---
title: Configure SAML SSO with PingOne
slug: opti-id/docs/configure-saml-sso-with-pingone
docTags: 
createdAt: 2026-07-30T20:38:23.419Z
---

Opti ID lets you configure Security Assertion Markup Language (SAML) single sign-on (SSO) with PingOne as the identity provider (IdP). With this configuration, PingOne authenticates and authorizes your users.

You should set up SSO for your organization before inviting users. After you configure SSO with Opti ID, users must log in to Opti ID using credentials for the SSO provider, including the technical contact who originally set up Opti ID for your organization.

:::hint{type="success"}
**Note**

Opti ID also supports configuring SSO with PingFederate.
:::

## Configure the SSO connection

1. If you have access to multiple environments in the PingOne portal, select the environment in which you want to create the SSO application for Opti ID and click **Manage Environment**.

   ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/vNk99gA-iRZ3K7x6iexTo-20260720-145952.png)
2. Go to **Applications** and click the plus (**+**) icon to add an application.

   ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/sVzKWnrPTMdIVUD-705jL-20260720-145952.png)
3. Complete the following application settings, then click **Configure**.
   - **Application Name** – Enter a name for the application, like *Optimizely SSO*.
   - **Description** – Enter a description for the application, like *Application for Optimizely SSO*.
   - **Application Type** – Select **SAML Application**.

     ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/6uIGDswvhyj6NAl-qYKhI-20260720-145952.png)
4. Complete the additional application settings, then click **Save**.
   - **Provide Application Metadata** – Select **Manually Enter**.
   - **ACS URLs** – Enter a valid placeholder URL, like `https://www.sample2.com`. You will replace this later.
   - **Entity ID** – Enter a valid placeholder URL, like `https://www.sample1.com`. You will replace this later.

     ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/09TNoqASe8NoxGZVYmkaL-20260720-145952.png)
5. Go to the **Attribute Mappings** tab and click the pencil icon to edit.

   ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/ojVhQAiY0yWZJocy8q2MQ-20260720-145952.png)
6. Add the following claims mappings (case sensitive), then click **Save**.

| Attributes    | PingOne Mappings | Required |
| ------------- | ---------------- | -------- |
| saml\_subject | Username         | Yes      |
| firstName     | Given Name       | Yes      |
| lastName      | Family Name      | Yes      |
| email         | Email Address    | Yes      |

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/IoPmNe1kJblKYLoQxF1qm-20260720-145952.png" size="100" isUploading="false" showCaption="false" width="562" height="486" darkWidth="562" darkHeight="486" indent="2"}

7. After saving, ensure that **Signing Algorithm** is set to **RSH\_SHA256**.

   ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/92IbL3RQrtL12NMVTdA6l-20260720-145952.png)

:::Paragraph{indent="1"}
If it is not set, edit the configuration and ensure **Sign Assertion & Response** is selected and the **Signing Algorithm** is **RSH\_SHA256**.
:::

::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/G2_9lyjlujV2oQaDGKtxJ-20260720-145952.png" size="100" isUploading="false" showCaption="false" width="779" height="721" darkWidth="779" darkHeight="721" indent="2"}

8. Go to the **Configuration** tab, click **Download Signing Certificate**, and select **X509 PEM (.crt)** to download and save the SAML signing certificate for later use.

   ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/rp-lad8bbPMYZYfspWREG-20260720-145952.png)
9. Copy the **Issuer ID** and **Single Signon Service** URLs from the **Configuration** tab and save them for later use.

   ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/vwOYxgl5ikZ7vD4B53rGD-20260720-145952.png)
10. Go to the **Overview** tab and toggle the application on for SSO.

    ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/0xJiJKf7s-zlLmw528wKw-20260720-145952.png)
11. Log in to Opti ID ([https://login.optimizely.com](https://login.optimizely.com/)) using your technical contact email and password. For information about properly activating the technical contact user, see [Technical contact initial login](docId:54t4Lixx0ncpbgd4T1Rhl).
12. After you log in, you should be on the home dashboard ([https://home.optimizely.com/dashboard](https://home.optimizely.com/dashboard)). Go to the **Admin Center**.
13. Go to **Settings > SSO > Add SSO Connection**, select **SAML** as the connection type, and complete the following fields:
    - **Connection Name** – Enter a name for this SSO connection to display when users log in. This helps you distinguish between multiple SSO connections.
    - **Issuer URL/Entity ID** – Enter the **Issuer ID** from step 8.
    - **SSO URL** – Enter the **Single Signon Service** URL from step 8.
    - **Signature Certificate** – Select the certificate that you downloaded in step 7.

      ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/iSKzoMNuCme5ZVvV7L9eQ-20260720-145952.png)
14. Click **Save**.
15. Copy the **Audience URL** and **Assertion Consumer Service URL** from the **SSO Connection Details** section.
16. Use the generated **Audience URL** and **Assertion Consumer Service URL** values to update the following placeholder values from step 4 in your PingOne SAML application:
    - **ACS URLs** – Paste the value from the **Assertion Consumer Service URL**.
    - **Entity ID** – Paste the value from the **Audience URL**.

:::hint{type="warning"}
**Important**

In accordance with your company policy, configure your Opti ID SSO application to enforce authentication on each login for added security or maintain user sessions for a specified duration to balance security and user convenience.
:::

## Test the SSO connection

One of the users you assigned in the SAML application should test the setup. They need to be a user in the Opti ID Admin Center but logged out.

1. Open an incognito window and go to [https://login.optimizely.com](https://login.optimizely.com).
2. When you enter your email and click **Next**, it should redirect you to your organization's IdP.
3. Double-check your settings if there are any issues with signing in with your incognito window.

If it does not work correctly, see the [Opti ID troubleshooting articles](docId:0GoWDar_6qWkZo6LqAecl). If you cannot resolve the issue, contact Optimizely Support.