You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Device42 integrates with SAML 2.0 in conjunction with AD or LDAP user synchronizations to provide Single Sign On (SSO) support in Device42. Once users are added to Device42 via Active Directory or LDAP, they will automatically be logged into Device42 when they load the site.
7
7
8
-
_Note_ Since authorization is handled by Device42, the user needs to exist within Device42 before they can log in for single sign on functionality to work.
8
+
:::note
9
+
Since authorization is handled by Device42, the SSO functionality only works if the user account already exists within Device42 before the user logs in.
10
+
:::
9
11
10
-
SAML configuration varies between providers, but we'll provide the steps for configuration with Microsoft ADFS, Okta and Onelogin below as examples. Device42 SSO should also work with **any**SAML2.0 compatible Identity Provider, and has been confirmired working with IDaaS providers Centrify and PingIdentity's PingOne and PingFederate as well.
12
+
SAML configuration varies between providers, but we'll provide the steps for configuration with Microsoft ADFS, Okta, and Onelogin below as examples. Device42 SSO should also work with **any**SAML 2.0 compatible Identity Provider and has been confirmed to work with IDaaS providers, Centrify, and PingIdentity's PingOne and PingFederate.
11
13
12
14
Should you need further assistance, please contact [Support](mailto:[email protected]).
13
15
14
-
###Microsoft ADFS Configuration
16
+
## Microsoft ADFS Configuration
15
17
16
-
Add new relying party trust.
18
+
Add a new relying party trust.
17
19
18
20
19
21
20
-
Next screen: Add data manually.
22
+
Next screen: Add data manually.
21
23
22
24
23
25
24
-
Next screen: Specify your app display name.
26
+
Next screen: Specify your app display name.
25
27
26
-
Next screen: Choose AD FS profile.
28
+
Next screen: Choose **AD FS** profile.
27
29
28
-
Next screen: Choose SAML 2.0 SSO and set proper D42 ACS url – https://\_\_\_device42\_\_\_url/saml2\_auth/acs/.
30
+
Next screen: Choose **SAML 2.0 SSO** and set proper D42 ACS URL: `https://___device42___url/saml2_auth/acs/`.
29
31
30
32
31
33
32
-
Next screen: Set identifiers access – https://\_\_\_device42\_\_\_url/saml2\_auth/acs/.
34
+
Next screen: Set identifiers access: `https://___device42___url/saml2_auth/acs/`.
33
35
34
36
35
37
36
-
Next screen: Permit all users
38
+
Next screen: Permit all users.
37
39
38
-
Next screen: In claims section (click “edit claims” on relying party / automatic go to this section after initial setup), add the following claims
40
+
Next screen: In the claims section (click **Edit claims** on the relying party / automatically go to this section after initial setup), add the following claims:
39
41
40
-
username claim
42
+
- The `username` claim
41
43
42
-
44
+
43
45
44
-
nameid claim
46
+
- The `nameid` claim
45
47
46
-
48
+
47
49
48
-
Copy metadata url from endpoints
50
+
Then, copy the metadata URL from the endpoints.
49
51
50
52
51
53
52
-
\*\* if you receive time synchronization error please write this command in powershell : Set-ADFSRelyingPartyTrust -TargetIdentifier "" -NotBeforeSkew 5
54
+
If you receive a time synchronization error, please write this command in PowerShell:
1\. Navigate to Azure AD in the Azure portal _\> Enterprise Applications > New Application > Create your own application_. Give your app a name (the app shown in the screenshots is _Device42SAML_) and select the third option _Integrate any other application..._, then click _Create_.
60
+
## Azure AD Configuration
57
61
58
-
62
+
1. Navigate to Azure AD in the Azure portal via **Enterprise Applications > New Application > Create your own application**. Give your app a name (the app shown in the screenshots is `Device42SAML`) and select the third option **Integrate any other application...**, then click **Create**.
59
63
60
-
2\. Open your newly created enterprise app _\> Option 2- Set up Single sign on_, or select _Single sign-on_ under Manage in left-hand toolbar.
64
+
61
65
62
-
66
+
2. Open your newly created enterprise app. Then, under the **Getting Started** section, select the second option, **Set up Single sign on**. Alternatively, select **Single sign-on** under **Manage** in the left-hand toolbar.
63
67
64
-
3\. Enter `https://<D42-FQDN-or-IP>/saml2_auth/acs/` in Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) in Section 1 Basic SAML Config.
68
+
65
69
66
-
70
+
3. In the first section, **Basic SAML Configuration**, enter `https://<D42-FQDN-or-IP>/saml2_auth/acs/` in the **Identifier (Entity ID)** and **Reply URL (Assertion Consumer Service URL)** fields.
67
71
68
-
4\. Navigate to the Device42 Appliance Manager > Global Settings > SAML 2.0 Settings. Copy the App Federation Metadata URL in the SAML Signing Certificate section from the enterprise app you created in Azure AD and paste into Metadata auto conf url in the D42 Appliance Manager.
72
+
69
73
70
-
74
+
4. Navigate to the Device42 Appliance Manager and go to **Global Settings > SAML/SSO Settings**. Copy the **App Federation Metadata URL** in the **SAML Signing Certificate** section for the enterprise app you created in Azure AD, and paste the URL into the **Metadata auto conf url** field in the Device42 Appliance Manager.
71
75
72
-
5\. While still in the SAML 2.0 settings of the Appliance Manager, enter `username` or other appropriate SAML attribute.
76
+
73
77
74
-
Save and restart the appliance from the VM console menu with option 4. You may wish to complete steps 6 and 7 before saving/restarting so that you can still login to D42 and create users with the local admin account you've used so far. The SAML attributes tested successfully are listed below:
78
+
5. While still in the **SAML 2.0 Settings** of the Appliance Manager, enter `username` or another appropriate SAML attribute in the **Username field**. Unless you have signed responses configured on your Azure AD provider side, keep the **Require signed response** box unchecked; otherwise, you'll get an unavailable page message.
75
79
76
-
-**emailaddress** - Email address associated with user account in Azure AD
77
-
-**name** - User Principal Name (UPN) associated with user account in Azure AD
80
+
Azure's built-in claims like `emailaddress` may not work with Device42, even though they appear in the Azure interface, because the built-in claim uses a namespace URI format. The solution is to create a new claim for `emailaddress` in your Azure AD enterprise app, map the claim to the user attribute, and use the custom claim name in the Device42 SAML **Username field**.
Save and restart the appliance from the VM console menu. You may wish to complete steps 6 and 7 before saving or restarting, so that you can still log in to Device42 and create users with the local admin account you've used so far.
80
83
81
-
6\. Assign users/groups to the SAML enterprise app you created in Azure AD. These should be users/groups that you want to allow authentication into Device42 via this SAML integration.
7\. For any users associated with the enterprise app in Azure AD, create the user in Device42 using the appropriate Azure AD value with a dummy password. The integration does not pull and create users directly from Azure AD, so the users must be created within Device42 prior to any attempt to authenticate via Azure AD.
86
+
6. Assign users or groups to the SAML enterprise app you created in Azure AD. These should be users or groups that you want to allow authentication into Device42 via this SAML integration.
84
87
85
-
8\. Once the above has been completed, you should be able to login to your D42 instance with your Azure AD credentials.
88
+
7. For any users associated with the enterprise app in Azure AD, create the user in Device42 using the appropriate Azure AD value with a dummy password. The integration does not pull and create users directly from Azure AD, so the users must be created within Device42 prior to any attempt to authenticate via Azure AD.
86
89
87
-
### Okta Configuration
90
+
8. Once the above has been completed, you should be able to log in to your Device42 instance with your Azure AD credentials.
In the “Applications” page find “Add application” button and click it.
102
+
On the Applications page, find and click the **Add Application** button.
98
103
99
104
100
105
101
-
Choose “Create new app”
106
+
Choose **Create New App**.
102
107
103
108
104
109
105
-
Select platform as Web and sign on method as SAML 2.0.
110
+
Select **Web** as the **Platform**and select **SAML 2.0** as the **Sign on method**.
106
111
107
112
108
113
109
-
Set application preferences and click next
114
+
Set your application preferences and click **Next**.
110
115
111
116
112
117
113
-
On the next page setup ACS url and field mapping. The Single Sign On URL & Audience URI should be `https://yourdevice42address/saml2_auth/acs/`. The Attribute value should be the same AD or LDAP attribute that your users will log into Device42 with. Note the "Name" given to it as this will be needed in the Device42 Appliance Manager configurations.
118
+
On the next page, set up the ACS URL and field mapping. Enter `https://yourdevice42address/saml2_auth/acs/` for both the **Single sign on URL** and the **Audience URI (SP Entity ID)** fields. In the **Attribute Statements** section, the **Value**should be the same AD or LDAP attribute that your users will use to log in to Device42. Note the attribute statement **Name**, as it is needed in the Device42 Appliance Manager configurations.
114
119
115
120
116
121
117
-
Click “Next” and finish setup. Open your application settings, go to the “Sign On” tab and copy url from “Identity provider metadata” link. This will be used as the "Metadata URL" in Device42's Appliance Manager.
122
+
Click **Next** and finish the setup. Open your application settings, go to the **Sign On** tab, and copy the URL of the **Identity Provider metadata** link. You will use this URL as the **Metadata auto conf url** in Device42's Appliance Manager.
118
123
119
124
120
125
121
-
### OneLogin Configuration
122
-
123
-
To configure SAML2 integration between OneLogin and Device42, you have to create a `SAML2 connector app` in OneLogin. Then, you will need to add users to the `SAML2 connector app` so they can login via a OneLogin account.
126
+
## OneLogin Configuration
124
127
125
-
**Creating SAML2 Connector App**
128
+
To configure SAML 2.0 integration between OneLogin and Device42, you have to create a `SAML2 connector app` in OneLogin. Then, you need to add users to the `SAML2 connector app` so they can log in via a OneLogin account.
126
129
127
-
1\. Create and login into your OneLogin account.
130
+
### Creating the SAML2 Connector App
128
131
129
-
2\. Create an app connector in OneLogin.
132
+
1. Create and log in to your OneLogin account.
130
133
131
-
- Go to Applications > Applications.
134
+
2. Create an app connector in OneLogin:
132
135
133
-
136
+
- Go to **Applications > Applications**.
134
137
135
-
- Click Add App.
138
+
136
139
137
-
140
+
- Click **Add App**.
138
141
139
-
3\. Search for `SAML custom connector` and select `SAML Custom Connector (Advanced)`
142
+
140
143
141
-
144
+
3. Search for **SAML custom connector** and select **SAML Custom Connector (Advanced)**.
142
145
143
-
4\. Type a display name and Save.
146
+
144
147
145
-
5\. Go to the `Configuration` tab
148
+
4. Type a display name and **Save**.
146
149
147
-
- Put the value `https://<<fqdn>>/saml2_auth/acs/` in `Audience (EntityID)`, `Recipient` and `ACS (Consumer)URL`
148
-
- Put `.*` in `ACS(Consumer) URL Validator`
149
-
- Save
150
+
5. Go to the **Configuration** tab:
150
151
151
-
152
+
- Put the value, `https://<<fqdn>>/saml2_auth/acs/`, in the **Audience (EntityID)**, **Recipient** and **ACS (Consumer) URL** fields.
153
+
- Put `.*` in the **ACS(Consumer) URL Validator** field.
154
+
- Save.
152
155
153
-
6\. Go to the `Parameters` tab and add a new field (by clicking on the `+` icon)
156
+
154
157
155
-
158
+
6. Go to the **Parameters** tab and add a new field by clicking on the **plus icon**.
156
159
157
-
- Type the `username` as `Field name`.
158
-
- Check `Include in SAML assertion`.
160
+
159
161
160
-
162
+
- Type `username` as the **Field name**.
163
+
- Select the **Include in SAML assertion** checkbox.
161
164
162
-
- Save
163
-
- Choose the `Username` from the drop down as the value.
165
+
164
166
165
-
167
+
- Click **Save**.
168
+
- Choose the **Username** from the dropdown as the **Value**.
166
169
167
-
- Save
170
+
168
171
169
-
7\. In the `SSO` tab:
172
+
- Click **Save**.
170
173
171
-
- Copy the “Issuer URL”. This will be entered in the “Metadata URL” field in Device42.
174
+
7. In the**SSO** tab:
172
175
173
-
176
+
- Copy the **Issuer URL**. You will enter this in the **Metadata auto conf url** field in Device42.
174
177
175
-
- After this, the SAML2 app is created and ready to be integrated with Device42.
178
+
176
179
177
-
**In Device42 Appliance Manager Configuration**
180
+
After this, the SAML2 app is created and ready to be integrated with Device42.
178
181
179
-
Login to Device42 Appliance Manager, `https://yourdevice42address:4343`, and go to the SAML 2.0 settings on the left, then set the Metadata url you obtained above.
182
+
### Configuring the Device42 Appliance Manager
180
183
181
-
184
+
- Log in to the Device42 Appliance Manager, `https://yourdevice42address:4343`, go to **SAML/SSO settings** on the left, and set the **Metadata auto conf url** you obtained above.
182
185
183
-
After this has been saved, SAML integration should be complete.
186
+
184
187
185
-
_Now that SAML integration is complete you need to add users to the_`SAML Connector App`_so they can login into Device42 via OneLogin account._
188
+
After this has been saved, the SAML integration should be complete. You now need to add users to the`SAML Connector App`so they can log in to Device42 via their OneLogin accounts.
186
189
187
-
**Create a User in OneLogin**
190
+
### Creating a User in OneLogin
188
191
189
-
- Go to Users > Users.
190
-
- Click New User.
192
+
- Go to **Users > Users**.
193
+
- Click **New User**.
191
194
192
-
195
+
193
196
194
-
- Fill the form. **Username should match the username in device42 app**.
197
+
- Fill in the form. **The username should match the username in the Device42 app**.
195
198
196
-
199
+
197
200
198
-
- Save.
201
+
-Click **Save**.
199
202
200
-
**Add User to Application**
203
+
### Adding a User to the Application
201
204
202
-
1. Click on the user name.
205
+
1. Click on the username.
203
206
204
-
2. Go to the `Applications` tab and add `Application` by clicking on the `+` icon.
207
+
2. Go to the **Applications** tab and add an **Application** by clicking on the **plus icon**.
Now you can log into Device42 using the OneLogin account.
222
+
Now you can log in to Device42 using the OneLogin account.
221
223
222
-
###Device42 Appliance Manager Configuration
224
+
## Device42 Appliance Manager Configuration
223
225
224
-
Login to Device42 Appliance Manager, `https://yourdevice42address:4343`, and go to the SAML 2.0 settings on the left, then set the Metadata url you obtained above. Set the "username" field to match the value you saved in the SAML configuration.
226
+
Log in to Device42 Appliance Manager, `https://yourdevice42address:4343`, go to the **SAML 2.0 Settings** on the left, and set the **Metadata auto conf url** you obtained above. Set the **Username field** to match the value you saved in the SAML configuration.
225
227
226
-
228
+
227
229
228
230
After this has been saved, SAML integration should be complete!
0 commit comments