SAML Configuration
The SAML Configuration page allows you to setup and configure external SAML and ADFS authentication providers. SAML Configuration setup and enabled here are available on the login page.
Creating New SAML Configuration
To Create a new SAML Configuration, click the Add button. Creating a new SAML Configuration is a multistep process that begins with filling out the form with all the required information. Once the form is submitted, the SAML/ADFS server can be configured to support DataShyft using the Callback URL and Audience URL that are provided after creating the SAML Configuration.
Editing a SAML Configuration
Editing an existing SAML Configuration allows you to update some aspects of the configuration. Here are some of the key fields you may want to edit.
Enabled — Toggling the Enabled flag will allow you to control whether this SAML Configuration is displayed on the Login page or not.
Metadata — If the SAML/ADFS server's Metadata XML changes, you can either update this field with the new XML, or clear this field and let the system automatically refetch the XML from the Metadata URL on the next authentication attempt.
Metadata Refetch Interval — You can adjust this value to control how frequently Secrata requests the Metadata XML.
IDP Group Mappings — If the group information sent by the IDP changes, you can update the group mappings to properly map those groups to Secrata Roles.
Identity Provider Fields
ID
A Unique ID assigned to this SAML Configuration. This ID is used when setting up the various URLs used in the SAML/ADFS relationship. It is recommended that you use a readily identifiable value to assist in troubleshooting any authentication issues. This ID only needs to be unique within your tenant.
Enabled
Toggle that indicates if this SAML Configuration is enabled or not. If an configuration is enabled, it will appear on the login screen, and users will be able to use it to authenticate using this SAML/ADFS server.
Display Name
The name shown to the users for this SAML Configuration. It is used on the Login screen if there are multiple, active SAML Configurations. In that case, the user will be given a series of of login buttons, each one labeled Login with <Display Name>. This allows the users to quickly identify which SAML/ADFS provider they should be logging in with.
Description
An optional description of this SAML Configuration. This is for your internal reference and is not displayed to end users.
Metadata
The Metadata XML for the SAML/ADFS server. If a Metadata URL is specified, the system will automatically fetch the Metadata XML from the Identity Provider and update it. Generally, you only need to specify this if your SAML/ADFS server does not support automatic fetching of the Metadata XML.
Metadata URL
The URL from which the SAML/ADFS server Metadata XML can be retrieved. If the SAML/ADFS server does not support dynamic fetching of the Metadata XML, leave this field blank.
Metadata Refresh Interval
This setting specifies how long, in minutes, the Metadata XML should be cached before it is refetched from the SAML/ADFS server. The Metadata XML will only be fetched when someone logs in. If a user attempts to login using this SAML Configuration, and the Metadata XML is older then this interval, Secrata will fetch the current Metadata XML before proceeding with the login.
Automatic refetching is disabled if the Metadata URL field is blank.
Group Mappings
Specifies how the Group information received from the SAML/ADFS server during login should be mapped to the internal Secrata Groups.
To configure mappings, click the plus button to add a new row to the table. In the IDP Group field, enter the name of the SAML/ADFS provided group that you wish to map. In the Secrata Group dropdown, select the Secrata group to map to. You can add as many mappings as you need. Each IDP Group can only map to a single Secrata Group.
The user will be assigned Secrata Groups on initial login, and those roles will not be automatically updated on login. If you wish to change a user's groups in Secrata, the groups will have to be manually change by editing their user account in Secrata.
Domain Restriction
The Domain Restriction allow you to specify a list of regexes that are used to determine if a user account is logging in with the correct Identity Provider. For example, if an Identity Provider specified a domain restriction regex of +@secrata.com, then any user whose email address was at the secrata.com domain would be required to login with this SAML Configuration. Attempting to login with a different SAML Configuration, or using the username and password fields, would result in an authentication failure.
SAML Callback URL
The SAML Callback URL that is provided to the SAML/ADFS server when setting up the trust relationship. Responses from the SAML/ADFS server will be directed to this URL so that Secrata can complete the user authentication.
SAML Audience URL
The SAML Audience URL is provided to the SAML/ADFS server when setting up the trust relationship.