- Getting started
- Best practices
- Tenant
- Actions
- Folders Context
- Automations
- Processes
- Jobs
- Triggers
- Logs
- Monitoring
- Queues
- Assets
- Storage Buckets
- Orchestrator testing
- Action Catalogs
- Profile
- System Administrator
- Identity Server
- Authentication
- Other Configurations
- Integrations
- Classic Robots
- Troubleshooting
Configure PingOne to Recognize a New Orchestrator Machine
The following steps are valid for PingOne SAML setup. Please note that the procedure is a broad description of a sample configuration. For a fully detailed how-to, visit the official PingOne Documentation.
-
Log in to the PingOne Administrator Console.
-
On the Applications tab, select + Add Application. A new window opens.
-
Select WEB APP, and select the Configure button in the SAML box.
-
On the Create App Profile page, enter an application name in the dedicated field, and select the Next button.
-
On the Configure SAML page, specify the ACS URL by filling in the URL of the Orchestrator instance plus the suffix
identity/Saml2/Acs. For instance:https://orchestratorURL/identity/Saml2/Acs. Keep in mind that the ACS is case sensitive. -
Scroll down the Configure SAML page, and set the Entity ID to
https://orchestratorURL. -
On the same page, select HTTP Redirect as your SLO binding.
-
In the Assertion Validity Duration field, enter the desired validity period in seconds, and press Next.
-
On the Map Attributes page, map the following attribute: Email Address =
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress -
Select Save and open the app from the Applications tab.
-
In the newly opened window, copy the Single SignOn URL.
Set Orchestrator/Identity Server to Use PingOne Authentication
-
Define a user in Orchestrator and have a valid email address set on the Users page.
-
Import the signing certificate provided by the Identity Provider to the Windows certificate store using Microsoft Management Console. See here how to do that.
-
Make sure that the following configuration is present in Identity Server's SAML2 settings within the External Providers page (read here how to access Identity Server):
-
Select the Enabled check box.
-
Set the Service Provider Entity ID parameter to
https://orchestratorURL. -
Set the Identity Provider Entity ID parameter to the value obtained by configuring PingOne authentication.
-
Set the Single Sign-On Service URL parameter to the value obtained by configuring PingOne authentication.
-
Select the Allow unsolicited authentication response check box.
-
Set the Return URL parameter to
https://orchestratorURL/identity/externalidentity/saml2redirectcallback. -
Set the External user mapping strategy parameter to
By user e-mail. -
Set the SAML binding type parameter to
HTTP redirect. -
In the Signing Certificate section, set the Store name parameter to
Myfrom the drop-box. -
Set the Store location parameter to
LocalMachine. -
Set the Thumbprint parameter to the thumbprint value provided in the Windows certificate store. Details here.
Note:Replace all occurrences of
https://orchestratorURLwith the URL of your Orchestrator instance.Make sure that the URL of the Orchestrator instance does not contain a trailing slash. Always fill it in as
https://orchestratorURL, nothttps://orchestratorURL/.
-
-
Click Save to save the changes to the external identity provider settings.
-
Restart the IIS server after performing any configuration changes within Identity Server.