Introduction
This recipe guides you through the basic steps needed to integrate PingOne, your Identity Provider (IdP), with your Liferay environment using Security Assertion Markup Language (SAML).
Prerequisites
PingOne environment
Liferay DXP environment
A user who has administrative access to PingOne environment
A user who has administrative access to Liferay's Control Panel
Steps
Sign in to your PingOne environment.
On the left sidebar menu, go to Applications → Applications.
Click the Add button to create a new application.
Enter these values and click Configure:
Field Value Application Name Liferay DXP - SAML
Description (Optional) Icon (Optional) Application Type SAML Application Under SAML Configuration, enter your application metadata and click Save.
Field Value Provide Application Metadata Manually Enter ACS URLs https://[your_web_server]/c/portal/saml/acs
Entity ID samlsp
Go to Configuration and click the Edit icon.
Enter these values and click Save:
Field Value Signing Certificate Choose between
Sign Response
orSign Assertion & Response
according to your use case.See Defining signature policy (SAML) from PingOne to learn more about these choices.
Signing Algorithm RSA_SHA256
Encryption Unchecked SLO endpoint https://[your_web_server]/c/portal/saml/slo
SLO binding HTTP POST
Assertion validity duration (in seconds) 3000
Go to Attribute Mappings, add these attributes, and click Save:
Attributes PingOne Mappings saml_subject Email Address emailAddress Email Address firstName Given Name lastName Family Name screenName User ID Go to Configuration, and download the Metadata XML file.
You will use it in a later step to configure Liferay DXP.
Click the toggle switch in the top right corner to enable the application.
Now configure Liferay DXP: On your Liferay DXP instance, open the Global Menu and go to Control Panel → Security → SAML Admin.
Under the General tab, set these values and click Save:
Field Value SAML Role Service Provider Entity ID samlsp
Create a Certificate and Private Key. An Encryption Certificate is not needed.
Go to the Service Provider tab, ensure these settings are checked, and click Save:
-
Sign Authn Requests?
-
Sign Metadata?
-
SSL Required
-
Allow showing the login portlet.
-
Enable “Require Assertion Signature?” if you chose the
Sign Assertion & Response
configuration option in PingOne.
-
Go to the Identity Provider Connections tab.
Click Add Identity Provider and configure these settings:
Field Value Name PingOne
Entity ID Enter the entityID
found in the Metadata XML file you downloaded from PingOneEnabled Checked Upload Metadata XML Checked Metadata XML Upload the Metadata XML file Name Identifier Format Email Address Under Attribute Mapping, add these Basic User Fields:
User Field Expression SAML Attribute emailAddress emailAddress
firstName firstName
lastName lastName
screenName screenName
Click Save.
Go back to the General tab, check
Enabled
, and click Save.You can now use PingOne with SAML to authenticate in your Liferay instance.
To validate your configuration: Log out of your current user.
Click Sign In.
This redirects you to PingOne's login page.
Type in the user name and password for your user.
Once you've successfully logged in, your PingOne user should be registered in Liferay.
Sign back in as your Liferay admin user.
Open the Global Menu and go to Control Panel → Users and Organizations. Verify that your PingOne user displays on the list.
![](/documents/23484947/25482497/01.png/fc717149-7733-e764-78bb-dbb7a9cb822e?t=1722608380162)
![](/documents/23484947/25482497/02.png/ed050b55-2b49-80dc-c3d4-86b42b73f535?t=1722608380626)
![](/documents/23484947/25482497/03.png/3f3a57df-194b-256b-8b3d-dd498a17faa6?t=1722608381015)
![](/documents/23484947/25482497/04.png/1d491304-6c6f-7c04-49d5-cd113bc74fc5?t=1722608381387)
Do not enable SAML until you have finished configuring all settings.
![](/documents/23484947/25482497/05.png/bca591a5-22ba-d920-a219-2b13a9b3d7a4?t=1722608381775)
![](/documents/23484947/25482497/06.png/ed146e6f-37e0-0e8b-8d69-eadb35130c87?t=1723731241544)
![](/documents/23484947/25482497/07.png/2d8a19ab-91a9-7332-6c79-2478d9393429?t=1723730707864)
![](/documents/23484947/25482497/08.png/41020f14-269d-46e1-4f0a-f65a131723e3?t=1723730698110)
![](/documents/23484947/25482497/09.png/59a798df-970e-64c9-8bd6-1bc9bee57da5?t=1723730653397)
![](/documents/23484947/25482497/10.png/ce17e2bf-77a9-2cf9-717d-0528e166a22f?t=1723730641630)
Conclusion
Congratulations! Users may now authenticate to your environment using PingOne.
Tips
INVALID_ACS_URL
If you encounter ErrorCode: INVALID_ACS_URL
, verify that your ACS URLs are configured correctly in PingOne with the appropriate path and Hypertext Transfer Protocol (HTTP or HTTPS). You can find them in your PingOne account by navigating to the application you created → Configuration tab → Edit icon.