PingFederate

This guide covers IdP-initiated login only. For SP-initiated login, follow the generic SAML setup and no provider-specific configuration is required.

Creating an SP Connection

1. In PingFederate, go to Applications > Service Providers.
2. Create an SP connection for Deque.
3. Enter a name (for example, Deque Axe).
4. Import the SP metadata file that Deque provided:
   • Upload the XML file or paste the metadata URL.
   • This pre-populates most settings.

Configuring Browser SSO

SAML Profiles

1. Go to the connection's Browser SSO configuration.
2. Confirm IdP-Initiated SSO is enabled. (SP-Initiated SSO can be left as-is.)

Assertion Creation

1. In Assertion Creation > Identity Mapping, set:

   • Name ID Value: The user's email address
   • Name ID Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

2. In Attribute Contract, ensure the following are included:

   • email
   • first_name
   • last_name

3. Under Attribute Mapping, map:

   • email → the user's email attribute in your directory
   • first_name → the user's first name attribute in your directory
   • last_name → the user's last name attribute in your directory

Protocol Settings

1. Go to Protocol Settings.
2. Confirm:
   • Assertion Consumer Service (ACS) URL: Set to the Entity ID value ending in /clients/<client name> (not the one ending in /endpoint)
   • Default Relay State (optional)
   • Other default settings are acceptable.

Configuring Credentials

1. Go to Credentials > Signature & Encryption Credentials.
2. Select your signing certificate.
3. Confirm SAML Assertion Signing is enabled, and Encryption is set to None.

Activating and Sending Metadata

1. Go to Activation and set the connection state to Active.
2. Save the configuration.
3. Export the metadata:
   • Go to Metadata Export.
   • Download the XML or copy the metadata URL.
   • Send it to helpdesk@deque.com.

Testing

1. Get your IdP-initiated start URL (see section below).
2. In a browser, open the start URL and select the Deque application.
3. Confirm you are redirected to Deque and arrive in the product.
4. Confirm your name and email address are correct on your Deque profile.

Deleting Endpoints

After setup, delete the /endpoint endpoint to prevent sign-in errors:

1. In the SP connection, go to Protocol Settings.
2. Under Assertion Consumer Service (ACS) URLs, delete the endpoint ending in /endpoint.
3. Save the configuration.

This ensures only the /clients/<client name> endpoint is available.

Your IdP-Initiated Start URL

After testing completes, send this URL to Deque:

1. Get your PingFederate runtime base URL (for example, https://pingfederate.example.com:9031).
2. Append /idp/startSSO.ping?spEntityId= followed by the Entity ID value (the one ending in /clients/<client name>).
3. Example: https://pingfederate.example.com:9031/idp/startSSO.ping?spEntityId=https://auth.deque.com/.../axe.example.com/endpoint/clients/axe-login-idp

Do not include additional query parameters in this URL.