20 docs tagged with "sso"

Configure Microsoft ADFS as the SAML identity provider for the iGrafx Identity Solution: add a relying party trust from the iGrafx metadata, add the NameID claim rule, and send iGrafx your IdP metadata.

Configure the platform to create authenticated SAML users automatically on first sign-in by mapping the ADFS first name, last name, and email claims.

Turn on just-in-time provisioning so SSO users get an account on first sign-in. Whether you can do it yourself depends on whether your platform shows a SAML or an OAuth authentication tab.

Choose how the iGrafx platform recognizes signed-in users by setting a Spring security profile — the default login form, CAS, preauthentication, Kerberos, SAML2, or SiteMinder.

Enable the Sign in with Microsoft button on the login page for Azure AD users, handle the first-login consent screen, and manage the iGrafx Process360 Live enterprise application in Entra ID.

Set up SPNEGO/Negotiate single sign-on for the iGrafx platform: create the service principal and keytab on the domain controller, configure the server, and configure each browser and the desktop client.

Problem

After updating to version 18 or later, you may encounter issues with Kerberos SSO no longer working. In the igrafx\_server.log file, you will see a "negotiate header was invalid" error followed by an "Encryption type RC4 with HMAC is not supported/enabled" or similar error. The reason for this is that Java has dropped support for HMAC and 3DES encryption with release 11.0.17 - to fix the problem, you will need to enable AES128/AES256 encryption for Kerberos.

Set up SAML SSO on the classic iGrafx login (not the iGrafx Identity Solution): configure Microsoft Azure AD, ADFS, Okta, or another SAML 2.0 provider, then test and disable form-based login.

Configure Microsoft Entra ID (Azure AD) as the SAML identity provider for the iGrafx Identity Solution: create an enterprise application, set the region-specific identifier and reply URL, and send iGrafx the metadata URL.

Problem

Configure Okta as the SAML identity provider for the iGrafx Identity Solution: create the app integration, set the SSO URL and entity ID for your region, map the attributes, and send iGrafx the metadata URL.

How SAML SSO works with the iGrafx Identity Solution as the service provider, the requirements, and links to the per-vendor setup guides for Microsoft Entra ID, Okta, and ADFS.

Set up SAML2 single sign-on for the iGrafx platform: create the SAML keystore, then configure Azure AD, ADFS, Okta, or Centrify as the identity provider, with user mapping and debugging options.

How single sign-on works with iGrafx Process360 Live, the SAML 2.0 identity providers it supports, and how to tell whether you're on the iGrafx Identity Solution or the classic login before you start.

Configure SAML SSO for an on-premises iGrafx platform using an Azure AD enterprise application: register the app, set the SAML URLs, and point the platform at the metadata.

Run the iGrafx platform behind SiteMinder / CA SSO as a preauthentication scenario: set the sitemindersecurity profile, customize the user header, and allow the desktop client through.

Fix two common Azure AD SAML SSO failures on the classic iGrafx login: a misconfigured Basic SAML Configuration, and a user or group not in scope for the enterprise application.

Check and update your identity provider configuration after upgrading to 20.x: re-import the service provider metadata, verify bindings and endpoint URLs, and troubleshoot SAML sign-in failures.

Users are logged out shortly after signing in via SiteMinder because the SAML session length matches a short assertion validity. Set the SP session duration in SiteMinder.