General

Store Store Login FAQ

Quick reference

The values you'll paste into Ping. All three URLs are scoped to your store and never change.

ACS URL
https://store.jaapi.store/api/auth/signin/sso
Entity ID
https://store.jaapi.store
SP metadata URL
https://store.jaapi.store/api/auth/signin/sso/metadata
NameID format
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Signature algorithm
RSA-SHA256

Which Ping product are you on?

"PingID" is Ping's MFA add-on, not a SAML identity provider. The actual IdP is one of the two products below. Pick the matching section before continuing — the admin console UI is different in each.

PingOne

Cloud SaaS IdP. Your admin console is on console.pingone.com (or the regional variants .eu, .asia, .ca).

What Ping sells to new customers. Common in cloud-first enterprises.

PingFederate

Self-hosted federation server. Your admin console runs on port 9999, with a URL like https://<host>:9999/pingfederate/app.

Classic on-prem deployment. Common in regulated industries and hybrid environments.

How users sign in

Once the integration is live, signing in from your Ping portal works right away. Sign-in started from the swag store itself uses the same Ping configuration and switches on once your single sign-on URL is saved in the store settings (see the final steps below).

From your Ping portal

Users open the Ping end-user dashboard (PingOne) or your federation portal (PingFederate) and click the tile for your swag store. Ping posts a signed assertion to store.jaapi.store and they land logged in.

IdP-initiated. No extra configuration needed.

From the swag store

Users go to store.jaapi.store/auth/signin and click Sign in with Ping. We redirect them to Ping to authenticate, then back to the store.

SP-initiated. Needs your IdP single sign-on URL saved in the store settings (see the final steps below).

PingOne setup

Use this section if your admin console is on console.pingone.com. You'll need a role with permission to create applications (typically Identity Data Admin or Application Admin).

Create the SAML application

  1. In the PingOne admin console, open Applications → Applications and click the + icon.
  2. Name the app "Jaapi Swag Store" and choose SAML Application. Click Configure.
  3. For configuration method, choose Import From URL and paste our SP metadata URL:

    https://store.jaapi.store/api/auth/signin/sso/metadata

    This auto-fills the ACS URL, Entity ID, and NameID format. If your tenant blocks outbound HTTPS, choose Manually Enter and use the values from the Quick reference above.
  4. Save the application.

Configure the SAML settings

On the application's Configuration tab, verify:

ACS URLs
https://store.jaapi.store/api/auth/signin/sso
Entity ID
https://store.jaapi.store
Subject NameID Format
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Sign Options
Sign Assertion (or Sign Assertion & Response)
Signing Algorithm
RSA_SHA256
Encryption
Off
Enforce Signed Authn Request
Off (leave default)

Map the email attribute

On the Attribute Mappings tab, map saml_subject to the user's Email Address attribute. This is what we use as the user's identity.

Leave these off

Enforce Signed Authn Request · Assertion encryption. Jaapi doesn't support signed AuthnRequests or encrypted assertions; if you enable either, sign-in will fail.

PingFederate setup

Use this section if your admin console runs on port 9999. You'll need an admin role with permission to create SP Connections.

Create the SP Connection

  1. In the PingFederate admin console, go to Applications → Integration → SP Connections and click Create Connection.
  2. Connection Template: select Do not use a template.
  3. Connection Type: check Browser SSO Profiles; protocol SAML 2.0.
  4. Connection Options: check Browser SSO.
  5. Import Metadata: select URL and paste our SP metadata URL:

    https://store.jaapi.store/api/auth/signin/sso/metadata

    This populates Entity ID, ACS URL, and signing requirements automatically. Use the File option if your PingFederate host can't reach the public internet.

Configure Browser SSO

Click Configure Browser SSO and set:

SAML Profiles
Enable IdP-Initiated SSO and SP-Initiated SSO
Assertion Lifetime
Defaults (5 minutes before/after)
Attribute Contract
SAML_SUBJECT sourced from the user's email attribute
Signature Policy
Always Sign Assertion (do NOT check 'Require AuthN requests to be signed')
Encryption Policy
None

Signing credentials

Under Credentials → Configure Credentials → Digital Signature Settings, pick your organization's standard signing certificate and check Include the Certificate in the Signature <KeyInfo> Element. Use RSA SHA256 as the algorithm — some older deployments default to SHA-1.

Leave these off

Require AuthN requests to be signed · Assertion encryption. Jaapi doesn't support signed AuthnRequests or encrypted assertions; if you enable either, sign-in will fail.

Optional user attributes

The SAML NameID (email) is the only required attribute. You can optionally send these to populate the user's profile on first login.

name

Display name. Source: the user's formatted name (PingOne) or Given Name + Family Name via an OGNL expression (PingFederate).

avatar

Profile picture URL. Source: a user attribute or extension that holds a publicly fetchable image URL. Skip if you don't have one.

Find your single sign-on URL

Only needed for a sign-in button on the store's sign-in page. Sign-in from your Ping portal works without it.

PingOne

  1. On the application's Overview tab, copy the Initiate Single Sign-On URL.

PingFederate

  1. Use the IdP SSO endpoint, typically https://<your-pf-host>/idp/SSO.saml2. The metadata XML lists it as the SingleSignOnService location.

Complete the integration

A store admin finishes the setup in the store settings. There is nothing to send us.

  1. Assign your test user to the application (PingOne: Access tab → assign groups · PingFederate: add the user to a group your IdP adapter authorizes).
  2. Download the signing certificate your connection uses (PingOne: the application's Configuration tab → Download Signing Certificate, X509 PEM · PingFederate: export it from Security → Signing & Decryption Keys & Certificates).
  3. In the store, open Settings → Sign-in & access and upload the file under SAML certificate.
  4. For a button on the store's sign-in page: save your IdP single sign-on URL under Sign-in button on the same page.
  5. Sign in to your Ping portal as the test user and click your application's tile. You land in the store, signed in.

When Ping rotates your signing certificate, upload the new one in the same place before the old one expires.