PingOne SSO

SureMDM integrates with PingOne through SAML 2.0 Single Sign-On (SSO). Users sign in to the SureMDM console with their PingOne credentials, so they don't need separate SureMDM credentials, and administrators manage access and authentication policies centrally in PingOne.

When a user signs in through PingOne SSO for the first time, SureMDM automatically creates the user in User Management with the permissions configured for the SSO setup under Dynamic Permission Assignment.

Prerequisites

• A PingOne account with an administrator role (for example, Environment Admin) for the environment in which the application is created. The environment must include the PingOne SSO service.
• A SureMDM account with permission to change Account Settings. Only Account Administrators can configure SSO permissions that grant Super User privileges.
• Your SureMDM server path.
• For condition-based rules in Dynamic Permission Assignment, the attributes used in the rules must be mapped in the PingOne application.

note

PingOne lists URLs by Geography. The examples in this article use the Europe region. Use the domain shown in your PingOne environment. Always refer to the official Ping Identity documentation for the latest details.

The configuration is done in three steps:

1. Create the SAML application in PingOne
2. Configure SAML Single Sign-On in the SureMDM console
3. Update PingOne with the SureMDM Assertion URL

Step 1: Create the SAML application in PingOne

Create the application

1. Sign in to the PingOne admin console (for example, console.pingone.eu) and select your environment.

2. Navigate to Applications > Applications and click the + icon.

3. Enter any friendly Application Name (for example, SureMDM) and, optionally, a description and icon.

4. In Application Type, select SAML Application and click Configure.

5. On the SAML Configuration page, under Provide Application Metadata, select Manually Enter and enter the following values:

Field	Value
ACS URLs	https://<SureMDM Server Path>/console/ssoconsumer/<Encrypted Account ID>
Entity ID	urn:42gears:suremdm:SAML2ServiceProvider

6. Click Save.

note

In the ACS URL, <SureMDM Server Path> is the SureMDM console URL and <Encrypted Account ID> is the encrypted Account ID.

The Encrypted Account ID is generated by SureMDM only after the SAML Single Sign-On settings are saved (Step 2). PingOne requires an ACS URL before the application can be saved, so for now enter a placeholder value in place of the Encrypted Account ID (for example, your Account ID). You will replace it with the actual URL in Step 3.

Copy the PingOne values and download the certificate

7. Open the application's Overview tab. Under Connection Details, copy the following values. You will paste them into SureMDM in Step 2.

PingOne value	Example
Issuer ID	https://auth.pingone.eu/<Environment ID>
Single Signon Service	https://auth.pingone.eu/<Environment ID>/saml20/idp/sso
Single Logout Service	https://auth.pingone.eu/<Environment ID>/saml20/idp/slo

8. Click Download Signing Certificate, and in Select format, select X509 PEM (.crt).

Configure attribute mapping

Attribute mappings specify which user attributes PingOne sends in the SAML assertion to SureMDM. By default, PingOne sends only saml_subject, which identifies the user. Additional attributes are required only for condition-based rules in Dynamic Permission Assignment.

9. Open the application's Attributes tab and click the edit (pencil) icon.
10. (Optional) Click + Add to add the attributes you want to use in SureMDM rules, for example, Groups mapped to Group Names. See Configure PingOne under Dynamic Permission Assignment.
11. Click Save.

(Optional) Select an authentication policy

Authentication policies control how users authenticate in PingOne before they are signed in to SureMDM, for example, password only or password with multi-factor authentication (MFA). If no policy is selected, the environment's default authentication policy applies.

12. Open the application's Policies tab and click the edit (pencil) icon.

13. On the PingOne Policies tab, select the policy to apply:

Policy	Description
Single_Factor	Users sign in with their PingOne username and password.
Multi_Factor	Users sign in with their username and password, followed by an additional verification step (MFA).

14. (Optional) Open the Selected Policies tab to review the selection. When more than one policy is selected, policies are applied in the order listed on this tab. A maximum of 20 DaVinci or PingOne policies can be selected.
15. Click Save.

note

Single_Factor and Multi_Factor are the policies available by default in a PingOne environment. Custom authentication policies created in PingOne also appear in this list. Selecting Multi_Factor is recommended because SureMDM administrators have access to device management functions.

Control user access

Access to the application is controlled by group membership. By default, no groups are applied, and every user in the PingOne environment can sign in to SureMDM through PingOne.

16. Open the application's Access tab and click the edit (pencil) icon.

17. Configure the following settings:

Setting	Description
Application Portal Display	(Optional) Select Display this application in the Application Portal to show SureMDM in the PingOne Application Portal, so users can launch it from there.
Admin Only Access	Leave must have the admin role cleared. When it is selected, only users with a PingOne admin role can sign in.
Group Membership Policy	Search for and select the groups whose members should sign in to SureMDM, for example, SureMDM-Admins. Selected groups appear on the Applied Groups tab.

18. Click Save.

After saving, the Access tab shows a summary of the settings. If Group Membership Policy shows No Restrictions, all users in the PingOne environment can sign in to SureMDM.

Enable the application

User access to a new application is disabled by default. Users cannot sign in to SureMDM through PingOne until the application is enabled.

19. On the application page, click the toggle at the top right to enable user access to the application.

Verification: The application is saved and enabled in PingOne, you have copied the Issuer ID, Single Sign-On Service, and Single Logout Service, you have downloaded the signing certificate in X509 PEM (.crt) format, and user access is configured.

Step 2: Configure SAML Single Sign-On in the SureMDM console

1. Log in to the SureMDM Web Console.

2. Navigate to Settings (gear icon at the top right) > Account Settings > Enterprise Integrations > SAML Single Sign-On.

3. Click Add.

4. In Select Identity Provider (IdP), select PingOne.

5. On the SSO Configuration tab, configure the following settings:

Setting	Description
Service Identifier	Paste the Issuer ID copied from the PingOne application's Overview tab. Example: https://auth.pingone.eu/<Environment ID>
Sign On Service URL	Paste the Single Sign-On Service URL copied from the PingOne application's Overview tab. Example: https://auth.pingone.eu/<Environment ID>/saml20/idp/sso
Logout Service URL	Paste the Single Logout Service URL copied from the PingOne application's Overview tab. Example: https://auth.pingone.eu/<Environment ID>/saml20/idp/slo
SSO Service Provider Name	Enter urn:42gears:suremdm:SAML2ServiceProvider
Display Name	(Optional) A name that identifies this configuration in the SAML Single Sign-On list.

6. Click Upload Certificate, select the X509 PEM (.crt) file downloaded from PingOne, and click OK.
7. Open the Dynamic Permission Assignment tab and configure the Default Permission: select the Roles, Device Group Set, Jobs/Profiles Folder Set, and Remote File Manager Access Control to assign to users who sign in through PingOne. To assign permissions based on SAML attributes, see Dynamic Permission Assignment.

Important

The Default Permission applies to every user who has access to the application in PingOne and does not match a Dynamic Permission Assignment rule. If the application's Group Membership Policy shows No Restrictions, any user in the PingOne environment can sign in to SureMDM with these permissions.

• Keep the Default Permission at the lowest level of access.
• Enable Deny Access to allow only users who match a configured rule to sign in. Users who do not match any rule are blocked instead of receiving the default permissions.

8. Click Save.
9. On the SAML Single Sign-On screen, locate the saved configuration and copy the full URL from the Assertion URL column. It contains your Encrypted Account ID and has this format:
   https://<SureMDM Server Path>/console/ssoconsumer/<Encrypted Account ID>

note

Use Modify to edit a saved configuration, and Enable/Disable to turn SSO on or off without deleting the configuration.

Step 3: Update PingOne with the Assertion URL

1. In the PingOne admin console, navigate to Applications > Applications and open the application created in Step 1.
2. Open the Configuration tab and click the edit (pencil) icon.
3. In ACS URLs, replace the placeholder with the exact Assertion URL copied from SureMDM.
4. Click Save.

Sign in to SureMDM using PingOne SSO

1. Open the SureMDM login page and click Sign In using SSO.

2. Click the PingOne icon and sign in with your PingOne credentials.

   Alternatively, use the URL shown in the Login URLs column of the SAML Single Sign-On screen, in this format: https://<SureMDM Server Path>/console/ssologin/<Encrypted Account ID>

Dynamic Permission Assignment

Dynamic Permission Assignment assigns different SureMDM permissions to users based on any attribute PingOne sends in the SAML assertion, for example, the user's group, username or email. When a user signs in, SureMDM compares the attribute values against your rules and assigns the permissions of the matching rule.

How SureMDM evaluates a sign-in

Situation	Result
An attribute matches a rule (Attribute + Condition + Value)	The user is allowed to sign in and is assigned the Role, Device Group Set, Jobs/Profiles Folder Set and Remote File Manager Access Control configured for that rule.
No rule matches	The user gets the Default Permission.
No rule matches, and Deny Access is enabled in Default Permission	The user is not allowed to sign in to SureMDM.

Default Permission is the fallback entry. Its Attribute, Condition, and Value fields are disabled because it applies to every user who does not match another rule. Set it to the lowest level of access you are comfortable giving any PingOne user who has access to the application.

Deny Access is available only in Default Permission. Enable it when only users who match a rule should be able to sign in (for example, only members of a SureMDM-Admins group). Users who do not match any rule are then denied access instead of receiving default permissions.

Configure PingOne

The attribute you want to use in a SureMDM rule must be sent as an attribute in the SAML assertion.

Attributes sent by default

A new SAML application in PingOne sends only the following attribute by default:

Attribute	PingOne Mapping
saml_subject	User ID

saml_subject identifies the user in the SAML assertion. It is always required, so its Required checkbox is selected and cannot be changed.

Any other attribute, such as group membership, username or email, must be added as an attribute mapping before it can be used in SureMDM.

To add an attribute:

1. Open the application and go to the Attributes tab.
2. Click the edit (pencil) icon.
3. Click + Add.
4. In Attributes, enter a name for the attribute, for example, Groups.
5. In PingOne Mappings, select the PingOne user attribute, for example, Group Names.
6. Leave Required cleared.
7. Click Save.

Required checkbox	Behaviour
Selected	The attribute must have a value for the user. If the value is empty (for example, the user is not a member of any group), PingOne cannot generate the SAML assertion and the sign-in fails.
Cleared (recommended)	PingOne sends the attribute only when the user has a value. Users without a value can still sign in and receive the Default Permission, or are blocked if Deny Access is enabled.

note

The Attribute name entered in SureMDM must exactly match the attribute name in PingOne. Attributes are sent only if they are populated on the user's profile in PingOne. For Group Names, PingOne sends the names of the groups the user is a member of.

Sample attributes

Attribute names are examples; you can use any name, as long as the same name is entered in SureMDM.

Use case	Example attribute	PingOne Mapping	Example Value in SureMDM
Group	Groups	Group Names	SureMDM-Admins
Username	username	Username	john.smith
Email	email	Email Address	john.smith@example.com
First name	firstname	Given Name	John
Last name	lastname	Family Name	Smith

Configure SureMDM

1. Navigate to Settings (gear icon) > Account Settings > Enterprise Integrations > SAML Single Sign-On.

2. Select the PingOne configuration and click Modify (or click Add and complete Step 2 for a new configuration).

3. Open the Dynamic Permission Assignment tab.

4. Configure the Default Permission, and enable Deny Access if users who do not match any rule should be blocked.

5. Click Add to create a rule and configure the following settings:

Setting	Description
Attribute	Name of any attribute present in the SAML assertion, for example Groups, username or email.
Condition	How SureMDM matches the attribute value with the rule value: Contains: the attribute value includes the specified value. Equals: the attribute value exactly matches the specified value. In: the attribute value matches one of the specified values.
Value	The value to match for the attribute, for example, a group name or a username.
Roles	Role to assign when the rule matches. See Configure Permissions for Role-Based Admin.
Device Group Set	Device group set to assign when the rule matches. See Configure Permissions for Device Group Set Based Admin.
Jobs/Profiles Folder Set	Jobs/profiles folder set to assign when the rule matches See Configure Permissions for Job Folder Set Based Admin.
Remote File Manager Access Control	Remote File Manager access control to assign when the rule matches. See Configure Permissions for Remote File Manager Based Admin.

6. Click Save.

For more information on SAML applications in PingOne, see Ping Identity's documentation: Introduction to PingOne and Adding an application - SAML.

Disclaimer

The third-party configuration steps in this article are based on Ping Identity's documentation available at the time of publication and may change. Always refer to the official Ping Identity documentation for the latest instructions.