SSO AuthenticationSAML 2.0
Ping Identity
Configure PingOne / Ping Identity as a SAML 2.0 identity provider for Safeguard.
Ping Identity
Example values
The tenant-specific values (the sg_ab12cde parts) show the shape only — Safeguard displays your real ACS URL and SP Entity ID in the Add Provider dialog after you click Save. This table makes it unambiguous which value goes on which side.
In Ping Identity — the SAML app / SP details (you enter these at the IdP):
| Field | Example value |
|---|---|
| ACS URL (ACS URLs) | https://api.safeguard.sh/auth/idp/realms/sg_ab12cde/broker/ping/endpoint |
| SP Entity ID / Audience | https://api.safeguard.sh/auth/idp/realms/sg_ab12cde |
| Name ID format | EmailAddress |
email attribute | the signed-in user's email (mapped from the Email Address attribute) |
In Safeguard — Add Provider → SAML 2.0 (you copy these from the IdP):
| Field | Example value |
|---|---|
| Alias | ping |
| Display Name | Sign in with Ping Identity |
| SSO Service URL | https://auth.pingone.com/<env-id>/saml20/idp/sso |
| Entity ID | https://auth.pingone.com/<env-id> |
| X.509 Certificate | the PEM block below |
-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAX...(full cert from your IdP)...P3B/k0SolrFYPo
-----END CERTIFICATE------ In PingOne, go to Connections → Applications → +, and choose SAML.
- Set ACS URL to the ACS URL Safeguard shows after Save and SP Entity ID to the SP Entity ID Safeguard shows after Save.
- Set the Subject NameID format to Email Address, mapped to the user's Email Address attribute.
- Under Attribute Mappings, add an outgoing attribute named
emailsourced from the user's Email Address — separate from the Subject NameID mapping above. - On the Configuration tab, download the Signing Certificate and copy the Issuer ID and SSO endpoint URL.
- In Safeguard, click Add Provider → SAML 2.0 → Ping Identity, and enter those three values.
- Assign the groups/users who should have access under the app's Access tab, then enable the connection.
- Click Test in Safeguard to confirm.
Common errors: sign-on succeeds at PingOne but the user is rejected at Safeguard — check that the Subject NameID mapping is set to Email Address, not Username, in the SAML assertion configuration.