PingOne Integration
Last Verified : 1st September 2021
- 1 Download the ResourceXpress MetaData file
- 2 Configure an Application in PingOne
- 2.1 ACS URL’s
- 2.1.1 Table 1.0 - ACS URL’s
- 2.2 SAML Attributes
- 2.2.1 Table 1.1 - Attribute Mappings
- 2.2.2 User Access
- 2.2.3 Download the SP Metadata File
- 2.1 ACS URL’s
- 3 Configuring SAML App in ResourceXpress
- 3.1 Upload
- 3.2 Auto-create Users
- 3.3 Welcome Email
- 3.4 Sync user details
- 3.5 Enabling SSO
Download the ResourceXpress MetaData file
Before downloading the Metadata file ensure you are accessing ResourceXpress via a routable URL. Do not download the file if you are browsing the application from its host server using “localhost”.
If your end-users will be accessing ResourceXpress via a public/external URL ensure you generate the file when browsing this URL not the internal FQDN.
Login to ResourceXpress as an application administrator
Navigate to the SSO Settings tab found on the System Settings page, under the Administration Settings menu header, and download the SPMetadata.xml.
Keep hold of this file for a later step.
Configure an Application in PingOne
Login to your PingOne admin console using your unique environment URL
In the desired environment navigate to Connections - Applications and click the icon to add a new Application.
Under New Application select WEB APP
Select Configure for the SAML connection type
Under Create App Profile provide an Application Name e.g. RX SaaS and optionally add a description and logo file.
Under Configure SAML select the option Import Metadata then click Choose File. Upload the SPMetaData.xml file obtained in Step 1.
ACS URL’s
The initial ACS URL will be populated automatically when the SPMetaData file is uploaded. This will be in the format https://rxserver.domain.com/SsoConsumer
PingOne also requires some additional ACS URL’s in order to accept the redirects to features such as Kiosk, Maps, and Mobile App use. The below table lists the required ACS URL with the expected format.
Table 1.0 - ACS URL’s
Feature | ACS URL Required | Examples |
|---|---|---|
Admin Console | https://<RXurl>/SsoConsumer?r=%2f | https://company.rx-cloud.com/SsoConsumer?r=%2f |
Kiosk | https://<RXurl>/SsoConsumer?r=%2fkiosk%2f%3fID%3d1 | For a system with 3x Kiosk profiles with ID numbers 1 to 3, the below additional ACS URL’s would be required
|
Maps | https://<RXurl>/SsoConsumer?r=%2fMaps%2f%3fID%3d1 | For a system with 3x Map profiles with ID numbers 1 to 3, the below additional ACS URL’s would be required
|
Mobile App | https://<RXurl>/SsoConsumer?r=%2f%3fma%3d1 | https://company.rx-cloud.com/SsoConsumer?r=%2f%3fma%3d1 |
The remaining options in the Configure SAML section can be left with the default values.
SAML Attributes
The below shows the required attribute mappings that must be added before enabling SSO in RX.
The below table details all available attributes including optional values that can be mapped to user accounts during an SSO event.
To continue with the setup please ensure that the Required attributes are mapped, once verified click Save and Close
Table 1.1 - Attribute Mappings
PingOne User Attribute | Application Attribute | Required |
|---|---|---|
Given Name |
| Required |
Family Name |
| Required |
Email Address |
| Required |
RFID |
| Optional |
Access Code |
| Optional |
RX Default Location |
The ID number for the Location that the user will have default access to. | Optional |
RX Allowed Location |
A comma separated list of Location ID numbers that the user has access to. | Optional |
Date Format |
The date format for the user.
| Optional |
RX Roles |
A comma separated list of Role ID numbers. The default role ID values are as below
| Optional |
The Ping One application has now been configured.
User Access
By default, PingOne will grant access to the application to all users in the environment. To restrict access to specific users and groups you will need to edit the applications Access settings.
Once you add specific users and/or groups, access to RX will be restricted to only those users.
Download the SP Metadata File
Under the Configuration section click the Download button to download the PingOne SP Metadata file. This file is required for the next step.
Configuring SAML App in ResourceXpress
The final step is to upload the XML file we downloaded earlier to ResourceXpress.
Upload
Navigate to the SSO Settings tab, this can be found on the System Settings page, under the Administration Settings menu.
Click Choose file alongside IDP Metadata, find the saml2-metadata-idp.xml file that was downloaded previously.
Then click Upload.
You will see the correct details auto-populated into the URL and Authenticating Authority fields.
Auto-create Users
When using SSO, by default all users will be granted the role of User.
This will allow them to view the Booking Manager page only. To allow users access to more features in ResourceXpress they will need to exist as a user in the ResourceXpress local database.
Ticking the option Auto create user records from SSO will automatically add new users into the ResourceXpress user database when they sign in for the first time This will then allow these users to be granted more access to the system, as well as assign them an RFID and Access code.
Welcome Email
When a user's account is auto-created in ResourceXpress, a Welcome email can be sent to them to confirm their account. Included in this email will be a randomly generated password that can be used for the upcoming mobile app.
To enable the Welcome Email, tick the Send Welcome Email box.
Sync user details
This option allows for user details such as Access Code and RFID to be synchronized with ResourceXpress’s user's database, this will keep these details up-to-date each time a user signs in.
Disabling this option will allow Admin users to modify these details manually in ResourceXpress.
Enabling SSO
Once all the above steps have been completed, click the Save button.
- style