Skip to main content

ARIS Technical Help

Set up SSO with SAML

SAML (Security Assertion Markup Language) is a standard for exchanging authentication data between security domains. SAML is an XML-based protocol that uses security tokens containing assertions to pass information about a user between an identity provider and a service provider. It enables web-based authentication scenarios including single sign-on across all ARIS runnables.

Prerequisite

You have the Technical configuration administrator function privilege.

Server

  • The SAML identity provider supports the HTTP POST binding as specified by the SAML 2.0 specification.

  • SSO must be configured for the servers.

  • You have access to the metadata XML file only if SAML is enabled.

  • ARIS must be registered as a trusted service provider at the SAML identity provider.

Client

Your web browser supports JavaScript.

Enable SSO for the servers (SAML).

  1. Start ARIS.

  2. Click Application launcher Application launcher > Administration Administration. Configuration Configuration is displayed.

  3. Click User management.

  4. Click the arrow next to SAML.

  5. Click General.

  6. Click Edit Edit.

  7. Enable Enable single sign-on.

  8. Enter the ID of the identity provider in the Identity provider ID field (entityID in the IdP metadata.xml file).

  9. Enter the ID of the service provider in the Service provider ID field, for example http(s)://<ARIS server name>.

  10. Enter the endpoint of the identity provider that is used for single sign-on in the Single sign-on URL field (SingleSignOnService URL in the IdP metadata.xml file).

  11. Enter the endpoint of the identity provider that is used for single log-out in in the Single logout URL field (SingleSignLogoutService URL in the IdP metadata.xml file).

  12. Click Save Save.

Optional SAML settings

  1. Click Signature.

  2. Click Edit Edit.

  3. Enable the check box of the options you want to set:

    • Enforce signing of assertions

    • Enforce signing of requests

    • Enforce signing of responses

    • Enforce signing of metadata

    • Select signature algorithm

  4. Click Save Save.

You have enabled the signing. Depending on the signing configuration, you have to configure the truststore and keystore.

Configure the truststore.

  1. Click Truststore.

  2. Click Upload. The dialog opens. Select the truststore file from your file system and click Upload.

  3. Click Edit Edit.

  4. Configure the Alias that was used for creating the truststore file.

  5. Configure the Password that was used for creating the truststore file.

  6. Click Save Save.

You have configured the truststore.

Optional: Configure the keystore.

  1. Click Keystore.

  2. Click Upload. The dialog opens. Select the keystore file from your file system and click Upload.

  3. Click Edit Edit.

  4. Configure the Alias that was used for creating the truststore file.

  5. Configure the Password that was used for creating the truststore file.

  6. Click Save Save.

You have configured the keystore.

Configure the user attributes.

Prerequisite

Your IdP Administrator configured the providing of these attributes in SAML response as claims.

  1. Click User attributes.

  2. Click Edit Edit.

  3. Specify the attribute fields, for example, the first name, the last name, or the e-mail.

  4. Click Save Save.

You have configured the user attributes.

Register ARIS in IdP as a trusted service provider.

Establish a circle of trust between the identity provider and the service provider.

Procedure. Procedure

  1. Open a browser.

  2. Enter the following URL into the address bar:

                            https://<SERVERNAME>/umc/rest/saml/metadata.xml?tenant=<TENANTID>

    You get a metadata file. Save this file as an XML file.

  3. Send the metadata file to your SAML identity provider that the metadata can be uploaded.

Your system is configured to be used with single sign-on and SAML.

Troubleshooting

Troubleshooting

You can find detailed information on SAML authentication issues in the log files of ARIS Administration.

<Your installation folder>\ARIS10.0\server\bin\work\work_umcadmin_<size>\base\logs