Enabling Ping Identity SSO

This guide will enable you to set up Ping Identity (PingID) in Mambu for Single Sign On.

PingID SSO setup

1. If you don't have a PingID account, visit the Ping Identity site to create a free account or log in to your existing one.
2. From your environment screen, select the relevant environment for SSO configuration.
3. Choose the Build your own solution option and select the appropriate cloud service for your organization.
4. On the left-side menu, click the Connections icon to create a new application.
   
5. Select Advanced Configuration and then choose the configure option for SAML.
   
6. Populate the application name and description, then click Next.
7. Select the Manually Enter option and fill in the fields as follows.
   • ACS URLS: https://<tenant>.mambu.com/saml/login
   • Entity ID: https://<tenant>.mambu.com/saml/login
   • Target Application URL: https://<tenant>.mambu.com/saml/login
   • Assertion Validity: 60
   • Click the “Save and Continue” button.
8. Download the .crt Signing Certificate.
9. Create the mapping as indicated below and click Save.
   
10. Enable the newly created application by selecting the toggle.
    
11. Navigate to the Configuration tab of the new application and save the ISSUER ID and SINGLE SIGNON SERVICE values, as they will be needed for SSO configuration in Mambu.

Mambu SSO setup

1. Log into Mambu and navigate to Administration > Access > Federated Authentication.
2. Select the Enable Sign Sign-On checkbox, ensuring the Manual Settings option is also selected.
3. Fill in the following parameters:
   • Name: This can be any chosen name and will be displayed on the Mambu login page for SSO login.
   • Single Sign-On Endpoint: This is the SINGLE SIGNON SERVICE value saved from the previous section.
   • Certificate FingerPrint: This is derived from the .crt certificate downloaded in step 7 of the Ping Identity setup.
     • Run the command openssl x509 -noout -fingerprint -sha256 -inform pem -in {/path/to/certificate-file} from your terminal to generate the fingerprint.
   • Issuer ID: This is the ISSUER ID saved from the previous section.
4. Save the changes and click Test SSO connection to validate the SSO functionality.

PingID user creation and group setup

To use PingID SSO for Mambu login, you need to create users and assign them to groups in PingID. The groups in PingID should correspond to roles in Mambu.

PingID group creation

1. Navigate to Identities > Groups.
   
2. Select the + icon to create a new group and populate the fields appropriately.
   

PingID user creation

1. Navigate to Identities > Users.
   
2. Click the Add User button and populate the user attributes as needed.

Assign users to groups

1. In PingID, navigate to the user and click on the Groups tab to assign users to a group.
2. Click the Add button to select the group.
3. Select the group and Save.

After completing these steps, visit your Mambu tenant, click the SSO link on the login page, and log in with any of the newly created PingID users.