Skip to main content

ARIS Technical Help

Set up SSO SAML

SAML (Security Assertion Markup Language) is a standard for exchanging authentication data between security domains. SAML is an XML-based protocol that uses security tokens containing assertions to pass information about a user between an identity provider and a service provider. It enables web-based authentication scenarios including single sign-on across all ARIS runnables.

Please contact your SAML administrator before you change any configuration.

Prerequisite

Server

  • The SAML identity provider supports the HTTP POST binding as specified by the SAML 2.0 specification.

  • SSO must be configured for the servers.

  • You have access to the metadata XML file only if SAML is enabled.

  • ARIS must be registered as a trusted service provider at the SAML identity provider.

Client

Your web browser supports JavaScript.

Procedure. Procedure
    1. Enable SSO (SAML).

    1. Open ARIS Advanced.

    2. Click Application launcher Application launcher > Administration Administration.

    3. Click Configuration management.

    4. Click Single sign-on.

    5. Under General, enable Enable single sign-on.

    6. Enter the ID of the identity provider in the Identity provider ID field (entityID in the IdP metadata.xml file).

    7. Enter the ID of the service provider in the Service provider ID field, for example https://eu.ariscloud.com/<room name>.

    8. Enter the endpoint of the identity provider that is used for single sign-on in the Single sign-on URL field.

    9. Enter the endpoint of the identity provider that is used for single log-out in in the Single logout URL field.

    10. Click Save Save.

    2. SAML settings

    1. Under Signature, enable the options you want to configure:

      • Enforce signing of assertions

      • Enforce signing of requests

      • Enforce signing of responses

      • Enforce signing of metadata

      • Select signature algorithm

    2. Click Save Save.

    You have enabled the signing. Depending on the signing configuration, you have to configure the truststore and keystore.

    3. Optional: Configure the keystore.

    1. Under Keystore, click Upload Upload.

    2. Click Upload. The dialog opens. Select the keystore file from your file system and click Upload.

    3. Configure the Alias that was used for creating the keystore file.

    4. Configure the Password that was used for creating the keystore file.

    5. Click Save Save.

    You have configured the keystore.

    4. Share the service provider (SP) metadata.

    1. You can find the service provider metadata under General. Send the service provider ID to your identity provider (IDP).

    2. Configure SAML using identity provider (IDP) metadata.

    3. Under

      General

      , enter the identity provider ID.

    4. Click Save Save.

    5. Configure the truststore.

    1. Under Truststore, click Upload Upload. The dialog opens. Select the truststore file from your file system and click Upload.

    2. Configure the Alias that was used for creating the keystore file.

    3. Configure the Password that was used for creating the keystore file.

    4. Click Save Save.

    You have configured the truststore.

    6. Configure the user attributes.

    1. Under User attributes, specify the attribute fields, for example, the first name, the last name, or the e-mail. If SCIM is in use, we recommend leaving the Member of field empty.

    2. Click Save Save.

    You have configured the user attributes.

    Remark: During the login process, the user is assigned to all groups provided by the identity provider in ARIS Advanced as part of the configured claim URL (Member of attribute). For technical reasons, the group membership cannot be removed automatically if the user's membership with the identity provider expires. To maintain the group membership in ARIS Advanced, we recommend configuring SCIM provisioning.

    7. Optional: Specify the advanced settings.

    • Under Advanced settings, configure:

      • Authentication context classes

      • Authentication content comparison

      • NamedID format

      • Clock skew (in seconds)

      • Assertion lifetime (in seconds)