Enable SSO for Eptura User

Step 1. Integrate PingFederate with Azure AD

---

Below are the steps for PingFederate integration.

Step 1.1 Create Azure EntraID App Registration for PingFederate Integration (Client Team)

1. Sign in to Microsoft Azure https://azure.microsoft.com/en-us/

Step 1.2 Get Redirect URIs from PingFederate (Implementation Team)

1. Sign in to PingFederate https://ssoadmin.epturacloud.com/render/pingfederate/app
2. Click the Applications tab.

When you are onboarded there will be 3 clients automatically created:

1. Client ID and Client Name has the suffix _epturaPFHost (This is your Ping Application.)
2. Client ID and Client Name has the suffix _tenantAppService
3. Client ID and Client Name has the suffix _scimUsers

Step 1.3 Create an IDP connection in PingFederate (Implementation Team)

1. Click the Authentication tab.
2. Click the IdP Connections tile and the IdP Connections screen displays.

3. Scroll down the page and click the Create Connection button. The IdP Connections screen displays.

4. Check the Browser SSO Profiles check box.
5. From the Protocol drop-down, select OpenID Connect.
6. Click the Next button.

7. Check the OAuth Attribute Mapping check box.
8. Click the Next button and General Info tab displays.

The General Info tab is where you will use the information the customer provided (above).

9. In the Issuer field, enter the truncated value that you saved of the OpenId Connect metadata document value from Endpoints (above).
10. Click the Load Metadata button and will see the message, “Metadata successfully loaded. The issuer was updated to match the `iss` value from the discovery endpoint.”
11. In the Connection Name field, enter the Primary Domain Name from Primary Domain Name (above).
12. In the Client ID field, enter Ping Application (client) ID from Application (client) ID (above).
13. In the Client Secret field, enter the Client Secret from Certificates & Secrets (above). 

14. Click the Next button and the Browser SSO tab displays.
15. Click the Configure Browser SSO button.

16. Click the Configure User-Session Creation button and User-Session Creation screen displays.

17. Click the Identity Mapping tab.

18. Select the No Mapping option, because the connection will be used within an authentication policy. 
19. Click the Next button.

20. Scroll to the end of the screen.

21. Add the following attributes:
    • family_name
    • given_name
22. Click the Done button and the Browser SSO screen displays.

23. Click the Next button to display the OAuth Attribute Mapping screen.

24. Click the Configure OAuth Attribute Mapping button.

25. For the USER_KEY's Source drop-down, select Provider Claims and from the Value drop-down, select preferred_username.
26. For the USER_NAME's Source drop-down, select, Provider Claims and from the Value drop-down, select preferred_username.
27. Click the Next button to display the Inssuance Criteria tab.
28. Click the Next button to display the Summary tab.
29. Click the Done button to display the Browser SSO screen.

30. Click the Next button to display the Protocol Settings tab.
31. Click the Next button to display the Summary tab.
32. Click the Done button to display the IdP Connection screen.

33. Click the Next button to display the Activation & Summary tab.

Step 1.4 Optional - Cluster Management

This needs to be done only if the Cluster Management warning is visible on the PingFederate console.

1. From the note, click the Cluster Management link.

2. Click the Replicate button and this displays the message " Cluster node notified of new configuration".

Step 1.5 Set Ping redirect URI in Azure Ping application (Client Team)

1. Sign in to Microsoft Azure https://portal.azure.com/
2. Navigate to Microsoft EntraID.
3. From the menu, select Manage > App Registrations.
4. Click the All applications tab.
5. Select the PingFederate application name you created.

6. From the menu, select Authentication.

7. Click the + Add a platform button and the Configure platforms form displays.

8. Click the Web tile and the Configure Web form displays.

9. In the Redirect URIs field, paste in the IdP Connection Redirect URI. From Redirect URI (above).
10. Click the Configure button.

Step 1.6 Redirect incoming requests to IdP in PingFederate (Implementation Team)

1. Sign in to PingFederate https://ssoadmin.epturacloud.com/render/pingfederate/app
2. Click the Authentication tab.
3. From the menu, click Policies > Selectors.

4. Click the HttpRequestDomainSelector instance name.
5. Click the Selector Result Values tab.
6. Scroll to the end of the screen
7. In the Results Value field, enter the primary domain.
8. Click the Add button.
9. Click the Save button.

Next, you will find the domain in a policy and define what will happen if a login attempt to that domain fails or succeeds.

10. Click the Authentication tab.
11. From the menu, click Policies.

12. Scroll down to the policy.
13. Click DomainSelectorPolicy.
14. Scroll down and under the HttpRequestDomainSelector there will be a list of the existing domains.

15. Locate your domain and click the drop-down.

1. From the drop-down, select the IdP Connection.
2. Either browse the list or search for your domain name.
3. Select the domain name.

Next, complete the Fail and Success for your connection.

15. For Fail, click Done and this is set to Done. 
16. For Success, click Done and this is set to Done. 

17. Click the Save button.

Step 1.7 Add access token mapping in PingFederate (Implementation Team)

1. Click Applications tab.
2. From the menu, click OAuth > Access Token Mappings.
3. Scroll down the screen.

4. From the Context drop-down, select your IDP connection.
5. From the Access Token Manager drop-down, select Default Access Token Management.
6. Click the Add Mapping button.

7. Click the Add Attribute Source button.

8. In the Attribute Source Id field, enter userCustomClaimSource.
9. In the Attribute Source Description field, enter userCustomClaimSource.
10. From the Active Data Store drop-down, select shared-auth-service-ds.
11. Click the Next button and the Configure Data Source Filters tab displays.

12. Scroll down to the Body.
13. In the Body field, paste the JSON code.

{ "data": { "cid": "${context.ClientId}", "login": 
"${idp.preferred_username}", 
"firstName": "${idp.given_name}", 
"lastName": "${idp.family_name}" } }

14. Click the Next button.
15. Click the Save button.

You will see messages that some mappings are required.

16. Scroll down to the mappings.
17. Complete the following mappings:

Contract	Source	Value
firstname	Idp Connection	given_name
lastname	Idp Connection	family_name
platform_domain	Other (userCustomClaimSource)	platform_domain
platform_env	Other (userCustomClaimSource)	platform_env
platform_namespace	Other (userCustomClaimSource)	platform_namespace
products	Other (userCustomClaimSource)	products
session_id	Other (userCustomClaimSource)	session_id
sub	Idp Connection	preferred_name
super_user	Other (userCustomClaimSource)	super_user
tenant_id	Other (userCustomClaimSource)	tenant_id
user_id	Other (userCustomClaimSource)	user_id

18. Click the Next button the Issuance Criteria tab displays.
19. Click the Next button the Summary tab displays.
20. Click the Save button.