> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/secure-and-govern/identity-providers/ping-identity.md).
# PingIdentity
Use PingIdentity as your identity provider for federated single sign-on, so users access Dispel with their existing enterprise credentials over OAuth (OIDC) or SAML.
## Overview
Connect PingIdentity — Ping's federated identity platform — as your organization's identity provider. Once connected, your users sign in to Dispel with their existing enterprise credentials through single sign-on. You can connect Ping over **OAuth (OIDC)** or **SAML**.
This page covers the Ping-specific setup. For the shared behavior that applies to every provider — how users sign in, group mapping, MFA, and disconnecting — see [Identity Providers](/secure-and-govern/identity-providers.md).
{% hint style="info" %}
**Where to find it.** Sign in as an organization administrator and open **Settings → Integrations** (or the dedicated **Settings → Authentication** page). PingIdentity appears in the **Identity & Authentication (IdP / SSO)** section. Click **Connect** on its card to begin.
{% endhint %}
## Before you begin
* You'll configure the IdP side in your Ping environment — **PingOne** or **PingFederate** — so you'll need administrative access there.
* Decide on a protocol — **OAuth (OIDC)** or **SAML**. See [Choosing a protocol](/secure-and-govern/identity-providers.md#choosing-a-protocol).
* Make sure the users who will sign in via Ping are already **invited to your organization** in Dispel. SSO authenticates users but doesn't create access on its own.
{% hint style="warning" %}
**One provider at a time.** If your organization is already connected to another identity provider, disconnect it before connecting PingIdentity.
{% endhint %}
## Connect with OAuth (OIDC)
#### In PingIdentity
1. In your Ping environment, create a new **OIDC / Web** application for Dispel.
2. Set the **redirect URI** to your Dispel address followed by `/oauth/login-callback` — for example `https://app.dispel.com/oauth/login-callback`. Confirm the exact address for your environment with your Dispel representative if you're unsure.
3. Generate a **client secret** for the application.
4. Note the application's **Client ID**, **client secret**, and your Ping OAuth/OIDC issuer endpoint.
#### In Dispel
1. Click **Connect** on the PingIdentity card and **Select Authentication Protocol → OAuth**.
2. Fill in the fields:
| Field | Value from PingIdentity |
| --------------------------- | -------------------------------------------------------------------- |
| **Client URL** | Your Ping OAuth/OIDC issuer endpoint (where tokens are issued). |
| **Client ID** | The application's **Client ID**. |
| **Client Secret** | The application's **client secret**. |
| **Organization Identifier** | A unique identifier you choose; users type it on the sign-in screen. |
3. Click **Save settings**.
## Connect with SAML
#### In PingIdentity
1. In your Ping environment, create a new **SAML** application for Dispel.
2. In the SAML configuration, paste the values Dispel shows at the top of its SAML form:
* **ACS URL / Assertion Consumer Service URL** ← Dispel's **Assertion Consumer Service URL**.
* **Entity ID / Audience** ← Dispel's **Service Provider (SP) Entity ID**.
3. From the Ping application's SAML / connection details, collect:
* The **Single Sign-On Service URL** → Dispel's **SSO URL**.
* The **IdP Entity ID / Issuer** → Dispel's **Identity Provider Entity ID**.
* The **signing certificate** → Dispel's **Base64 Signing Certificate**.
4. Grant the application to the users or groups who should have access.
#### In Dispel
1. Click **Connect** on the PingIdentity card and **Select Authentication Protocol → SAML**.
2. Copy the **Service Provider (SP) Entity ID** and **Assertion Consumer Service URL** shown at the top of the form (use **Copy ID** / **Copy URL**) into Ping, as above.
3. Fill in the fields:
| Field | Value from PingIdentity |
| ------------------------------- | --------------------------------------------------------------------- |
| **SSO URL** | The **Single Sign-On Service URL**. |
| **Identity Provider Entity ID** | The **IdP Entity ID / Issuer**. |
| **Base64 Signing Certificate** | The Ping signing certificate. Paste it or use **Upload Certificate**. |
| **Organization Identifier** | A unique identifier you choose; users type it on the sign-in screen. |
4. Click **Save settings**.
5. Click **Test connection**. Dispel redirects you to Ping to sign in, then shows the email and name it received. If the test fails, confirm the values match your Ping application and that the test user is invited to your organization.
## After connecting
* **Users sign in** by entering your Organization Identifier on the Dispel sign-in screen and authenticating with Ping. See [How users sign in](/secure-and-govern/identity-providers.md#how-users-sign-in).
* **Map Ping groups to Dispel groups** so membership stays in sync — see [OIDC Group Mapping](/integrate-and-administer/integrations/oidc-group-mapping.md).
* **MFA** enforced in Ping applies during sign-in; Dispel's email one-time codes don't apply to SSO users. See [SSO and multi-factor authentication](/secure-and-govern/identity-providers.md#sso-and-multi-factor-authentication).
* **To switch protocols or providers**, disconnect first. See [Switching or disconnecting a provider](/secure-and-govern/identity-providers.md#switching-or-disconnecting-a-provider).
## Frequently asked questions
Does this work with both PingOne and PingFederate?
Yes. Create an OIDC or SAML application in whichever Ping product you use, then enter its values in Dispel. The Dispel-side fields are the same either way.
Which protocol should I use with Ping?
Either works. Use whichever matches the application you create in Ping — an OIDC application for OAuth, or a SAML application for SAML.
My SAML test connection failed. What should I check?
Confirm the SSO URL, IdP Entity ID, and certificate match your Ping application, that you pasted Dispel's SP Entity ID and ACS URL into Ping's SAML configuration, and that the test user is granted access to the Ping application and invited to your Dispel organization.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.dispel.com/secure-and-govern/identity-providers/ping-identity.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.