---
title: "Configuring Corporate Sign In with PingFederate"
canonical: "https://documentation.chaos.com/space/KB/124354609/Configuring%20Corporate%20Sign%20In%20with%20PingFederate"
format: markdown
---
This page provides information on how to configure Corporate Sign in in Chaos services with PingFederate.



## **Overview**

---

<span style="color: #000000">In this section we explore how you can integrate your PingFederate identity provider with Chaos, so that your employees benefit from the </span>**Corporate Sign In**<span style="color: #000000">** functionality**</span><span style="color: #000000">. </span>

<span style="color: #000000">Before doing the steps in this section, make sure to </span><span style="color: #000000">[reach out to Chaos](https://docs-chaos.atlassian.net/wiki/spaces/KB/pages/124387373/Corporate+Sign+In#Requesting Corporate Sign In)</span><span style="color: #000000"> first to request the Corporate Sign In feature.</span>



## **Chaos to PingFederate communication**

---

<span style="color: #000000">The communication link between Chaos and PingFederate goes over a TLS connection. In order for this communication to be successful PingFederate must present a trusted </span><span style="color: #000000">**SSL certificate**</span><span style="color: #000000">.</span>



## **PingFederate configuration**

---

The following sections assume you have **PingFederate** installed and **Outbound Provisioning** enabled. <span style="color: #000000">This setup has been verified against</span> **PingFederate version 10**.

<span style="color: #000000">In addition to the basic installation you need to install Ping’s official</span><span style="color: #000000">[ SCIM Connector](https://docs.pingidentity.com/integrations/scim/pf_scim_connector.html)</span><span style="color: #000000">. PingFederate only supports SCIM version 1.1 which is not compatible with SCIM version 2.0 that Chaos uses. The connector will add support for SCIM version 2 to PingFederate Outbound provisioning capabilities.</span>

<span style="color: #000000">Please consult PingFederate’s </span><span style="color: #000000">[installation and configuration documentation](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-102.pdf)</span><span style="color: #000000"> in case you need help.</span>


<span style="color: #000000"> </span>

## **Configure OpenID-Connect policy**

---

<span style="color: #000000">This step is needed so that the returned OAuth tokens contain the required claims with the information, taken from the correct LDAP attributes.</span>

<span style="color: #000000">In PingFederate’s administrative UI go to </span><span style="color: #000000">**Applications**</span><span style="color: #000000"> > </span><span style="color: #000000">**OAuth**</span><span style="color: #000000"> > </span><span style="color: #000000">**OpenID Connect Policy Management**</span><span style="color: #000000"> and click </span><span style="color: #000000">**Add Policy**</span><span style="color: #000000">.</span>

 

|  |  |
| --- | --- |
| <span style="color: #000000">Policy ID</span> | <span style="color: #000000">A unique identifier of the policy</span> |
| <span style="color: #000000">Name</span> | <span style="color: #000000">A unique and recognizable name for this policy</span> |
| <span style="color: #000000">Access Token Manager</span> | <span style="color: #000000">JSON Web Tokens</span> |
| <span style="color: #000000">INCLUDE USER INFO IN ID TOKEN</span> | <span style="color: #000000">✅ Checked</span> |

 

<span style="color: #000000">Click </span><span style="color: #000000">**Next**</span><span style="color: #000000">.</span>

<span style="color: #000000">Under </span><span style="color: #000000">**Attribute Contract**</span><span style="color: #000000"> leave only email, family_name and given_name:</span>

 

![image](media://fdb4b774-ead6-4cb3-9224-f3244b161878)

 

Cl<span style="color: #000000">ick </span><span style="color: #000000">**Next**</span><span style="color: #000000">.</span>

<span style="color: #000000">Under </span><span style="color: #000000">**Attribute Scopes**</span><span style="color: #000000"> add profile and select the email attribute manually. Don’t forget to press </span><span style="color: #000000">**Add**</span><span style="color: #000000">.</span>

 

![image](media://ea9e52e2-22fc-494c-8ac0-e445d096bba0)

 

<span style="color: #000000">Click </span><span style="color: #000000">**Next**</span><span style="color: #000000">.</span>

<span style="color: #000000">Under </span><span style="color: #000000">**Attribute Sources & User Lookup,**</span><span style="color: #000000"> click </span><span style="color: #000000">**Add Attribute Source**</span><span style="color: #000000">. Fill in the following information for the attribute source datastore:</span>

 

|  |  |
| --- | --- |
| Attribute Source ID | A unique identifier of the attribute source |
| Attribute Source Description | A description for the attribute source |
| Active Data Store | pingdirectory |

This will automatically fill in the store type as LDAP.

---

Click **Next**.

Under LDAP Directory Search tab fill in the following: 


|  |  |
| --- | --- |
| Base DN | dc=example,dc=com |
| Attributes to return from search:<br>Select <Show all attributes> and add the following attributes: | mail<br>cn<br>sn |


![image](media://956f2f03-5c24-4d0b-9e59-5c72cbd3596e)

---

Click **Next**.

Under LDAP Filter put the following as filter: 

```xml
entryUUID=${Username}
```

---

Click **Done**.

Back on the OIDC Policy management under Contract Fulfillment select the source to take the corresponding OAuth claims from as follows:

 

![image](media://1eeff5bb-c3e6-4af4-bf0e-7fdd0b0d4402)

 

Go to Summary page and click Save.

 

Creating an OAuth client in PingFederate

---

Open PingFederate’s administrative UI, go to Applications > OAuth > Clients and create a New Client.

Fill in the following fields:

 

|  |  |
| --- | --- |
| <span style="color: #000000">Client ID</span> | <span style="color: #000000">The <client id></span> |
| <span style="color: #000000">Name</span> | <span style="color: #000000">A unique and recognizable name</span> |
| <span style="color: #000000">Client Authentication</span> | <span style="color: #000000">CLIENT SECRET.</span><br><span style="color: #000000">After selecting this option a new field called Client Secret will be displayed underneath</span> |
| <span style="color: #000000">Client Secret</span> | <span style="color: #000000">The <client secret></span> |
| <span style="color: #000000">Allowed Grant Types</span> | <span style="color: #000000">Authorization Code</span> |
| <span style="color: #000000">OpenID Connect > Policy</span> | <span style="color: #000000">The policy, created in the previous section</span> |


> ✅ <span style="color: #000000">The <client id> and <client secret> are provided by Chaos during the </span><span style="color: #1155cc">[onboarding process](https://docs-chaos.atlassian.net/wiki/spaces/KB/pages/124387373)</span><span style="color: #000000">.</span>


<span style="color: #000000">Click </span><span style="color: #000000">**Save**</span><span style="color: #000000">.</span>



## <span style="color: #000000">**Configure User datastore**</span>

---

<span style="color: #000000">In this guide we are using Ping Identity’s own LDAP solution - PingDirectory.</span>

<span style="color: #000000">If your setup depends on another user repository type, some steps may be different. To start with LDAP navigate to System > Data & Credential Stores > Data Stores and Add New Data Store. </span>

<span style="color: #000000">Pick a unique name and select LDAP as store type. Follow the instructions in PingFederate’s documentation on how to configure an</span> [LDAP connection](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-102.pdf).

 


## <span style="color: #000000">**Create a SCIM SP Connection**</span>

---

<span style="color: #000000">In </span><span style="color: #000000">**Applications**</span><span style="color: #000000"> > </span><span style="color: #000000">**Integration**</span><span style="color: #000000"> > </span><span style="color: #000000">**SP Connections**</span><span style="color: #000000"> click </span><span style="color: #000000">**Create Connection.**</span>

<span style="color: #000000">Select </span><span style="color: #000000">**Do not use a template for this connection**</span><span style="color: #000000"> and click </span><span style="color: #000000">**Next.**</span>

<span style="color: #000000">On the Connection Type tab select </span><span style="color: #000000">**Outbound Provisioning**</span><span style="color: #000000"> and from the new drop-down menu select </span><span style="color: #000000">**Type: SCIM Connector.**</span>


> ℹ️ The SCIM Connector type will only show if you’ve successfully installed the SCIM Connector from the PingFederate configuration section above and restarted PingFederate after doing so. Using SCIM 1.1 Service Provider will not work.

 

![image](media://4fa05750-9c2a-46d1-849c-8a721079ae82)


<span style="color: #000000">Click </span><span style="color: #000000">**Next**</span><span style="color: #000000">.</span>

<span style="color: #000000">In the</span><span style="color: #000000">** General Info**</span><span style="color: #000000"> tab fill in:</span>

 

|  |  |
| --- | --- |
| <span style="color: #000000">Partner’s Entity ID</span> | <span style="color: #000000">A unique ID identifying the partner connection</span> |
| <span style="color: #000000">Connection Name</span> | <span style="color: #000000">A unique and recognizable name for this connection</span> |

 

<span style="color: #000000">Click </span><span style="color: #000000">**Next**</span><span style="color: #000000">. </span>

<span style="color: #000000">On the </span><span style="color: #000000">**Outbound Provisioning**</span><span style="color: #000000"> click </span><span style="color: #000000">**Configure Provisioning**</span><span style="color: #000000">.</span>

<span style="color: #000000">In the </span><span style="color: #000000">**Target**</span><span style="color: #000000"> tab fill in the following:</span>

 

|  |  |
| --- | --- |
| <span style="color: #000000">SCIM URL</span> | https://dev.scim.chaos.com/<tenant id>/v2 |
| <span style="color: #000000">SCIM Version</span> | <span style="color: #000000">2.0</span> |
| <span style="color: #000000">Authentication Method</span> | <span style="color: #000000">OAuth 2 Bearer Token</span> |
| <span style="color: #000000">Access Token</span> | <span style="color: #000000"><access token></span> |
| <span style="color: #000000">Unique User Identifier</span> | <span style="color: #000000">workEmail</span> |
| <span style="color: #000000">Users API Path</span> | <span style="color: #000000">/Users</span> |
| <span style="color: #000000">Provisioning Options</span> | <span style="color: #000000">Select:</span><br>- User Create
- User Update
- User Disable/Delete |
| <span style="color: #000000">Remove User Action</span> | <span style="color: #000000">Possible options are:</span><br>- Delete: When a user is deleted from the PingFederate’s user repository they are also deleted from Chaos’ repository
- Disable: When a user is deleted from PingFederate’s user repository they are only disabled in Chaos’ repository<br><span style="color: #000000">Chaos recommends picking Delete User</span> |

> ✅ The <tenant id>, part of the SCIM URL and the <access token> are provided by Chaos during the [onboarding process](https://docs-chaos.atlassian.net/wiki/spaces/KB/pages/124387373).

 

Click **Next**. In the **Manage Channels** tab press the **Create** button.

Pick a unique and recognizable Channel Name.

Click **Next**.

In the **Source** tab select the **DataStore**, configured earlier in this guide. Click **Next**. 

In the **Source Settings** tab fill in the following:

 

|  |  |
| --- | --- |
| <span style="color: #000000">Entity GUID Attribute</span> | <span style="color: #000000">entityUUID</span> |
| <span style="color: #000000">GUID Type</span> | <span style="color: #000000">Text</span> |
| <span style="color: #000000">Group Member Attribute</span> | <span style="color: #000000">uniqueMember</span> |
| <span style="color: #000000">User Object Class</span> | <span style="color: #000000">person</span> |
| <span style="color: #000000">Group Object Class</span> | <span style="color: #000000">groupOfUniqueNames</span> |
| <span style="color: #000000">Changed Users/Groups Algorithm</span> | <span style="color: #000000">Timestamp No Negation</span> |
| <span style="color: #000000">Timestamp Attribute</span> | <span style="color: #000000">modifyTimestamp</span> |
| <span style="color: #000000">Account Status Attribute</span> | <span style="color: #000000">accountLocked</span> |
| <span style="color: #000000">Account Status Algorithm</span> | <span style="color: #000000">Flag</span> |
| <span style="color: #000000">Default Status</span> | <span style="color: #000000">true</span> |
| <span style="color: #000000">Flag Comparison Value</span> | <span style="color: #000000">true</span><br><span style="color: #000000">Note that this value is case sensitive. If the attribute value is set as TRUE in LDAP, the comparison here will not pass and the account won’t be locked.</span> |
| <span style="color: #000000">Flag Comparison Status</span> | <span style="color: #000000">false</span> |


> ⚠️ <span style="color: #000000">These settings are only applicable in case you are using PingDirectory (Ping Identity’s LDAP server) as a user repository. Consult </span><span style="color: #1155cc">[PingFederate’s documentation](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-102.pdf)</span><span style="color: #000000"> if you are using a different User repository datastore.</span>

 

<span style="color: #000000">Click </span><span style="color: #000000">**Next**</span><span style="color: #000000">.</span>

<span style="color: #000000">In the Source Location tab fill in:</span>

 

|  |  |
| --- | --- |
| <span style="color: #000000">Base DN</span> | <span style="color: #000000">dc=example,dc=com</span> |
| <span style="color: #000000">Users Filter</span> | <span style="color: #000000">(&(uid=*)(objectClass=person))</span> |

 

<span style="color: #000000">Click </span><span style="color: #000000">**Next**</span><span style="color: #000000">.</span>

<span style="color: #000000">In the </span>**Attribute Mapping**<span style="color: #000000"> tab configure:</span>

 

|  |  |
| --- | --- |
| <span style="color: #000000">userName</span> | <span style="color: #000000">uid</span> |
| <span style="color: #000000">workEmail</span> | <span style="color: #000000">mail</span> |
| <span style="color: #000000">familyName</span> | <span style="color: #000000">sn</span> |
| <span style="color: #000000">givenName</span> | <span style="color: #000000">cn</span> |


> ✅ <span style="color: #000000">Configure any additional fields, listed in </span><span style="color: #1155cc">[Basics > SCIM](https://docs-chaos.atlassian.net/wiki/spaces/KB/pages/124387373/Corporate+Sign+In#SCIM)</span><span style="color: #000000"> as per your schema definition and needs.</span>

 

<span style="color: #000000">The required active field is automatically calculated based on the configuration, defined in the </span><span style="color: #000000">**Source Settings**</span><span style="color: #000000"> tab earlier. It depends on the Account Status Attribute and Account Status Algorithm and the flag combinations set in that section.</span>

<span style="color: #000000">An excerpt from the </span><span style="color: #1155cc">[PingFederate’s official documentation](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-102.pdf)</span> <span style="color: #000000">reads:</span>

<span style="color: #000000">*"Flag Comparison Status:*</span>

<span style="color: #000000">*Indicates whether the user is enabled or disabled when the flag has the value specified in the Flag Comparison Value field. Setting the value to true equals enabled, while setting the value to false equals disabled.*</span>

<span style="color: #000000">*Example:*</span>

<span style="color: #000000">*if the Account Status Attribute is set to nsaccountlock, and the Flag Comparison Value is set to true, and the Flag Comparison Status is set to false, then any users with nsaccountlock=true are disabled."*</span>

  

<span style="color: #000000">Click </span><span style="color: #000000">**Save**</span><span style="color: #000000"> to save the SP Connection.</span>