Skip to main content

Set up single sign-on with Ping Identity

Set up SAML single sign-on between Ping Identity (PingOne) and Axiamatic. Create the app, configure SAML, send your metadata and certificate, then assign groups.

Let your team sign in to Axiamatic with their Ping Identity accounts.

Overview

Single sign-on (SSO) with Ping Identity is a connection that lets people in your organization sign in to Axiamatic with the PingOne account they already use. The connection uses SAML 2.0, a standard way for PingOne to tell Axiamatic who a person is.

Setup runs in both directions. Axiamatic sends you the details you need to create the app in PingOne. You then send back two files that let Axiamatic trust sign-ins from your organization.

Before you start

Axiamatic emails you four things before setup. Keep the email open, because you enter three of them in PingOne.

  • ACS URL: the Assertion Consumer Service URL, which is where PingOne sends people after they sign in. You paste it into ACS URLs.

  • Entity ID: the name that identifies Axiamatic as a SAML app. You paste it into Entity ID.

  • Verification certificate: a certificate that lets PingOne confirm that sign-in requests really come from Axiamatic. You upload it in the app's configuration.

  • Axiamatic logo: an image file you upload as the app icon.

You also need a PingOne admin role that can create and configure applications, such as Application Owner or Environment Admin.

Create the Axiamatic app in PingOne

To create the app, sign in to the PingOne admin console and follow these steps.

  1. Go to Connections > Applications and click the + icon next to Applications.

  2. Enter Axiamatic as the Application Name.

  3. Upload the Axiamatic logo from the email as the Icon so your team recognizes the app.

  4. Under Choose Application Type, select SAML Application and click Save.

  5. When PingOne asks for more SAML configuration, click Configure.


Configure SAML settings

The SAML settings tell PingOne how to identify Axiamatic, where to send people after they sign in and which details to pass along. Follow these steps in order.

  1. On the SAML configuration page, paste the ACS URL into ACS URLs and the entity ID into Entity ID. Click Save.

  2. Open the Axiamatic app, go to the Configuration tab and click the edit icon.

  3. Set Subject NameID Format to the email address format, urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.
    ​

  4. Under Verification Certificate (Optional), click + Add Certificate and upload the verification certificate from Axiamatic.

  5. Click Save.

  6. Go to the Attribute Mappings tab and click the edit icon.

  7. Map saml_subject to Email Address, email to Email Address and name to Username. Click Save.

These attributes send each person's email address and username to Axiamatic.

Send your metadata and certificate to Axiamatic

Axiamatic needs two files from PingOne to trust sign-ins from your organization. You download both from the app's Configuration tab.

  1. Open the Axiamatic app and go to the Configuration tab.

  2. Under Connection Details, click Download Metadata.

  3. Click Download Signing Certificate.

  4. Send both files to your Axiamatic contact by replying to the setup email.

SSO starts working once Axiamatic adds these files on its side and confirms with you.

Enable the app and assign users

People can only sign in to Axiamatic once the app is enabled and they have access to it. Open the Axiamatic app in PingOne and follow these steps.

  1. Turn on the toggle at the top of the app panel to enable the app.

  2. Go to the Access tab and click the edit icon.

  3. Add the groups whose members should sign in to Axiamatic and click Save.

Axiamatic recommends giving access through groups instead of individual people. New teammates then get access as soon as they join the group, and nobody has to update the app by hand.

Frequently Asked Questions

Does this work with PingFederate?

This article covers PingOne, the cloud version of Ping Identity. If your organization uses PingFederate, contact your Axiamatic representative before you start.

Where do I find the ACS URL, entity ID and verification certificate?

Axiamatic sends them in the setup email along with the logo. Contact your Axiamatic representative if you don't have the email.

Do I have to add the verification certificate?

PingOne marks it as optional, but Axiamatic recommends adding it. It lets PingOne reject sign-in requests that don't come from Axiamatic.

A teammate can't sign in. What should I check?

Check that the app is enabled and that the teammate belongs to a group on the app's Access tab. People without access can't sign in through SSO.

What happens when the signing certificate changes?

Sign-ins stop working until Axiamatic has the new certificate. Send the new signing certificate to Axiamatic before you start using it.

For pricing information, demo requests, or assistance, contact us at [email protected]

Related Articles
Did this answer your question?