Which Ping product are you on?

"PingID" is Ping's MFA add-on, not a SAML identity provider. The actual IdP is one of the two products below. Pick the matching section before continuing — the admin console UI is different in each.

How users sign in

Once the integration is live, signing in from your Ping portal works right away. Sign-in started from the swag store itself is switched on per store — it uses the same Ping configuration, we just need your single sign-on URL (see the final step below).

PingOne setup

Use this section if your admin console is on console.pingone.com. You'll need a role with permission to create applications (typically Identity Data Admin or Application Admin).

Create the SAML application

1. In the PingOne admin console, open Applications → Applications and click the + icon.
2. Name the app "Jaapi Swag Store" and choose SAML Application. Click Configure.
3. For configuration method, choose Import From URL and paste our SP metadata URL:

   https://store.jaapi.store/api/auth/signin/sso/metadata

   This auto-fills the ACS URL, Entity ID, and NameID format. If your tenant blocks outbound HTTPS, choose Manually Enter and use the values from the Quick reference above.
4. Save the application.

Configure the SAML settings

On the application's Configuration tab, verify:

ACS URLs

https://store.jaapi.store/api/auth/signin/sso

Entity ID

https://store.jaapi.store

Subject NameID Format

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

Sign Options

Sign Assertion (or Sign Assertion & Response)

Signing Algorithm

RSA_SHA256

Encryption

Off

Enforce Signed Authn Request

Off (leave default)

Map the email attribute

On the Attribute Mappings tab, map saml_subject to the user's Email Address attribute. This is what we use as the user's identity.

PingFederate setup

Use this section if your admin console runs on port 9999. You'll need an admin role with permission to create SP Connections.

Create the SP Connection

1. In the PingFederate admin console, go to Applications → Integration → SP Connections and click Create Connection.
2. Connection Template: select Do not use a template.
3. Connection Type: check Browser SSO Profiles; protocol SAML 2.0.
4. Connection Options: check Browser SSO.
5. Import Metadata: select URL and paste our SP metadata URL:

   https://store.jaapi.store/api/auth/signin/sso/metadata

   This populates Entity ID, ACS URL, and signing requirements automatically. Use the File option if your PingFederate host can't reach the public internet.

Configure Browser SSO

Click Configure Browser SSO and set:

SAML Profiles

Enable IdP-Initiated SSO and SP-Initiated SSO

Assertion Lifetime

Defaults (5 minutes before/after)

Attribute Contract

SAML_SUBJECT sourced from the user's email attribute

Signature Policy

Always Sign Assertion (do NOT check 'Require AuthN requests to be signed')

Encryption Policy

None

Signing credentials

Under Credentials → Configure Credentials → Digital Signature Settings, pick your organization's standard signing certificate and check Include the Certificate in the Signature <KeyInfo> Element. Use RSA SHA256 as the algorithm — some older deployments default to SHA-1.

Optional user attributes

The SAML NameID (email) is the only required attribute. You can optionally send these to populate the user's profile on first login.

What we need from you

To finish the integration, we need the IdP metadata (which contains your signing certificate) and — for SP-initiated sign-in — your single sign-on URL.

PingOne

1. On the application's Overview tab, copy the IDP Metadata URL (or click Download Metadata).
2. From the same tab, copy the Initiate Single Sign-On URL — this is the IdP sign-on URL we need for the storefront-side flow.

PingFederate

1. On the SP Connection summary, click Export Metadata and save the XML.
2. Note the IdP SSO endpoint — typically https://<your-pf-host>/idp/SSO.saml2. It's also included in the metadata XML as the SingleSignOnService location.

Complete the integration

Once the SAML configuration is in place, run a test login and send us the artifacts so we can pin your IdP certificate.

1. Assign your test user to the application (PingOne: Access tab → assign groups · PingFederate: add the user to a group your IdP adapter authorizes).
2. Sign in to your Ping portal as the test user and click your application's tile. The first attempt will fail — this is expected.
3. Email support@jaapi.store with:

   • Store domain: store.jaapi.store
   • Which Ping product you're on (PingOne or PingFederate)
   • Your IdP metadata URL or downloaded XML
   • (For storefront sign-in) Your IdP single sign-on URL — required to enable the SSO button on the storefront

Later certificate renewals are self-service: when Ping rotates your signing certificate, a store admin can paste the new one under SAML SSO in the store settings — no need to email us again.

Related guides