Versions Compared

Old Version 1

changes.mady.by.user Universal Importer for Confluence

Saved on

compared with

New Version Current

changes.mady.by.user Phillip Hanegan

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


...

...

Style
importhttps://docs.empowerid.com/docs.css
EmpowerID supports SAML-based identity transactions, allowing you to federate EmpowerID with any third-party 
...
service providers that use SAML to exchange identity data. 
...
This topic describes the general steps for registering a third-party SAML application in EmpowerID and is divided into the following activities:
...
EmpowerID provides templates for a number of popular service providers, to include ADP, Box, Google, Salesforce and more. Each template is pre-configured with the information required by that specific service provider. In situations where a template does not exist for a service provider, the Default template provides a starting point. This topic demonstrates using this template. 

To register a SAML application in EmpowerID
 From 
  1. In the Navigation Sidebar, 
...
  1. expand Applications and 
...
  1. click Manage Applications.
  2. From the Actions pane of the Application Management page, click the Create Application action. 
...


  1. Image Added


    This opens the Application Details form for the new application. This form contains various tabs and fields for registering the SAML application.
 In the following image, the Navigation Sidebar has been collapsed to conserve screen real estate.
...

  1. Image Added

  2. From the General tab of the Application Details form, do the following:
      ...
        1. Enter a Name, Display Name and Description for the application in the Name, Display Name and Description fields, respectively. The Name must be the one word.
        2. Allow Access Requests
      ...
        1.  — Specify whether to allow access requests. When this option is selected, the application appears in the IT Shop, allowing users to request or claim an account in the application.
        2. Allow Request Account
      ...
        1.  — Specify whether to allow users to request an account in the application. When this option is selected 
      ...
        1. and Allow Access Requests is selected, users can request an account in the application.
        2. Allow Claim Account
      ...
        1.  — Specify whether to give users the ability to claim an account they have in the application. When this option is selected, users can claim their accounts and gain instant access after passing the requisite identity proofs.
        2. Login Is Email Address
      ...
        1.  — Specify whether the login for the application is an email address. This setting is necessary for passing the appropriate identity assertion to the application when logging in from EmpowerID.
        2. Make me the Application Owner
      ...
        1.  — Specify whether you are the owner of the application. Application owners have the ability to manage the application and approve or deny access requests.
        2. Configure Advanced Claim and Request Account Options
      ...
        1.  — Select this option and then provide the appropriate advanced configuration information if you have custom pages and workflows configured in EmpowerID for processing access requests as well as for managing any accounts linked to the application's (internal to EmpowerID) account directory.
      ...

      2. Leave the rest of the fields in the General tab as is and click the Single Sign-On tab.
      ...
      2. From the Single Sign-On Connection Type drop-down
      ...
      1. , select SAML.

        Image Added


      2. Select the Create a New SAML Connection checkbox.
      ...


      1. Image Added


      2. In the SAML Connection Information section that appears, do the following:
        1. Select the 
      ...
        1. Default SSO Connection Settings template. This template provides a generic starting point for configuring SAML SSO connections for service providers.

           Info
          You should see the Display Name field update to the name you gave the application earlier.

        2. Enter a Description in the Description field.
        3. Select the appropriate SAML Submission Method from the SAML Submission Method drop-down. In this example, HTTPPost is the selected method.
        4. Select the appropriate SAML Name Identifier Format from the SAML Name Identifier Format drop-down. In this example, Unspecified is the selected format.
        5. Enter the Assertion Consumer URL in the Assertion Consumer URL field. This value is supplied by the service provider. In this example, the value is https://sso.empoweriam.com/ABeansSaml/saml.acs.aspx.
        6. Edit the Initiating URL field, replacing <ServiceProviderName> with the name you gave to the application in the General section of the form. 

          Image Added



      2. In the Single Logout Configuration section of the form, enter the Logout URL and Logout SAML Protocol provided by the service provider. If Single Logout is not supported by the service provider then leave these fields empty.

        Image Added


      3. In the Certificates section, select Enable Response Signature and then select the appropriate Signing Certificate.

        Image Added

      4. On the Users tab, either create a new account directory for the application, or select an existing account directory from which to add accounts for the application. In this example, a new account directory is created.
         Info
        If you 
      ...
      1.  create a new account directory, EmpowerID creates a special type of account store internal to EmpowerID, known as a "tracking-only" account store.
        A tracking-only account store 
      ...
      1. is a container within EmpowerID 
      ...
      1. that stores user and group records for SSO or attestation without making a connection to the external directory 
      ...
      1. of the application. 
      ...
      1. This is helpful because it creates a one-to-one correlation between the account store and the application, 
      ...
      1. and the SSO connection for the application. 
      ...
      1. This example creates a new account directory.
      ...

      1. Image Added


      2. Optionally, 
      ...
      1. Click the Groups tab and then click the Add Button (+) in the Groups grid.
      2. In the Group Information dialog that appears, search for the group you want to add to the application and then click the tile for that group.
      3. Click Add and repeat step b for any other groups.
      ...
      1. click the Extension tab and add extension attributes as needed.
      2. Optionally, click the IP Ranges tab and define ranges of IP addresses that are allowed to access the application as needed. This 
      ...
      1. lets you 
      ...
      1.  secure access to the application based on the location of the user
      ...
      1. . 

        For example, you can choose to deny access to users 
      ...
      1.  logging in from home, but allow them access 
      ...
      1.  from the internal network. Expand the drop-down box to see how.

         Rw ui expands macro

         Rw ui expand macro
        titleTo add IP address ranges
        1. In the Assigned IP 
      ...
        1.  Ranges 
      ...
        1. grid, click the IP Address Ranges tab and then click the Add Button (+)
      ...
        1. .
        2. In the Basic Information dialog that appears, 
      ...
        1. if necessary, select Create a New IP Address Range and fill in the information for it. Otherwise, in the Select Existing IP Address Range
      ...
        1.  field, enter the name of an existing IP Address Range 
      ...
        1.  and 
      ...
        1.  click the tile for that range.
          See the 
      ...
        1.   topic for more details on adding IP Address Ranges to an application.

        2. Click Add and repeat step b for any other IP Address Ranges.


      2. Click the Add to Cart button.
      3. Click the My Cart link located at the top of the page and in the Cart dialogue that appears type a reason for creating the application and then click Submit.
      ...
      To claim an SSO application account
      1. Log in to the EmpowerID Web application as a person with an account in the SSO application you just created.
      2. From the Navigation Sidebar, navigate to the Request Access page for applications by expanding Applications and clickingRequest Access.
      3. From the Request Access page, search for the SSO application and then click the Request Access link for that application.
      4. Click Claim Existing Account.
      5. In the Register SSO Application Account form that appears, type the username for the application account in the SSO Application Login field and then click Submit.
      6. Retrieve the one-time password (OTP) sent by EmpowerID to your email address, paste it in the Password field of the One-Time Password Validation form and then click Submit. The OTP is used by EmpowerID to verify that the access request originated from the user.
      7. From the Navigation Sidebar, navigate to your personal applications by expanding Applications and clicking Login.
      8. Click the button for the application.
      ...
      Administrative Procedures:
      ...
      References:
      ...
      1.  

        Image Added