This feature is available only on the Enterprise subscription plan.
PingIdentity is a hosted identity and access management service provided by PingOne company.
In this article you'll learn how to set up single sign-on with Lokalise and PingIdentity. You can also refer to the PingIdentity official document on SSO.
Index
Configuration on Lokalise
To get started, log into Lokalise, click on the avatar in the bottom left corner and choose Team settings:
Then, proceed to the Advanced security tab and tick the Enable SSO field:
Team's domain — enter your PingIdentity domain.
ACS URL Preview —
https://app.lokalise.com/sso/yourdomain.com/acs. Make sure the domain is entered fully with TLD (.com,.co.uk, etc.).SAML 2.0 Endpoint (HTTP) — enter Single Sign-on Service from the PingIdentity SAML app’s Configuration tab, for example
https://auth.pingone.eu/ca6a602d-c58d-488d-9d21-77e82366caf3/saml20/idp/sso.Identity Provider Issuer — Issuer ID from the PingIdentity SAML app’s Configuration tab, for example
https://auth.pingone.eu/ca6a602d-c58d-488d-9d21-77e82366caf3.Public Certificate — obtained by clicking on the Download Signing Certificate button in the PingIdentity SAML app’s Configuration tab. Must begin with
-----BEGIN CERTIFICATE-----and end with-----END CERTIFICATE-----.Sign AuthnRequest is not usually required. If you do need this feature, then tick the corresponding field and copy certificate from Service provider Public Certificate field on Lokalise, and then save it to an
.crtfile. Proceed to PingIdentity SAML app’s Configuration tab, click the Edit button in the top right corner, and enable the Enforce Signed Authn Request option. The Verification Certificate section will appear below, so import the.crtfile saved from Lokalise:
If you need to reconfigure the same SSO domain for another Lokalise team, please follow these steps:
Empty all fields within Single sign-on (SSO) section of the Advanced security tab.
Uncheck Enable SSO setting.
Click on Save.
Proceed with configuring SSO for the other Lokalise team.
Configuration on PingIdentity
Proceed to your PingIdentity dashboard, click Connections > Applications, and then press on the "plus" icon:
Overview tab
Only the Application Name field is mandatory here, all other fields are optional. Enter any name and click Save.
Configuration tab
Next, you'll be presented with the Configuration tab:
ACS URLS — enter the ACS URL Preview here copied from Lokalise, for example
https://app.lokalise.com/sso/yourdomain.com/acs(check the previous section to find this value).SIGNING KEY — choose Sign Assertion & Response
Signing Algorithm — choose RSA_SHA256
ENTITY ID — enter
https://lokalise.com.SLO BINDING — choose HTTP POST.
SUBJECT NAME ID FORMAT — choose
urn:oasis:names:tc:SAML:2.0:nameid-format:persistent.
Once you're ready, hit Save.
Attribute Mappings tab
You'll be presented with the Attribute Mappings tab:
saml_subject — can’t be removed but will be disregarded by Lokalise anyway.
NameID — must be unique, pseudo-random, and will not change for the user over time — like a User ID or Account ID for example.
User.Email — set to
Email Address.first_name (optional) — set to
Given Name.last_name (optional) — set to
Family Name.
There's no need to add any other parameters as Lokalise will disregard those anyway. Please note that all names and values are case sensitive!
After editing, you'll be presented with a summary of the added SAML attributes:
Access tab
Next, the Access tab:
Enable the Display this application in the Application Portal option in the Application Portal Display section.
Users tab
To add users on PingIdentity, proceed to Identities > Users tab, and click the "plus" icon:
When adding a new user, make sure that:
The user is enabled (toggle a blue switch as shown in the screenshot above).
The user's profile contains values for the SAML attributes specified under the Attribute Mappings tab.
Logging in with SSO
Once everything is set up, proceed to https://app.lokalise.com/sso and enter user email associated with the PingIdentity domain. Upon the first log in, you'll be asked to confirm your email:
