Set up single sign-on with PingFederate

Let your team sign in to Axiamatic with their PingFederate accounts.

Overview

Single sign-on (SSO) with PingFederate is a connection that lets people in your organization sign in to Axiamatic with the work account your PingFederate server already manages. The connection uses SAML 2.0, a standard way for PingFederate to tell Axiamatic who a person is.

Setup runs in both directions. Axiamatic sends you a metadata file that describes Axiamatic as a SAML app. You use it to create an SP connection in PingFederate, then send Axiamatic your own metadata file.

Before you start

Axiamatic emails you two files before setup. Save both to your computer, because you upload them while you create the connection.

Metadata XML file: a file that describes Axiamatic as a SAML app, including its entity ID and the URL where PingFederate sends people after they sign in. PingFederate reads these values from the file, so you don't type them in.
Axiamatic logo: a PNG file you add to the connection so your team recognizes the app.

You also need a PingFederate administrator account that can create SP connections.

Create the Axiamatic connection in PingFederate

PingFederate calls an app that people sign in to an SP connection. To create one for Axiamatic, sign in to the PingFederate admin console and follow these steps.

Go to SP Connections and click Create Connection.
On the Connection Template tab, choose No Template and click Next.
On the Connection Type tab, select Browser SSO Profiles, set Protocol to SAML 2.0 and click Next.
On the Connection Options tab, select Browser SSO and click Next.
On the Import Metadata tab, select File, click Choose File and upload the metadata XML file from Axiamatic. Click Next.
Check the values on the Metadata Summary tab and click Next.
On the General Info tab, enter Axiamatic as the Connection Name and add the Axiamatic logo. Click Next.

Configure SAML settings

The Browser SSO settings decide how people start a sign-in and which details PingFederate sends to Axiamatic. On the Browser SSO tab, click Configure Browser SSO and follow these steps.

On the SAML Profiles tab, select IdP-Initiated SSO and SP-Initiated SSO. This lets people sign in from your portal or from the Axiamatic sign-in page.
On the Assertion Creation tab, click Configure Assertion Creation.
On the Identity Mapping tab, select Standard.
On the Attribute Contract tab, set the Subject Name Format for SAML_SUBJECT to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.
Under Extend the Contract, add email and name with the basic attribute name format.
On the Authentication Source Mapping tab, map the contract to your IdP adapter. Set SAML_SUBJECT and email to the attribute that holds each person's email address, and set name to the one that holds their username.
On the Protocol Settings tab, make sure POST is an outbound binding and POST and Redirect are inbound bindings.

The attribute names in step 6 depend on how your IdP adapter is set up, so use the ones your adapter provides. Settings this article doesn't mention can stay as your organization normally configures them.

Activate the connection

The connection only accepts sign-ins once it has a signing certificate and is active. Follow these steps to finish the setup.

On the Credentials tab, choose the certificate PingFederate uses to sign assertions for Axiamatic. Click Next.
On the Activation & Summary tab, set the connection status to active.
Click Save.
On the SP Connections page, check that the Enabled toggle for the Axiamatic connection is on.

PingFederate decides who can sign in through your authentication policies and IdP adapter, not through the connection itself. If only some people should use Axiamatic, limit access there.

Send your metadata to Axiamatic

Axiamatic needs your IdP metadata to trust sign-ins from your organization. The file includes your PingFederate sign-in URL and signing certificate, so it is the only file you need to send.

Go to SP Connections.
In the row for the Axiamatic connection, click Select Action and choose Export Metadata.
Save the exported file.
Send it to your Axiamatic contact by replying to the setup email.

SSO starts working once Axiamatic adds the file on its side and confirms with you.

Frequenty Asked Questions

Is this the same as setting up PingOne?

No. PingFederate is the server version of Ping Identity that your organization runs itself, and PingOne is the cloud version. If you use PingOne, follow the Ping Identity setup article instead.

Where do I find the metadata file?

Axiamatic sends it in the setup email along with the logo. Contact your Axiamatic representative if you don't have the email.

Which attribute should I use for email and name?

Use the attributes your IdP adapter provides for each person's email address and username. The names vary between setups, so check your adapter's configuration if you're not sure.

A teammate can't sign in. What should I check?

Check that the Axiamatic connection is enabled. Then check that your authentication policies let the teammate sign in to it.

What happens when the signing certificate changes?

Sign-ins stop working until Axiamatic has your new certificate. Export your metadata again and send it to Axiamatic before you switch to the new certificate.

For pricing information, demo requests, or assistance, contact us at [email protected]