> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/platform-administration/user-management/single-sign-on-sso-for-authentication-to-snyk/configure-self-serve-single-sign-on-sso/ping-identity-setup.md). # Ping Identity setup How to set up a Ping Identity application and connect it to Snyk for SSO {% hint style="info" %} **Snyk is rolling out a new navigation.** The steps on this page describe the classic interface. If your view looks different, visit [Navigate the Snyk Web UI](https://docs.snyk.io/navigate-the-snyk-web-ui#where-things-moved) to map these options to the new interface. {% endhint %} ## Ping Identity setup This page explains how to set up a Ping Identity Application and connect it to Snyk to facilitate SSO. You need the Group Admin role on a Snyk Enterprise plan, self-serve SSO turned on for your Group, and permissions in Ping Identity to create an application. To turn on self-serve SSO, contact your Snyk account team or [Snyk Support](https://support.snyk.io). Self-serve SSO does not support [custom role mapping](/platform-administration/user-management/single-sign-on-sso-for-authentication-to-snyk/custom-mapping.md). Before configuring your Ping Identity Application to use SSO with Snyk, obtain an entity ID and a reply URL (Assertion Consumer Service URL) from Snyk. Then follow these steps: 1. In the left menu, select your **Group**, then **Settings**.

Entity ID and ACS URL under the Group SSO settings

2. Select **SSO** and copy the values under **Entity ID** and **ACS URL** or leave the browser tab open for easy access.

3. Navigate to Ping Identity and select **Applications** in the **Connections** menu. Click on the plus sign to create a new application.

4. Name your application appropriately, select **SAML Application**, and click **Configure.**

5. Enter the details you copied from Snyk, the **ACS URL** and **Entity ID,** and select **Save**.

6. Select **Configuration** and download the signing certificate in PEM format.

7. Scroll further down and copy the **Single Signon Service** details.

8. Return to the the Snyk portal and paste the single sign-in URL copied at step 2 into the **Sign in URL** field. \\

9. Open the downloaded certificate in your preferred text editor, copy the text and paste it into the Snyk **X509 signing certificate** field, and add the relevant domains that are supported by this SSO connection.\ Finally, verify if an IdP-initiated workflow should be enabled and then click **Create Auth0 connection** if you are creating a completely new connection or **Save changes** if you are editing an existing connection.

10. In Ping Identity, select **Attribute mappings** and click the pencil to edit.

11. Click the cog icon and add the following attributes: **email**: Email Address\ **username**: Username\ **name**: the expression `user.name.given + ' ' + user.name.famil`y; click the cog icon to enter an advanced description.

Add an advanced expression for the name attribute

12. In the Snyk portal, decide how new users should be treated when signing in and choose the option you would like to use: **Group member**, **Org collaborator**, or **Org admin**. 13. Change the profile attributes to the attribute names you entered in Ping Identity then click **Save changes.**\\

14. Enable the application and assign it to users.

Enable and assign the application to users

15. Verify you can log in, either with the direct URL at the top of **Step 3 Snyk SSO settings** (not shown in the image) or by going to the [generic SSO login](https://app.snyk.io/login/sso). The connection works when a user assigned to the application logs in through the direct URL at the top of **Step 3** on the Snyk SSO settings page, or through the [generic SSO login](https://app.snyk.io/login/sso), the name and email address Snyk records for that user match the values Ping Identity sends, and the user has the role you chose for new users. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.snyk.io/platform-administration/user-management/single-sign-on-sso-for-authentication-to-snyk/configure-self-serve-single-sign-on-sso/ping-identity-setup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.