How to configure Ping Identity SAML SSO

December 03, 2024 22:05

Note

If you are on our Teams plan and would like to add single sign-on (SSO) features to your Calendly account, you can do so from your billing page. The SSO add-on costs $3 per user, per month.

Step 1: Navigate to the Calendly SSO Configuration Page

Open calendly.com and sign in.
Select Account.
Select Organization Settings.
Select Single sign-on on the left side of the page.

Step 2: Add Calendly as a Ping Application

Open your Ping Identity dashboard in a separate tab.
Select CONNECTIONS.
Select + Add Application.
Select WEB APP. Then, in the SAML row, select Configure.
Fill in the Application Name (e.g. Calendly) and Description (e.g. online appointment scheduling software).
Select Next.
Under ACS URLs, enter https://example.com (this will be changed later).
Under ENTITY ID, enter https://example.com (this will be changed later).
Select Download Signing Certificate and select X509 PEM (.crt).
Under SIGNING ALGORITHM, make sure RSA_SHA256 is selected.
Under ASSERTION VALIDITY DURATION (IN SECONDS), enter 60.
Select Save and Continue.
Under PINGONE USER ATTRIBUTE, select Email Address.
Add an Email Address attribute
1. Select +ADD ATTRIBUTE.
2. Select PingOne Attribute.
3. Under PINGONE USER ATTRIBUTE, select Email Address.
4. Under APPLICATION ATTRIBUTE, enter email.
5. Check the box next to Required.
Add a Given Name attribute
1. Select +ADD ATTRIBUTE.
2. Select PingOne Attribute.
3. Under PINGONE USER ATTRIBUTE, select Given Name.
4. Under APPLICATION ATTRIBUTE, enter firstName.
5. Check the box next to Required.
Add a Family Name attribute
1. Select +ADD ATTRIBUTE.
2. Select PingOne Attribute.
3. Under PINGONE USER ATTRIBUTE, select Family Name.
4. Under APPLICATION ATTRIBUTE, enter lastName.
5. Check the box next to Required.
Select Save.

Step 3: Set up IDP

Expand the Calendly application by selecting the down arrow button on the right.
Select Configuration.
Copy the ISSUER ID and paste it into the Entity ID field on Calendly’s SSO settings page (from Step 1: Navigate to the Calendly SSO configuration page)
Copy SINGLE SIGNON SERVICE and paste it into the Identity provider’s SAML HTTP Request URL field on Calendly’s SSO settings page.
Upload the downloaded PEM certificate into the X.509 certificate for SAML authentication field on Calendly’s SSO settings page.
In Calendly, select Save & continue.
In Ping, select the pencil icon on the right.
Select SAML SETTINGS to expand the section.
In Calendly, copy the ACS URL from Step two.
In Ping, under ACS URLs, remove the existing text and paste.
In Calendly, copy the Audience URL from Step two and paste it in Ping, under ENTITY ID.
In Calendly, copy the Default relay state and paste it in Ping under TARGET APPLICATION URL.
In Ping, select Save.
Select < To Application List at the top of the page.
Use the toggle to enable the Calendly application.
If you are registered on Ping with the same email as your Calendly Org admin, continue to Step 5: Test connection.

Step 4: Creating an Identity

In Ping, select IDENTITIES in the menu.
Select the + Add User button.
Enter GIVEN NAME (first name) and FAMILY NAME (last name).
Under EMAIL ADDRESS and USER NAME, enter your test user’s email.
Select Save.
Locate your use in the table and select the down arrow to expand.
Select Reset Password.
Enter a temporary password (you will be prompted to change this upon your first login).
Select Save.

Step 5: Test connection

In Calendly, select Enable SSO for yourself, select Test connection. If successful, you'll see a confirmation.

Screenshot 2023-10-11 at 10.13.52 AM.png

Step 6: Enforce for your organization

In Calendly, select Enforce SAML SSO for my organization, then Apply.

Once SSO is enforced, all users will be logged out and need to use SAML SSO to log into Calendly. Only the organization owner can log in using their fallback (original) login method by selecting Log in using another method on the login page.