Continuing SAML App Configuration in PingOne

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US
  1. Return to the Application Configuration page in PingOne and configure your SSO settings.
  2. Enter the Jamf Pro metadata URL or upload the XML file downloaded from Jamf Pro.
    Make sure the following metadata and settings are populated and in the following format:
    • Assertion Consumer Service (ACS) —

      https://instancename.jamfcloud.com/saml/SSO

    • Entity ID —

      https://instancename.jamfcloud.com/saml/metadata

      Make sure this value matches the entity ID in Jamf Pro.
    • Single Logout Endpoint —

      https://instancename.jamfcloud.com/saml/SingleLogout

    • Signing Algorithm —RSA_SHA256
  3. Click Continue to Next Step.
  4. In SSO Attribute Mappings, click Add new attribute.
    Note:It is possible to change the name of the SAML attribute which will be used by Jamf Pro to retrieve group information (Group Mapping).
  5. (Optional) If mapping users by groups, do the following:
    1. Enter https://schemas.xmlsoap.org/claims/Group in the Application Attribute field.
    2. Click Advanced.
    3. Enter unspecified in the Application Attribute.
    4. Choose "memberOf" from the IDP Attribute Name or Literal Value pop-up menu.
  6. If mapping users by NameID, do the following:
    1. Choose "SAML_SUBJECT" from the Application Attribute pop-up menu.
    2. Click Advanced.
    3. Select "unspecified" from the Application Attribute pop-up menu.
    4. Depending on your Jamf Pro Single Sign-On settings, add appropriate attributes:

      • If Jamf Pro maps users by Username in the IDP Attribute Name or Literal Value field, select "First Name". If you want to have a space between the First and Last Name, add another attribute and in the IDP Attribute Name or Literal Value field enter the space character and select the As Literal checkbox. Next, add another attribute and in the IDP Attribute Name or Literal Value field select "Last Name".

      • If Jamf Pro maps users by Email in the IDP Attribute Name or Literal Value field, choose "Email".

  7. (Optional) If mapping users by a custom attribute, do the following:
    1. Choose the sameApplication Attribute that was specified in Jamf Pro.

      You must still configure NameID (SAML_SUBJECT).

    2. Click Save and Publish.
    3. Review the setup and click Finish.