every host
On the existing SP connection, go to Browser SSO > Protocol Settings and add each of the following as an Assertion Consumer Service URL. Use the POST binding.
https://<vip-hostname>:<port>/saml/callbackhttps://<node1-hostname>:<port>/saml/callbackhttps://<node2-hostname>:<port>/saml/callback
Add one entry for each additional node. Mark one entry as the default, typically the VIP.
PingFederate compares ACS URLs exactly, including scheme, host, port, and path. A mismatch in any part causes the login to fail or return to the wrong host.
Match the Issuer and Entity ID
Set the Issuer on the Identity Provider in Platform (Admin Essentials > Authorization > Identity Providers) to exactly match the Partner Entity ID on the PingFederate SP connection. The comparison is case-sensitive. Use a single Entity ID for the whole deployment.
Confirm the authentication context
Platform requests urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport with Comparison="exact". Confirm that your PingFederate authentication policy or authentication context mapping can satisfy this request. If it can’t, PingFederate can return a “no authentication context” error even when the ACS URLs are correct.
Configure the load balancer
- Forward the original
Hostheader to the Platform nodes, or setX-Forwarded-Host. If a node receives its own hostname instead of the VIP hostname, Platform puts the node hostname in the ACS URL for requests that came through the VIP. - Make the Platform nodes reachable on their own hostnames. This lets administrators use SSO directly on each node without local accounts.
Test the configuration
- Sign in through the VIP URL. Confirm that the browser returns to the VIP after authentication.
- Sign in through each node URL. Confirm that the browser returns to that node after authentication.
- Inspect the
SAMLRequestquery parameter with a browser SAML tracer. The value is base64 and deflate encoded. Confirm thatAssertionConsumerServiceURLmatches the host you used and thatIssuermatches the PingFederate Entity ID.