Using PingFederate as an identity provider

You can use PingFederate as an identity provider to access SC//Reliant™ Platform Manager. To do this, you create an SP connection for SC//Reliant Platform Manager in the PingFederate administrative console. The following is the SC//Reliant Platform Manager service provider metadata that you use when creating the connection.

Prerequisites

Before you begin, make sure you have the following in PingFederate. For more information, see Configuring a SAML application in the Ping Identity documentation.

• A datastore connection.
• A configured password credential validator (PCV).
• A configured identity provider (IdP) adapter, such as an HTML form adapter.
• An IdP digital signing certificate.

The PingFederate SP connection lets you import the Service Provider metadata to assist with the integration. You should download the SC//Reliant Platform Manager metadata XML file before creating your SP connection. The SC//Reliant Platform Manager metadata XML file can be downloaded from the following URL after you have authenticated to SC//Reliant Platform Manager.

https://platform.reliant.io/saml/metadata.xml

Alternatively, if your PingFederate environment can reach SC//Reliant Platform Manager, you can import the metadata directly from the same URL.

Step 1: Create the PingFederate SP connection

The Ping Identity documentation provides the steps for configuring a SAML application on their platform. For more information, see Configuring a SAML application in the Ping Identity documentation.

1. In the PingFederate administrative console, go to Applications, Integration, SP Connections.
2. Choose Create Connection.
3. On the Connection Template tab, choose Do not use a template for this connection and then choose Next.
4. On the Connection Type tab, select the Browser SSO Profiles checkbox and, in the Protocol list, select SAML 2.0. Choose Next.
5. On the Connection Options tab, leave the Browser SSO checkbox selected and then choose Next.
6. On the Import Metadata tab, import the SC//Reliant Platform Manager Service Provider metadata. You can upload the metadata.xml file you downloaded earlier, or pull it from the https://platform.reliant.io/saml/metadata URL. Choose Next.
7. On the General Info tab, confirm that the Entity ID is https://platform.reliant.io, provide a Connection Name such as SC//Reliant Platform Manager, and then choose Next.
8. On the Browser SSO tab, choose Configure Browser SSO.
   1. On the SAML Profiles tab, select the IdP-Initiated SSO and SP-Initiated SSO checkboxes and then choose Next.
   2. On the Assertion Lifetime tab, leave the default entries and then choose Next.
   3. On the Assertion Creation tab, choose Configure Assertion Creation.
      1. On the Identity Mapping tab, choose Standard and then choose Next.
      2. On the Attribute Contract tab, confirm the attribute contract and then choose Next.
      3. On the Authentication Source Mapping tab, choose Map New Adapter Instance.
      4. On the Adapter Instance tab, select your previously configured HTML form adapter and then choose Next.
      5. On the Mapping Method tab, leave the default selection and then choose Next.
      6. On the Attribute Contract Fulfillment tab, for SAML_SUBJECT, select Adapter in the Source list and select mail in the Value list. Choose Next.
      7. On the Issuance Criteria tab, choose Next.
      8. On the Summary tab, review your entries and then choose Done.
      9. On the Authentication Source Mapping tab, choose Next, then on the Summary tab choose Done.
   4. On the Assertion Creation tab, choose Next.
   5. On the Protocol Settings tab, choose Configure Protocol Settings.
      1. On the Assertion Consumer Service URL tab, confirm the endpoint is https://platform.reliant.io/saml/consume and then choose Next.
      2. On the Allowable SAML Bindings tab, ensure POST is selected and then choose Next.
      3. On the Signature Policy tab, choose Always Sign the SAML Assertion. SC//Reliant Platform Manager expects both the response and the assertion to be signed, so also select the option to sign the response. Choose Next.
      4. On the Encryption Policy tab, choose None and then choose Next.
      5. On the Summary tab, review your entries and then choose Done.
   6. On the Protocol Settings tab, choose Next, then on the Summary tab choose Done.
9. On the Browser SSO tab, choose Next.
10. On the Credentials tab, choose Configure Credentials.
    1. On the Digital Signature Settings tab, in the Signing Certificate list, select your organization's signing certificate.
    2. Select the Include the Certificate in the Signature <KeyInfo> Element checkbox and then choose Next.
    3. On the Summary tab, review your entries and then choose Done.
11. On the Credentials tab, choose Next.
12. On the Activation & Summary tab, use the toggle to enable the connection, scroll to the bottom, and choose Save. The connection is enabled when the toggle is green.

Step 2: Retrieve the PingFederate Identity Provider metadata

Once you have your PingFederate SP connection created, you need to retrieve the PingFederate IdP metadata and provide it to your Scale Computing Account Manager to complete the setup.

1. In the PingFederate administrative console, go to System, Protocol Metadata, Metadata Export.
2. Follow the export workflow, selecting the SC//Reliant Platform Manager connection when prompted, and download the exported IdP metadata XML file.
3. Provide the exported metadata file to your Scale Computing Account Manager. This metadata is then associated with your SC//Reliant Platform Manager tenant by our engineering team.

Troubleshooting login issues when using PingFederate as an Identity Provider

Issue: Receiving error "Invalid Email or password" when logging in to SC//Reliant Platform Manager

Possible causes: If you receive an Invalid Email or password error when logging in to SC//Reliant Platform Manager, ensure that the email address asserted by PingFederate is the same as the email address for your SC//Reliant Platform Manager account. They must match the case as well, so ensure the email address is all lowercase. Verify that the SAML_SUBJECT attribute contract fulfillment maps to the mail value from your adapter so that the correct email address is sent to SC//Reliant Platform Manager.

Related documentation

• Using a SAML 2.0 identity provider
• Using OneLogin as an identity provider