IDE Services On-Prem SAML with PingOne

To integrate PingOne SAML with IDE Services, proceed with the next steps:

1. Create an application in PingOne Console, choose SAML Application as the Application type:
2. Next, choose Manual Enter and set ACS URLs and Entity ID (same as sp-id here):
3. Once the application is created:

• Copy the Issuer ID value and set it as idp-id in application.yaml
• Copy Single Signon Service value and set it as sso-utl in application.yaml
• Define next attributes so IDE Services will correctly map them with the internal database (by default, PingOne map saml_subject to the User ID which is wrong):

Here is the working version of application.yamlthe auth section:

  auth:
    internal-tokens:
      token-life: 30m
      refresh-token-life: 30d
      private-key: # https://www.jetbrains.com/help/ide-services/saml.html#-47k2sx_83
      public-key: # https://www.jetbrains.com/help/ide-services/saml.html#-47k2sx_84
    root-admin-emails:
      - "johndoe@example.com"
    saml:
      enabled: true
      sp-id: '${tbe.deployment.url}/api/saml/metadata'
      sp-assertion-consumer-service-url: '${tbe.deployment.url}/api/saml/authenticated'
      sp-x509cert: # https://www.jetbrains.com/help/ide-services/saml.html#-47k2sx_70
      sp-private-key: # https://www.jetbrains.com/help/ide-services/saml.html#-47k2sx_71
      sso-url: 'https://auth.pingone.eu/f4644c1e-6e5f-42f7-a559-6918a5e175cf/saml20/idp/sso'
      idp-id: 'https://auth.pingone.eu/f4644c1e-6e5f-42f7-a559-6918a5e175cf'
      idp-x509cert: <https://www.jetbrains.com/help/ide-services/saml.html#-47k2sx_74>
      cert-algorithm: sha256
      idp-http-method: 'POST' #optional