You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/administration/saml-2-0-configuration.mdx
+47-49Lines changed: 47 additions & 49 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,16 +6,16 @@ sidebar_position: 13
6
6
Device42 integrates with SAML 2.0 in conjunction with AD or LDAP user synchronizations to provide Single Sign On (SSO) support in Device42. Once users are added to Device42 via Active Directory or LDAP, they will automatically be logged into Device42 when they load the site.
7
7
8
8
:::note
9
-
Since authorization is handled by Device42, the user needs to exist within Device42 before they can log in for single sign on functionality to work.
9
+
Since authorization is handled by Device42, the SSO functionality only works if the user account already exists within Device42 before the user logs in.
10
10
:::
11
11
12
-
SAML configuration varies between providers, but we'll provide the steps for configuration with Microsoft ADFS, Okta and Onelogin below as examples. Device42 SSO should also work with **any**SAML2.0 compatible Identity Provider, and has been confirmired working with IDaaS providers Centrify and PingIdentity's PingOne and PingFederate as well.
12
+
SAML configuration varies between providers, but we'll provide the steps for configuration with Microsoft ADFS, Okta, and Onelogin below as examples. Device42 SSO should also work with **any**SAML 2.0 compatible Identity Provider and has been confirmed to work with IDaaS providers, Centrify, and PingIdentity's PingOne and PingFederate.
13
13
14
14
Should you need further assistance, please contact [Support](mailto:[email protected]).
15
15
16
16
## Microsoft ADFS Configuration
17
17
18
-
Add new relying party trust.
18
+
Add a new relying party trust.
19
19
20
20
21
21
@@ -25,33 +25,33 @@ Next screen: Add data manually.
25
25
26
26
Next screen: Specify your app display name.
27
27
28
-
Next screen: Choose AD FS profile.
28
+
Next screen: Choose **AD FS** profile.
29
29
30
-
Next screen: Choose SAML 2.0 SSO and set proper D42 ACS url –`https://___device42___url/saml2_auth/acs/`.
30
+
Next screen: Choose **SAML 2.0 SSO** and set proper D42 ACS URL:`https://___device42___url/saml2_auth/acs/`.
31
31
32
32
33
33
34
-
Next screen: Set identifiers access –`https://___device42___url/saml2_auth/acs/`.
34
+
Next screen: Set identifiers access:`https://___device42___url/saml2_auth/acs/`.
35
35
36
36
37
37
38
-
Next screen: Permit all users
38
+
Next screen: Permit all users.
39
39
40
-
Next screen: In claims section (click **Edit claims** on relying party / automatic go to this section after initial setup), add the following claims
40
+
Next screen: In the claims section (click **Edit claims** on the relying party / automatically go to this section after initial setup), add the following claims:
41
41
42
-
The `username` claim:
42
+
-The `username` claim
43
43
44
-
44
+
45
45
46
-
The `nameid` claim:
46
+
-The `nameid` claim
47
47
48
-
48
+
49
49
50
-
Copy metadata URL from the endpoints.
50
+
Then, copy the metadata URL from the endpoints.
51
51
52
52
53
53
54
-
If you receive a time synchronization error please write this command in PowerShell:
54
+
If you receive a time synchronization error, please write this command in PowerShell:
2. Open your newly created enterprise appthe select Option 2 **Set up Single sign on**, or select **Single sign-on** under **Manage** in the left-hand toolbar.
66
+
2. Open your newly created enterprise app. Then, under the **Getting Started** section, select the second option, **Set up Single sign on**. Alternatively, select **Single sign-on** under **Manage** in the left-hand toolbar.
67
67
68
68
69
69
70
-
3.Enter `https://<D42-FQDN-or-IP>/saml2_auth/acs/`**in Identifier (Entity ID)** and Reply URL **(Assertion Consumer Service URL)**in Section 1 - Basic SAML Config.
70
+
3.In the first section, **Basic SAML Configuration**, enter `https://<D42-FQDN-or-IP>/saml2_auth/acs/` in the **Identifier (Entity ID)** and **Reply URL (Assertion Consumer Service URL)**fields.
71
71
72
72
73
73
74
-
4. Navigate to the Device42 Appliance Manager and go to **Global Settings > SAML/SSO Settings**. Copy the App Federation Metadata URL in the SAML Signing Certificate section from the enterprise app you created in Azure AD and paste into the **Metadata auto conf url** field in the Device42 Appliance Manager.
74
+
4. Navigate to the Device42 Appliance Manager and go to **Global Settings > SAML/SSO Settings**. Copy the **App Federation Metadata URL** in the **SAML Signing Certificate** section for the enterprise app you created in Azure AD, and paste the URL into the **Metadata auto conf url** field in the Device42 Appliance Manager.
75
75
76
76
77
77
78
-
5. While still in the SAML 2.0 settings of the Appliance Manager, enter `username` or other appropriate SAML attribute. Unless you have signed responses configured on your Azure AD provider side, keep **Require signed response** unchecked, otherwise you'll get an unavailable page message.
78
+
5. While still in the **SAML 2.0 Settings** of the Appliance Manager, enter `username` or another appropriate SAML attribute in the **Username field**. Unless you have signed responses configured on your Azure AD provider side, keep the **Require signed response**box unchecked; otherwise, you'll get an unavailable page message.
79
79
80
-
Azure's built-in claims like `emailaddress` may not work with Device42, even though they appear in the Azure interface because the built-in claim uses a namespace URI format. The solution is to create a new claim for `emailaddress` in your Azure AD enterprise app, map the claim to the user attribute, and use the custom claim name in the Device42 SAML **Username field**.
80
+
Azure's built-in claims like `emailaddress` may not work with Device42, even though they appear in the Azure interface, because the built-in claim uses a namespace URI format. The solution is to create a new claim for `emailaddress` in your Azure AD enterprise app, map the claim to the user attribute, and use the custom claim name in the Device42 SAML **Username field**.
81
81
82
-
Save and restart the appliance from the VM console menu. You may wish to complete steps 6 and 7 before saving or restarting so that you can still log in to Device42 and create users with the local admin account you've used so far.
82
+
Save and restart the appliance from the VM console menu. You may wish to complete steps 6 and 7 before saving or restarting, so that you can still log in to Device42 and create users with the local admin account you've used so far.
6. Assign users or groups to the SAML enterprise app you created in Azure AD. These should be users or groups that you want to allow authentication into Device42 via this SAML integration.
87
87
88
88
7. For any users associated with the enterprise app in Azure AD, create the user in Device42 using the appropriate Azure AD value with a dummy password. The integration does not pull and create users directly from Azure AD, so the users must be created within Device42 prior to any attempt to authenticate via Azure AD.
89
89
90
-
8. Once the above has been completed, you should be able to login to your Device42 instance with your Azure AD credentials.
90
+
8. Once the above has been completed, you should be able to log in to your Device42 instance with your Azure AD credentials.
91
91
92
92
## Okta Configuration
93
93
@@ -99,35 +99,35 @@ Click the **Applications** button.
In the Applications page, find and click the **Add application** button..
102
+
On the Applications page, find and click the **Add Application** button.
103
103
104
104
105
105
106
-
Choose **Create new app**.
106
+
Choose **Create New App**.
107
107
108
108
109
109
110
-
Select **Web** as the **Platform** and select **SAML 2.0**and the **Sign on method**.
110
+
Select **Web** as the **Platform** and select **SAML 2.0**as the **Sign on method**.
111
111
112
112
113
113
114
114
Set your application preferences and click **Next**.
115
115
116
116
117
117
118
-
On the next page setup ACS url and field mapping. The Single Sign On URL & Audience URI should be `https://yourdevice42address/saml2_auth/acs/`. The Attribute value should be the same AD or LDAP attribute that your users will log into Device42 with. Note the "Name" given to it as this will be needed in the Device42 Appliance Manager configurations.
118
+
On the next page, set up the ACS URL and field mapping. Enter `https://yourdevice42address/saml2_auth/acs/` for both the **Single sign on URL** and the **Audience URI (SP Entity ID)** fields. In the **Attribute Statements** section, the **Value**should be the same AD or LDAP attribute that your users will use to log in to Device42. Note the attribute statement **Name**, as it is needed in the Device42 Appliance Manager configurations.
119
119
120
120
121
121
122
-
Click **Next** and finish setup. Open your application settings, go to the **Sign On** tab and copy the URL from **Identity provider metadata** link. This will be used as the **Metadata auto conf url** in Device42's Appliance Manager.
122
+
Click **Next** and finish the setup. Open your application settings, go to the **Sign On** tab, and copy the URL of the **Identity Provider metadata** link. You will use this URL as the **Metadata auto conf url** in Device42's Appliance Manager.
123
123
124
124
125
125
126
126
## OneLogin Configuration
127
127
128
-
To configure SAML2 integration between OneLogin and Device42, you have to create a `SAML2 connector app` in OneLogin. Then, you will need to add users to the `SAML2 connector app` so they can login via a OneLogin account.
128
+
To configure SAML 2.0 integration between OneLogin and Device42, you have to create a `SAML2 connector app` in OneLogin. Then, you need to add users to the `SAML2 connector app` so they can log in via a OneLogin account.
129
129
130
-
**Creating SAML2 Connector App**
130
+
### Creating the SAML2 Connector App
131
131
132
132
1. Create and log in to your OneLogin account.
133
133
@@ -141,26 +141,26 @@ To configure SAML2 integration between OneLogin and Device42, you have to create
141
141
142
142
143
143
144
-
3. Search for **SAML custom connector** and select **SAML Custom Connector (Advanced)**
144
+
3. Search for **SAML custom connector** and select **SAML Custom Connector (Advanced)**.
145
145
146
146
147
147
148
148
4. Type a display name and **Save**.
149
149
150
150
5. Go to the **Configuration** tab:
151
151
152
-
- Put the value `https://<<fqdn>>/saml2_auth/acs/` in **Audience (EntityID)**, **Recipient** and **ACS (Consumer) URL**
153
-
- Put `.*` in **ACS(Consumer) URL Validator**
154
-
- Save
152
+
- Put the value,`https://<<fqdn>>/saml2_auth/acs/`, in the**Audience (EntityID)**, **Recipient** and **ACS (Consumer) URL** fields.
153
+
- Put `.*` in the **ACS(Consumer) URL Validator** field.
154
+
- Save.
155
155
156
156
157
157
158
158
6. Go to the **Parameters** tab and add a new field by clicking on the **plus icon**.
159
159
160
160
161
161
162
-
- Type `username` as **Field name**.
163
-
-Check the **Include in SAML assertion** checkbox.
162
+
- Type `username` as the **Field name**.
163
+
-Select the **Include in SAML assertion** checkbox.
164
164
165
165
166
166
@@ -173,36 +173,34 @@ To configure SAML2 integration between OneLogin and Device42, you have to create
173
173
174
174
7. In the **SSO** tab:
175
175
176
-
- Copy the **Issuer URL**. This will be entered in the **Metadata auto conf url** field in Device42.
176
+
- Copy the **Issuer URL**. You will enter this in the **Metadata auto conf url** field in Device42.
177
177
178
178
179
179
180
-
-After this, the SAML2 app is created and ready to be integrated with Device42.
180
+
After this, the SAML2 app is created and ready to be integrated with Device42.
181
181
182
-
**In Device42 Appliance Manager Configuration**
182
+
### Configuring the Device42 Appliance Manager
183
183
184
-
Login to the Device42 Appliance Manager, `https://yourdevice42address:4343`, and go to **SAML/SSO settings** on the left, then set the **Metadata auto conf url** you obtained above.
184
+
- Log in to the Device42 Appliance Manager, `https://yourdevice42address:4343`, go to **SAML/SSO settings** on the left, and set the **Metadata auto conf url** you obtained above.
185
185
186
-
187
-
188
-
After this has been saved, SAML integration should be complete.
186
+
189
187
190
-
Now that SAML integration is complete you need to add users to the `SAML Connector App` so they can log in to Device42 via the OneLogin account.
188
+
After this has been saved, the SAML integration should be complete. You now need to add users to the `SAML Connector App` so they can log in to Device42 via their OneLogin accounts.
191
189
192
-
**Create a User in OneLogin**
190
+
### Creating a User in OneLogin
193
191
194
192
- Go to **Users > Users**.
195
193
- Click **New User**.
196
194
197
-
195
+
198
196
199
-
- Fill the form. **Username should match the username in device42 app**.
197
+
- Fill in the form. **The username should match the username in the Device42 app**.
200
198
201
-
199
+
202
200
203
201
- Click **Save**.
204
202
205
-
**Add User to Application**
203
+
### Adding a User to the Application
206
204
207
205
1. Click on the username.
208
206
@@ -215,7 +213,7 @@ Now that SAML integration is complete you need to add users to the `SAML Connect
@@ -225,7 +223,7 @@ Now you can log in to Device42 using the OneLogin account.
225
223
226
224
## Device42 Appliance Manager Configuration
227
225
228
-
Log in to Device42 Appliance Manager, `https://yourdevice42address:4343`, and go to the SAML 2.0 settings on the left, then set the Metadata url you obtained above. Set the **Username field** to match the value you saved in the SAML configuration.
226
+
Log in to Device42 Appliance Manager, `https://yourdevice42address:4343`, go to the **SAML 2.0 Settings** on the left, and set the **Metadata auto conf url** you obtained above. Set the **Username field** to match the value you saved in the SAML configuration.
0 commit comments