Once you have configured the LastPass Data Store, create a new Service Provider connection.

• 1. Open PingFederate.
  2. Select Applications > SP Connections > Create Connection.
  3. On the Connection Template tab, enable Do not use a template for this connection.
  4. Select Next.
  5. On the Connection Type tab, enable Browser SSO Profiles.
  6. Set the Protocol to SAML2.0.
  7. Select Next.
  8. On the Connection Options tab, enable Browser SSO if not enabled by default, then click Next.
  9. On the Import Metadata tab, select None.
  10. On the General info tab, enter https://accounts.lastpass.com in the Partner's Entity ID field.
  11. Enter LastPass in the Connection Name field.
  12. Select Next.

      

  13. On the Browser SSO tab, select Configure Browser SSO.

Configure Browser SSO.

14. Select Browser SSO > Configure Browser SSO.
15. Select SP-initiated SSO.

Configure Assertion Creation.

16. On the Assertion Lifetime tab, keep the default values, then click Next.
17. On the Assertion Creation tab, select Configure Assertion Creation.
18. Select Standard in Identity Mapping, then click Next.
19. On the Attribute Contract tab, select SAML_SUBJECT.
20. Set the Subject Name Format to urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified.
21. Add the following attributes to Extend the Contract with the Attribute Name Format urn:oasis:names:tc:SAML:2.0:attrname-format-unspecified:
    • DirectoryUserName
    • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
    • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
    • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
    • LastPassKeyPart
    • LastPassKeyPartSignature

    

22. Select Next.

Map new adapter instance.

23. On the Authentication Source Mapping tab, select Map New Adapter instance.
24. Select your desired Adapter Instance, then click Next.
25. On the Mapping Method tab, enable Retrieve Additional attributes from multiple data stores using one mapping, then click Next.

Add the Active Directory attribute source.

26. On the Attribute Sources & User Lookup tab, select Add Attribute Source.
27. On the Data Store tab, configure the following settings:

    Configuration settings	Instructions
    Attribute Source ID	0
    Attribute Source Description	Enter your description
    Active Data Store	Active Directory

28. Select Next.
29. On the LDAP Directory search tab, configure the settings as follows:

    Configuration settings	Instructions
    Base DN	Enter your domain (for example, DC=testcorp,DC=com).
    Search Scope	Set to SUBTREE_SCOPE.
    Attributes to return from search	Set Root Object Class to Show All Attributes. Add the following attributes: Subject DN givenName mail sAMAccountName sn

30. Select Next.
31. On the LDAP Filter tab, enter (sAMAccountName=${username}) in the "Filter" field.
32. On the Summary tab, select Done.

    

Add the LastPass Data Store Directory attribute source.

33. On the Attribute Sources & User Lookup tab, select Add Attribute Source.
34. On the Data Store tab, configure the settings as follows:

    Configuration settings	Instructions
    Attribute Source ID	1
    Attribute Source Description	Enter your description
    Active Data Store	LastPass Federated Login

35. Select Next.
36. On the Configure Data Source Filters tab, enter ${mail} into the "LASTPASSDATASTORE USERNAME" field (or enter the equivalent attribute name that contains the user’s email address).
37. Select Next.
38. On the Configure Data Source Fields tab, enable the LASTPASSKEYPART and LASTPASSKEYPARTSIGNATURE settings.
39. On the Summary tab, select Done.

    

Configure the Attribute Contract Fulfillment mapping.

40. On the Attribute Contract Fulfillment tab, configure the settings as follows:

    Attribute Contract	Source	Value
    Directory Username	LDAP (AD)	sAMAccountName
    LastPassKeyPart	Other (LastPass)	LastPassKeyPart
    LastPassKeyPartSignature	Other (LastPass)	LastPassKeyPartSignature
    SAML_SUBJECT	Text	LastPassFederatedLogin
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress	LDAP (AD)	mail
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname	LDAP (AD)	givenName
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname	LDAP (AD)	sn

41. Select Next.

    

42. Optional: Specify any authorization condition(s) on the Issuance Criteria tab, then click Next.
43. On the Summary tab, click Done.
44. On the Assertion Creation tab, select Next.

Configure the Protocol settings.

45. On the Protocol Settings tab, select Configure Protocol Settings.
46. On the Assertion Consumer Service URL tab, enable the Default setting.
47. Set the SAML Binding to POST.
48. Enter the Endpoint URL, which is the LastPass Assertion Consumer Service URL copied in Step #2.
49. Select Next.
50. On the Allowable SAML Bindings tab, enable the POST setting.
51. Leave the default values for other settings as is.
52. On the Summary tab, select Done.

    

    Result: Your Browser SSO settings are configured.

Set the credentials.

53. On the Credentials tab, select Configure Credentials
54. On the Digital Signature Settings tab, select your Signing Certificate.
55. Enable the INCLUDE THE CERTIFICATE IN THE SIGNATURE <KEYINFO> ELEMENT setting, and then click Next.
56. On the Summary tab, select Done.

    

57. On the Credentials tab, click Next.
58. Review your settings on the Activation & Summary tab.
59. Select Save.