icon-zslogin.svg
ZIdentity

Configuring PingFederate as an External IdP

This guide provides information on how to configure PingFederate as an external identity provider (IdP) for ZIdentity to facilitate single sign-on (SSO) to various Zscaler services for admin access management. You can configure PingFederate as an external IdP to enable SSO to ZIdentity using the Security Assertion Markup Language (SAML) authentication protocol. You can provision users to ZIdentity from PingFederate using System for Cross-domain Identity Management (SCIM) provisioning.

If you want to leverage step-up authentication, it is recommended to use OIDC-based integrations as most IdPs only support step-up authentication with the OIDC protocol.

Prerequisites

Ensure that you have a way to integrate an authenticated identity with PingFederate through IdP Adapters or Authentication Policies.

Configuring PingFederate as IdP for ZIdentity

To set up PingFederate as an IdP for ZIdentity:

    1. Log in to the ZIdentity Admin Portal.
    2. Go to Integration > External Identities.

    3. Click Add Primary IdP (or Add Secondary IdP).

      The Add Primary Identity Provider (or Add Secondary Identity Provider) window appears.

    4. In the Add Primary Identity Provider (or Add Secondary Identity Provider) window, on the Basic tab:

      1. Under the General section:

        1. Name: Enter a name for the IdP.
        2. Identity Vendor: Select PingFederate from the drop-down menu.
        3. Domain: Select the domain for which the IdP is responsible for authenticating the users. This allows the Zscaler service to display the correct IdP to authenticate an incoming user.
        4. Protocol: Select SAML.
        5. Status: Select Enabled.

        6. Login ID: Enter an attribute that you want to be mapped with the Login ID attribute.

          • If you are using email as the Login ID attribute, ensure that your email domain matches with one of the domains added to ZIdentity for the Primary Email attribute.
          • You can use any email domain for your primary email if you are using any attribute other than email as the source for the Login ID attribute.
          • Ensure that the attribute you enter in the Login ID field matches exactly with the attribute received in the SAML assertions.

      2. Under the SAML Configuration section:

        1. Input Method: Select Metadata URL.

        2. IdP Metadata URL: Enter a random URL, and click Fetch.

          The random URL is added for generating SP Metadata in the ZIdentity Admin Portal. This value is manually overridden in a subsequent step.

      3. Click Save.

      The IdP is added to the ZIdentity Admin Portal.

    5. Locate the IdP on the Primary Identity Provider (or Secondary Identity Provider) table, and click the Edit icon.

      The Edit Primary Identity Provider (or Edit Secondary Identity Provider) window appears.

    6. In the Edit Primary Identity Provider (or Edit Secondary Identity Provider) window:

      1. On the Basic tab, under the SAML Configuration section, locate SP Metadata, and click Download SP Metadata.

        The SP Metadata is downloaded as an XML file.

      2. On the Advanced tab:

        1. Enable SAML Signing Request.
        2. Signing Algorithm: Select the signing algorithm.

        3. SP SAML Certificate: Click Download Certificate.

          The SP SAML Certificate is downloaded.

        4. Enable Encrypted SAML Assertion.

        5. SAML Encryption Certificate: Click Download Certificate.

          The SAML Encryption Certificate is downloaded.

      3. Click Update.
    Close
    1. Log in to the PingFederate server.
    2. Go to Applications > Integration > SP Connections.

    3. Click Create Connection.

      The SP Connection wizard appears.

    4. In the SP Connection wizard:

      1. On the Connection Template tab:

        1. Select Do Not Use a Template for This Connection.

        2. Select Next.
      2. On the Connection Type tab:

        1. Select Browser SSO Profiles as Connection Template and SAML 2.0 as Protocol.

        2. Click Next.
      3. On the Connection Options tab:

        1. Ensure that the Browser SSO option is selected.

        2. Click Next.
      4. On the Import Metadata tab:
        1. Metadata: Select the File option, and click Choose File.

        2. Upload the SP Metadata file downloaded from the ZIdentity Admin Portal.

        3. Click Next.
      5. On the Metadata Summary tab:

        1. Verify the Entity ID value.

        2. Click Next.
      6. On the General Info tab:

        1. Review the connection details.

        2. Click Next.
      7. On the Browser SSO tab:

        1. Click Configure Browser SSO.

          The Browser SSO wizard appears.

        2. In the Browser SSO wizard:

          1. On the SAML Profiles tab:

            1. Select IdP-Initiated SSO and SP-Intiated SSO.

            2. Click Next.
          2. On the Assertion Lifetime tab:
            1. Minutes Before: (Optional) Modify the validity of the assertion before its issuance.

            2. Minutes After: (Optional) Modify the validity of the assertion before its issuance.

            3. Click Next.
          3. On the Assertion Creation tab:

            1. Click Configure Assertion Creation.

              The Assertion Creation wizard appears.

            2. In the Assertion Creation wizard:

              1. On the Identity Mapping tab:

                1. Select Standard.

                2. Click Next.
              2. On the Attribute Contract tab:

                1. Add the attributes that you want to send to ZIdentity.

                  These values are included in the SAML assertion, and they must match the values on the ZIdentity Admin Portal.

                2. Click Next.

              3. On the Authentication Source Mapping tab, choose either to Map New Adapter Instance or Map New Authentication Policy based on your authentication configuration.

              4. Click Next.
              5. On the Summary tab:

                1. Review the configured information.

                2. Click Done.

              The Assertion Creation wizard is closed, and you are redirected to the Assertion Creation tab in the Browser SSO wizard.

            3. Click Next.
          4. On the Protocol Settings tab:

            1. Click Configure Protocol Settings.

              The Protocol Settings wizard appears.

            2. In the Protocol Settings wizard:

              1. On the Assertion Consumer Service URL tab:

                1. Ensure that the Endpoint URL value is populated from the SP Metadata file uploaded to PingFederate.

                2. Click Next.
              2. On the Allowable SAML Bindings tab:

                1. Select POST method, and ensure that other methods are not selected.

                2. Click Next.

              3. On the Signature Policy tab, do not make any changes, and click Next.

              4. On the Encryption Policy tab:

                1. (Optional) Select The Entire Assertion to enable an encryption policy.

                  If you do not want to enable an encryption policy, ensure that the None option is selected.

                2. Click Next.
              5. On the Summary tab:

                1. Review the configured information.

                2. Click Save.

              The Protocol Settings wizard is closed, and you are redirected to the Protocol Settings tab in the Browser SSO wizard.

            3. Click Next.
          5. On the Summary tab:

            1. Review the configuration summary.

            2. Click Save.

          The Browser SSO wizard is closed, and you are redirected to the SP Connection wizard.

        3. Click Next.
      8. On the Credentials tab:

        1. Click Configure Credentials.

          The Credentials wizard appears.

        2. In the Credentials wizard:

          1. On the Digital Signature Settings tab:

            1. Signing Certificate: Select the certificate that you want to use for signing the SAML assertion from the drop-down menu. If a signing certificate is not available, you must add a new certificate to the PingFederate server. To add a new certificate, click Manage Certificates.

              The signing certificate is downloaded from the ZIdentity Admin Portal in a previous step.

            2. Click Next.

          2. (Optional) On the Select XML Encryption Certificate tab:

            If you want to encrypt assertions, select an algorithm and certificate for encryption using the following steps.

            1. Select an algorithm for Block Encryption and Key Transport.

            2. Select a certificate. If a certificate is not available, click Manage Certificates to upload a new certificate.

            3. Click Next.
          3. On the Summary tab:

            1. Review the configuration summary.

            2. Click Done.

          The Credentials wizard is closed, and you are redirected to the Credentials tab in the SP Connection wizard.

        3. Click Next.
      9. On the Activation & Summary tab:

        1. Review the configuration summary.

        2. Click Save.

      The SP Connection for ZIdentity is configured and saved.

    5. Ensure that the configured SP Connection is displayed on the SP Connections page.

    6. Click Select Action for the configured SP Connection, and click Export Metadata.

      The Metadata Export wizard appears.

    7. In the Metadata Export wizard, on the Export & Summary tab, click Export.

      The Metadata file is downloaded.

    8. In the ZIdentity Admin Portal, go to Integration > External Identities.

    9. Locate the IdP on the Primary Identity Provider (or Secondary Identity Provider) table, and click the Edit icon.

      The Edit Primary Identity Provider (or Edit Secondary Identity Provider) window appears.

    10. In the Edit Primary Identity Provider (or Edit Secondary Identity Provider) window:

      1. On the Basic tab, under the SAML Configuration section:

        1. Input Method: Click Upload Metadata.
        2. IdP Metadata: Click Upload IdP Metadata.

      2. Click Update.

        This replaces the random URL entered for the IdP Metadata URL field in a previous step.

    Close

  • You can provision PingFederate users for ZIdentity using just-in-time (JIT) provisioning or System for Cross-domain Identity Management (SCIM) provisioning.

      1. In the ZIdentity Admin Portal, go to Integration > External Identities.

      2. Locate the IdP on the Primary Identity Provider (or Secondary Identity Provider) table, and click the Edit icon.

      3. The Edit Primary Identity Provider (or Edit Secondary Identity Provider) window appears.

      4. In the Edit Primary IdP (or Edit Secondary IdP) window:

        1. Go to the Provisioning tab.
        2. Select Enable Just-in-time (JIT) Provisioning.

        3. Map the ZIdentity user and group attributes with the appropriate PingFederate attributes as necessary. The mapping of the Primary Email attribute is mandatory as it is required for functionalities, such as password resetting and multi-factor authentication. By default, the following attributes in SAML assertions mapped with the corresponding user attributes in ZIdentity.

          Attribute in SAML AssertionsDefault ZIdentity User Attributes
          firstNameFirst Name
          lastNameLast Name
          displayNameDisplay Name
          • If the external IdP is configured to send different attributes for First Name, Last Name, or Display Name, then you must map those attributes. For example, if the SAML assertion from the external IdP includes Surname instead of lastName, then you must map it with the Last Name user attribute in ZIdentity.

          • While mapping attributes, ensure that the attributes you enter in the Just-in-time Attribute field match exactly with the attributes that would be received in the SAML assertions.

      5. Click Update.
      Close

      1. In the ZIdentity Admin Portal, go to Integration > External Identities.

      2. Locate the IdP on the Primary Identity Provider (or Secondary Identity Provider) table, and click the Edit icon.

      3. The Edit Primary Identity Provider (or Edit Secondary Identity Provider) window appears.

      4. In the Edit Primary IdP (or Edit Secondary IdP) window:

        1. Go to the Provisioning tab.
        2. Select Enable SCIM Provisioning.
        3. Copy the SCIM Endpoint URL and Bearer Token value. This value is used in a subsequent step.
        4. (Optional) Map the SCIM attributes (e.g., addresses) with the corresponding ZIdentity user attribute. This mapping is required only for attributes that need to be mapped to a custom user attribute in ZIdentity. To learn more about the SCIM attributes that require custom attribute mapping, see Understanding SCIM.

      5. Click Update.
      6. In the PingFederate server, go to Applications > Integration > SP Connections.

      7. Locate the SP connection created for ZIdentity, and click the connection name to edit the configuration.

        The SP Connection wizard appears.

      8. In the SP Connection wizard:

        1. On the Connection Type tab, select Outbound Provisioning as Connection Template, and select SCIM Connector as Type.

          The Outbound Provisioning tab is added to the SP Connection wizard.

        2. On the Outbound Provisioning tab, click Configure Provisioning.

          The Configure Channels wizard appears.

        3. In the Configure Channels wizard:

          1. On the Target tab:

            1. SCIM URL: Enter the SCIM Endpoint URL copied from the ZIdentity Admin Portal.
            2. SCIM Version: Select 2.0 from the drop-down menu.
            3. Authentication Method: Select OAuth 2 Bearer Token from the drop-down menu.
            4. Access Token: Enter the Bearer Token copied from the ZIdentity Admin Portal.
            5. Click Next.

          2. On the Manage Channels tab:

            1. Click Create.

              The Channel wizard appears.

              To learn more about channels in PingFederate, refer to the PingFederate Technical documentation.

            2. In the Channel wizard:

              1. On the Channel Info tab:
                1. Channel Name: Enter a name for the channel.
                2. Max Threads: Enter 1.

                3. Timeout (Secs): Enter 60.

                4. Click Next.
              2. On the Source tab:

                1. Active Datastore: Select the datastore from the drop-down menu.

                2. Click Next.

              3. On the Source Settings tab, leave the configuration to its default settings, and click Next.

              4. On the Source Location tab:
                1. Base DN: Enter the Base DN for your data store.
                2. Under the Users section:
                  1. Group DN: Enter the Group DN for the users in your data store.
                  2. Enable Nested Search.

                3. Under the Groups section:

                  1. Group DN: Enter the Group DN for groups in your data store.
                  2. Enable Nested Search.

                4. Click Next.
              5. On the Attribute Mapping tab:
                1. Ensure that the userName filed is mapped to userPrincipalName attribute.

                2. Map any other attributes as necessary. The mapping of the Email attribute is mandatory as it is required for functionalities, such as password resetting and multi-factor authentication.

                3. Click Next.
              6. On the Activation & Summary tab:

                1. Channel Status: Select Active.

                2. Click Done.

              The Channel wizard is closed, and you are redirected to the Manage Channels tab.

            3. Click Done.

          The Configure Channels wizard is closed, and you are redirected to the Outbound Provisioning tab.

        4. Click Next.

        5. On the Activation & Summary tab, review the configuration, and click Save.

      Close
    Close
Related Articles
About External Identity ProvidersAdding OpenID ProvidersAdding SAML Identity ProvidersConfiguring Okta as an External IdPConfiguring Microsoft Entra ID as an External IdPConfiguring Microsoft AD FS as an External IdPConfiguring PingOne as an External IdPConfiguring Auth0 as an External IdPConfiguring OneLogin as an External IdPConfiguring PingFederate as an External IdP