Skip to content

Configure SAML SSO with Ping Identity for your organization

Lightrun offers support for Single Sign-On (SSO) using Ping Identity as the identity provider (IdP) by integrating Lightrun with the SAML 2.0 integration in Ping Identity.

Using SAML, Lightrun functions as a service provider, receiving user authentication information from Ping, which serves as the external identity provider. When SSO is enabled, Lightrun is no longer responsible for user authentication, but still manages the redirection of login requests to the identity provider and verifies the integrity of the response from the identity provider.

Terminology

  • Identity Provider (IdP): A service that manages user accounts, providing authentication services to applications. Lightrun supports Ping Identity for this purpose.
  • Service Provider: The website that hosts apps. In our case, it is Lightrun.
  • Service Provider Entity UID: The URL is used to uniquely identify your service provider and is generated in the SSO page in the Lightrun Management Portal.
  • Single Sign on URL: This endpoint URL is generated in the SSO page in the Lightrun Management Portal.
  • Single Sign on Service URL: The URL is used for sending authentication requests (SAMLAuthnRequest) and is generated in Ping Identity.

The process of setting up SSO involves these main stages:

  1. Setting up the Lightrun-SAML integration in Ping.
  2. Configuring and enabling SSO in the Lightrun Management Portal.

Set up Lightrun SAML integration in Ping

Setting up the Lightrun integration in Ping Identity includes these main steps.

STEP 1: COPY URLS in lightrun management portal
  1. Log in to your Lightrun account.

  2. In the Identity and Access Management tab > Identity Configuration > Login Methods.

  3. Click the SSO toggle. SAML Applications --half

  4. Select SAML as your SSO Protocol.
  5. Click Other as your Identity Provider.

  6. From the Service Provider's Redirect URL field, click Copy.

    This field will serve as the redirect URL used when configuring the identity provider.

  7. From the Service Provider's Entity ID field, click Copy. This field will serve as the unique identification of the SAML Service provider.

STEP 2: Set up Lightrun Application in Ping Identity
  1. Sign in to Ping Identity.
  2. In the Administration console, Navigate to Connections > Applications, and click the + (plus icon) to create the application. The Add Application window opens.
  3. Enter a user-defined name for the application. For example: <lightrun-app>.
  4. Under Application Type, select SAML Application.
  5. Click Save.
  6. Select the Configuration tab. SAML Applications --half
  7. Select Manually Enter.
  8. In the ACS URLs field, paste the Service Provider's Redirect URL that you copied from the Lightrun SSO settings in the previous step.
  9. In the Entity ID field, paste the Service Provider's Entity ID that you copied from the Lightrun SSO settings in the previous step.
  10. Click Save.
STEP 3: COPY URLS in Ping Identity
  1. In Ping Identity, access your <lightrun app> that you configured in the previous stage.
  2. Select the Configuration tab.
  3. Scroll down and copy the Single Signon Service URL.

    SAML Applications --half

Step 2: Configure and enable SSO in Lightrun

Setting up the SSO in the Lightrun Management Portal includes these main steps.

  1. Log in to your Lightrun account.
  2. Click Settings on the top right-hand side of your screen to navigate to the Identity and Access Management tab > Identity Configuration > Login methods > SSO section.

  3. To enable SSO, click the SSO toggle.

    SAML Applications --half

  4. Select SAML as your SSO Protocol.

  5. Select Other as your Identity Provider.
  6. In the Identity Provider's SSO URL field, paste the Single Signon Service you copied in the previous step, which is used to send authentication requests (SAMLAuthnRequest).
  7. Click Save.

Further Reading

Last update: November 19, 2024