Ping Identity

Use these steps to configure the SSO authentication with Ping Identity.

Prerequisite

  • Permissions to your company's DNS server if you select login-based domain verification as the integration type.

To configure Ping Identity as your Identity Provider:

  1. From the left toolbar, click Getting started.

  2. In the Connect a directory section, click Connect (or Add another Directory).

    The IdP Integration wizard opens.

  3. Enter a name for the Integration Title and select Ping Identity.

  4. Click Next.

In this step of the IdP Integration Wizard, you can configure SSO authentication for Check Point Portal administrators and for users of Check Point Portal services (for example: Harmony Connect). This configuration does not affect Identity and Trust user authentication.

  1. Select Enable Administrators to log in to the portal using this IdP.

  2. Select one of these options:

    • Login based on domain verification - Check Point Portal Administrators can log in to this Check Point Portal account with SSO from the Identity Provider. Administrators log in through the Check Point Portal login page.

    • Login with a unique URL - Check Point Portal Administrators can log in to multiple Check Point Portal accounts with SSO from the Identity Provider. Administrators log in using the URL that appears at the bottom of the Login with a unique URL section. Copy this URL and keep it in a safe place.

  1. In the Service(s) Integration section, select one of these options:

    • No Services - End users of Check Point Portal services cannot authenticate with SSO from the Identity Provider. This is the default configuration.

    • All Services - End users can log in with SSO from the Identity Provider to all Check Point services that support SSO.

    • Specific Service(s) - From the list of services, select service(s) to allow end users to log in with SSO from the Identity Provider. Available services:

      • Connect

      • Quantum Gateways

  2. Click Next (or, if you are editing a configuration, Apply) to complete the Integration Type configuration.

Note - If you selected Login with a unique URL for Integration Type, the Verify Domain step is not necessary.

  1. Connect to your DNS server.

  2. Copy the DNS Value from the Check Point Portal IdP Integration wizard > Verify Domain step.

  3. On your DNS server, enter the Value as a TXT record.

  4. In the Check Point Portal > Domain(s) section, enter a public DNS domain server name and click the plus icon.

    Check Point makes a DNS query to verify your domain's configuration.

  5. Optional - add more DNS domain servers.

  6. Click Next.

    Note - Wait until the DNS record propagates and becomes resolvable.

In this step, you create a SAML application in the Ping Identity Portal.

Before you start, in the Check Point Portal, copy and save the Entity ID and the Reply URL.

First, create a new environment in the Ping Identity Portal.

  1. Log in to your Ping Identity Portal.

  2. Go to the Home page and click Add Environment.

  3. Select Customer solution and click Next.

  4. Make sure PingOne for Customers is available. Click Next.

  5. Enter all relevant information in the form.

  6. Click Finish. Ping Identity redirects you to the Home page.

In the new environment, create a web application.

  1. Navigate to Connections > Applications and click Add Application.

  2. Click WEB APP, then select SAML and click Configure.

  3. A new Create App Profile page opens.

  4. Enter the application details. For example, set the application name to Check Point Portal.

  5. Click Next. The Configure SAML Connection page opens.

  6. Under Provide Meta Data, select Manually Enter.

  7. Configure SAML Connection:

    • ACS URLs - Use the Reply URL.

    • Signing - Set to Sign Response.

    • Entity ID - Use the Entity ID that you copied from the SSO wizard.

    • Assertion Validity Duration - Set to 3600.

  8. Click Save and Continue.

  9. In the Map Attributes page, configure SAML attributes. The User ID attribute = saml_subject appears by default. Change User ID to Email Address.

  10. Click Add Attribute and select PingOneAttribute to add a new attribute:

    1. For User Attribute, select Group Names.

    2. For Application Attribute, enter memberOf.

    3. Select the Required option.

  11. Click Add Attribute and select PingOneAttribute to add a new attribute:

    1. For User Attribute, select Given Name.

    2. For Application Attribute, enter firstName.

    3. Select the Required option.

  12. Click Add Attribute and select PingOneAttribute to add a new attribute:

    1. For User Attribute, select Family Name.

    2. For Application Attribute, enter lastName.

    3. Select the Required option.

  13. Click Add Attribute and select PingOneAttribute to add a new attribute:

    1. For User Attribute, select Email Address.

    2. For Application Attribute, enter email.

    3. Select the Required option.

  14. Click Add Attribute and select PingOneAttribute to add a new attribute:

    1. For User Attribute, select User Id.

    2. For Application Attribute, enter userid.

    3. Select the Required option.

  15. Click Save and Close.

  16. Ping Identity redirects you to the Applications page. In your newly created application, go to the Configuration tab and click Download under Connection Details > Download Metadata.

  17. Download the SAML Metadata file to your computer.

IdP Initiated lets you connect directly to the Check Point Portal from your Ping Identity admin console. To do this, you must create a Check Point Portal app card in your Ping Identity admin console. See the Ping Identity documentation for the Application portal.

Step 1: In Check Point Portal, enable IdP Initiated flow:

In the Check Point Portal > IdP Integration Allow Connectivity step, select the checkbox Enable IDP initiated flow.

The Relay State field appears.

Step 2: In your Ping Identity account, configure the IdP Settings:

  1. Navigate to your Ping Identity admin console.

  2. From the left toolbar, click Connections > Applications.

  3. Open the application object for the SAML connection to Check Point Portal.

  4. From the top navigation toolbar, click Overview.

  5. Click the Protocol SAML button.

    The Edit Configuration menu opens for the application object.

  6. In the Edit Configuration menu > Target Application URL field, enter the Relay State from Check Point Portal.

  7. Click Save.

Important - Before you can test the connectivity between Ping Identity and Check Point Portal, you must complete all the IdP integration steps in Check Point Portal.

In this step, you upload the federation metadata XML file.

  1. On the Check Point Portal, open the Identity Provider Wizard on the Configure Metadata page and upload the Federation Metadata XML that you downloaded from the Ping Identity Portal.

    Note - Check Point uses the service URL and the name of your Certificate to identify your users behind the site.

  2. Click Next. Check Point verifies the metadata of your Identity Provider.

Directory Integration gets information about users and groups for the services you selected in the Integration Type step > Service(s) Integration section.

Directory Integration does not apply to Users and User Groups in the Check Point Portal.

Important - After you create a Directory Integration, you cannot change it. To create a different Directory Integration, you must create a new Identity Provider (IdP) Integration.

To integrate Ping Identity with Identity and Trust, you must configure Directory Integration using Manual Sync.

You can manage user identity data with Manual API Sync or with System for Cross-Domain Identity Management (SCIM).

Directory Integration Method

How it Works

Which Users and Groups are Synced

Manual Sync

Allows Check Point services to query for any change in Ping Identity users and groups. The Check Point Portal pulls users and groups from Ping Identity.

All users and groups in Ping Identity.

Nested groups in Ping Identity are supported.

SCIM (Automatic Sync)

Allows Ping Identity to push any change in the user and group directory to Check Point services.

Only users and groups in Ping Identity that are assigned to the SCIM connection you created from Ping Identity to the Check Point Portal.

Some Check Point services may need a permanent user ID (SID) from your directory. This ID lets the service reliably identify each employee and keep their access and permissions accurate, even when their profile changes.

Step 1 - Set up Users and Groups Synchronization:

To start, create a Worker application and then you can set up permissions for users and groups.

Step 2 - Create a Worker application in the Ping Identity Portal:

  1. In the Ping Identity Portal, from the left menu, expand Applications > click Add Application.

    The Applications page opens.

  2. At the top of the page, click the + icon to the right of the word Applications.

    The Add Application window opens.

  3. In the Application Name field, enter a name for the application.

  4. In the Application Type section, select Worker.

  5. Click Save.

    Ping Identity creates an application object.

Step 3 - Set up Users and Groups Permissions:

Set up permissions to allow the selection of users and user groups from your Ping Identity for the Check Point Portal SSO.

  1. In the application object, open the Configuration tab.

  2. In the upper right, click the edit button (pencil icon).

  3. In the Grant Type section, select Client Credentials.

  4. In the Token Endpoint Authentication Method field, select Client Secret Post.

  5. Click Save.

  6. Open the Roles tab.

  7. Click Identity Data Read Only > Select All.

  8. Click Save.

  9. On the Applications page:

    1. Move the slider for the Web App SAML application you created for the Check Point Portal to the ON position.

    2. Move the slider for the Worker application you created for the Check Point Portal to the ON position.

Step 4 - Add the onPremSID custom object attribute:

Configure a custom attribute to use it as a security user ID (SID).

  1. Navigate to Directory > User Attributes and click the plus icon to add the attribute.

  2. Select Declared and click Next.

  3. Enter these details for one attribute and click Save:

    • Name - onPremSid

    • Display Name - On Premises Security Identifier

    • Description - On Premises Security Identifier

  4. Repeat the step for another attribute and click Save:

    • Name - onPremSAMAccountName

    • Display Name - On Premises SAM Account Name

    • Description - On Premises SAM Account Name

  5. Navigate to Integrations > Provisions and select your AD integration.

  6. Select Attribute Mapping and click the pen icon to edit.

  7. Map the parameters as follows:

    • SAMAccountName: On Premises SAM account name

    • objectSid: On Premises Security Identifier

  8. To test the mapping, go to Directory > Users and select an AD user. The SID data appears under Custom Attributes.

Step 5 - Copy the relevant values to the Check Point Portal Wizard:

  • Environment ID - In Ping Identity Portal, from the left toolbar, click Settings > Environment Properties and copy the value of Environment ID.

  • Region - In Ping Identity Portal, from the left toolbar, click, Settings > Environment Properties and view the region. In the Wizard, enter EU for Europe, COM for the United States, and ASIA for the Asian Pacific.

  • Client ID and Shared Secret - In Ping Identity Portal, from the left toolbar, click Applications and open your Worker application. Open the Overview tab and copy these values: Client ID and Client Secret.

    Best Practice - Check Point recommends that you save the Client Secret value in a separate, secure file to retrieve it when required.

Step 6 - Verify that all fields in Directory Integration are correct:

  1. To test the users and group synchronization between the Check Point Portal and the Identity Provider, click Test Connectivity.

  2. If the test is unsuccessful, repeat the Set Directory Integration step to configure the user and group synchronization parameters.

  3. Click Next.

Prerequisites:

  • In the Check Point Portal, create a user group with an Admin global role. See Users.

  • You must have Administrator permissions for the Ping Identity account.

Step 1 - In the Check Point Portal, copy values and finish the IdP Integration Wizard:

  1. In the Integration Wizard, open the Directory Integration step and select Automatic Sync (SCIM).

  2. Copy these values and keep them in a safe place:

    • SCIM API Token

    • URL

  3. Click Next.

    The Confirm Identity Provider step opens.

  4. Click Submit.

    Ping Identity is now integrated with the Check Point Portal. The Ping Identity integration appears in the gallery in the Check Point Portal. Finish configuring SCIM (Automatic Sync) in the Ping Identity Portal.

Step 2 - In the Ping Identity Portal, create a new Connection:

  1. In the Ping Identity Portal, from the left menu, expand Integrations and click Provisioning.

  2. Next to Provisioning, click the + button.

    The Create a New Connection wizard opens.

  3. To the right of Identity Store, click Select.

  4. Search for scim.

  5. Select SCIM Outbound.

  6. Wizard Step 1:

    1. Enter a name for the integration, for example, Check Point Portal SCIM.

    2. Click Next.

  7. Wizard Step 2:

    1. In the Configure Authentication section > SCIM BASE URL field, paste the URL you copied from the Check Point Portal.

    2. For Authentication Method, select OAuth2 Bearer Token.

    3. In the Oauth Access Token field, paste the SCIM API Token you copied from the Check Point Portal.

    4. Click Test Connection.

      If the test is successful, a confirmation message appears. If the test fails, make sure that you copied and pasted the values correctly from the Check Point Portal to the Ping Identity Portal.

    5. In the Ping Identity Portal, click Next.

  8. Wizard Step 3:

    1. In the Configure Parameters section, select Deprovision on Rule Deletion.

      Important - Do not change the default values of other parameters.

    2. Click Save.

      The wizard closes. The new connection you created for the Check Point Portal appears in the Provisioning menu > Connections tab. By default, this connection is not active.

    3. In the top right, move the slider to the ON position to activate the connection.

Step 3 - In the Ping Identity Portal, create a rule for the connection:

  1. In the Provisioning menu, open the Rules tab.

  2. Click the + button > New Rule.

    The Create a New Rule window opens.

  3. Enter a name for the rule.

  4. Click Create Rule.

  5. In the Available Connections section, to the right of the name of the connection you created for the Check Point Portal, click the + button.

  6. Click Save.

Step 4 - In the Ping Identity Portal, add users to the rule:

  1. Click the User Filter icon.

  2. Next to User Filter, click the edit (pencil) button.

  3. Create user filters. For more information, see Ping Identity documentation.

  4. Click Save.

Step 5 - In the Ping Identity Portal, add attributes to the rule:

  1. Click the Attribute Mapping icon.

  2. Next to Attribute Mapping, click the edit (pencil) button.

  3. Add these attributes:

    PingOne Directory

    myScim

    Enabled

    active

    Given Name

    displayName

    User ID

    externalID

    Username

    userName

    Primary Phone

    workPhone

  4. Click Save.

Step 6: In the Ping Identity Portal, add groups to the rule:

  1. Click the Global Provisioning icon.

  2. Click Add Groups.

  3. Select groups to add to the rule.

    Note - If groups are in a hierarchy, you must select the parent and the child group individually.

  4. Click Save.

Step 7: In the Ping Identity Portal, apply the rule to the connection:

  1. In the Configuration tab, make sure all the values are correct.

  2. In the top right, move the slider to ON to apply the rules.

Review the SSO configuration details, then click Submit.

Important - Create a user group with the applicable roles and assign it to the related IdP group name or ID. This depends on the applicable identity provider before you log out. For more information, see User Groups.