Introduction

SSO integration configuration is done with both PingOne and OpsRamp. The configuration sets up redirects to the custom branded URL.

Prerequisites

  • Partners must register with OpsRamp to get OpsRamp login credentials.
  • Provide your custom branding URL (such as <yourwebsitename>.opsramp.com).

Step 1: Create a certificate

  1. From the PingOne console, navigate to Settings > Certificates & Key Pairs > + Add > Create Key Pair.

    Create a certificate - Create a Key Pair
    Create a certificate - Create a Key Pair

  2. From the Create Key Pair screen, enter the required details and click Save & Finish.

Step 2: Create a SAML application

  1. Navigate to Applications > Applications > +.

  2. Enter the Application Name.

  3. Enter a description about the application in the Description field.

  4. Select the SAML Application tile.

  5. Click Configure.

    Create a SAML application
    Create a SAML application

  6. From the Add Application page, select an option from the following in the Provide Application Metadata field:

    • Import Metadata: Use this option if you have metadata for the already existing application.
    • Import From URL: Provide the URL where the metadata is available.
    • Manually Enter: Enter the following information:
      • Assertion Consumer Service (ACS) URLs: https://.opsramp.com/samlResponse.do. Click +Add to add more URLs.
      • Entity ID: https://.opsramp.com
    Application Configuration

  7. Click Save. Attribute mapping is saved by default.
    In the Attribute Mappings tab, click the Edit icon and click Add to add attribute mappings.
    Note: Use the newly added attributes for JIT provisioning in OpsRamp.

    SSO Attribute Mapping

  8. Click the Configuration tab.

  9. Review the SAML application for Single Sing-On URL.

  10. Download the SAML Metadata and copy the entityID URL.
    Example: If the entityID URL is <md:EntityDescriptor entityID="https://auth.pingone.asia/1765cc97-11a1-4b98-a58a-47b5ca9bd620"ID="DUp57Bcq-y4RtkrRLyYj2fYxtqR" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">, the issuer URL is https://auth.pingone.asia/1765cc97-11a1-4b98-a58a-47b5ca9bd620.

  11. Download the Signing Certificate and save it.

  12. Copy the Initiate Single Sign-On (SSO) URL.

    SSO Attribute Mapping

Step 3: PingOne configuration for SCIM provisioning

Follow these steps to configure SCIM provisioning:

  1. Click Integration > Provisioning

    PingOne Provisioning screen

  2. Click Provisioning + > New Connection. The Create a New Connection screen is displayed.

    PingOne New Connection screen

  3. Select Identity Store. Search for SCIM Outbound and click select to select SCIM Outbound.

    Select SCIM Outbound option

  4. Click NEXT.

    Enter information in the New Connection screen

  5. Enter the following information in the screen:

    1. Name: Enter the name of the connection.
    2. Description: Provide a description for the connection.

  6. Click Next.

    Enter information in the Configure Authentication screen

  7. Under Configure Authentication, enter the following information:

    1. SCIM BASE URL: Copy the URL from OpsRamp Configuration and paste it in this field.
    2. SCIM Version: Select the version as 2.0.
    3. Authentication Method: Select OAuth 2 Bearer Token from the drop-down list.
    4. Oauth Access Token: Copy one-time token from OpsRamp Configuration and paste it in this field.
    5. Auth Type Header: Select the header as Bearer.

  8. Click Next.

    Enter information in the Configure Preferences screen

  9. Enter the required information and click Save.

Step 4: OpsRamp configuration

  1. From All Clients, select a client.

  2. Navigate to Setup > Account.

  3. Select the Integrations and Apps tab.

  4. The Installed Integrations page, where all the installed applications are displayed. Note: If there are no installed applications, it will navigate to the Available Integrations and Apps page.

  5. Click + ADD on the Installed Integrations page. The Available Integrations and Apps page displays all the available applications along with the newly created application with the version.

  6. Search for Ping using the search option available. Alternatively, use the All Categories option to search.

  7. Click +Add on the Ping tile.

    SSO - Ping configuration page

  8. Enter the following information in the Configuration page:

    • Metadata XML: Upload the XML file. This file will have all the information related to Issuer URL, Redirection URL, Logout URL, and Certificate. After you upload the Metadata XML file, these fields are automatically populated.
      Alternatively, you can enter the information in the fields manually.
    • Issuer URL: Identity provider Issuer URL
    • Redirection URL: SAML EndPoints for HTTP
    • Logout URL: URL for logging out
    • Certificate: x.509 Certificate

  9. Provision Username as: There are two ways to provision a user. Select the appropriate option:

    • Identify Provider’s Name Identifier option is selected by default. The user which is created in the SSO portal will reflect in OpsRamp.

    • Identify Provider’s Name Identifier with OpsRamp tenant-unique prefix: This option allows you to:

      • Create usernames with a unique 3-digit alphanumeric prefix, that is generated automatically by the system.
      • Install the same identity provider across multiple OpsRamp tenants.
        Note: Once you enable this option and install the integration, you cannot revert your changes.
        Example: There are three partners, Partner P1, P2, and P3. Each partner has usernames created with unique 3-digit alphanumeric prefix, like g0z.username1 for partner P1, p0w.username1 for partner P2, and t9q.username1 for partner P3.

  10. Click Next.

  11. In the Inbound page, there are two sections: USER PROVISION and MAP ATTRIBUTES.

    USER PROVISION

    OpsRamp supports two user provisioning methods to onboard users from identity providers like Ping:

    • SCIM
    • JIT
    • NONE: Only the existing users will be able to login.

    SCIM

    Following section describes SCIM provisioning in detail.

    1. Click Edit icon and select the following details and click UPDATE USER PROVISION:

      • Provision Type: SCIM. When configuring the integration it is necessary to select the Provision Type - SCIM to synchronize users and groups when provisioning occurs.
      • Default Role: The required user role.
      Select SCIM as user provision

    The details are updated and the USER PROVISION section displays the unique Tenant Prefix, URL and Token information.

  12. Copy the URL and Token information. These details are used when configuring Ping Provisioning settings.

    User Provision screen

    MAP ATTRIBUTES

  13. Define the following Map Attributes:

    Note:

    • For SCIM: The Role OpsRamp property is required.
    • For JIT: The OpsRamp properties like Primary Email, First Name, Last Name, and Role are required.

    1. Click +Add in the Map Attributes section.
    2. From the Add Map Attributes window, enter the following information:

    User:

    1. Select OpsRamp Entity as User and OpsRamp Property as Role.
      Role mapping is required for User and User Group.
    Add Map attributes
    1. Ping Entity: Enter the value.
    2. Ping Property: Enter the value.
      In PROPERTY VALUES section:
    3. Ping Property Value: The user details in the request payload received by OpsRamp contains the field information. Ensure that you provide the value of the field in this box.
      • Example payload:
          {
        "schemas": [
            "urn:ietf:params:scim:schemas:core:2.0:User"
        ],  
        "userName": "user.name1@opsramp.com",
        "name": {
            "givenName": "user",
            "familyName": "name1"
        },
        "emails": [
            {
                "primary": true,
                "value": "user.name1@opsramp.com",
                "type": "work"
            }
        ],
        "phoneNumbers": [
            {
                "primary": true,
                "value": "1234567890",
                "type": "work"
            }
        ],
        "addresses": [
            {
                "primary": true,
                "country": "IN"
            }
        ],
        "timezone": "india",
        "externalId": "00upcikgqpH6esdAN0h7",
        "groups": [],
        "password": "o6p5MVRK",
        "active": true
    }
    4. OpsRamp Property Value: Select the appropriate role corresponding to the Ping Property Value.
    5. Click Save. The mapping is saved and displayed.
      To add more property values click +Property Value.
      User the Filter option to filter the map attributes.

    Similarly, map attributes for other entities.

    Note: If mapping for Time Zone is not provided, then organization timezone is considered by default.

    User Group:

    1. Select OpsRamp Entity as User Group and OpsRamp Property as Role.
    Mapping attributes - User Group
    1. Ping Entity: Enter the value.
    2. Ping Property: Enter the value.
      In PROPERTY VALUES section:
    3. Ping Property Value: The user group details in the request payload received by OpsRamp contains the field information. Ensure that you provide the value of the field in this box.
      • Example payload:
           {
         "schemas": [
             "urn:ietf:params:scim:schemas:core:2.0:Group"
         ],
         "displayName": "abc group",
         "members": [
             {
                 "value": "USR0002265918",
                 "display": "user.name1@opsramp.com"
             },
             {
                 "value": "USR0002398463",
                 "display": "user.name2@opsramp.com"
             }
         ]
     }

      In this case, you enter abc group as value. If there is a match, OpsRamp provisions the user group accordingly.

    4. OpsRamp Property Value: Select the appropriate role corresponding to the Ping Property Value.
    5. Click Save. The mapping is saved and displayed.
      To add more property values click +Property Value.
    6. Click Add Map Attributes.

    • Click the three dots (menu icon) available at the end of each row to edit or delete a map attribute.

    If the Role is not configured in Map Attributes section, the Default Role provided in the User Provision section is considered for SSO.

    JIT

    Following section describes JIT provisioning in detail.

    In the Inbound page:

    1. Click Edit icon and select the following details and click UPDATE USER PROVISION:
      • Provision Type: JIT. When configuring the integration it is necessary to select the Provision Type - JIT to synchronize users when provisioning occurs.
      • Default Role: The required user role.
    Select JIT as user provision

  14. The details are updated and the USER PROVISION section displays the unique Tenant Prefix. These details are used when configuring Ping Provisioning settings.

    User Provision screen

  15. Follow the steps mentioned in the MAP ATTRIBUTES section above, to define the Map Attributes.

  16. Click Finish. The integration is installed.

Actions on Integration

You can perform actions like View Logs, Export, Edit, and Uninstall on the integration.

Audit Logs

View Inbound logs from the View Logs option for the integration. You can view if the event was successful or not.

See Audit Logs for more information.