SSO Setup

Ping Identity SSO Setup

You need: the PingOne Identity Data Admin role (or PingFederate administrator access), and the Owner or Admin role in a Routebase organization on the Enterprise plan.

Time: about 25 minutes for SSO, plus 10 for SCIM provisioning.

Read SSO Setup Overview first for the prerequisites that apply to every provider — in particular, verify your email domain under Settings → Domains before you begin.

This guide follows PingOne (cloud). PingFederate uses different screens but the same field names, and the Routebase side is identical.

Routebase has no Ping-specific vendor preset, so you pick Generic SAML in the wizard and enter the four claim names yourself. Everything else works exactly as with the presets.

1. Create the SAML application in PingOne

Routebase needs Ping's metadata before it can create a connection, so PingOne comes first. The ACS URL and Entity ID you enter here are placeholders — you replace them in step 3.

  1. In the PingOne admin console, go to Connections → Applications → + Application.

  2. Choose Web App → SAML → Configure.

  3. Application name: Routebase. Save and continue.

  4. On the Configuration step, choose Manually Enter:

    • ACS URLs: https://example.com/placeholder (replaced in step 3)
    • Entity ID: urn:placeholder (replaced in step 3)
    • Sign-on URL: leave blank
    • SLO endpoint: leave blank
    • Subject NameID Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

  5. Attribute Mappings — the outgoing claim names are case-sensitive and must match what you configure in Routebase in step 2:

    PingOne attribute Outgoing claim name
    Email Address email
    Given Name firstName
    Family Name lastName

  6. Optionally add a groups claim sourced from Group Names if you plan to map groups to Routebase roles. Filter to a prefix such as routebase- so you are not leaking your whole group structure into an assertion.

  7. Save the application.

  8. On the application detail page, copy the Metadata URL. A metadata URL is preferable to a download: Routebase re-reads it, so certificate rotations in Ping do not break your sign-ins. If your PingFederate instance exposes no public metadata URL, download the metadata XML instead — you paste it into the IdP metadata XML field in step 2, and you then have to re-paste it yourself after every certificate rotation.

  9. On the Access tab, assign the population or groups that should reach Routebase.

2. Create the connection in Routebase

  1. Go to Settings → Single Sign-On and click Create connection.
  2. Protocol: SAML 2.0.
  3. Vendor: Generic SAML.
  4. Metadata:
    • Connection name: something that identifies the environment, e.g. Acme PingOne Production. Only admins ever see it.
    • IdP metadata URL: paste the PingOne metadata URL from step 1 — or paste the XML into IdP metadata XML if you had to download it.
  5. Mapping: because Generic SAML has no preset, type the four claim names exactly as you set them in PingOne — email, firstName, lastName, and groups if you added it. Email is required; the rest are optional.
  6. Click Next. Routebase creates the connection in Draft status and the Test step appears.

3. Paste the Routebase values back into PingOne

The Test step shows three values with copy buttons. Two of them go back into PingOne:

Routebase field PingOne field
ACS URL Configuration → ACS URLs
Entity ID Configuration → Entity ID

Open the application → Configuration → Edit, replace the two placeholders from step 1, and save.

The third value, Connection ID, is only useful when contacting support.

4. Test and activate

  1. Back in the Routebase wizard, click Open test login. A sign-in opens in a new tab.
  2. Sign in as a Ping user in the application's assigned population.
  3. When the round-trip succeeds, click Activate.

If the test fails, work through SSO Troubleshooting — it is organised by what the user actually sees.

5. Optional: require SSO for your domain

Go to Settings → Domains, find your verified domain, and turn on SSO required. Everyone whose email address is on that domain must then sign in through Ping.

Existing password users are not locked out immediately: they get a 14-day grace period with an in-app banner and a Link account button. See Single Sign-On (SSO) for what the banner says and when it appears.

6. Optional: SCIM provisioning

PingOne's outbound SCIM 2.0 with bearer authentication matches Routebase directly.

  1. In Routebase, go to Settings → Single Sign-On → SCIM Provisioning Tokens → New token. Name it PingOne Production and copy the token immediately — it is shown once.
  2. In PingOne, open the Routebase application → Provisioning → Add Provisioning and choose SCIM Outbound.
  3. Fill in:
    • SCIM URL: https://api.routebase.dev/scim/v2/<your-org-slug> — your organization slug is the one that appears in your Routebase URLs.
    • Authentication Method: OAuth 2 Bearer Token
    • OAuth Access Token: the token from step 1.
  4. Click Test. PingOne should report success.
  5. Map the user attributes — at minimum:
    • userName ← Email
    • emails[0].value ← Email
    • name.givenName ← Given Name
    • name.familyName ← Family Name
  6. Enable the Create, Update and Delete operations, and set the provisioning schedule. The default of five minutes is fine.

Users who leave the assigned population are deactivated in Routebase and their sessions are revoked.

To rotate a token without downtime, create the new one first, put it into PingOne, confirm a sync, and only then revoke the old one — both are valid until you revoke.

7. Optional: map Ping groups to Routebase roles

If you push group display names through the groups claim or through SCIM groups, open Settings → Single Sign-On → Group Role Mappings.

  • The external group name must match the name Ping sends. Matching is case-insensitive.
  • Priority decides the winner when a user is in several mapped groups — higher wins. Give every mapping a distinct priority; ties are resolved arbitrarily.
  • Users matching no mapping fall back to the connection's default role.
  • Role changes take effect on the next sign-in, and re-evaluation is throttled to roughly five minutes per user. After changing groups, have the user sign out fully and back in.

Other providers: Okta · Microsoft Entra ID · Google Workspace · OneLogin · Troubleshooting