Connect Microsoft Entra ID, Okta, ADFS, Google Workspace, or any SAML 2.0 identity provider to IDaaS EIAM so that employees can sign in with their existing enterprise accounts. Configure the IdP in IDaaS, update the IdP application settings, and verify SSO.
Key concepts
After you bind a SAML identity provider, users can sign in to IDaaS EIAM with their existing enterprise accounts.
|
Concept |
Description |
|
SAML |
Security Assertion Markup Language (SAML), an XML-based open standard for exchanging authentication and authorization data between an IdP and a service provider (SP). IDaaS EIAM uses SAML 2.0. |
|
IdP |
Identity provider. An external identity system, such as Entra ID, Okta, or ADFS, that authenticates users and issues SAML assertions. |
|
SP |
Service provider. In this context, IDaaS EIAM acts as the SP. It receives and parses SAML assertions from the IdP to complete user sign-in. |
|
Federated authentication |
A trust relationship in which the SP accepts authentication results from the IdP. With federated authentication, IDaaS EIAM trusts identity providers such as Entra ID, Okta, ADFS, or Google Workspace to enable single sign-on (SSO). |
Create a SAML identity provider in IDaaS
-
In the IDaaS EIAM console, click Identity Providers > Inbound > Add Inbound, select SAML Identity Provider, and then click Add.
-
In the dialog box that appears, configure the following settings in the Bind SAML Identity Provider section:
-
Display Name: a name for the SAML identity provider. This name appears on the sign-in page.
-
Logon Settings: enter the Metadata URL from your IdP, and then click Parse. The system automatically parses the XML and retrieves the IdP SSO URL, IdP Entity ID, and Signature Verification Certificate.
-
-
Click Next to proceed to the scenario selection page.
-
Select the account binding scenarios that match your requirements, and then click Create.
Scenario
Description
Manual Account Binding
Prompts users to manually link their SAML account to an IDaaS account when no binding exists.
Automatic Account Binding
Automatically binds the account when the IDaaS field value matches the NameID in the SAML response and no existing binding is found.
Auto create user
Creates a new IDaaS account for unregistered SAML users. Account information is refreshed on each sign-in.
Automatically Update Information
Updates account information from SAML assertion attributes on each sign-in, based on field mapping rules.
If you enable Automatically Update Information, the Field Mapping configuration page appears. For configuration details, see SAML IdP Field Mapping Configuration Guide.
Configure SSO settings in your IdP
-
In the IDaaS EIAM console, click Identity Providers > IdPs > Inbound, and then click Configuration Information for the SAML identity provider you created. Copy the SP ACS URL and SP Entity ID values.
-
Open your IdP application, find the SAML configuration section, and update the SP ACS URL and SP Entity ID settings with the values you copied.
Verify SSO
-
Open the IDaaS EIAM user portal. The SAML identity provider appears as a sign-in option under other sign-in methods.
-
Click the SAML sign-in option. The browser redirects to the IdP for authentication.
-
If you are not signed in to the IdP, enter your credentials. After successful authentication, the browser redirects back to IDaaS.
-
If you are already signed in, the browser redirects directly back to IDaaS.
-
-
After authentication, the system matches the account based on the binding scenario you configured. If no automatic match is found, the system either prompts for manual binding or creates an account, depending on your settings.