Configuring a SAML2 Provider - Configuring a SAML2 Provider - This type of provider uses a SAML2 server to authenticate users and log them in. - Perceptive Content - OnBase - Other - Identity and Access Management Services - Other/Identity-and-Access-Management-Services/5.3/Identity-and-Access-Management-Services/Configuring-IdS/Configuring-Providers/Configuring-a-SAML2-Provider - 5.3 - 5.3

This type of provider uses a SAML2 server to authenticate users and log them in.

1. Launch the Hyland IdS Administration client and log in (see Accessing the Hyland IdS Administration Client).
   Upon successfully logging in, the tenant, provider, client connection, and API resource information is displayed. In a wide display, the tenant information is in the left pane and the providers, client connections, and API resources configured for that tenant are listed in the right pane. In a narrow display, the tenant information is at the top of the page and the provider, client connection, and API resource information is below it.
2. Click the Provider tab to view the providers currently configured for the tenant.
   The number of providers configured is displayed in parentheses in the tab heading.

   
3. If you are configuring a new provider, click Add New at the upper right of the providers list. If you are configuring an existing provider, click its name in the list of providers.
   The Provider configuration page is displayed. It is divided into the Basic Settings and Protocol areas. In a wide display, the Basic Settings area is on the left. In a narrow display, the Basic Settings area is at the top of the page.
4. Under Basic Settings, configure the following options.

   Option	Description
   Name	This setting contains a unique name for the provider. This value is required and cannot contain any slashes (/ or \).
   	Institution Id: The unique identifier of the institution where the user belongs. This attribute is mandatory. Datasource Name: Name of the datasource where the user belongs. This attribute is mandatory.
   User Attribute Mapping	These settings are used to synchronize user attribute information. The following attributes can be synchronized. UserId: The unique user identifier received from the SAML provider. This can be configured to use the user name if the user name does not change over time. This attribute is required. Username: The URI of the claim type in the provider response that contains the user name of the user logging in. The specific value depends on the SAML assertion from the external provider. This attribute is required. Tip: To determine the value, look at the Name attribute of the <saml2:Attribute> element in a sample SAML assertion generated from the external provider being used. For complete details on SAML and SAML assertions, see the SAML 2.0 documentation available from OASIS. Email: The URI of the claim type in the provider response that contains the email address of the user logging in. Real Name: The URI of the claim type in the provider response that contains the real name of the user logging in. Group: The URI of the claim type in the provider response that contains the group membership of the user logging in.
   Strip domain from username	Select this option to remove the domain from the user name before it is passed for authentication. This setting controls whether to automatically strip the domain from user names that are passed as either domain\username or username@domain. This is useful when providers use a full domain and user name but the authenticating system only uses the user name.
   Enable User Provisioning	Select this option to synchronize the user attributes defined in the User Attribute Mapping section when the user logs in. Note: User provisioning requires a SCIM Endpoint to be defined for the tenant. See Configuring the Tenant.
   User Provisioning Create Enabled	Select this option to allow creating a new user in the tenant resource if the user logging in is not found. If this option is not selected and the user logging in is not found, that user is not logged in and an error message is displayed. Note: User provisioning requires a SCIM Endpoint to be defined for the tenant. See Configuring the Tenant.
   User Provisioning Update Enabled	Select this option to allow updating an existing user in the tenant resource if the user logging in is found. If this option is not selected, the incoming user information from the tenant is ignored and no updates are made to user information. Note: User provisioning requires a SCIM Endpoint to be defined for the tenant. See Configuring the Tenant.

5. Under Protocol, select SAML2 from the Type drop-down list.
   The specific settings for SAML2 providers are displayed.
6. In the External Idp Metadata section, provide external IdP metadata information from your third-party SAML provider using one of the following methods:
   • Click Upload Metadata file to upload the static SAML provider metadata file, an XML file that contains the metadata information about the third-party SAML provider.
     Note:

     When information in the metadata file changes, an updated static metadata file must be uploaded for the SAML provider configuration to remain current.

   • Enter the URL or UNC path to a static file that contains the metadata information about the third-party SAML provider in the External IdP Metadata Location field and click Connect. This should be a UNC path to a static file that contains the metadata information about the third-party SAML provider.
     Tip:

     For information on creating a metadata URL used by the SAML provider to access the metadata about the Hyland IdS, see Creating a Metadata URL for SAML Providers.

   • If metadata information is already configured and new metadata information must be configured for this provider, click Reconfigure to remove the previously configured metadata information. Then, provide the new metadata information by using one of the other methods described in this step.
   Once the information is uploaded or if the provided site URL or UNC path connects successfully, the information is autopopulated into the available fields in the Protocol area and the following non-editable fields are displayed:

   Setting	Description
   Entity ID	The unique identifier of the SAML identity provider, usually formatted as a URL. It is also known as the Identity Provider Issuer or just Issuer. Note: The Entity ID is the only authority the Hyland IdS accepts SAML assertions from.
   Authentication Request Binding	Refers to how authentication requests are handled by the SAML server. This value specifies the binding of the request sent from the Hyland IdS to the SAML server. The value is either HTTP Post or HTTP Redirect.

7. Update the values of the SAML2 protocol settings to match your environment.
   Tip:

   For more information on the SAML protocol, see the SAML documentation currently maintained by OASIS.

   The following settings are available.

   Setting	Description
   Assertion Binding	Select how the assertions are handled by the SAML server: This value specifies the binding of the request sent from the SAML server to the Hyland IdS. The following values are available: HTTP POST Artifact The default value is HTTP POST.
   Authentication Request Signing Algorithm	Select the encryption algorithm used for the signing certificate. The available algorithms are: RSA-SHA1 RSA-SHA256 RSA-SHA384 RSA-SHA512 Tip: The default value is RSA-SHA256 and is the recommended value to use.
   Signing Certificate Path	Enter the path to the certificate used to sign outbound messages of the authentication request. Note: Configuring a signing certificate is required to enable the Single Logout (SLO) feature. SLO is complementary to Single Sign-On (SSO) and allows users to log out from the applications they previously logged into using SSO. This path can be a thumbprint in the format thumbprint:xxxx, where xxxx is the thumbprint value. Note: If the certificate path is referenced by thumbprint, the certificate must be stored in the Trusted Root Certification Authorities in your local computer.
   Decryption Certificate Path	Enter the path to the certificate parties other than the Hyland IdS should use to decrypt messages sent to the Hyland IdS. This path can be a thumbprint in the format thumbprint:xxxx, where xxxx is the thumbprint value. Note: If the certificate path is referenced by thumbprint, the certificate must be stored in the Trusted Root Certification Authorities in your local computer.
   Minimum Incoming Signing Algorithm	Select the minimum encryption algorithm that can be used for the incoming signing certificate. The available algorithms are: RSA-SHA1 RSA-SHA256 RSA-SHA512 Tip: It is recommended to use RSA-SHA256.

8. Click Save in the lower right corner of the page.
9. Recycle the application pool of the Hyland IdS in Internet Information Services (IIS) Manager for the changes to take effect.
   The Hyland Identity Service Metadata section is displayed at the bottom of the configured SAML2 provider page. See the following available settings:

   Setting	Description
   Entity Id	Contains the Hyland IdS Service Entity Id that can be used to configure an external SAML2 provider to connect with the Hyland IdS. Note: The Entity Id for the provider is displayed in the Hyland IdS Administration client user interface.
   Hyland Identity Service Metadata Location	Contains the URL location of the Hyland IdS metadata that can be used to configure an external SAML2 provider to connect with the Hyland IdS.
   Download Metadata	Downloads the metadata of Hyland Identity Service. This metadata contains information that can be used to help configure an external SAML2 provider configuration to connect with the Hyland IdS.