Administrator or above

Set up single sign-on with Ping Identity

3 min read · Updated 4 Nov 2026

This guide covers the Ping side of single sign-on: registering Astrato as an OpenID Connect application and collecting its credentials. It then hands back to the Astrato steps, which are the same for every provider.

A Ping Identity connection asks for the same values as Open ID Connect: an issuer URL, the identity provider domains, a client ID and a client secret. It has no Scope field.

Before you start

You meet the requirements in Set up single sign-on, and have read Do not lock yourself out.
You can create applications in your PingOne environment or PingFederate server.
The people who will sign in have an email address in Ping. Astrato identifies people by email.

Values you will bring back to Astrato

Astrato Setup field	Where it comes from
Connection name	A name of your choice
Issuer URL	The issuer of your environment. In PingOne it has the form `https://auth.pingone.<region>/<environment-id>/as`, for example `.eu`
Identity provider domains	The email domains your people sign in with, as a comma-separated list
Client ID	The application’s client ID
Client secret	The application’s client secret

To check the issuer URL, open it in a browser with /.well-known/openid-configuration added to the end. A correct issuer returns a JSON document whose issuer value matches it. You can also enter that discovery address as the Issuer URL.

Copy the callback URLs from Astrato

In Astrato, open Administration → Enterprise Connection and stay on Login connections.
Select Add connection and choose Ping Identity in Select a Login provider.
Leave the Configuration tab open. It lists two callback URLs, the sign-out redirect URL and the scopes openid profile email.

Register Astrato in Ping

Ping’s screens differ between PingOne and PingFederate and change over time; Ping’s own documentation covers where each setting is. Whichever you use, the application needs:

The type of an OpenID Connect web application, using the authorization code grant and a client secret.
Both callback URLs from Astrato’s Configuration tab as redirect URIs, exactly as shown.
The sign-out redirect URL from the same tab, if the application has a field for it.
The scopes openid, profile and email.
Access for the people or groups who should use Astrato, and the application enabled.

Then copy the client ID and client secret.

Finish in Astrato

Go back to the Add connection dialog and select Continue to Setup. Fill in the values from the table above, then follow the rest of Set up the connection, Verify the connection and Test a normal sign-in.

The Add connection dialog with Ping Identity selected, on its Setup tab: Connection name, an Issuer URL of the form https://auth.pingone.eu/<environment ID>/as, Identity provider domains example.com, Client ID, a masked Client secret, the Allow users outside the identity provider domain to sign in without SSO box ticked, the two synchronization boxes cleared, and Cancel and Create buttons

What you see	Likely cause	What to do
Ping reports that the redirect URI is not allowed	A callback URL is missing from the application, or differs from Astrato’s	Add both callback URLs from Astrato’s Configuration tab, exactly as shown
Verification cannot reach the provider	The issuer URL is wrong, for example the wrong region or environment ID	Use the `issuer` value from the environment’s discovery document
Ping signs the user in, but Astrato does not	The ID token carries no email address	Give the account an email address and allow the `email` scope

For errors on the Astrato side, see Common errors.

What next

Test a normal sign-in before you clear Allow users outside the identity provider domain to sign in without SSO.
Sync groups and roles from your provider
Provision users and groups with SCIM