Group Email Manager

login signup

Configuring Ping Identity for Simplelists SAML2 Authentication

Authenticate to Simplelists using Ping Identity

Introduction

Implementing SAML Authentication for simplelists.com is described below.

Ping Identity Configuration

Login to your Ping Identity Environment

  1. Login to your Ping Identity Console and select your environment

Shows the Ping Identity Dashboard

Create SAML2 Application

    ###

    img src="saml/ping/03-saml-ping-select-applications.png" alt="Shows the Applications menu selected" title="03-saml-ping-select-applications" class="blog-border"

  1. Click Connections
  2. Click Applications
  3. Click the Shows the plus sign icon next to Applications 

    ###

    img src="saml/ping/04-saml-ping-add-application.png" alt="Shows the Add Application page" title="04-saml-ping-add-application" class="blog-border"

  1. Enter an Application Name
  2. Optionally enter a Description
  3. Click SAML Application
  4. Click Configure

SAML Configuration (from Metadata)

    ###

    img src="saml/ping/05-saml-ping-add-application-metadata.png" alt="Show Metadata Import Page" title="05-saml-ping-add-application-metadata" class="blog-border"

  1. Select Import Metadata
  2. Click Select a file
  3. Locate the saml.xml that you downloaded from the Simplelists Authentication Provider above and click to select the file

    ###

    img src="saml/ping/06-saml-ping-add-application-save-metadata.png" alt="Show Save Metadata Page" title="06-saml-ping-add-application-save-metadata" class="blog-border"

  4. After the Metadata has been loaded Click Save

Download Metadata and Signing Certificate

    ###

    img src="saml/ping/07-saml-ping-saml-configuration.png" alt="Shows SAML configuration page" title="07-saml-ping-saml-configuration" class="blog-border"

  1. Click Configuration

    ###

    img src="saml/ping/08-saml-ping-download-metadata.png" alt="Shows the Download Metadata page" title="08-saml-ping-download-metadata" class="blog-border"

  2. Click Download Metadata (save for upload to Simplelists)

    ###

    img src="saml/ping/08-saml-ping-download-certificate.png" alt="Shows the Download certificate page" title="08-saml-ping-download-certificate" class="blog-border"

  3. Click Download Signing Certificate
  4. Select X509 PEM (.crt) (save for upload to Simplelists)
  5. Click Save

Attribute Mappings

    ###

    img src="saml/ping/09-saml-ping-attributes-configuration.png" alt="Shows the Attribute Configuration page" title="09-saml-ping-attributes-configuration" class="blog-border"

  1. Click Attribute Mappings
  2. Click the blue and white edit icon

    Shows Edit Icon

Edit Attribute Mappings

    ###

    img src="saml/ping/11-saml-ping-attributes-configuration-02.png" alt="Shows the Attributes completion" title="10-saml-ping-attributes-configuration-02" class="blog-border"

  1. Click Add
  2. Add the following mappings
    Attributes PingOne Mappings
    saml_subject Email Address
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname Given Name
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname Family Name
  3. Click Save

Enable SAML Application

    ###

    img src="saml/ping/12-saml-ping-enable-application.png" alt="Shows Enable the Application toggle" title="12-saml-ping-enable-application" class="blog-border"

  1. Toggle the Enable/Disable “toggle”

Shows the Application is Enabled

Testing Login

At this point you should have successfully configured basic SAML2 authentication.

  1. Open the Simplelists web page (https://www.simplelists.com)

    ###

    img src="saml/ping/14-saml-simplelists-main-page.png" alt="Shows the Simplelists Main page" title="14-saml-simplelists-main-page" class="blog-border"

  2. Click Login
  3. Enter your email address on the simplelists web page

    ###

    img src="saml/ping/15-saml-simplelists-login.png" alt="Shows the login page for Simplelists" title="15-saml-simplelists-login" class="blog-border"

  4. Enter your Ping enabled email address and click submit.

If everything is correctly configured you will be presented with the Ping login page.

Shows the Ping Login Screen
  1. Enter the email address that you have enabled for Ping in simplelists
  2. Enter your password
  3. Click Sign On

You should be logged into the simplelists web page as your user.

Optional Settings

The following settings provide extra features that are not necessary if you are simply authenticating from the Simplelist’s web page.

Automatic User Creation

Simplelists supports the auto user creation both via the Simplelists website and via an IdP Initiated login (if configured).  For auto user creation from the Simplelists web page you need to ensure that your domain name is configured in the Authentication Provider.

For information on Configuring Automatic User Creation in Simplelists see the help page.

Note: Groups must be configured and properly provided by Ping as in Group Support (below) in order for the user to be automatically created.

Group Support

Simplelist’s can use groups provided by the Ping provider to create users and manage the permissions.  The following section assumes that you have existing groups in Ping for use with Simplelists.  If not, create groups for the type of permissions that you would like to have.  For instance groups may be:

  1. SimpleLists-Administrator
  2. SimpleLists-ListManager
  3. SimpleLists-Billing Manager

Create Groups in Ping

  1. Click Identities
  2. Click Groups
  3. Click the Shows the plus sign icon next to Groups

Show Ping Console with Groups Selected

    ###

    img src="saml/ping/18-saml-ping-specify-group-name.png" alt="Shows page to define the group name" title="18-saml-ping-specify-group-name" class="blog-border"

  1. Enter the Group Name and click Save

Add users to the group

    ###

    img src="saml/ping/19-saml-ping-add-users-to-group.png" alt="Shows page to add users to the group" title="19-saml-ping-add-users-to-group" class="blog-border"

  1. Click Users

    ###

    img src="saml/ping/20-saml-ping-add-users-individually.png" alt="Shows adding users to the group Individually" title="20-saml-ping-add-users-individually" class="blog-border"

  2. Click Add Individually
  3. Search for a User

    ###

    img src="saml/ping/21-saml-oing-select-user.png" alt="Shows selecting the user and searching" title="21-saml-oing-select-user" class="blog-border"

  4. Select the User
  5. Click Save

Shows the selected user in the group

Ping Application Group Configuration

Add a Group Memberships to the Application

  1. Access the SAML application you previously configured

    ###

    img src="saml/ping/23-saml-ping-application-access.png" alt="Shows the Application Configuration - Select Attribute Mappings" title="23-saml-ping-application-access" class="blog-border"

  2. Edit the Attribute Mappings
  3. Click the edit icon Shows the edit icon

Edit Attribute Mappings

  1. Click Add
  2. Add the following mapping to the existing

Attributes PingOne Mappings
http://schemas.microsoft.com/ws/2008/06/identity/claims/groups Group Names

Shows added Group Attribute

IdP Initiated Login

Simplelists has support for IdP initiated login.  That is, login that is initiated by selecting the Simplelists application on the user’s Ping Application Portal.  Selecting the application on the portal page redirects to the Simplelist web page where the user is automatically logged into the application.

  1. Open the Ping SAML application that you created
  2. Click Connections
  3. Click Applications
  4. Click on the Simplelists application
  5. Edit the Configuration
  6. Click Configuration
  7. Click the blue and white edit icon Shows the Edit Icon

    ###

    img src="saml/ping/25-saml-ping-target-url.png" alt="Shows the SAML Authentication for Relay State" title="25-saml-ping-target-url" class="blog-border"

  8. Enter the RelayState value from the Simplelists Authentication provider in the Target Application URL field (example: v0aWiPupDsvdBitylxpcGxtfE0FKYc2z)
  9. Click Save

Require Signed AuthnRequests

Note: Requiring Signed AuthnRequests may break the ability to initiate login to Simplelists from the Ping Application Portal if you have configured that functionality.

  1. Open the Ping SAML application that you created
  2. Click Connections
  3. Click Applications
  4. Click on the Simplelists application
  5. Edit the Configuration
  6. Click Configuration
  7. Click the blue and white edit icon Shows the edit icon

    ###

    img src="saml/ping/26-saml-ping-enforce-signed-authnrequests.png" alt="Shows Configuration to Enforce Signed AuthnRequests" title="26-saml-ping-enforce-signed-authnrequests" class="blog-border"

  8. Select Enforce Signed AuthnRequest
  9. Click Save

Enable Encrypted Assertions

Encrypted assertions are supported by Simplelists and allow you to increase the security of your authentication.

Edit the SAML Application

  1. Click Configuration

    ###

    img src="saml/ping/27-saml-ping-edit-application.png" alt="Show Edit Application page" title="27-saml-ping-edit-application" class="blog-border"

  2. Click the blue and white edit icon Shows the edit icon

Set Required Encryption Settings

  1. Click Sign Assertion & Response
  2. Click Enable Encryption

    ###

    img src="saml/ping/28-saml-ping-configure-encryption-settings.png" alt="Show Encryption Settings" title="28-saml-ping-configure-encryption-settings" class="blog-border"

  3. Choose AES_256 from the Algorithm drop down
  4. Select Import
  5. Click Choose File
  6. Select the Simplelists Signing Certificate simplelists.cer that you downloaded above
  7. Click Save

Test login with encrypted assertions

Simply login to the Simplelists website and verify that you are able to log in.  You can verify that the Assertion is encrypted by viewing it using a SAML Message decoder plugin for your browser; see the Troubleshooting section.