| Panel | |
|---|---|
|
Overview
| Note | ||
|---|---|---|
| ||
The information provided on this page assumes you have a working knowledge of SAML Single Sign-On. |
UDMG Authentication Proxy enables Web Browser Single Sign-On (SSO) on the UDMG Admin UI through Security Assertion Markup Language 2.0 (SAML 2.0).
...
UDMG Authentication Proxy uses SAML Single Sign-On for authentication and User Provisioning. All user and group authorization must be configured within UDMG through Permission assignment.
Terminology
IdP | Identity Provider (for example, Okta) | Third-party system that pre-authenticates SAML users. |
|---|---|---|
SAML | Security Assertion Markup Language | SAML is an XML-based protocol for exchanging security information between a SAML Identity Provider and a SAML Service Provider. |
SP | Service Provider (for example, Universal Controller) | Receives and accepts authentications via SAML Single Sign-On. |
SSO | Single Sign-On | Method of authentication. |
Administrator Account
A list of administrator accounts and local account with fewer privileges can be defined on the UDMG Server database. They can login with the local authentication provider that is enabled for any service; therefore, these accounts will always be accessible for cases where, for example, Single Sign-On Settings are incorrectly configured or the Identity Provider is inaccessible.
Example Configuration:
Assuming the following service configuration on the UDMG Authentication Proxy, the below sections describe how to add the saml provider as option for user authentication.
| Code Block | ||
|---|---|---|
| ||
[service.demo] protocol = "http" policy = "failover" [[service.demo.targets]] hostname = "udmg.demo" port = 18080 |
...
Example with Okta App Integration
Before you begin
The Single sign on URL (SAML Post URL location, or callback URL) must be determined.
It will be in the form https://<FQDN>:<PORT>/service/auth/sso/saml/callback, where FQDN and PORT are the name and port for the host where the UDMG Authentication Proxy and NGINX server are installed.
For example https://udmg.demo/service/auth/sso/saml/callback.
SAML integration on Okta
To configure the SAML integration on Okta, follow these steps:
...
- Enter an App name such as stb-udmg, optionally add a logo and click Next:
In Configure SAML step, in the SAML Settings section, enter the value for
Single sign on URL
- Set the Audience URI to stb-udmg
- Select EmailAddress for Name ID format
- Select Email for Application username
- Keep the other default setting and click Next.
...