1. Home
    2. Prisma
    3. Prisma Cloud
    4. Prisma Cloud Compute Edition Administrator’s Guide
    5. Authentication
    6. Integrate with PingFederate via SAML 2.0 federation

    Integrate with PingFederate via SAML 2.0 federation

    Many organizations use SAML to authenticate users for web services. Prisma Cloud supports the SAML 2.0 federation protocol to access the Prisma Cloud Console. When SAML support is enabled, users can log into the Console with their federated credentials. This article provides detailed steps for federating your Prisma Cloud Console with your PingFederate v8.4 Identity Provider (IdP).
    The Prisma Cloud/PingFederate SAML federation flow works as follows:
    1. Users browse to Prisma Cloud Console.
    2. Their browsers are redirected to the PingFederate SAML 2.0 endpoint.
    3. They enter their credentials to authenticate. Multi-factor authentication can be enforced at this step.
    4. A PingFederate SAML token is returned to Prisma Cloud Console.
    5. Prisma Cloud Console validates the SAML token’s signature and associates the user to their Prisma Cloud account via user identity mapping or group membership.
    Prisma Cloud Console is integrated with PingFederate as a federated SAML Service Provider. The steps to set up the integration are:

    Configure PingFederate

    1. Logon to PingFederate
    2. Go to
      IdP Configuration > SP Connection > Connection Type
      , and select
      Browser SSO
      .
    3. Go to
      IdP Configuration > SP Connection > Connection Options
      , and select
      Browser SSO Profiles SAML 2.0
      .
    4. Skip the
      Import Metadata
       tab.
    5. Go to
      IdP Configuration > SP Connection > General Info
      .
      1. In
        Partner’s Entity ID
        , enter
        twistlock
        .
        By default, the Partner’s Entity ID is "twistlock". When configuring the SAML Audience in the Prisma Cloud Console, the default value is "twistlock". If you choose a different value here, be sure to set the same value in your Console.
      2. In
        Connection Name
        , enter
        Prisma Cloud Console
        .
      3. Click
        Add
        .
    6. In
      Browser SSO > SAML Profiles
      , select both
      IDP-INITIATED SSO
       and
      SP-INITIATED SSO
      .
    7. Go to
      Assertion Creation
       and set
      SAML_SUBJECT
       to
      SAML 1.1 nameid-format
      .
      In this example you mapped the user’s email address to the SAML_SUBJECT attribute which matches the user’s Prisma Cloud account. If you are using group-to-Prisma Cloud-role associations, add
      groups
       to the list of attributes to be returned in the SAML token.
    8. In
      IdP Configuration > SP Connection > Browser SSO > Protocol Settings > Assertion