## SSO integration with PingFederate using SAML

URL: https://docs.atlan.com/product/integrations/identity-management/sso/references/integration-with-pingfederate-using-saml

> Configure SAML 2.0 single sign-on between PingFederate and Atlan so your users sign in to Atlan with their PingFederate credentials. Copy Atlan's service provider metadata into PingFederate, configure both ACS endpoints, and import PingFederate's IdP metadata back into Atlan.

:::info Looking for PingFederate OAuth instead?
This guide covers PingFederate as a SAML identity provider for logging into Atlan. For PingFederate as an OAuth identity provider for querying Snowflake from Atlan Data Exploration, see [SSO integration with PingFederate using OAuth](https://docs.atlan.com/llms/governance/access-control/integration-with-pingfederate-using-oauth/llms.txt).
:::

Configure SAML 2.0 single sign-on so your users sign in to Atlan with their PingFederate credentials. Setup moves metadata in both directions: you copy Atlan's service provider details into a new SP Connection in PingFederate, then import PingFederate's identity provider metadata back into Atlan.

PingFederate is an on-premises enterprise IdP with no app gallery. Configuration is done in the PingFederate Admin Console and requires a PingFederate administrator. Start in Atlan, complete the SP Connection in PingFederate, then return to Atlan to finish.

## Prerequisites

Before you begin, make sure you have:

- **Admin access in Atlan.** Only admins can configure SSO.
- **Administrator access in PingFederate** so you can create an SP Connection and export IdP metadata.
- A decision on the **default role** new users receive on first sign-in (Admin, Member, or Guest). Set it in [Set default role for SSO users](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt). Most workspaces use Member.

## Copy Atlan's service provider metadata

1. In your Atlan workspace, click **Settings** from the left menu.

 If you are using the **Old UI (Classic)**, from the left menu, click **Admin**.

2. Click **SSO**.

3. Click **New**, then select **SAML 2.0** as the provider.

4. For _Alias_, enter a short identifier for this connection (for example, `pingfederate`), then click **Next**.

5. Under _Service provider metadata_, copy both values. You will paste them into PingFederate in the next step:

 - **Atlan SAML Assertion URL**
 - **Atlan Audience URI (SP Entity ID)**

 :::info PingFederate requires two ACS URLs
 PingFederate must handle both IdP-initiated and SP-initiated SSO flows. The two assertion URLs for your connection are:

 - **SP-initiated SSO:** `https://{{instance}}/auth/realms/default/broker/{{alias}}/endpoint`
 - **IdP-initiated SSO:** `https://{{instance}}/auth/realms/default/broker/{{alias}}/endpoint/clients/atlan-saml`

 where `{{instance}}` is your Atlan workspace URL and `{{alias}}` is the alias you entered above. Add both as ACS endpoints in PingFederate to support both login flows.
 :::

Keep this tab open. You will return here to finish setup.

## Configure PingFederate as SAML IdP

The following steps are performed in the PingFederate Admin Console by a PingFederate administrator.

1. Log into the **PingFederate Admin Console**.

2. In the left menu, go to **Applications** and click **SP Connections**.

3. Click **Create Connection**.

4. Under _Connection Type_, select **Browser SSO Profiles** and set the protocol to **SAML 2.0**, then click **Next**.

5. Under _SP Entity ID_, enter the **Atlan Audience URI (SP Entity ID)** you copied from Atlan.

6. Under _Connection Name_, enter a recognizable name for this connection (for example, `Atlan`), then proceed to the Browser SSO configuration.

7. Under _Assertion Consumer Service (ACS) URLs_, add both assertion URLs:

 - Add the **SP-initiated** URL (`/endpoint`) and set it as the **default** binding.
 - Add the **IdP-initiated** URL (`/endpoint/clients/atlan-saml`) as a secondary binding.

 Both must be present to support users signing in from the Atlan login page (SP-initiated) and from a PingFederate application portal (IdP-initiated).

8. Under _Attribute Contract_, configure PingFederate to send the following attributes in the SAML assertion:

 - `firstName`
 - `lastName`
 - `email`
 - `memberOf` (required for group mapping in Atlan)

 Map each attribute to the corresponding value from your user store in the _Authentication Source_ configuration.

9. Complete the remaining connection steps in PingFederate (credentials, activation), then save the SP Connection.

10. Export the **IdP metadata XML** from PingFederate. You can find it under the SP Connection's summary page or via PingFederate's federation metadata endpoint. Save the file as `.xml`.

 :::info
 The SSO URL in PingFederate's metadata must be reachable from Atlan over an internet connection.
 :::

## Import PingFederate's metadata into Atlan

With the SP Connection configured in PingFederate, go back to Atlan to finish. Open your Atlan SSO settings (the SAML 2.0 provider you started in the first step) and:

1. Under _Identity provider metadata_, provide the metadata from PingFederate one of two ways:

 - **Import from XML** (recommended): click **Import from XML** and select the metadata XML file you exported from PingFederate.
 - **Enter manually**: paste the **SAML SSO URL** and the **x.509 certificate** from PingFederate into their respective fields.

2. Click **Save**.

Your users can now sign in to Atlan with PingFederate. By default, they can still sign in with a local Atlan account too. To require PingFederate, enable **Enforce SSO** (see below).

## Enforce SSO (optional)

Once PingFederate SSO works, you can disable local email-and-password sign-in so everyone authenticates through PingFederate:

1. In Atlan, go to **Settings → SSO** and open your PingFederate provider.

2. Enable **Enforce SSO**.

After enforcing SSO, have your PingFederate administrator manage access from PingFederate rather than [inviting users directly in Atlan](https://docs.atlan.com/llms/governance/access-control/invite-new-users/llms.txt). Assigned users are provisioned automatically on their first sign-in.

## Troubleshooting

**Invalid signature error**

If you encounter an `Invalid signature` error after setup, verify that the certificate in the PingFederate metadata XML is of the SHA-256 or SHA-512 type. MD5 and SHA-1 certificates are not accepted. Re-export the metadata from PingFederate after updating the certificate algorithm if needed.

**SP-initiated login fails but IdP-initiated works (or vice versa)**

Each login flow uses a different ACS URL. If one flow fails, confirm that both URLs are registered as ACS endpoints in the PingFederate SP Connection:

- SP-initiated: `https://{{instance}}/auth/realms/default/broker/{{alias}}/endpoint`
- IdP-initiated: `https://{{instance}}/auth/realms/default/broker/{{alias}}/endpoint/clients/atlan-saml`

Check that the SP-initiated URL is set as the default binding in PingFederate.

**404 error when logging in**

A 404 error on the PingFederate side can indicate that the SP Connection requires a signed authentication request. Navigate to the _Signature Policy_ tab in your PingFederate SP Connection and uncheck **Always Sign Assertion**. For details, see [PingFederate SSO 404 error](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt).

**General SSO sign-in issues**

For attribute mapping errors, group sync issues, or user provisioning failures, see [Troubleshooting SSO](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt). Contact [Atlan Support](https://docs.atlan.com/support/submit-request) if the issue persists.

## See also

- [Set default role for SSO users](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt): Pick the role new PingFederate users receive on first sign-in.
- [Restrict auto user creation](https://docs.atlan.com/llms/governance/access-control/limit-sso-automatically-creating-users-when-they-log-in/llms.txt): Limit who gets provisioned through PingFederate.
- [PingFederate SSO 404 error](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt): Fix the signed-assertion 404 error specific to PingFederate.
- [SSO integration with PingFederate using OAuth](https://docs.atlan.com/llms/governance/access-control/integration-with-pingfederate-using-oauth/llms.txt): A different flow, PingFederate as an OAuth identity provider for Snowflake query authentication.
- [Troubleshooting SSO](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt): General sign-in and group sync troubleshooting.

---