PingFederate Configuration Instructions

Step 1: Log In and Start a New SP Connection

1. Log in to PingFederate: Open your browser, navigate to the PingFederate Admin Console, and sign in with your administrator credentials.
2. Navigate to IdP Configuration: On the left-hand menu, go to the IdP Configuration section.
3. Create a New SP Connection: Click Create New under the SP Connections area.

Step 2: Select Connection Template and Options

4. Choose Connection Template: On the Connection Type page, select the Browser SSO Profiles connection template and click Next.

5. Select Connection Options: On the Connection Options page, check the Browser SSO option and click Next.

6. Skip Metadata Import: On the Import Metadata page, simply click Next to skip this step.

Step 3: Enter Partner and Base URL Details

7. Provide DataCamp Details: 
   1. In the Partner’s Entity ID (Connection ID) field, enter your DataCamp subdomain found in DataCamp Groups Settings.
   2. Enter your desired Connection Name.
   3. In the Base URL field, paste the Assertion Consumer Service URL you obtained from DataCamp.

Scroll down and click Next.

Step 4: Configure Browser SSO and SAML Profiles

8. Configure Browser SSO: On the Browser SSO page, click Configure Browser SSO.
9. Select SAML Profiles: On the SAML Profiles page, check both IdP-Initiated SSO and SP-Initiated SSO options, then click Next.

10. Set Assertion Lifetime: Enter your desired Assertion Lifetime (in seconds) and click Next.

Step 5: Configure Assertion Creation

11. Start Assertion Creation: On the Assertion Creation page, click Configure Assertion Creation.
12. Select Identity Mapping: Choose the Standard Identity Mapping option and click Next.

13. Adjust Subject Name Format: Change the Subject Name Format for the SAML_SUBJECT to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

14. Map Adapter Instance: 
    1. Click Map New Adapter Instance on the Authentication Source Mapping page.
    2. Choose your desired Adapter Instance. For example, if you’re using the PingOne HTML Form Adapter, select it. (Ensure the adapter provides the user’s email address.)
    3. Click Next.

15. Select Adapter Contract Values: If your adapter meets DataCamp’s requirement (providing the user’s email address), select Use only the adapter contract values in the SAML assertion and click Next.

16. Set SAML_SUBJECT Source: Set the SAML_SUBJECT Source to your adapter and its Value to the user’s email address, then click Next.

17. Configure Issuance Criteria: Specify any authorization conditions if needed on the Issuance Criteria page, then click Next.

18. Finish Assertion Creation: On the Adapter Mapping Summary page, click Done. Then, click Next on the Assertion Creation page, and finally click Done on the Assertion Creation Summary page. Click Next to continue.

Step 6: Configure Protocol Settings

19. Begin Protocol Settings: Click Configure Protocol Settings on the Protocol Settings page.
20. Set Binding and Endpoint:
    1. Set the Binding to POST.
    2. Paste the Assertion Consumer Service URL (copied from DataCamp earlier in Step 7) into the Endpoint URL field.
    3. Click Add

21. Add other Other Allowed ACS URL 
    1. Click Add again and paste the Other Allowed ACS URL from the same page where you obtained your Assertion Consumer Service URL in step 7. Keep binding at POST.
    2. Click Add, then Next

22. Allowed SAML Bindings: On the Allowable SAML Bindings page, check POST and click Next.
23. Signature and Encryption Policies:
    1. Click Next on the Signature Policy page.
    2. Click Next on the Encryption Policy page, then click Done on the Protocol Settings Summary page.
24. Finalize Protocol Settings, Click Next on the Protocol Settings page to move forward.
25. Browser SSO Summary, On the Browser SSO Summary page, click Done, then click Next on the Browser SSO page.

Step 7: Configure Credentials and Activate the Connection

26. Configure Credentials: On the Credentials page, click Configure Credentials.
27. Select Signing Certificate:
    1. Choose the Signing Certificate you want to use with DataCamp.
    2. Use the certificate’s serial number (noted earlier) to identify the correct one.
    3. Check the box Include the certificate in the signature element.
    4. Click Next.

28. Digital Signature Settings Summary: On the Digital Signature Settings Summary page, click Done, then click Next on the Credentials page.
    1. Export the metadata for the newly-created DataCamp SP connection.
    2. Export the signing certificate.
29. Activate the Connection: On the Activation & Summary page, change the Connection Status to Active. Scroll down and click Save.

Step 8: Configuring DataCamp Side

30. Paste the entityID value that you copied previously in step 27 to the Entity ID / Issuer URL field.
31. Paste the Location value you copied previously in step 27 to the Login URL / SSO Endpoint  field.
32. Paste the PingFederate certificate into the IdP Certificate field including ---BEGIN and ----END.