Skip to content

Index

import TabItem from "@theme/TabItem"; import Tabs from "@theme/Tabs";

This source lets users authenticate with their PingOne credentials by configuring PingOne as a federated identity provider using SAML or OpenID Connect (OIDC).

Preparation

The following placeholders are used in this guide:

  • authentik.company is the FQDN of the authentik installation.

Configuration methods

You can integrate PingOne with authentik using either SAML or OpenID Connect (OIDC). Select a tab below for the corresponding instructions.

<Tabs defaultValue="saml" values={[ { label: "SAML", value: "saml" }, { label: "OIDC", value: "oidc" }, ]}

SAML

Export the authentik signing certificate

PingOne needs the authentik certificate to verify signed requests from authentik and to encrypt assertions.

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to System > Certificates.
  3. Click the certificate you plan on using for signing (for example, the default authentik Self-signed Certificate).
  4. Click Download Certificate.

PingOne configuration

Create a SAML application

  1. Log in to the PingOne admin console.
  2. Navigate to Applications > Applications and click +.
  3. Set Application Name to authentik, select SAML Application as the application type, and then click Configure.
  4. Select Manually Enter and configure the following settings:
    • ACS URLs: https://authentik.company/source/saml/<pingone-slug>/acs/
    • Entity ID: https://authentik.company/source/saml/<pingone-slug>/metadata/
  5. Click Save.

Configure signing, encryption, and request verification

  1. On the application's Configuration tab, click the Edit (pencil) icon.
  2. Configure the following settings:
    • Set Sign to Sign Assertion & Response.
    • Set Subject NameID Format to urn:oasis:names:tc:SAML:2.0:nameid-format:persistent. authentik requires the NameID to have an explicit format.
    • Under Encryption, select Enable Encryption, import the authentik certificate you exported earlier, and leave the algorithm on its default value.
    • Set SLO Endpoint to https://authentik.company/source/saml/<pingone-slug>/slo/.
    • Select Enforce Signed Authentication Request and import the authentik certificate you exported earlier as the Verification Certificate.
  3. Click Save.

Configure attribute mapping

  1. On the application's Attribute Mappings tab, click the Edit (pencil) icon.
  2. Set the saml_subject attribute to Username.
  3. Click Save.

Download the PingOne signing certificate

  1. On the application's Overview tab, under Connection Details, click Download Signing Certificate and select X509 PEM (.crt).
  2. Take note of the Single Signon Service and Single Logout Service URLs. These values are required in the next section.

Enable the application

  1. Toggle on the switch in the top right of the application panel to enable the application.

authentik configuration

Upload the PingOne certificate to authentik

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to System > Certificates and click Import Existing Certificate-Key Pair.
  3. Set Certificate Name to PingOne Signing Certificate.
  4. Paste the contents of the PingOne certificate you downloaded earlier into the Certificate field.
  5. Leave the Private Key field empty.
  6. Click Import Certificate-Key Pair.

Create a SAML source in authentik

  1. Navigate to Directory > Federation and Social login and click New Source.
  2. Select SAML Source and configure the following settings:
    • Set Source Name to PingOne.
    • Set Slug to pingone. The slug must match the slug used in the PingOne ACS URLs and Entity ID fields.
    • Set SSO URL to the Single Signon Service URL from PingOne (for example, https://auth.pingone.com/<environment-id>/saml20/idp/sso).
    • Set SLO URL to the Single Logout Service URL from PingOne (for example, https://auth.pingone.com/<environment-id>/saml20/idp/slo).
    • Set Binding Type to Post-auto binding.
    • Set Signing keypair to an authentik certificate (for example, the default authentik Self-signed Certificate).
    • Set Verification Certificate to the PingOne certificate you uploaded earlier.
    • Enable Verify Assertion Signature.
    • Under Advanced protocol settings, set Encryption Certificate to the authentik certificate you exported earlier (for example, the default authentik Self-signed Certificate).
  3. Click Finish.

OIDC

PingOne configuration

Create an OIDC application

  1. Log in to the PingOne admin console.
  2. Navigate to Applications > Applications and click +.
  3. Set Application Name to authentik, select OIDC Web App as the application type, and then click Save.

Configure the redirect URI

  1. On the application's Configuration tab, click the Edit (pencil) icon.
  2. Set Redirect URIs to https://authentik.company/source/oauth/callback/<pingone-slug>/.
  3. Click Save.

Grant scopes

  1. On the application's Resources tab, click the Edit (pencil) icon.
  2. Grant the profile and email scopes (the openid scope is granted by default).
  3. Click Save.

Enable the application

  1. Toggle on the switch in the top right of the application panel to enable the application.
  2. On the Configuration tab, take note of the Client ID and Client Secret. These values are required in the next section.

authentik configuration

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Directory > Federation and Social login and click New Source.
  3. Select OpenID Connect OAuth Source and configure the following settings:
    • Set Source Name to PingOne.
    • Set Slug to pingone. The slug must match the slug used in the PingOne Redirect URIs field.
    • Under Protocol settings:
      • Set Consumer key to the Client ID from PingOne.
      • Set Consumer secret to the Client Secret from PingOne.
    • Under URL settings:
      • Set OIDC Well-known URL to https://auth.pingone.com/<environment-id>/as/.well-known/openid-configuration. authentik reads the authorization, token, user info, and JWKS URLs from the well-known URL.
  4. Click Finish.

:::info Display new source on login screen For instructions on how to display the new source on the authentik login page, refer to the Add sources to default login page documentation. :::

:::info Embed new source in flow :ak-enterprise For instructions on embedding the new source within a flow, such as an authorization flow, refer to the Source Stage documentation. :::

Source property mappings

Source property mappings allow you to modify or gather extra information from sources. See the overview for more information.

Resources