This article describes setting up single sign-on (SSO) with Ping Identity's PingOne product. This feature must be enabled in your account by a MetaLocator support technician in order to function as shown in this article.
Configuring Ping Identity
Step 1. Create a new Application within PingOne.
Step 2. Choose Manually Enter
Step 3. Obtain your ACS URL
Login to MetaLocator as the Account Owner and obtain the User ID as shown below
The ACS URL will be
https://admin.metalocator.com/plugins/user/oneloginsaml/oneloginsaml.php?acs&id=XXXXX
Where XXXXX is your primary Account Owner's User ID as obtained above.
Entity ID is
metalocator-saml
Under Attribute Mappings, configure the application as shown below:
Configuring MetaLocator
Login as the Account Owner
Important: This must be done in the Owner account. There is only one Owner account for a given customer. Your owner account will be indicated as Owner as shown below:
Go to My User Profile as shown below:
Scroll down and expand Show Advanced Options, then update the following options according to your PingOne settings.
onelogin_saml_idp_domain
Set this to the domain associated with your email address, e.g. customer.com. This ensures that the anonymous link on our login form knows which SSO to invoke based on an incoming email.
Users will be created on the fly based on the email address coming from Okta. The accounts will be created as "blocked" accounts with no access to any MetaLocator features. The requesting user will receive an email notification that their account is pending review and the account owner will receive an email notification that an account is pending review as shown below:
Click the link provided and login as the account owner. Click the username to edit the user. Choose an appropriate user type:
Click Save, then enable the user as shown below. This triggers an email notification to the new SSO user indicating that their login has been enabled.
The email notification is shown below.
When the user logs in, they will now see the resources available to them, based on the type of user chosen above.
Name ID format
If required, the Name ID format is:
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified