Skip to content
English - United States
Contact Us
  • There are no suggestions because the search field is empty.

Configure PingOne SSO and SCIM for RocketDocs

This guide connects PingOne to RocketDocs with SAML 2.0 SSO. You can also configure SCIM provisioning for RocketDocs users. A PingOne administrator and a RocketDocs administrator can complete these steps. Contact RocketDocs Support if your settings differ from this guide.

Placeholder format

This guide uses <tenant> for your RocketDocs tenant name.

Replace <tenant> in each URL with your tenant name.

Tenant URL

https://<tenant>.rocketdocs.com

ACS URL

https://<tenant>.rocketdocs.com/api/auth/AssertionConsumerService

Login URL

https://<tenant>.rocketdocs.com/app/login

SCIM Endpoint URL

https://<tenant>.rocketdocs.com/integrationapi/scim

Signing model

  • PingOne signs the SAML assertion with its identity provider (IdP) certificate.

  • RocketDocs uses the PingOne IdP certificate to verify the assertion.

  • The SAML response remains unsigned.

  • RocketDocs uses SCIM for optional user provisioning.

  • This setup does not use SAML Single Logout.

 

Step 1: Prepare the values

Required access

  • Use a PingOne account that can configure applications and provisioning.

  • Use a RocketDocs account that can edit System Settings.

  • Keep one RocketDocs local administrator session open during SSO setup.

Create the RocketDocs values

  1. Record your RocketDocs tenant URL.
  2. Build the ACS URL from the tenant URL.
  3. Record the current SSO SP Name.
  4. Use the tenant URL if no SSO SP Name exists.
  5. Copy the SSO SP Name exactly into the PingOne Entity ID.

Tenant URL

https://<tenant>.rocketdocs.com

ACS URL

https://<tenant>.rocketdocs.com/api/auth/AssertionConsumerService

SSO SP Name

Use the existing value. Otherwise, use the full tenant URL.

PingOne Entity ID

Use the exact SSO SP Name, including case, scheme, and trailing slash.

NameID

Use the email address that matches the RocketDocs SSO User ID.

📋Note:

Keep Allow Users To Use System Login on during setup and testing. This setting helps prevent an administrator lockout.

 Choose how RocketDocs creates users

Existing users

Keep Auto Generate SSO User off.

SCIM provisioning

Keep Auto Generate SSO User off. Complete Steps 12 through 17.

JIT provisioning

Turn on Auto Generate SSO User only when your organization approves JIT.

 

Step 2: Create the PingOne SAML application

  1. Sign in to the PingOne admin console.
  2. Select the correct PingOne environment.
  3. Go to Applications > Applications.
  4. Select the plus icon.
  5. Enter RocketDocs - <company name> in Application Name.
  6. Enter a description if required.
  7. Select SAML Application.
  8. Select Configure.
  9. Select Manually Enter.

Ping 1

📋Note:

The application name is visible to PingOne administrators. Users see it when Application Portal Display is on.

 

Step 3: Enter the SAML endpoints

  1. Find the manual SAML configuration fields.
  2. Enter the RocketDocs ACS URL in ACS URLs.
  3. Enter the exact RocketDocs SSO SP Name in Entity ID.
  4. Save the application configuration.

PingOne field

Value

ACS URLs

https://<tenant>.rocketdocs.com/api/auth/AssertionConsumerService

Entity ID

Use the exact RocketDocs SSO SP Name.

📋Note:

The PingOne Entity ID and RocketDocs SSO SP Name must match exactly. The ACS URL is a separate value.

 

Check the exact match

  • The letter case matches.

  • The https:// scheme matches.

  • The domain name matches.

  • The trailing slash matches.

Do not change an existing SSO SP Name during this setup.

 

Step 4: Configure signing and NameID

  1. Open the application Configuration tab.
  2. Edit the SAML configuration.
  3. Enter the values in the following table.
  4. Save the configuration.

PingOne setting

Value

Signing Key

Select the active RSA signing key.

Sign

Sign Assertion

Signing Algorithm

RSA_SHA256

Encryption

Off

Subject NameID format

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

Enforce Signed Authentication

Request

Off

SLO Endpoint

Leave blank.

SLO Response Endpoint (optional)

Leave blank.

Configure the SAML subject

  1. Open the Attribute Mappings tab.
  2. Edit the saml_subject mapping.
  3. Select the PingOne email attribute.
  4. Save the mapping.

📋Note:

The SAML subject must contain the email address used as the RocketDocs SSO User ID.

 

 Step 5: Configure optional JIT attributes

For existing or SCIM-provisioned users

  1. Keep the saml_subject email mapping.
  2. Do not add another SAML attribute mapping.
  3. Make sure the email matches the RocketDocs SSO User ID.

Only when RocketDocs JIT provisioning is on Add the following mappings in the PingOne Attribute Mappings tab.

SAML attribute name

PingOne value

email

Email Address

firstname

Given Name

lastname

Family Name
  1. Add the email mapping.
  2. Add the firstname mapping.
  3. Add the lastname mapping.
  4. Save the mappings.

📋Notes:

  • RocketDocs does not require a group or role claim for sign-in.
  • JIT requires all three attributes. Keep JIT off when SCIM creates the users.

 

 Step 6: Limit access to approved users

  1. Open the application Access tab.
  2. Select the pencil icon.
  3. Find the approved pilot group.
  4. Select the pilot group.
  5. Confirm that the group appears under Applied Groups.
  6. Select Save.

ping 2

📋Note:

All users can access the application when no group is listed. Apply an approved pilot group before you enable the application.

Start with one approved test user in the pilot group.

 

Step 7: Get the PingOne IdP values

  1. Open the application Overview tab.
  2. Find Connection Details.
  3. Copy the Issuer ID.
  4. Download the IdP metadata XML.
  5. Open the metadata XML in a plain-text editor.
  6. Find the SingleSignOnService element.
  7. Copy its Location value.
  8. Open the Configuration tab.
  9. Select the pencil icon.
  10. Select Download Signing Certificate.
  11. Select the X509 PEM certificate format.
  12. Save the certificate file.

PingOne value

RocketDocs use

Issuer ID

SSO Idp Name

SingleSignOnService Location

SSO Idp SingleSignOnServiceUrl

X509 PEM certificate

SSO Idp PartnerCertificates

 

Step 8: Open the RocketDocs SSO settings

  1. Sign in to RocketDocs as an administrator.
  2. Open Settings.
  3. Select System Settings.
  4. Find the SSO section.
  5. Select the pencil icon to edit a setting.

pung 3

📋Note:

Enter the values from your PingOne application in the matching RocketDocs fields.

If you cannot see System Settings, ask a RocketDocs administrator for access.


Step 9: Enter the RocketDocs SSO values

RocketDocs setting

Value

Turn SSO on/off

Keep off during setup. Set on after all values are saved.

Auto Generate SSO User

Set off for existing users or SCIM. Set on only for approved JIT provisioning.

Allow Users To Use System Login

Set on during setup and testing.

Auto Generate Based On This User

Leave blank unless JIT is on. For JIT, select an active template user.

Want Assertion Signed

true

Want Response Signed

false

SSO Idp Name

Paste the PingOne Issuer ID.

SSO Idp SignAuthnRequest

false

SSO Idp SingleSignOnServiceUrl

Paste the metadata SingleSignOnService Location value.

SSO Idp PartnerCertificates

Paste the complete PingOne IdP certificate text.

SSO Idp Description

Optional. Enter PingOne or another useful description.

SSO SP Name

Enter the exact PingOne Entity ID.

SSO SP Description

Optional. Enter a useful RocketDocs description.

 

Step 10: Paste the PingOne certificate

  1. Find the certificate file that you downloaded from PingOne.
  2. Open the file in a plain-text editor.
  3. Select the complete certificate text.
  4. Copy the text without changing it.
  5. Edit SSO Idp PartnerCertificates in RocketDocs.
  6. Paste the complete certificate text.
  7. Save the setting.

The copied text must include both boundary lines and all text between them.

-----BEGIN CERTIFICATE-----

MIIC...all certificate characters and lines...

-----END CERTIFICATE 

 

📋Note:

Copy the entire string. Include BEGIN CERTIFICATE and END CERTIFICATE. Do not remove characters, spaces, or line breaks.

 

Confirm the saved certificate

  1. Return to the RocketDocs SSO settings.
  2. Find SSO Idp PartnerCertificates.
  3. Confirm that RocketDocs reports Certificate present: True.

 

Step 11: Activate and test SSO

Activate SSO

  1. Check all RocketDocs SSO values.
  2. Keep Allow Users To Use System Login on.
  3. Set Turn SSO on/off to on.
  4. Enable the RocketDocs application in PingOne.
  5. Keep the current RocketDocs administrator session open.
  6. Open a private browser window.
  7. Open https://<tenant>.rocketdocs.com/app/login.
  8. Sign in with the approved PingOne test user.
  9. Confirm that the correct RocketDocs user opens.

Run an optional PingOne-initiated test

ping 4

  1. Open the application Overview tab.
  2. Open the Initiate Single Sign-On URL.
  3. Confirm that the correct RocketDocs user opens.

If the test fails

PingOne denies access

Confirm that the pilot group appears under Applied Groups.

Audience error

Compare the PingOne Entity ID with the RocketDocs SSO SP Name.

User not found

Compare the SAML subject with the RocketDocs SSO User ID.

Signature error

Paste the complete current PingOne IdP certificate again.

Expand access only after the pilot test succeeds.


Step 12: Generate the RocketDocs SCIM credentials

Skip Steps 12 through 17 if your organization does not use SCIM provisioning.

📋Note:

These steps configure user provisioning only. Contact RocketDocs Support before you add group provisioning to the PingOne rule.

Check access

  1. Sign in to RocketDocs as a system administrator.
  2. Open Settings.
  3. Select System Settings.
  4. Find the SSO section.
  5. Confirm that SCIM Provisioning appears beside SSO.

📋Note:

If SCIM Provisioning does not appear, contact RocketDocs Support.

 

Generate the credentials 

📋Note:

A new token immediately invalidates the current SCIM token. Generate a token when you are ready to update PingOne.

  1. Select SCIM Provisioning.
  2. Select Generate token.
  3. Copy the SCIM Endpoint URL.
  4. Copy the Bearer Token before you close the drawer.
  5. Record the displayed expiration date.

SCIM Endpoint URL

https://<tenant>.rocketdocs.com/integrationapi/scim

Bearer Token

Use the token that RocketDocs shows after generation.

📋Note:

Store the bearer token in your approved secret store. RocketDocs does not show the token again after you close the drawer.

 

 Step 13: Create the PingOne SCIM connection

  1. Go to Integrations > Provisioning in PingOne.
  2. Select the plus icon.
  3. Select New Connection.
  4. Select Identity Store.
  5. Select SCIM Outbound.
  6. Select Next.
  7. Enter RocketDocs - <company name> as the connection name.
  8. Enter a description if required.
  9. Select Next. Configure authentication

PingOne field

Value

SCIM Base URL

Paste the RocketDocs SCIM Endpoint URL.

Users Resource

/Users

Groups Resource

/Groups

SCIM Version

2.0

Authentication Method

OAuth 2 Bearer Token

OAuth Access Token

Paste only the RocketDocs bearer token value.

Auth Type Header

Bearer
  1. Select Test connection.
  2. Confirm that the connection test succeeds.
  3. Continue to the connection preferences.

 

Step 14: Configure the SCIM preferences

PingOne field

Value

User filter expression

userName Eq "%s"

User Identifier

userName

Group Membership Handling

Use Merge for shared management. Use Overwrite when PingOne manages all memberships.

Enable users creation

On

Enable users updation

On

Enable users disable

On

Enable users deprovision

On

Remove Action

Disable

Deprovision on rule deletion

Off
  1. Enter the preference values.
  2. Enter the user action values.
  3. Select Save.

ping 5

📋Note:

Use Disable for Remove Action. Delete deactivates the user, marks it deleted, and removes assigned access.

If the test fails, check the endpoint, token, resources, and authentication header.

 

Step 15: Create the outbound provisioning rule

  1. Return to Integrations > Provisioning.
  2. Select the plus icon.
  3. Select New Rule.
  4. Select PingOne as Source.
  5. Select the RocketDocs SCIM connection as the target.
  6. Select Continue.
  7. Enter a rule name and description.
  8. Select Next.
  9. Add a filter for the approved pilot users.
  10. Select Next.

Map the user attributes

Use the same email for the SAML subject and SCIM userName.

PingOne source

SCIM target

RocketDocs value

Email Address

userName

SSO User ID

Given Name

givenName

First name

Family Name

familyName

Last name

Email Address

workEmail

Primary email
  1. Add each required attribute mapping.
  2. Select Save.
  3. Enable the provisioning rule.
  4. Open Sync Status.
  5. Confirm that the first sync starts.

Step 16: Test SCIM provisioning

Provision one test user 

📋Note:

A new SCIM user has the user role. The user has no license, privileges, restrictions, or group memberships. Assign the required access before the user signs in.

  1. Add one approved test user to the pilot rule.
  2. Open the PingOne rule Sync Status.
  3. Confirm that PingOne reports a successful sync.
  4. Open RocketDocs User Management.
  5. Find the test user.
  6. Confirm the first name, last name, email, and SSO User ID.
  7. Assign a RocketDocs license.
  8. Assign any required groups or privileges.
  9. Sign in through PingOne as the test user.

Test an update

  1. Change an approved profile value in PingOne.
  2. Wait for PingOne to send the update.
  3. Confirm the new value in RocketDocs.
  4. Restore the approved profile value in PingOne.

Test deactivation

  1. Disable the approved test user in PingOne.
  2. Confirm that RocketDocs deactivates the test user.
  3. Confirm that the user cannot sign in.
  4. Restore the user when required.

Expand the rule only after all pilot tests succeed.

Keep Auto Generate SSO User off for SCIM-provisioned users.

 

Step 17: Maintain and troubleshoot SCIM

Replace a SCIM token

Replace the SCIM token before its displayed expiration date.

  1. Plan a short provisioning interruption.
  2. Open System Settings > SSO > SCIM Provisioning.
  3. Select Regenerate token.
  4. Copy the new bearer token.
  5. Replace the PingOne OAuth Access Token immediately.
  6. Run Test connection again.

Select Revoke token when your organization stops SCIM provisioning.

If SCIM fails

Connection test fails

Check the SCIM Endpoint URL, resources, and current bearer token.

PingOne reports unauthorized

Replace a lost, expired, or revoked token.

User already exists

Match the PingOne email and userName to the RocketDocs SSO User ID.

User cannot sign in

Check the SAML subject, PingOne access, and RocketDocs SSO User ID.

User has no access

Assign a RocketDocs license and any required groups or privileges.

 

Get support

Email support@rocketdocs.com if you need help.

Include the tenant URL, PingOne Issuer ID, error message, and test time.

Do not send a bearer token, private key, or user password.

Related help: Add a PingOne application, Edit a PingOne SAML application, and control application access. Also see Download IdP metadata, Create a SCIM connection, and create an outbound rule. PingOne interface labels can change.