Registering SAML Apps

Home / Configuring SSO Connections / SAML / Current: Registering SAML Apps

1. In the Navigation Sidebar, expand Applications and click Manage Applications.

2. From the Actions pane of the Application Management page, click the Create Application action.
   
   
   
   This opens the Application Details form for the new application. This form contains various tabs and fields for registering the SAML application.

   In the following image, the Navigation Sidebar is collapsed to conserve screen real estate.

   
   
   
   

3. From the General tab of the Application Details form, do the following:
   1. Enter a name, display name and description for the application in the Name, Display Name and Description fields.
   2. Allow Access Requests - Specify whether to allow access requests. When this option is selected, the application appears in the IT Shop, allowing users to request or claim an account in the application.
   3. Allow Request Account - Specify whether to allow users to request an account in the application. When this option is selected and Allow Access Requests is selected, users can request an account in the application.
   4. Allow Claim Account - Specify whether to give users the ability to claim an account they have in the application. When this option is selected, users can claim their accounts and gain instant access after passing the requisite identity proofs.
   5. Login Is Email Address - Specify whether the login for the application is an email address. This setting is necessary for passing the appropriate identity assertion to the application when logging in from EmpowerID.
   6. Make me the Application Owner - Specify whether you are the owner of the application. Application owners have the ability to manage the application and approve or deny access requests.
   7. Configure Advanced Claim and Request Account Options - Select this option and then provide the appropriate advanced configuration information if you have custom pages and workflows configured in EmpowerID for processing access requests as well as for managing any accounts linked to the application's (internal to EmpowerID) account directory.
      
      
4. Click the Single Sign-On tab and from the Single Sign-On Connection Type drop-down, select SAML.
   
   
   
   
5. Select the Create a New SAML Connection checkbox.
   
   
   
   
6. In the SAML Connection Information section that appears, do the following:

   1. Select the template for your application from the SAML Application Template drop-down.
      
      For example, if your SAML application configures your corporate Salesforce account for SSO with EmpowerID, select Salesforce SSO Connection Settings. This populates the SAML Connection Information section with the base information necessary for federating Salesforce.
      
      
      
      

      If you are configuring an application for SSO with EmpowerID and the application does not appear in the SAML Application Template drop-down, select Default SSO Connection Settings.

   2. Type a display name for the SAML Connection in the Display Name field.
   3. Select the appropriate certificate to sign the SAML assertions sent to the application from the Certificate drop-down.
   4. Edit the Assertion Consumer URL field as needed. This value is supplied by the service provider.
      
      

7. On the Users tab, either create a new account directory for the application, or select an existing account directory from which to add accounts for the application.

   If you create a new account directory, EmpowerID creates a special type of account store internal to EmpowerID, known as a "tracking-only" account store.

   A tracking-only account store is a container within EmpowerID that stores user and group records for SSO or attestation without making a connection to the external directory of the application. This is helpful because it creates a one-to-one correlation between the account store and the application, and the SSO connection for the application. This example creates a new account directory.

   
   
   
   

8. Optionally, add extension attributes to the application on the Extension tab.
   
   
   
   

9. Optionally, on the IP Ranges tab, define ranges of IP addresses that are allowed to access the application. This lets you secure access to the application based on the location of the user.
   
   For example, you can choose to deny access to users logging in from home, but allow them access from the internal network. Expand the drop-down box to see how.
   
   
10. Click the Add to Cart button.
11. Click the My Cart link located at the top of the page and in the Cart dialogue that appears type a reason for creating the application and then click Submit.