PingFederate Single Sign-On
Ping Identity·AE_PingFederate_SSO_ConfigurationGuide
Overview
The PingFederate SSO connector configures AlertEnterprise Guardian to federate authentication to Ping Identity PingFederate via SAML 2.0. AE Guardian acts as the SAML Service Provider; PingFederate acts as the Identity Provider. PingFederate is the second-most-common enterprise IdP in financial services after Okta, particularly in customer-managed federation deployments where the customer wants on-prem / private-cloud-hosted IdP infrastructure rather than a SaaS IdP.
Pattern mirrors adfs-sso / okta-sso / microsoft-entra-id-sso: AE provides metadata XML; PingFederate admin imports it as an SP Connection with appropriate attribute contracts (email → Name ID).
Architecture
Composed from this connector's actors + edges. Trust zones are color-coded; trust crossings render as thicker lines.
Authentication
1 method supported
AE Guardian SP federates to PingFederate IdP. PingFederate posts a SAML response to AE's ACS endpoint with Name ID set to the user's email.
Prerequisites
Everything that must be in place for this connector to work, with the owner who's responsible.
PingFederate deployment with SP Connection for AE
customerAn operational PingFederate deployment. The PingFederate admin creates an SP Connection for AE Guardian, imports AE metadata XML, configures attribute contracts and policy.
User records pre-synced into AE Guardian database
aeSame constraint as other SSO connectors — users authenticated by PingFederate must already exist in AE Guardian's database.
Known limitations
Documented constraints to set customer expectations before deployment.
Authentication only — no provisioning or reconciliation
informationalFor Ping-side identity data, use a separate provisioning connector targeting Ping's authoritative source (typically AD / Entra ID / a directory PingFederate fronts).
IAM specifics
- OIDC
- yes
- SAML
- yes
- SCIM
- yes
- JIT provisioning
- configurable
- Group sync mode
- not-supported
- Source of record
- No
MFA enforced by PingFederate authentication policy / Selector. AE Guardian inherits MFA enforcement from the PingFederate policy chain.
- src/connectors/ping-federate-sso/source.pdf — Full configuration guide — 21 pages, updated 2026-02-19