Skip to main content

Ping Identity SSO

In this guide, you’ll learn how to set up Ping Identity authentication in Coalesce.

Ping Identity Administrator

You must be a Ping Administrator to complete this process.

Before You Begin​

Check Your Subdomain​

Your subdomain is the subdomain of your Coalesce instance. For example, if you login at https://testapp.app.coalescesoftware.io/. Your subdomain is testapp.

To check if already have a subdomain, go your organizations single sign-on settings.

If you don't have a subdomain, you can add one to the subdomain box. Coalesce will automatically configure your subdomain based on the name entered. Check with your IT team before adding it to your organizations settings.

Single Sign-On configuration form header showing Authority and Subdomain fields with Other selected

Create a Ping Identity Application​

  1. In Ping go to the Applications page, and create a new application.

  2. Give the application a name.

  3. Select Single-Page as the Application Type.

  4. Click Save.

    Add new application in Ping Identity

  5. After saving, you’ll be taken to the Application overview screen.

  6. Click on Configuration, then edit.

  7. Set the following confirmation options:

    1. Select all options under Response Type:
      1. Code
      2. Token
      3. ID
    2. Grant Type:
      1. Click Authorization Code
      2. PKCE Enforcement is Optional
      3. Click Implicit
    3. Under Redirect URIs enter your Coalesce instance URL with login/callback added.
      1. https://<your Coalesce app domain>/login/callback
      2. For example: https://testapp.app.coalescesoftware.io/login/callback
    4. The other configuration options can be left as default.

  8. Click Save.

  9. After saving, you’ll be taken to the Application overview screen.

  10. Next, you’ll make sure your allowed scopes are set. Click on Resources, then edit.

  11. Make sure the following scopes are set:

    1. openid
    2. email
    3. profile
    Required Ping scopes

  12. Make sure your application is turned on by toggling the switch near the X.

Gather Your Ping SSO Information​

You are gathering your subdomain, Authorization Server, and OIDC clientID.

  1. On the Application overview screen, click URLs to open a drop-down.

    Ping URLs screen

  2. Copy the Authorization URL. You only need up to the /as. Leave off the trailing slash.

    1. For example: https://auth.pingone.com/8d472703-1eaf-491b-a425-91aff175d01f/as.

Get your OIDC Client ID​

  1. On the Application overview screen, copy the Client ID.
Ping OIDC Client ID

Configure Coalesce Ping Settings​

  1. Open a new window.

  2. Sign in to your Coalesce application using username and password.

  3. Go to Organization Settings > Single Sign-On.

  4. Enter in the following information:

    FieldDescription
    AuthorityThe system being used for Single Sign On. Choose Other.
    SubdomainThis will be the same as Subdomain. Not the entire URL.
    Authorization Serverhttps://auth.pingone.com/8d472703-1eaf-491b-a425-91aff175d01f/as
    Server-Side Authorization (Optional)Toggle on to add an authorization URL. Use this when the authorization server blocks access to the OpenID configuration or token endpoints.
    Authorization Endpoint (Available with Server-Side Authorization )The authorization URL to redirect to.
    The image shows the Org Settings page in Coalesce's interface, specifically the Single Sign-On configuration section. It includes fields for Authority, Subdomain, Authorization Server, and OIDC Client ID, along with an option to enable Server-Side Authorization.

  5. Go to your SSO URL, which will be formatted like - https://mySubdomain.<app_domain> - and click on the Use Single Sign-On button to log in using SSO.

Use Single Sign On Button

If instead of a button you see an error message, check to make sure you correctly entered all the fields in your Coalesce SSO settings. If the problem persists please reach out to our Support Team.

Duplicate Accounts After SSO Setup​

Seperate SSO Account Creation

The creation of a separate SSO account is expected behavior and does not affect your existing basic auth account's permissions.

When you first authenticate using SSO in Coalesce, the system creates a new SSO account separate from your existing basic authentication account. This new SSO account is automatically assigned Org Member permissions by default.

If you previously had admin permissions through your basic auth account, you'll need to update the permissions for your new SSO account. To do this:

  1. Log in using your basic authentication credentials.
  2. Update the permissions for your SSO account.
  3. If you don't have admin access, contact your organization's admin to update the permissions.