Configure SAML with PingOne as identity provider

Note: Make sure your domain is verified successfully.

1. In the Verify Domain page of the setup wizard Nintex Automation Cloud, click Next.
2. In the Configure Identity Provider page, select Ping as the identity provider.

Additional fields appear for the following:

• Entity ID
• ACS URLS
• SAML Attribute Mappings

Note: You will later need to copy and insert these values in specific fields in PingOne.

3. Keep your Nintex Automation Cloud browser open and go to PingOne.

1. Add Nintex Automation Cloud as an application or service provider for SAML.
2. Copy the Entity ID and ACS URLS values, and the attribute statements from Nintex Automation Cloud, and then paste them in the corresponding fields in PingOne.



3. Map the three identity attributes: First name, Last name, and Email.

4. Retrieve the SAML metadata URL or file. Copy the metadata URL, and paste it in the URL field of Nintex Automation Cloud's setup wizard.

Follow these steps to complete the SAML configuration:

1. In the Connect page of the setup wizard in Nintex Automation Cloud, click Connect.

Note: The Connect button is enabled only when your domain is successfully verified and you have provided the metadata URL or file.

After connecting, your SAML configurations are checked. If successful, the setup wizard goes to the final page with the following information:

Information	Description
Expiry date of certificate	Date when your certificate expires.
Recipient email address of the reminder for certificate expiry	When your certificate is expiring soon, a reminder email will be sent to the recipient email address. Caution: You must renew the certificate before the expiry date.
One-Time Password (OTP) URL	The One-Time Password (OTP) URL is used for troubleshooting purposes when configuration fails and you are locked out of your tenant. Follow these steps to access your tenant when you cannot sign in due to a failed configuration of SAML: To copy the One-time password URL, click (Copy) next to the One-time password URL field. Open a new tab on your web browser, paste the copied URL and press ENTER. Enter your email address, and click Submit. For verification, a one-time password is sent to your email address. The one-time password expires after five minutes. Enter the one-time password you received, and click Sign in. You can access your Nintex Automation Cloud tenant and resume configuring your identity federation.

2. Click Done.

The Identity federation section now lists information about your SAML configuration such as provider, domain, person who completed the configuration, and the date of configuration.

1. Sign in to your Nintex Automation Cloud tenant.
2. Click Sign in or press ENTER.

You are taken to the login page of PingOne.

3. In PingOne's login page, type your credentials, and then submit.

If the SAML configuration is successful, you are granted access to the Nintex Automation Cloud tenant.

Identity federation setup wizard elements and description

Page	Section	User interface element	Description
Identity provider type		Warning message	A warning message appears, listing the tenants that are associated with your tenant. Enabling single sign-on in your tenant will also enable single sign-on in associated Nintex Automation Cloud tenants. For example, both sales-myorg.workflowcloud.com and hr-myorg.workflowcloud.com will be enabled with single sign-on if you configure SAML in either of them.
		Select single sign-on (SSO) type	Select the means to enable SSO in your Nintex Automation Cloud tenant. Azure Active Directory: Enable users to single sign-on using their Azure Active Directory accounts. If you select Azure Active Directory, you are immediately taken to the final page as you don't have to configure the connection. For more information, see Configure single sign-on with Azure Active Directory. SAML: Enable SSO using SAML protocol in your preferred identity provider. For more information, see Configure single sign-on using SAML protocol.
Verify Domain (This page displays only when you select SAML for Single sign-on (SSO) type)		DNS record	The code to use as a value in your DNS record. For the domain verification steps, see Verify a domain for SAML configuration. Caution: As part of the prerequisites to federation configuration, you must first verify ownership over a domain that you're going to use for SAML configuration. If you have not verified your domain, or if your DNS is still processing the verification, you can continue configuring SAML in Nintex Automation Cloud, but you cannot submit your SAML configuration.
		(Copy)	Click to copy the code.
Configure Identity Provider (This page displays only when you select SAML for Single sign-on (SSO) type)	Choose Identity Provider	Identity provider	Displays the list of identity providers you can use for your tenant's identity federation.
	Service Provider data		(Appears after you select an identity provider) In the context of our SAML configuration, the service provider is Nintex Automation Cloud. Depending on the identity provider you choose, the SAML terminologies displayed in this section correspond with what your identity provider uses. SAML terminologies used in identity providers   Generic term Terminologies used in identity providers Okta PingOne OneLogin Google Suite Active Directory Federation Services Azure Active Directory   Entity ID A globally unique identifier of an entity, which in our case is the Nintex Automation Cloud tenant to be configured with SAML. Audience URI (SP Entity ID) Entity ID Audience Entity ID Relying party trust identifier Identifier (Entity ID) ACS URL or Assertion Consumer Service URL Single sign on URL ACS URLS ACS (Consumer) URL ACS URL Relying party SAML 2.0 SSO service URL Reply URL (Assertion Consumer Service URL) Metadata An XML document that contains information about a SAML deployment. URL A link is provided to retrieve the URL. IDP Metadata URL A downloadable metadata file is also available. Issuer URL A downloadable metadata file is provided. Federation Service identifier App Federation Metadata Url
		Attributes	Set of identity data about a user. In configuring SAML in Nintex Automation Cloud, only three attributes are requested from the identity provider: First name Last name Email
		(Copy)	Click to copy the values in the fields.
Connect (This page displays only when you select SAML for Single sign-on (SSO) type)		URL	Location of the SAML metadata An XML document that contains information about a SAML deployment..
		Upload metadata	The SAML metadata file.
Complete		<Date>	(Only displayed for SAML) Expiry date of the certificate.
		<Email address>	(Only displayed for SAML) Email address to receive reminder when certificate is soon to expire.
	One-Time Password (OTP) URL	<URL>	The One-Time Password (OTP) URL is used for troubleshooting purposes when configuration fails and you are locked out of your tenant. Follow these steps to access your tenant when you cannot sign in due to a failed configuration of SAML: To copy the One-time password URL, click (Copy) next to the One-time password URL field. Open a new tab on your web browser, paste the copied URL and press ENTER. Enter your email address, and click Submit. For verification, a one-time password is sent to your email address. The one-time password expires after five minutes. Enter the one-time password you received, and click Sign in. You can access your Nintex Automation Cloud tenant and resume configuring your identity federation.