Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Panel
Table of Contents
maxlevel2

...

Any action URL parameters on the URL used by the SAML-authenticated user to access the Universal Controller web application are restored when the Service Provider-initiated SAML SSO authentication flow has completed successfully and the user has been redirected back to the Universal Controller web application.
 

Note
titleNote:

This is not applicable for an Identity Provider-initiated login.

...

If you are a SAML-enabled user, the Controller allows you to initiate the SAML Single Sign-On authentication flow without leaving the application. On the Session Expired pop-up, instead of entering your login credentials, simply click the Login button to initiate the SAML SSO authentication flow..

If only your Universal Controller session has expired, and not your session with the Identity Provider, you are logged in without being prompted for your credentials. Click Continue on the original dialog to proceed, which closes the SAML SSO authentication flow window.
 

...

An administrator can turn on/off and configure SAML Single Sign-On through the user interface.

Note
titleNote

Each Universal Controller cluster node maintains its own SAML Single Sign-On configuration, associated by Node Id. Therefore, you must complete the SAML Single Sign-On configuration for each deployed cluster node, including the Active node and any Passive nodes.

The Identify Provider Metadata File and KeyStore File, by default located under ${catalina.base}/conf/saml/, must be accessible to each cluster node.


Step 1

From the Administration navigation pane, select SAML Single Sign-On. The SAML Single Sign-On page displays.
 

Step 2

Enter / select your SAML Single Sign-On, using the field descriptions below as a guide.

  • Required fields display an asterisk ( * ) after the field name.
  • Default values for fields, if available, display automatically.

Step 3

Click the button.

...

Universal Controller Uninitialized

While the Universal Controller web application is initializing, the user login flow cannot proceed. Any users attempting to authenticate with SAML at this time receive the following error:
 
Universal Controller is being initialized. Please try again later.

User Account Not Found

Any SAML-authenticated user who cannot be linked to a user account in the Universal Controller database is prohibited from accessing the application and receives the following error:
 
User 'username' not synchronized with Universal Controller. Please check with your administrator.
 
Additionally, the uc.log will contain the following warning:
 
User 'username' authenticated by identity provider 'remote-entity-id' not synchronized with a Universal Controller account.

User Account Not Active

Any SAML-authenticated user linked to a Universal Controller user account that is not Active is prohibited from accessing the application and receives the following error:
 
User 'username' not synchronized with Universal Controller. Please check with your administrator.
 
Additionally, the uc.log will contain the following warning:
 
User 'username' authenticated by identity provider 'remote-entity-id' is synchronized with an inactive Universal Controller account.

Login Method

Any SAML-authenticated user linked to a Universal Controller user account that is not designated to use Single Sign-On login method is prohibited from accessing the application and receives the following error:
 
User 'username' not synchronized with Universal Controller. Please check with your administrator.
 
Additionally, the uc.log will contain the following warning:
 
User 'username' authenticated by identity provider 'remote-entity-id' is not permitted to use Single Sign-On login method.

User Account Locked

Any SAML-authenticated user linked to a Universal Controller user account that is locked is prohibited from accessing the application and receives the following error:
 
User account 'username' is locked. Please check with your administrator.

No Web Browser Access

Any SAML-authenticated user linked to a Universal Controller user account designated with the Single Sign-On login method, but without Web Browser Access, is prohibited from accessing the application and receives the following error:
 
User 'username' not permitted to login through the web browser. Please check with your administrator.

...