SSO integration configuration is done with both PingOne and OpsRamp. The configuration sets up redirects to the custom branded URL.

Prerequisites

  • Partners must register with OpsRamp to get OpsRamp login credentials.
  • Provide your custom branding URL (such as <yourwebsitename>.opsramp.com).

Step 1: Create a certificate

  1. From the PingOne console, select the SETUP tab and click Certificates.
  2. Click +Certificate to create a new certificate.
  3. From the Create New Certificate screen, enter the required details and click Save.

Step 2: Create an application

  1. From the PingOne console, select the Applications tab and click My applications.

  2. Click the SAML tab.

  3. From the Add Application drop-down options, select New SAML application.

  4. Enter the application information and click Continue to Next Step.

  5. From the Application Configuration screen, enter the information and click Continue to Next Step:

    • Assertion Consumer Service (ACS): https://.opsramp.com/samlResponse.do
    • Entity ID: https://.opsramp.com
    • Application URL: https://.opsramp.com

  6. Enter information for SSO attribute mapping and click Continue to Next Step.

  7. Enter Group Access and click Continue to Next Step.

  8. Do the following from the Review SetUp screen:

    • Click Download on Signing Certificate and from the .cer file, save the certificate.
    • Click Download on SAML Metadata and copy the entityID URL. For example: If the entityID URL is <md:EntityDescriptor entityID="https://pingone.com/idp/sandbox.opsramp"ID="g7r1YVie-iqysV037OuX9rIpUDO" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">, the issuer URL is https://pingone.com/idp/sandbox.opsramp.
    • Copy Initiate Single Sign-On (SSO) URL.

  9. Click Finish to save the configuration.

    Setup SSO Summary

Step 3: OpsRamp configuration

  1. From All Clients, select a client.

  2. Navigate to Setup > Account.

  3. Select the Integrations and Apps tab.

  4. The Installed Integrations page, where all the installed applications are displayed. Note: If there are no installed applications, it will navigate to the Available Integrations and Apps page.

  5. Click + ADD on the Installed Integrations page. The Available Integrations and Apps page displays all the available applications along with the newly created application with the version.

  6. Search for Ping using the search option available. Alternatively, use the All Categories option to search.

  7. Click +Add on the Ping tile.

    SSO - Ping configuration page

  8. Enter the following information in the Configuration page:

    • Metadata XML: Upload the XML file. This file will have all the information related to Issuer URL, Redirection URL, Logout URL, and Certificate. After you upload the Metadata XML file, these fields are automatically populated.
      Alternatively, you can enter the information in the fields manually.
    • Issuer URL: Identity provider Issuer URL
    • Redirection URL: SAML EndPoints for HTTP
    • Logout URL: URL for logging out
    • Certificate: x.509 Certificate

  9. Provision Username as: There are two ways to provision a user. Select the appropriate option:

    • Identify Provider’s Name Identifier option is selected by default. The user which is created in the SSO portal will reflect in OpsRamp.

    • Identify Provider’s Name Identifier with OpsRamp tenant-unique prefix: This option allows you to:

      • Create usernames with a unique 3-digit alphanumeric prefix, that is generated automatically by the system.
      • Install the same identity provider across multiple OpsRamp tenants.
        Note: Once you enable this option and install the integration, you cannot revert your changes.
        Example: There are three partners, Partner P1, P2, and P3. Each partner has usernames created with unique 3-digit alphanumeric prefix, like g0z.username1 for partner P1, p0w.username1 for partner P2, and t9q.username1 for partner P3.

  10. Click Next.

  11. In the Inbound page:
    User Provision:

    • Select the following details and click Update User Provision:
    • Provision Type: If you select provision type as JIT, JIT user is created during user login.
    • Default Role: The required user role.

  12. Define the following Map Attributes:

    Note: The OpsRamp properties Primary Email, First Name, Last Name, and Role are required.

    1. Click +Add in the Map Attributes section.
    2. From the Add Map Attributes window, enter the following information:

    User:

    1. Select OpsRamp Entity as User and OpsRamp Property as Role.
      Role mapping is required for User and User Group.
    1. Pingidentity Entity: Enter the value.
    2. Pingidentity Property: Enter the value.
      Similarly, do the role mapping for Primary Email, First Name, and Last Name..
      Under Property Values:
    3. Pingidentity Property Value: Enter the value that is coming from Pingidentity side (from the payload).
    4. Pingidentity Property Value: Select the appropriate role corresponding to the Pingidentity Property Value.
    5. Click Save. The mapping is saved and displayed.
      To add more property values click +Property Value.
      User the Filter option to filter the map attributes.

    Similarly, map attributes for other entities.

    User Group:

    1. Select OpsRamp Entity as User Group and OpsRamp Property as Role.
    1. Pingidentity Entity: Enter the value.
    2. Pingidentity Property: Enter the value.
      Similarly, do the role mapping for Primary Email, First Name, and Last Name..
      Under Property Values:
    3. Pingidentity Property Value: Enter the value that is coming from Pingidentity side (from the payload).
    4. Pingidentity Property Value: Select the appropriate role corresponding to the Pingidentity Property Value.
    5. Click Save. The mapping is saved and displayed.
      To add more property values click +Property Value.
    6. Click Add Map Attributes.

    • Click the three dots (menu icon) available at the end of each row to edit or delete a map attribute.

If the Role is not configured in Map Attributes section, the Default Role provided in the User Provision section is considered for SSO.

  1. Click Finish. The integration is installed.