This article includes step-by-step instructions for configuring single sign-on (SSO) settings in PingOne. For end users, you can integrate with PingOne to enable SAML-based SSO for Automated Device Enrollment (with an Enrollment Customization SSO authentication pane), Device Enrollment (also known as "user-initiated enrollment"), and Jamf Self Service for macOS.
While SAML-based SSO for administrators remains supported, Jamf recommends OIDC-based SSO through Jamf Account as a preferred authentication solution. OIDC-based SSO through Jamf Account offers seamless login across Jamf products and access to platform capabilities like blueprints and compliance benchmarks. End-user authentication for enrollment and Self Service can continue using SAML after transitioning administrator authentication to OIDC. For details on implementing OIDC-based SSO, see SSO with OIDC Through Jamf Account in the Jamf Pro Documentation.
This procedure involves the following steps:
Creating a new application in PingOne
Enabling Single Sign-On in Jamf Pro
Continuing SAML App Configuration in PingOne
(Optional) Adding Attribute Mappings in PingOne
Keep the following in mind when configuring SSO in Ping Identity:
Some setting names were changed in Jamf Pro 10.13.0. If you are using an earlier version of Jamf Pro, the setting names will not match the updated names in this article. For a list of name changes, see the 10.13.0 version of the Jamf Pro Release Notes.
Setting up SSO may require simultaneous configuration between PingOne and Jamf Pro to ensure some settings are mapped correctly. Additional settings or steps may also be required. See the Single Sign-On section of the Jamf Pro Documentation for Jamf Pro-specific requirements and instructions.