---
title: "PingFederate SSO Setup with Ping Directory"
slug: "pingfederate-sso-setup-with-ping-directory"
status: "new"
updated: 2026-09-25T13:49:21Z
published: 2026-09-25T13:49:21Z
canonical: "docs.revealdata.com/pingfederate-sso-setup-with-ping-directory"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revealdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PingFederate SSO Setup with Ping Directory

This article explains how to configure **PingFederate SSO with PingDirectory** for the Reveal Hold application.

The setup includes:

1. Creating an LDAP Password Credential Validator
2. Creating an HTML Form IdP Adapter
3. Mapping the IdP Adapter to the Policy Contract
4. Creating an Access Token Management instance
5. Creating Access Token Mappings
6. Creating an OpenID Connect Policy
7. Creating an OpenID Connect client
8. Creating the required groups and users in Ping Directory
9. Providing the required PingFederate runtime URL, client ID, and client secret to the Reveal Hold application

The configuration below is based on the provided setup information.

Before starting, make sure:

- PingFederate is installed and accessible.
- PingDirectory is already configured and available as an LDAP data store.
- You have access to the PingFederate Admin Console.
- You have the required PingDirectory administrator credentials.
- You have the required access to create users and groups in PingDirectory.

---

### 1. Create the Password Credential Validator

#### Step 1: Open Password Credential Validators

1. Log in to the **PingFederate Admin Console**.
2. From the top menu, click **System**.
3. Open **Password Credential Validators.**

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Screenshot%202026-09-16%20152707.png)
4. Click **Create New Instance.**

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping2.png)

#### Step 2: Enter the Instance Details

1. Enter the following values:

| Field | Value |
| --- | --- |
| Instance Name | `RevealHoldSSOvalidator` |
| Instance ID | `RevealHoldSSOvalidator` |
| Type | `LDAP Username Password Credential Validator` |
| Parent Instance | None |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping3.png)

1. Click **Next**.

#### Step 3: Configure LDAP

In the **Instance Configuration** page, enter the following values:

| Field | Value |
| --- | --- |
| LDAP Datastore | `PingDirectory-Dev` |
| Search Base | `Provide the required base DN` |
| Search Filter | `(mail=${username})` |
| Scope of Search | `Subtree` |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping4.png)

Click **Next** and **Next**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping5.png)

Review the configuration on the **Summary** page and click **Save**.

---

### 2. Create OAuth Scopes

1. Under **System option**, click **OAuth Scopes**.
2. Add the following scopes in the **Common Scope** page and save the configuration.

| Scope Name | Description |
| --- | --- |
| email | Email scope |
| openid | OpenID Connect scope |
| profile | Profile scope |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping6.png)

### 3. Create the HTML Form IdP Adapter

#### Step 1: Open IdP Adapters

1. From the top menu, click **Authentication**.
2. Select **IdP Adapters**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping7.png)
3. Click **Create New Instance**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping8.png)

#### Step 2: Enter Adapter Details

| Field | Value |
| --- | --- |
| Instance Name | `RevealHoldSSOHTMLform` |
| Instance ID | `RevealHoldSSOHTMLform` |
| Type | `HTML Form IdP Adapter` |
| Parent Instance | None |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping9.png)

Click **Next**.

#### Step 3: Add the Credential Validator

On the IdP Adapter configuration page:

1. Click **Add a new row** under **Credential Validators**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping10.png)
2. Select `RevealHoldSSOvalidator`.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping11.png)
3. Click **Update**.
4. Click **Next**.

#### Step 4: Add Contract Attributes

Add the following attributes:

| Section | Attribute |
| --- | --- |
| Core Contract | `policy.action` |
| Core Contract | `username` |
| Extend the Contract | `cn` |
| Extend the Contract | `dn` |
| Extend the Contract | `email` |
| Extend the Contract | `family_name` |
| Extend the Contract | `given_name` |
| Extend the Contract | `groups` |
| Extend the Contract | `mail` |
| Extend the Contract | `memberOf` |
| Extend the Contract | `mobile` |
| Extend the Contract | `sn` |
| Extend the Contract | `telephoneNumber` |
| Extend the Contract | `title` |
| Extend the Contract | `uid` |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/ping-one.png)

Click **Next**.

#### Step 5: Configure Adapter Attributes

Configure the attributes as follows:

| Attribute | Pseudonym | Mask Log Values |
| --- | --- | --- |
| `cn` | No | No |
| `dn` | No | No |
| `email` | Yes | No |
| `family_name` | Yes | No |
| `given_name` | Yes | No |
| `groups` | Yes | No |
| `mail` | No | No |
| `memberOf` | Yes | No |
| `mobile` | No | No |
| `policy.action` | No | No |
| `sn` | No | No |
| `telephoneNumber` | No | No |
| `title` | No | No |
| `uid` | No | No |
| `username` | Yes | No |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Screenshot%202026-09-16%20153107.png)

1. Set:
  1. **Unique Contract Attribute:** None
  2. **Mask All OGNL-Expression Generated Log Values:** No
2. Click **Next**.
3. Review the Adapter Contract Mapping and click **Next**.
4. Review the **Summary** page and click **Save**.

#### Step 6: Configure Adapter Contract Mapping — Add Attribute Source

1. In the IdP Adapter configuration, click the Adapter Contract Mapping tab (or click **Next** until you reach the **Adapter Contract Mapping** step).
2. Click **Configure Adapter Contract**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Screenshot%202026-09-16%20153121.png)
3. On the Adapter Contract Mapping screen, click + Add Attribute Source.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Screenshot%202026-09-16%20153203.png)
4. Fill in the following fields:

The Add Attribute Source wizard opens with a Data Store tab.

| Field | Value |
| --- | --- |
| Attribute Source ID | RevealSSOgroup |
| Attribute Source Description | RevealSSOgroup |
| Active Data Store | PingDirectory-Dev |
| Data Store Type | LDAP (auto-populated) |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Screenshot%202026-09-16%20153229.png)

1. Click **Next** to proceed to the **LDAP Directory Search** tab.
2. Configure the **LDAP** search settings as follows:

| Field | Value |
| --- | --- |
| Base DN | Provide the required base DN |
| Search Scope | Subtree |
| Attributes to Return | Subject DN, cn, givenName, mail, sn |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Screenshot%202026-09-16%20153247.png)

To add attributes:

- Click **Add Attribute** next to the attributes list.
- Select **Subject DN** from the dropdown — this captures the full LDAP distinguished name.
- Repeat and add: **cn, givenName, mail, sn**.

1. Click **Next** to proceed to the LDAP Filter tab.
2. Enter the following LDAP search filter: **(mail=${username})**

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping18.png)

1. Click **Next**, then **Done** to save the attribute source.

#### Step 7: Configure Adapter Contract Fulfillment

In the Adapter Contract Fulfillment table, for each attribute listed below:

- Click the Source dropdown and change it from Adapter to LDAP (RevealSSOgroup).
- In the Value dropdown that appears, select the corresponding LDAP attribute from the list.

Apply the following mappings:

| Contract Attribute | Source > Value |
| --- | --- |
| cn | LDAP (RevealSSOgroup) → cn |
| email | LDAP (RevealSSOgroup) → mail |
| given_name | LDAP (RevealSSOgroup) → givenName |
| family_name | LDAP (RevealSSOgroup) → sn |
| mail | LDAP (RevealSSOgroup) → mail |
| sn | LDAP (RevealSSOgroup) → sn |
| dn | LDAP (RevealSSOgroup) → Subject DN |
| username | Adapter |
| groups | Adapter |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping19.png)

After updating all attributes, click **Next**, then **Save** to save the adapter configuration.

---

### 4. Map the IdP Adapter to the Policy Contract

#### Step 1: Open Policy Contract Grant Mapping

1. Go to **Authentication**.
2. Open **Policy Contract Grant Mapping**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping20.png)
3. Select **IdP Adapter Grant Mapping**.
4. Select the IdP Adapter created earlier.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping21.png)
5. Click **Add Mapping**.
6. Click **Next**.

#### Step 2: Configure Contract Fulfillment

Configure the following values:

| Contract | Source | Value | Actions |
| --- | --- | --- | --- |
| `USER_KEY` | Adapter | `username` | None available |
| `USER_NAME` | Adapter | `username` | None available |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping22.png)

Click **Next**.

Review the Summary and click **Save**.

---

### 5. Create Access Token Management

#### Step 1: Open Access Token Management

1. From the top menu, click **Application**.
2. Select **Access Token Management**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping23.png)
3. Click **Create New Instance**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping24.png)

#### Step 2: Enter the Instance Details

| Field | Value |
| --- | --- |
| Instance Name | `RevealHoldSSOATM` |
| Instance ID | `RevealHoldSSOATM` |
| Type | `Internally Managed Reference Tokens` |
| Parent Instance | None |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping25.png)

Click **Next** and **Next**.

#### Step 3: Configure the Access Token Attribute Contract

Add the following attributes:

| Field | Value |
| --- | --- |
| Subject Attribute Name | `USER_KEY` |
| Extended Contract Attribute | `email` |
| Extended Contract Attribute | `given_name` |
| Extended Contract Attribute | `groups` |
| Extended Contract Attribute | `sub` |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping26.png)

Set **Multi-Valued = No** for all listed attributes and click **Next**.

#### Step 4: Configure Access Control

1. Select the **Restrict Allowed Clients** checkbox.
2. Select your **Client ID** from the list.
3. Click **Add**.
4. Click **Next** to proceed to the next step.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping27.png)
5. Review the Summary, and click **Save**.

---

### 6. Create Access Token Mapping

#### Step 1: Open Access Token Mappings

1. Under **Application → Access Token Management**, open **Access Token Mappings**.
2. Select:
  1. IdP Adapter: `RevealHoldSSOHTMLform`
  2. Access Token Manager: `RevealHoldSSOATM`

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping28.png)
3. Click **Add Mapping**.

#### Step 2: Configure Contract Fulfillment

Enter the following:

| Contract | Source | Value | Actions |
| --- | --- | --- | --- |
| `email` | Adapter | `email` | None available |
| `given_name` | Adapter | `given_name` | None available |
| `groups` | Adapter | `groups` | None available |
| `sub` | Adapter | `cn` | None available |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping29.png)

Click **Next**.

Review the **Summary** and click **Save**.

---

### 7. Create OpenID Connect Policy

#### Step 1: Open OpenID Connect Policy Management

1. Under **Application**, open **OpenID Connect Policy Management**.
2. Click **Add Policy**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping30.png)

#### Step 2: Enter Policy Details

| Field | Value |
| --- | --- |
| Policy ID | `RevealholdssoOpenID` |
| Name | `RevealholdssoOpenID` |
| Access Token | `RevealHoldSSOATM` |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping31.png)

Click **Next**.

#### Step 3: Configure the Attribute Contract

Delete the existing extended contract attributes and add the following:

| Attribute | Override Default Delivery | ID Token | User Info | Multi-Valued |
| --- | --- | --- | --- | --- |
| `cn` | No | No | Yes | No |
| `dn` | No | No | Yes | No |
| `email` | No | No | Yes | No |
| `givenName` | No | No | Yes | No |
| `groups` | No | No | Yes | No |
| `mail` | No | No | Yes | No |
| `mobile` | No | No | Yes | No |
| `name` | No | No | Yes | No |
| `roles` | No | No | Yes | No |
| `sn` | No | No | Yes | No |
| `telephoneNumber` | No | No | Yes | No |
| `title` | No | No | Yes | No |
| `uid` | No | No | Yes | No |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping32.png)

Click **Next**.

---

### 8. Configure Attribute Source and User Lookup

#### Step 1: Add Attribute Source

1. On **Attribute Sources & User Lookup:**
  1. Click **Add Attribute Source**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping33.png)
2. Enter the following:

| Field | Value |
| --- | --- |
| Attribute Source ID | `RevealHoldSSOsource` |
| Description | `RevealHoldSSOsource` |
| Active Data Store | `Pingdirectory` |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping34.png)

1. Click Next.

#### Step 2: Configure LDAP Directory Search

Configure the following:

| Field | Value |
| --- | --- |
| Base DN | Provide the required base DN |
| Search Scope | `Subtree` |

Add the following attributes:

- `cn`
- `givenName`
- `mail`
- `mobile`
- `sn`
- `telephoneNumber`
- `title`
- `uid`

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping35.png)

Click **Next**.

#### Step 3: Add LDAP Filter

Add the following LDAP filter:

```plaintext
(cn=${sub})
```

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping36.png)

Click **Next**.

Review the Summary and click **Save**.

---

### 9. Configure Contract Fulfillment

Configure the OpenID Connect Policy Contract Fulfillment as follows:

| Attribute Contract | Source | Value | Actions |
| --- | --- | --- | --- |
| `cn` | LDAP (`legalholdidcattribute`) | `cn` | None available |
| `dn` | LDAP (`legalholdidcattribute`) | `Subject DN` | None available |
| `email` | Access Token | `email` | None available |
| `givenName` | LDAP (`legalholdidcattribute`) | `givenName` | None available |
| `groups` | Expression | Group expression | Edit |
| `mail` | LDAP (`legalholdidcattribute`) | `mail` | None available |
| `mobile` | LDAP (`legalholdidcattribute`) | `mobile` | None available |
| `name` | Access Token | `given_name` | None available |
| `roles` | Access Token | `groups` | None available |
| `sn` | LDAP (`legalholdidcattribute`) | `sn` | None available |
| `sub` | Access Token | `sub` | None available |
| `telephoneNumber` | LDAP (`legalholdidcattribute`) | `telephoneNumber` | None available |
| `title` | LDAP (`legalholdidcattribute`) | `title` | None available |
| `uid` | LDAP (`legalholdidcattribute`) | `uid` | None available |

---

### 10. Configure the Groups Expression

The groups expression is used to retrieve the groups for the logged-in user from PingDirectory.

Use the following expression as the base configuration:

```plaintext
#groupCnOnly = new java.util.ArrayList(),
#env = new java.util.Hashtable(),
#env.put("java.naming.factory.initial", "com.sun.jndi.ldap.LdapCtxFactory"),
#env.put("java.naming.provider.url", "ldaps://ping-dev.legalhold.nl:1636"),
#env.put("java.naming.security.authentication", "simple"),
#env.put("java.naming.security.principal", "cn=Directory Manager"),
#env.put("java.naming.security.credentials", "<Directory Manager password>"),
#ctx = new javax.naming.directory.InitialDirContext(#env),
#sc = new javax.naming.directory.SearchControls(),
#sc.setSearchScope(2),
#userResults = @java.util.Collections@list(#ctx.search("Provide the required base DN", "(cn=" + #this.get("sub") + ")", #sc)),
#userDN = #userResults.size() > 0 ? #userResults.get(0).getNameInNamespace() : "",
#filter = "(member=" + #userDN +")",
#en = #ctx.search("ou=Groups,dc=legalhold,dc=nl", #filter, #sc),
#resultsList = @java.util.Collections@list(#en),
#resultsList.{
  #attrs = #this.getAttributes(),
  #groupCnOnly.add(#attrs.get("cn").get())
},
#ctx.close(),
new org.sourceid.saml20.adapter.attribute.AttributeValue(#groupCnOnly)
```

**Important**

Before saving the expression:

- Update the **LDAP URL**.
- Update the **Directory Manager username**.
- Replace the password placeholder with the correct **PingDirectory Directory Manager password**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping37.png)

After updating the values, click **Next**, review the Summary, and click **Save**.

---

### 11. Create the OpenID Connect Client

#### Step 1: Open Clients

1. Under **Application**, click **Clients**.
2. Click **+ Add Client**.

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping38.png)

#### Step 2: Configure General Information

| Field | Value |
| --- | --- |
| Client ID | `250820260000` |
| Client Name | `RevealHoldSSOCLient01` |

#### Step 3: Configure Client Authentication

| Field | Value |
| --- | --- |
| Authentication Method | `Client Secret` |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping39.png)

#### Step 4: Configure Secret Storage

| Field | Value |
| --- | --- |
| Secret Storage | `Internally Managed` |

For **Client Secret**:

- Select **Generate.**
- Copy and securely store the generated client secret.

For **Client Secret Retention Period**:

- Select **Use Global Settings**.

#### Step 5: Configure Redirect URI

Add the required Redirect URI: **https://legalhold.one/signin-mt-oidc/**

Make sure the actual application URL is used for the target environment.

#### Step 6: Configure Grant Types

Check the following:

- Authorization Code
- Implicit
- Refresh Token
- Client Credentials

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping40.png)

#### Step 7: Configure OAuth Settings

Set the following:

| Field | Value |
| --- | --- |
| OpenID Connect Policy | `RevalholdssoOpenID` |
| Default Access Token Manager | `RevealHoldSSOATM` |
| Bypass Authorization Approval | Enabled |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping41.png)

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping42.png)

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/PIng43.png)

Click **Save**.

After saving, copy the **Client ID** and **Client Secret** and store them securely.

---

### 12. Create Groups in PingDirectory

Create the following groups in PingDirectory:

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping44.png)

Add users to the appropriate group based on their Reveal Hold application role.

---

### 13. Create Users in PingDirectory

When creating users, make sure the required LDAP attributes are populated.

The provided example contains the following attributes:

| Attribute | Example Value |
| --- | --- |
| `objectClass` | `top` |
| `objectClass` | `person` |
| `objectClass` | `organizationalPerson` |
| `objectClass` | `inetOrgPerson` |
| `cn` | `madhu` |
| `sn` | `dhannaram` |
| `createTimestamp` | `20260819120830.858Z` |
| `creatorsName` | `cn=Directory Manager,cn=Root DNs,cn=config` |
| `entryUUID` | `a8d40f19-fa9e-4dd0-82fb-ac78b840a511` |
| `givenName` | `madhu dannaram` |
| `mail` | `mdhannaram@revealdata.com` |
| `modifiersName` | `cn=Directory Manager,cn=Root DNs,cn=config` |
| `modifyTimestamp` | `20260819121047.881Z` |
| `pwdChangedTime` | `20260819120830.858Z` |
| `subschemaSubentry` | `cn=schema` |
| `uid` | `madhu.d` |
| `userPassword` | Encrypted/hashed password |

![](https://cdn.us.document360.io/3e21d801-ca9f-4c51-93db-9cbd32741f3d/Images/Documentation/Ping45.png)

> [!NOTE]
> Note
> 
> The timestamps, UUID, and other system-generated values in this table are examples from the provided configuration and should not be copied as fixed values for new users.

---

### 14. Final Information Required for Reveal Hold

After the PingFederate configuration is completed, provide the following information to configure SSO in the Reveal Hold application:

**PingFederate Runtime Engine URL**: The PingFederate runtime engine uses **port 9031** in the provided setup. Provide the correct PingFederate runtime engine URL for the environment.

**Client ID**: Provide the client ID created in the OpenID Connect client configuration.

**Client Secret**: Provide the client secret generated while creating the OpenID Connect client.

> [!NOTE]
> Note
> 
> The username is configured using the `email` field.

---

### 15. Configuration Checklist

Use this checklist to confirm that the setup is complete:

- PingDirectory data store is available in PingFederate.
- `RevealHoldSSOvalidator` is created.
- LDAP search base and search filter are configured.
- `RevealHoldSSOHTMLform` IdP Adapter is created.
- `RevealHoldSSOvalidator` is linked to the IdP Adapter.
- Required IdP Adapter contract attributes are added.
- IdP Adapter is mapped to the Policy Contract.
- `RevealHoldSSOATM` Access Token Manager is created.
- Access Token attributes are configured.
- Access Token Mapping is created.
- `RevealholdssoOpenID` OpenID Connect Policy is created.
- Attribute source is configured.
- LDAP directory search is configured.
- LDAP filter is configured.
- Contract fulfillment is configured.
- Groups expression is configured with the correct environment values.
- OpenID Connect client is created.
- Client ID and Client Secret are securely stored.
- Required PingDirectory groups are created.
- Users are created and assigned to the correct groups.
- PingFederate runtime engine URL is available.
- Client ID, Client Secret, and runtime URL are provided to the Reveal Hold application.

### 16. Important Final Tasks and Network Requirements

**Step 1 – PingFederate URL** Customer should provide the PingFederate Runtime Engine URL while Reveal Hold will allow the provided DNS/URL in our network. Please ensure the URL is accessible from the Reveal Hold environment.

**Step 2 – IP Whitelisting** Reveal Hold will provide our IP address to the customer while customer should whitelist our IP address in their network. This will allow Reveal Hold to access the PingFederate URL.