Adding an Identity Provider - Adding an Identity Provider - Use the Add Identity Provider wizard to add an external identity provider to your Content Innovation Cloud account. - Content Innovation Cloud - Content Innovation Cloud Administration Portal - Current/Content-Innovation-Cloud-Administration-Portal/bwq1689260642576 - Current - Current

Use the Add Identity Provider wizard to add an external identity provider to your Content Innovation Cloud account.

1. Open the Administration Portal.
2. Select the Identity tab below the application header.
   The Internal Users page is displayed.
3. In the sidebar, click Identity Providers.
   The Identity Providers page is displayed.
4. Click Add Identity Provider in the upper-right corner of the page.
   The Add Identity Provider wizard is displayed.
5. On the Information page, enter the following information:

   Setting	Description
   Identity Provider Name	The friendly name for this identity provider. The Content Innovation Cloud sign-in page displays this value as an authentication option for users whose email domains are assigned to this identity provider.
   Entity ID	The globally unique SAML identifier of the identity provider.
   Metadata URL	The URL from which SAML metadata will be collected. SAML metadata must be provided through an internet-accessible URL. You cannot import the metadata as a file.
   Minimum Assertion Signature Algorithm	The minimum signature algorithm allowed to process an assertion.

6. Click Next Step.
7. On the Bindings page, specify whether this identity provider should override the default binding for authentication requests or assertions.

   Setting	Description
   Override authentication request binding	Select to force a specific binding to be used for SAML authentication requests to this identity provider. If this option is not selected, authentication requests are sent using the preferred binding specified in the identity provider's SAML metadata. HTTP-Redirect is the binding typically recommended for SAML authentication requests. For information about available bindings, see SAML 2.0 Bindings.
   Override assertion binding	Select to request a specific binding for SAML responses (assertions). The identity provider is not required to comply with this request. HTTP-POST is the binding typically recommended for SAML responses. For information about available bindings, see SAML 2.0 Bindings.

8. Click Next Step.
9. On the Claim Type Mapping page, enter the SAML attribute for each claim type.

   Only claim types marked with an asterisk are required.

   Claim Type	Description
   External User ID	The user's persistent external identifier. The identifier must be unique to a single user.
   Email	The user's primary email address. The email address must be unique to a single user.
   Username	The user's username. If this claim type is not mapped, or if no username value is provided, then the email value is used instead.
   First Name	The user's first name.
   Last Name	The user's last name.
   User Groups	Groups the user belongs to.

10. Optional: Map custom user attributes as needed.
    Note: Custom user attributes must be added to your Content Innovation Cloud account before they can be mapped. Contact your Hyland support representative if your account requires custom user attributes.
    1. On the Claim Type Mapping page, select the Custom Attributes tab.
    2. Click Map Custom Attribute.
       If this option is not available, then there are no custom user attributes available to map.
    3. Select a custom user attribute from the Attribute drop-down list.
    4. In the Source Claim Name field, enter the name of the attribute as specified in SAML assertions from this identity provider. This value is case sensitive.
    5. Map additional custom user attributes as needed.
11. Click Next Step.
12. On the Email Domains page, specify the email domains allowed to authenticate using this identity provider.

    • Select one or more existing email domains to assign to this identity provider.

    • Click Add Email Domain to add a new email domain.

      Note: You can add a new domain only if your Content Innovation Cloud account has at least one user with a verified email address that uses the domain you want to add. If no such verified user exists, then you cannot add the domain to your account.

      After adding a domain, you can select it for this identity provider. For information about adding email domains, see Adding an Email Domain.

    Users can authenticate using this identity provider only if their email domains match one of those selected.
13. Click Next Step.
14. On the Settings page, indicate whether this identity provider configuration should be enabled.

    • Choose Enabled to make the identity provider an available sign-in option as soon as the configuration is saved.

    • Choose Disabled if the identity provider should not yet be available to authenticate users for the Content Innovation Cloud.

15. Click Next Step.
16. Review the configuration settings you specified.
17. Click Add Identity Provider to complete the process.
    The new identity provider is added to the Identity Providers list, and a confirmation message is displayed.