Set up SSO with Ping Identity (PingOne)

This page is for organization owners and admins who want members to sign in to Actagate with their Ping Identity (PingOne) account. You create an OIDC Web App in PingOne, add a connection on the Actagate settings screen, test it, and then activate it.

Before you start, ask your operator to set SSO_SECRET_ENCRYPTION_KEY and WEB_BASE_URL (see Single sign-on basics).

1. Create the app in Ping Identity (PingOne)

1. In the PingOne admin console, open Applications > Applications, press + and create an OIDC Web App. The app settings screen opens
2. On the Configuration tab, set Response Type to Code and Grant Type to Authorization Code. Set PKCE Enforcement to require S256
3. Enter the temporary value https://<host>/api/auth/sso/callback/0 in Redirect URIs. The real URL is known after you save the connection in step 2
4. Set Token Endpoint Authentication Method to Client Secret Basic or Client Secret Post
5. On the Access tab, use a group membership policy to give access to the admin who will run the test and the members who will sign in
6. Turn the app on with its toggle
7. Copy the Client ID, Client Secret and Environment ID

Official documentation: PingOne applications, OIDC settings

2. Add the connection in Actagate

1. Open Settings > Security (/ws/settings/security). Under Single sign-on, in “Pick a provider to add a connection”, open “Ping Identity (PingOne)”. The connection form opens
2. Enter “Display name”, “Issuer URL”, “Client ID” and “Client secret”, then press “Add connection”. The screen shows “Connection saved.” and a new connection marked “Draft · Not tested” appears under “Connections”
3. Copy the “Callback URL to register in the IdP” shown on the connection. It looks like https://<host>/api/auth/sso/callback/<connection ID>
4. Register that URL in Redirect URIs in Ping Identity (PingOne) and delete the temporary value. Match the displayed value exactly, including the connection ID

The connection form (Okta example). The Ping Identity (PingOne) form has the same fields: the provider hint, "Official setup guide", "Display name", "Issuer URL", "Client ID" and "Client secret"

The issuer looks like https://auth.pingone.<region>/<environment ID>/as. Region examples are com, eu, ca, asia and com.au. With a custom domain, enter https://<custom domain>/as.

After you save, the client secret is never shown again. The screen only says “Secret: set”.

3. Test

1. Press “Test” on the connection. The Ping Identity (PingOne) sign-in page opens
2. Sign in with your own Ping Identity (PingOne) account. You return to the settings screen, which shows “Test passed. You can activate the connection.” The connection is now marked “Test passed”

The test runs the full authorization code flow with PKCE and checks the ID token signature, issuer, audience, expiry, nonce and sub. Your admin session stays as it is. The test creates no user and links no login method. If it fails, the screen shows a reason code.

4. Activate

1. Press “Activate” on the connection. The screen shows “Connection activated. It is now available on the login screen.” and the status changes to “Active”

You can press “Activate” only after a test passes. Changing the Issuer URL, client ID or client secret clears the test result and returns the connection to draft.

5. Check sign-in

1. An invited member who is not an admin opens the login screen. A button labeled “Continue with ” is shown
2. The member presses the button and signs in with Ping Identity (PingOne). The Actagate screen opens
3. Check that a user who is not assigned to the app in Ping Identity (PingOne) cannot sign in

On the first sign-in, Actagate matches the email address that the IdP marks as verified (email_verified) against the invited member’s email address. Owners and admins sign in with an existing method first, then link the connection with “Add ” under Settings > Login methods.

6. Troubleshooting

• discovery_failed: check the region and the Environment ID in the issuer
• pkce_unsupported: set PKCE Enforcement to S256
• provider_rejected: check the Access tab assignment and the URL in Redirect URIs
• token_exchange_failed: check the client ID, the secret and the Token Endpoint Authentication Method

Other reason codes are listed in SSO troubleshooting.