Skip to main content

Legacy SAML setup guide

info

This guide is for customers not on the new iGrafx IdentityiGrafx Identity The iGrafx identity and access management service that brokers authentication between customer identity providers and Process360 Live components. Solution. To check: open your platform URL in a private browser window — if you're forwarded to id.igrafxcloud.com or id.igrafxcloud.eu, you're on the new flow, so follow the SAML setup guide for the iGrafx Identity Solution instead.

SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. (Security Assertion Markup Language) provides single sign-on between service providers (applications that require authentication) and identity providers (applications that provide it). The iGrafx platform is the service provider; your Azure AD, ADFS server, or Okta instance is the identity provider.

The SAML SSO flow between the identity provider and the iGrafx platform. The SAML SSO flow between the identity provider and the iGrafx platform.

Prerequisites​

  • A SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. 2.0–compatible identity provider.
  • A test user in your cloud platform whose username matches the NameID of a user in your identity provider.

Steps​

Follow the procedure for your identity provider, then test SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials. with your test user. Once authentication succeeds, create a ticket in the iGrafx Service Desk to disable form-based login (recommended). SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials. is then complete and user import/synchronization is ready to configure.

Microsoft Azure Active Directory​

  1. Add the iGrafx Platform enterprise application to your Azure Active Directory.
  2. Follow the Microsoft tutorial.
  3. Set your Unique User Identifier to the mail attribute in your integration.
  4. In Administration → User Management → SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO., click Update Identity Provider Metadata and provide the metadata URL.
  5. Change the NameID policy to Email.
  6. Test the flow from your Login page with Sign in via SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials..

The enterprise application for SCIM is registered separately — see Synchronizing your user base.

Microsoft ADFS Server​

  1. Get the spring_saml_metadata.xml file from the iGrafx team.
  2. In the AD FS 2.0 Management Console, select Add Relying Party Trust (you may need to install Active Directory Federation Services).
  3. Select Import data about the relying party from a file, choose spring_saml_metadata.xml, and click Next. Ignore any warning that some metadata isn't supported.
  4. Enter a display name, leave multi-factor authentication unconfigured, and Permit all users to access this relying party.
  5. On Ready to Add Trust, confirm the Endpoints tab has multiple endpoints — if not, regenerate the metadata with HTTPS URLs.
  6. Leave Open the Edit Claim Rules dialog selected and finish.
  7. Select Add Rule → Send LDAP Attributes as Claims → Next. Name it NameID, choose Active Directory, mail as the LDAP attribute, and Name ID as the outgoing claim type. Finish and confirm.
  8. Download your IdP metadata from https://YOUR_ADFS_SERVER/FederationMetadata/2007-06/FederationMetadata.xml.
  9. In Administration → User Management → SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO., click Update Identity Provider Metadata and provide the file.
  10. Confirm the NameID policy is unspecified (unless you have a custom policy), then test with Sign in via SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials..

Okta​

  1. In Administration → User Management → SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO., click Download Service Provider Metadata.

  2. In Okta as an administrator, select Applications → Create New App, choose SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. 2.0, and Create.

  3. Name the app (for example iGrafx) and click Next.

  4. Configure SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO.:

    SettingValue
    Single Sign-on URLhttps://SUBDOMAIN.igrafxcloud.com/saml/SSO (use your cloud subdomain)
    Audience URI (SP Entity ID)The value from the <md:EntityDescriptor entityID="???"> attribute of the spring_saml_metadata.xml downloaded in step 1
    Relay StateLeave blank
    Name ID formatE-Mail
    Application usernameAny option that maps to login names that exist in your iGrafx platform

  5. Finish creating the app. Optionally configure custom username mappings on the People page.

  6. On the Sign On tab, download the Okta IdP metadata via the Identity Provider metadata link.

  7. In Administration → User Management → SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO., click Update Identity Provider Metadata and provide the URL.

  8. Optionally change the NameID policy to Email, then test with Sign in via SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials..

Other identity providers​

Providers such as Ping Identity, Centrify, Auth0, and HP IceWall are supported as long as they support SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. 2.0. Follow your provider's manual and use Administration → User Management → SAMLSAML An XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Process360 Live supports SAML 2.0 for SSO. to set it up, then test with Sign in via SSOSSO An authentication scheme that lets users sign in once with an identity provider and access Process360 Live without re-entering credentials..

tip

Whichever provider you use, prefer a valid email address as the Unique User Identifier / NameID. The iGrafx IdentityiGrafx Identity The iGrafx identity and access management service that brokers authentication between customer identity providers and Process360 Live components. Solution expects an email address, so matching that now keeps a later move to it straightforward.

Debugging​

In Administration → Support → Logging Settings, add these classes at DEBUG level:

  • org.springframework.security.saml2 — version 20.0.0 and later. On earlier versions, use org.springframework.security.saml instead.
  • org.opensaml
  • PROTOCOL_MESSAGE