# PingOne for Enterprise identity provider

> Set up single sign-on (SSO) for Cloud Management Platform (CMP) using PingOne for Enterprise

---

Site [llms.txt](/llms.txt)

---

## Before you begin

- Create at least one [branded portal](/docs/cmp/configure/administration/system/branded-portals/) for this SSO provider. Its URL determines the metadata and ACS URL.
- Have an administrator account in PingOne for Enterprise that can create an application and add users.
- Have a PingOne organization.

<div class="alert alert-info" role="alert">


PingOne also offers a similar product, PingIdentity SSO. CMP can integrate with it as well, but this guide covers PingOne for Enterprise specifically.
</div>


## Set up PingOne in CMP

1. In CMP, log in as an administrator.
1. Select **Admin** > **Single Sign-On (SSO)**.
1. Select **Add** > **Generic SAML Provider**.
1. Complete the [SAML settings](/docs/cmp/configure/access-and-security/users/sso-saml/set-up/#saml-settings) form, selecting the branded portal for this provider.
1. Select **Create**.
1. Copy and store the **Single Sign-On URL** and **Metadata URL / Entity ID**, and select **Download Metadata XML**. You use these later during PingOne setup.

## Create the PingOne application

### Connect to the PingOne directory

1. Log in to the PingOne for Enterprise web interface.
1. In the top navigation menu, select **Setup** > **Identity Repository** > **Connect to an Identity Repository**.
   1. For **Connect to an Identity Repository**, select **PingOne Directory**, then select **Next**.
   1. After the directory is configured, select **Next**.
   1. Make note of the **Map Attributes**; you use them later.
1. Select **Finished**.

### Add the PingOne SAML application

1. In the top navigation menu, select **Applications** > **Add Application** > **Search Application Catalog**.
1. Search for "Ping", then select the arrow next to **Ping IDaaS Directory Provisioner** > **Setup**.

   ![Screenshot: search for "Ping", then select the arrow next to Ping IDaaS Directory Provisioner > Setup](/img/cmp/configure/access-and-security/users/sso-saml/pingone/cmp_sso-pingone-add-app-search.png)

Selecting **Setup** opens PingOne's configuration wizard. Complete each step:

#### SSO Instructions

1. Download the signing certificate.
1. Copy and store the IDs, URL, and issuer for later use.
1. Select **Continue to Next Step**.

![Screenshot: select Continue to Next Step](/img/cmp/configure/access-and-security/users/sso-saml/pingone/cmp_sso-pingone-sso-instructions.png)

#### Connection Configuration

1. Upload the **Metadata URL** you collected in [Set up PingOne in CMP](#set-up-pingone-in-cmp), step 6. The ACS URL and Entity ID fields populate from the metadata and should match your SSO provider in CMP.
1. Select **Continue to Next Step**.

#### PingOne App Customization

1. Optionally, change the PingOne app icon, name, description, and category.
1. Select **Continue to Next Step**.

#### Group Access

1. If you have groups, add them here.
1. Select **Continue to Next Step**.

#### Review Setup

1. Review the presented information.
1. Copy and store the **Initiate Single Sign-On (SSO) URL**. You need it to test the connection later.
1. Download the **Signing Certificate** and **SAML Metadata**.
1. Select **Finish**.

![Screenshot: select Finish](/img/cmp/configure/access-and-security/users/sso-saml/pingone/cmp_sso-pingone-step-5-review-setup.png)

## Upload the metadata to CMP

Return to your PingOne SSO provider in CMP to upload the XML metadata.

1. In your PingOne SSO provider, select **Upload IdP XML**.
   - **Metadata Source**: Metadata file
   - **Metadata File**: Select the file you downloaded in the Review Setup step.
1. To upload certificates, select **Certificates**.

## Test the SSO connection

1. In CMP, select **Admin** > **Users** and create a new user. Make sure the user's group membership matches any group entered in PingOne setup.
1. Go to the **Initiate Single Sign-On (SSO) URL** and log in with the new user account.
1. If you are redirected to CMP and can log in, the SSO configuration is complete.