Skip to content
FreesbeFreesbe DocsBack to freesbe.net

Set up single sign-on with Ping Identity

How-toFor adminsReviewed Guides: Single sign-on, Admin Center

Connect PingOne (or PingFederate) so people sign in to Freesbe with their Ping account and its MFA.

Before you start

Section titled “Before you start”
  • Single sign-on with your own provider comes with the Corporate and Enterprise plans.
  • Verify your company’s email domain in the Admin Center under People → Joining → Email domains (see Let people join with their work email). Your provider can only sign in addresses at a verified domain.
  • You need to be an owner of the workspace in Freesbe, and able to add apps in Ping Identity.
  • Keep the Freesbe page open in one tab and Ping Identity in another: you copy details both ways.

1. Start in Freesbe

Section titled “1. Start in Freesbe”
  1. Open the Admin Center: Security → Sign-in & access → Single sign-on.
  2. Choose Ping Identity and SAML 2.0, then Set up Ping Identity.
  3. The page shows Add Freesbe to Ping Identity with the details to copy. Leave it open.

2. Add Freesbe to PingOne

Section titled “2. Add Freesbe to PingOne”
  1. In the PingOne admin console, go to Applications → Applications and click +. Name it Freesbe, choose SAML Application and Configure.
  2. Choose to enter the details manually: paste Freesbe’s Reply URL into ACS URLs and its Entity ID into Entity ID. Save.
  3. On Attribute Mappings, map saml_subject to Email Address.
  4. On Configuration, copy the IDP Metadata URL.
  5. On Access, choose the groups who use Freesbe, and turn the application on.

With PingFederate, create an SP connection with the same entity ID and ACS URL, send the email address as the subject, and export its metadata file.

3. Tell Freesbe about Ping Identity

Section titled “3. Tell Freesbe about Ping Identity”

Under Tell Freesbe about Ping Identity, paste the metadata URL (or upload the metadata file) and click Save.

4. Test it

Section titled “4. Test it”
  1. Back on the Freesbe page, under Test it, click Test sign-in.
  2. Sign in to Ping Identity as yourself. You’re brought back to the page, which says Signed in and shows what Ping Identity sent: your email address, name and any other attributes.
  3. Nobody else can sign in through Ping Identity until a test goes through. Once it has, people at your domain choose Sign in with your company’s SSO on the sign-in page.

To make everyone use it, see Require single sign-on for everyone.

If the test doesn’t sign in

Section titled “If the test doesn’t sign in”

The page says why. The usual reasons:

  • “isn’t at one of this workspace’s verified email domains”: Ping Identity sent an address at another domain, or a username instead of the email. Send the user’s primary email as the saml_subject (Email Address).
  • “isn’t signed with the identity provider’s certificate”: the certificate Freesbe has isn’t the one Ping Identity signs with. Paste the metadata URL again, or upload the new metadata file.
  • “for another app (Audience)” or “isn’t for this sign-in address”: the entity ID or reply URL in Ping Identity doesn’t match Freesbe’s. Copy them again from step 1; they end in /metadata and /acs.
  • “is encrypted”: turn off assertion encryption for the Freesbe app.
  • The provider shows its own error (often “not assigned”): give yourself access to the Freesbe app in Ping Identity.

See Single sign-on for everything else.

With OpenID Connect instead

Section titled “With OpenID Connect instead”

Choose OpenID Connect in step 1, and add an OIDC Web App in PingOne. Add Freesbe’s Redirect URL under Redirect URIs, with the openid, email and profile scopes. In Freesbe enter the Issuer ID from the app’s Configuration, and its client ID and secret.