Ping Identity SAML Authentication

Ping Identity provides enterprise services, including SSO using the SAML protocol.

To use Ping Identity to authenticate users in the Akeyless Platform, you need to set up Akeyless as an application in the Ping Identity Platform. You can then create a SAML authentication method in Akeyless for Ping Identity.

Prerequisites

To use Ping Identity SAML authentication for the Akeyless Platform, you must have an Akeyless account and a Ping Identity account (either a trial account or a regular account with enterprise SSO support).

Create the SAML Authentication Method in Akeyless

Unlike IdPs that need placeholder endpoint values up front, Ping Identity imports its SAML configuration directly from an Akeyless metadata URL, so create the Akeyless Authentication Method first.

Akeyless Console

1. Log in to the Akeyless Web Console, and go to Administration, then Users & Auth Methods.
2. Select New.
3. In Select Type, select SAML.
4. In the Metadata URL field, you'll add your Ping IdP metadata URL once it's available — continue to the Ping setup below and return to finish this step, or save a draft with a placeholder value if your workflow requires an early record.
5. Set the Unique Identifier field with email.

6. Leave Dedicated SAML Endpoint off to use the shared Akeyless metadata URL (see Optional: Dedicated SAML Endpoints below if you need a per-method URL instead).
7. Select Finish.

Create a Ping Identity Application

1. Log in to PingOne, and go to Applications > Add Application > New SAML Application.

2. On the Application Details page, define the application name, description, and category, then select Continue to Next Step.

3. On the SAML Configuration page, select Import from URL, and import the shared Akeyless SAML metadata URL:

   https://auth.akeyless.io/saml/metadata

4. Once the metadata has been uploaded, configuration information appears. Confirm that:

   • Assertion Consumer Service (ACS) is set to https://auth.akeyless.io/saml/acs.
   • Entity ID matches the imported metadata's entity ID.

5. From the Signing options, select the Sign Assertion radio button, then select Continue to Next Step.

6. On the Attribute Mapping tab, select Add New Attribute, and add the following attribute settings:

   • Application Attribute: SAML_SUBJECT mapped to User ID
   • Application Attribute: Email mapped to Email Address

7. Edit your Application configuration and in the SUBJECT NAMEID FORMAT field, select urn:oasis:names:tc:SAML:2.0:nameid-format:transient.

8. Select Continue to Next Step.

9. Add the groups in your Ping Identity account to this application, then select Continue to Next Step and Finish.

Your new application appears in the list of available applications.

Go back to the Akeyless Authentication Method and finish setting the Metadata URL to the shared endpoint above, then save.

Associate with Access Roles

After creating the method, associate it with one or more Access Roles so authenticated users can access the required resources.

1. In the Akeyless Console, go to Administration, then Users & Auth Methods.
2. Select the SAML Authentication Method.
3. Add the relevant Access Roles.
4. Save the changes.

Authenticate with Ping Identity SAML

Akeyless Console

1. Open https://console.akeyless.io.
2. In the Or continue with section, select SAML.
3. Enter the SAML Authentication Method Access ID.
4. Complete sign-in in Ping Identity.

Akeyless CLI

akeyless configure \
  --profile ping-saml \
  --access-id <SAML Access ID> \
  --access-type saml

Dedicated SAML Endpoints for Ping Identity

The Dedicated SAML Endpoint flag is set per Authentication Method, you can enable it for one Ping Identity Authentication Method while other SAML methods in the same Akeyless account keep using the shared endpoints. Enable it if you plan to run more than one PingOne application against Akeyless and need each one to have unique SAML values.

When enabled, this Authentication Method exposes its own endpoints scoped to its Access ID. Replace <SAML_AUTH_METHOD_ACCESS_ID> with the Access ID of this method:

Since the Akeyless Access ID must exist before you can build this dedicated metadata URL, create the Akeyless Authentication Method first with Dedicated SAML Endpoint enabled, copy its Access ID, then import the resulting dedicated metadata URL into PingOne in place of the shared one.

Troubleshooting

If authentication fails, check the following:

• The Ping application uses the correct endpoint values for this specific Authentication Method — the shared endpoints by default, or the dedicated endpoints if Dedicated SAML Endpoint is enabled on this method.
• The Ping assertion includes the key configured in Unique Identifier.
• The user is assigned to the Ping application.
• The metadata URL configured in Akeyless is valid and current.