---
updatedAt: 2026-03-25T20:58:26.000Z
---

# Configure Ping Identity with Password Safe | BI On-prem

## What is Ping Identity?

Ping Identity is a cloud-based and on-premises identity and access management platform that helps organizations securely manage user authentication, authorization, and access to applications and APIs.

## How is it useful?

Ping Identity improves security by centralizing authentication and enforcing MFA. It enhances user experience through SSO and seamless access to apps. It also simplifies administration with centralized control over identities and access. Finally, it sSupports modern apps and APIs for hybrid and cloud environments.

Configuring BeyondInsight and Password Safe to use Ping Identity SAML authentication involves configuring the SAML application with BeyondInsight SAML information in the Ping Identity admin portal and then configuring the SAML identity provider settings for Ping Identity in the BeyondInsight console.

## Configure SAML application in Ping Identity

To configure a new SAML application for BeyondInsight and Password Safe in Ping Identity, follow the below steps.

1. Sign in to the Ping Identity admin portal.
2. Click the **Add Application** button, and then select **New SAML Application** from the menu.
3. Fill in **Application Name** and **Description**.
4. Set **Category** to **Other**, and then click **Continue to Next Step**.
5. Set the following:

   * Set **Assertion Consumer Service (ACS)** to:
   * Set **Entity ID** to:

     *https\://<ServerURL>/eEye.RetinaCSSAML/*
   * Set **Single Logout Binding Type** to **Redirect**.
   * Upload **Primary Verification Certificate** (use **SP Public Certificate.cer** from **\WebSiteSAML\Certificates**). The certificate is automatically generated when the BI SAML configuration is saved.
   * Click **Continue to Next Step**.

> ℹ️
>
> After setting up SAML configuration in the BeyondInsight console, you must download the certificate from the configured SAML identity provider in BeyondInsight. The steps are detailed in the next section.

6. Add the following attributes, and then click **Save & Publish**:
   * **Group:** Check the **As Literal** box. This must match the group created in BeyondInsight.
   * **Name** (required).
   * **Email** (optional).
   * **Surname** (optional).
   * **GivenName** (optional).

The application attributes are mapped as follows:

| Application Attribute | Identity Bridge Attribute or Literal value |
| :-------------------- | :----------------------------------------- |
| Group                 | PingID                                     |
| Name                  | Email                                      |
| Email                 | Email                                      |
| Surname               | Last Name                                  |
| GivenName             | First Name                                 |

> ℹ️
>
> * **Group** can also be mapped to the user's groups in Active Directory if all groups are required.  However the redirect URL must be limited to a max of 2048 characters. We recommend using a single group or minimal groups. If too many groups are returned, a login issue can occur.
> * The following is applicable **only to BI version 6.3.1**. It is not required for 6.4.4 or later releases. In 6.4.4 and later releases, the user is automatically logged in to Password Safe, and can then navigate to BeyondInsight, if they have the proper permissions.
>
> To create an application that goes to Password Safe when IdP-initiated login is used, add a new attribute called **Website**. When the value of **Website** is set to Password Safe, the user is logged in to Password Safe. If the attribute is not present or is set to anything other than Password Safe, the user will be directed to BeyondInsight.

7. Download the **Signing Certificate**.
8. Download **SAML Metadata**.
9. Click **Finish**.

## Configure SAML identity provider in BeyondInsight

To configure a new SAML for Ping Identity in BeyondInsight:

1. Open a browser and enter the URL for your Password Safe instance: **https\://\<hostname>/WebConsole/index.html**.

2. Enter your username and password.

3. From the left menu, click ![Configuration icon](https://files.readme.io/5440329f4c22243ec1f8721a1c3d821fa7d6b7468cd0904e01869dc74e6cf354-configuration.png).\
   The **Configuration** page displays.

4. Under **Authentication Management**,  select **SAML Configuration**.\
   The **SAML Configuration** page displays.

   ![SAML Identity Provider Configuration page](https://files.readme.io/4eeb27b3636a70b81de05d74e5e7578a52c80d214abd9b4cf64f6777a1394db4-image.png)

5. Under **SAML Identity Providers**, click **Create New SAML Identity Provider +**.

6. Provide a name for the new SAML identity provider (IdP).

7. Complete the **Identity Provider Settings** as follows:
   * Check the **Default Identity Provider** option if you have more than one IdP for the same service provider (SP), and would like this IdP to be used as default for SP initiated logins.
     * This is useful in the case where a user accesses the SAML site access URL without providing an IdP.
     * Also, when a user clicks the **Use SAML Authentication** link from the BeyondInsight login page, they are redirected to the default IdP's site for authentication.
   * Check **Force Reauthentication** to require users to authenticate with the identity provider for each BeyondInsight session. Once enabled, if BeyondInsight is logged out but the IdP still has an active session, when the user attempts to access Password Safe from a service provider initiated login, the IdP prompts the user to log in again.
   * **Identifier:** Enter the Ping Identity value **Identity Provider Issuer**.
   * **Single Sign-on Service URL:** Enter the Ping Identity value **Identity Provider Single Sign-On URL**.
   * **SSO URL Protocol Binding:** Select **HTTP Post** as the type.
   * **Single Logout Service URL:** Enter the Ping Identity value **Identity Provider Single Logout URL**.
   * **SLO URL Protocol Binding:** Select **HTTP Post** as the type.
   * **Encryption and Signing Configuration:** Check applicable boxes to enable options, based on your Ping Identity settings. A typical configuration is shown; however, depending on your Ping Identity settings, some configuration selections may be different.
   * **Signature Method:** Select the method, as is required by Ping Identity.
   * **Current Identity Provider Certificate:** Upload the Ping X.509 certificate.
   * **User Mapping:** Select the type of user account from the dropdown. This indicates how user claims from the SAML provider are mapped in the BeyondInsight User database.
     * **None:** This is the legacy type of mapping, which is not based on type of user.
     * **Local:** Select this option for local user account claims. BeyondInsight maps the user and group name.
     * **Microsoft Entra ID:** Select this option for Entra ID user account claims. When selected, BeyondInsight maps the **ObjectID** attribute to the **AppUser** and **UserGroup** attributes for the user.
     * **Active Directory:** Select this option for Active Directory user account claims. If the claims are configured to pass the SID of the user and group, BeyondInsight maps the SID for the user and group, which is preferred over mapping domain name and group name attributes.

8. The following **Service Provider Settings** are auto-generated by BeyondInsight:
   * **Entity ID:** This is the fully qualified domain name, followed by the file name: **https\://\<serverURL>/eEye.RetinaCSSAML/**. This is used for audience restriction.
   * **Assertion Consumer Service URL:** The HTTPS endpoint on the service provider where the identity provider redirects to with its authentication response. .

9. Click **Create SAML Identity Provider**.

[block:image]{"images":[{"image":["https://files.readme.io/3a0d0d7e00074055ad8ed7e312e728055db30ba397ea4eeab76668c75eca9b6f-saml_onprem.png","","The SAML Configuration page in BeyondInsight displays a left panel listing SAML Identity Providers, with a button labeled “Create New SAML Identity Provider.” The right panel shows the form for creating a new SAML identity provider, including fields for provider name, identity provider settings, SSO URLs, binding options, encryption and signing configuration, certificate management, user mapping, and service provider settings. A button labeled “Create SAML Identity Provider” appears at the bottom of the form."],"align":"center","border":true}]}[/block]

### Disable forms login

In environments where SAML, smart card, or claims-aware is configured, we recommend enabling the **Disable Forms Login** authentication option to disallow users from using the standard login form in BeyondInsight.

To disable forms login for existing users, enable this option directly on a user account as follows:

1. Open a browser and enter the URL for your Password Safe instance: **https\://\<hostname>/WebConsole/index.html**.
2. Enter your username and password.
3. From the left menu, click ![Configuration icon](https://files.readme.io/5440329f4c22243ec1f8721a1c3d821fa7d6b7468cd0904e01869dc74e6cf354-configuration.png).\
   The **Configuration** page displays.
4. Under **Role Based Access**,  select **User Management**.\
   The **User Management** page displays.
5. Select the **Users** tab.
6. Locate the user in the grid.
7. Click ![Ellipsis icon](https://files.readme.io/faa7a2bef0e2f0c4d703a15905445d79ad1d8aa6fb34571fadfa09c4223c24f8-ellipsis.png) **> Edit User Details**.
8. Under **Authentication Options**, check **Disable Forms Login** to enable the option.
9. Click **Update User**.

> ℹ️
>
> Contact BeyondTrust Support for assistance if you need to bulk-apply this setting to existing accounts.

To disable forms login globally for newly created directory accounts:

1. Open a browser and enter the URL for your Password Safe instance: **https\://\<hostname>/WebConsole/index.html**.
2. Enter your username and password.
3. From the left menu, click ![Configuration icon](https://files.readme.io/5440329f4c22243ec1f8721a1c3d821fa7d6b7468cd0904e01869dc74e6cf354-configuration.png).\
   The **Configuration** page displays.
4. Under **Authentication Management**,  select **Authentication Options**.
5. Under **Forms Login Options**, check the **Disable Forms Login for new directory accounts** option to enable it.
6. Click **Save**.