Configure Identity Providers

The Software AG Cloud Identity Provider functionality enables you to configure identity providers that can authenticate Software AG Cloud users. Software AG supports SAML 2.0.

Overview

Single Sign-On (SSO) is an authentication mechanism that allows users to access multiple applications by using a single ID and password.

Software AG Cloud supports SSO that allows users to authenticate themselves against an Identity Provider (IdP) rather than obtain and use a separate username and password. Once the IdP authenticates the users, it informs Software AG Cloud about it, which in turn lets the users access the applications without having to sign in using their Software AG Cloud credentials. This makes the login process easier, faster, and more secure.

Basic Flow

Log on to Software AG Cloud as a user with Cloud-Tenant-Administrator privileges.
In Software AG Cloud, you can grant access to external identity provider users by assigning the default Software AG Cloud roles to the users, or by assigning Software AG Cloud roles to the users based on external identity provider group membership. If you want to do the latter, go to Administration > Roles and note the role names.
Create the URI for connecting the external identity provider to Software AG Cloud:

a. Go to Administration > Single-sign on > Add identity provider.

b. Specify the identity provider display name and unique identifier.

c. Copy the auto-created URI that appears in the Software AG Cloud redirect URI field to the clipboard. You can use the icon at the far right of the field to copy.
Configure your identity provider using the following examples:
Complete the configuration in Software AG Cloud:

a. Return to the Metadata page and complete the fields. If you copied the external identity provider metadata URI or saved the metadata to file, choose to import and then specify the URI or file.

b. Click Next.

c. Go to the Configuration page and complete the fields as necessary. If you imported the external identity provider metadata, some of the fields are pre-populated with that corresponding metadata. If you did not import metadata, the Software AG Cloud fields map to external identity provider attributes as follows:

Tab Name	Field Name	Description	Identity Provider Attribute or Field
Metadata	Single Sign-On Type	SAML 2.0	——–
Metadata	Identity provider display name	Friendly name of the identity provider.	——–
Metadata	Identity provider unique identifier for use in Software AG Cloud redirect URI	Unique identifier for the identity provider.	——–
Metadata	Software AG Cloud redirect URI	URI that redirects external identity provider users to Software AG Cloud.	Copy the Software AG Cloud redirect URI to these fields: Okta: Single sign on URL and Audience URI fields. Azure: Reply URL and Sign on URL fields. ADFS: Auto-populated with the Relying Party > Endpoints > SAML Assertion Consumer Endpoints on importing the Software AG Cloud descriptor to ADFS while adding the relying party.
Configuration	NameID policy format	Format to use for the subjects of SAML assertions.	Okta: Set the Name ID format attribute. Azure: Set the Name identifier attribute. ADFS: Auto-populated with the NameID format set as the Outgoing name ID format while adding claim rules in the relying party in ADFS.
Configuration	Single sign-on service URL	URL for the identity provider endpoint/service to which applications must submit service requests (SAML AuthnRequests).	If you are creating the identity provider from scratch in Software AG Cloud (as opposed to importing a configuration), copy the value from this identity provider field to the Software AG Cloud field: Okta: Identity Provider Single Sign-On URL field. Azure: Login URL field. ADFS: Copy the Location value under the SingleSignOnService tag in https://HOST NAME/FederationMetadata/2007-06/FederationMetadata.xml.
Configuration(SAML advanced settings)	HTTP-POST binding response	Whether the identity provider uses HTTP-POST binding to respond to authentication requests instead of the default HTTP-Request rebinding. Default value is true.	——–
Configuration (SAML advanced settings)	HTTP-POST binding for AuthnRequest	Whether the identity provider expects applications to use HTTP-POST binding to submit authentication requests instead of the default HTTP-Redirect binding. Default value is true.	——–
Configuration (SAML advanced settings)	Assertions signed (on/ off)	Whether the identity provider signs SAML assertions and send the signed assertion.	If you set the Software AG Cloud field to On, set this attribute as follows: Okta: Set the Assertion Signature attribute to Signed. Azure: Set the Signing Option attribute to Sign SAML assertion. ADFS: Assertion is signed by default.
Configuration (SAML advanced settings)	Assertions encrypted	Whether Software AG Cloud expects an encrypted assertion from the identity provider.	If you set the Software AG Cloud field to ON, create the certificate as follows: i. Copy the Service Provider Descriptor URL from the Configuration tab in Software AG Cloud and open it in a browser. Note: This field is visible only after the Single sign-on profile is saved. ii. Copy the content of the X509Certificate attribute from the response to a file, add the header —–BEGIN CERTIFICATE—– and the footer —–END CERTIFICATE—–, and save the file with the extension .cert. Set this attribute and upload the certificate: Okta: Set the Assertion Encryption attribute to On and then upload the certificate. Azure: Token Encryption section of the application’s page - upload the certificate and then set the Activate token encryption attribute to On. ADFS: Auto-popluated on importing the Software AG Cloud descriptor to ADFS while adding the relying party. If updated later, in ADFS navigate to > Encryption and add the new certificate.
Configuration (SAML advanced settings)	Validate signature	Whether Software AG Cloud validates SAML assertion signatures.	If you set the Software AG Cloud field to On, copy the public certificate from the identity provider to the Validating X509 Certificates field in Software AG Cloud. You can obtain the certificate as follows: Okta: i. Copy the X.509 Certificate from the View Setup Instructions link in the Sign-on tab of the application and remove the —–BEGIN CERTIFICATE—– header and the —–END CERTIFICATE—– footer. ii. Copy the X.509 Certificate by downloading the metadata file provided at the Identity provider Metadata link in the Sign-on tab of the application. Azure: Go to Azure Active directory > Enterprise applications > Symantec Web Security Service (WSS) > Single sign-on > SAML Signing Certificate and download the certificate provided at the Certificate (Base64) link. ADFS: Auto-populated if the federation metadata was imported using a file. If the Create from scratch option was used, then copy the content inside the tag in https://HOST NAME/FederationMetadata/2007-06/FederationMetadata.xml.
Attributes	Username	Name of the SAML attribute that identifies the user.	Always the NameID attribute value in the Identity provider (for example, an email address or user name).
Attributes	Work email	Name of the SAML attribute that provides the user’s email address.	Okta: Set the user.email attribute. Azure: Set the user.mail attribute. ADFS: In ADFS navigate to > Add Rule. In the Add Transform Claim Rule window, select LDAP Attribute as “E-Mail-Address” and set Outgoing claim type as the same value provided in Software AG Cloud.
Attributes	First name	Name of the SAML attribute that provides the user’s first name.	Okta: Set the user.firstName attribute. Azure: Set the user.givenname attribute. ADFS: In ADFS navigate to Relying Party > Add Rule. In the Add Transform Claim Rule window, select LDAP Attribute as “Given Name” and set Outgoing claim type as the same value provided in Software AG Cloud.
Attributes	Last name	Name of the SAML attribute that provides the user’s last name.	Okta: Set the user.lastName attribute. Azure: Set the user.surname attribute. ADFS: In ADFS, navigate to > Add Rule. In the Add Transform Claim Rule window, select LDAP Attribute as “Surname” and set Outgoing claim type as the same value provided in Software AG Cloud.
Roles	Software AG Cloud Roles	Roles set in the Identity provider. The values are reflected in the SAML assertion. In the SAML assertion response, Software AG Cloud looks for a key named “roles” to get the list of roles.	Okta: Add a new key named “roles” under Group Attribute Statements and set the value to the name of the groups. Azure: In the User Attributes & Claims section add a new key named “roles” and set the value to user.assignedroles. ADFS: In ADFS, navigate to > Add Rule. In the Add Transform Claim Rule window, select Send Claims Using a Custom Rule and update the Custom rule section.

d. Click Next.

e. On the Attributes page, type the user attribute names you specified in identity provider.

f. Click Next.

Notes:
Whenever a user logs in, all user attributes are updated from the external identity provider.

You cannot use an external identity provider user as a technical user for API authentication. Instead, use an internal user for technical API calls.

g. On the Roles page, you can grant access to identity provider users as follows:

By assigning default Software AG Cloud roles to Identity Provider user:
1. Click Assign default Software AG Cloud roles to users. Later, you can go to individual Software AG Cloud products and modify access.

By assigning Software AG Cloud roles to identity provider users based on Identity Provider group membership:
1. Click Assign Software AG Cloud roles to users by mapping to identity provider roles.
2. Click +, select a Software AG Cloud role, and then type the name of the Identity Provider group that corresponds to the role. Software AG Cloud updates the user role assignments at each login. If an external-Identity Provider role matches the SAML assertion, the role is added. If not, the role is removed.

h. Save the identity provider configuration.