Orchestrator can handle Single Sign-On Authentication based on SAML 2.0. To enable it, both Orchestrator as Service Provider, and an Identity Provider must be properly configured so that they can communicate with each other. If SAML is enabled and correctly configured, a button is displayed at the bottom of the Login page. If the external identity provider uses a multi-factor authentication protocol, the user needs to comply to the corresponding rules as well in order to successfully log in.
Before we get to the detailed procedure, here is a quick overview of what you have to do to enable SAML authentication.
- Define a user in Orchestrator and have a valid email address set on the Users page.
- Import the signing certificate provided by the Identity Provider to the Windows certificate store using Microsoft Management Console, and set Orchestrator to use it accordingly. See here how to do that.
- Add the configuration block specific to the Identity Provider in
web.config, making sure that the
ExternalAuth.Saml2.Enabledparameter is set to
The above method is valid if your email address is set as a SAML attribute, however you can configure your own mapping strategy as well. See here how to do that.