Skip to main content

Get help for ARIS Advanced

Enable SSO (Single Sign-On)

SSO (Single Sign-On) in ARIS Advanced is realized using SCIM in combination with SAML. ARIS Advanced supports the service provider-initiated SAML-based SSO. ARIS Advanced does not support the identity provider initiated SAML based SSO for public cloud.

In ARIS Advanced edition, the user limit is set to 200. Only 200 users are allowed to provision in ARIS Advanced edition.

In ARIS Advanced Base Extension edition, the user limit is set to 2000. You can provision up to 2000 users in ARIS Advanced Base Extension edition. You cannot exceed that limit.

Prerequisite

Server

  • The SAML identity provider supports the HTTP POST binding as specified by the SAML 2.0 specification.

  • SSO must be configured for the servers.

  • You have access to the metadata XML file only if SAML is enabled.

  • ARIS Advanced must be registered as a trusted service provider at the SAML identity provider.

Client

  • Your web browser supports JavaScript.

Procedure. Procedure
    Enable SSO (SAML).

    1. Click Application launcher Application launcher > Administration Administration.

    2. Click Configuration management.

    3. Click Single sign-on.

    4. Under General, enable Enable single sign-on.

    5. Enter the ID of the identity provider in the Identity provider ID field (entityID in the IdP metadata.xml file).

    6. Enter the ID of the service provider in the Service provider ID field, for example http(s)://<ARIS Advanced server name>.

    7. Enter the endpoint of the identity provider that is used for single sign-on in the Single sign-on URL field (SingleSignOnService URL in the IdP metadata.xml file).

    8. Enter the endpoint of the identity provider that is used for single log-out in in the Single logout URL field (SingleSignLogoutService URL in the IdP metadata.xml file).

    9. Click Save Save.

    Optional: Specify the SAML settings.

    1. Under Signature, enable the options you want to configure:

      • Enforce signing of assertions

      • Enforce signing of requests

      • Enforce signing of responses

      • Enforce signing of metadata

      • Select signature algorithm

    2. Click Save Save.

    You have enabled the signing. Depending on the signing configuration, you have to configure the truststore and keystore.

    Optional: Configure the keystore.

    1. Under Keystore, click Upload Upload.

    2. Click Upload. The dialog opens. Select the keystore file from your file system and click Upload.

    3. Configure your keystore.

    4. Click Save Save.

    You have configured the keystore.

    Share the service provider (SP) metadata.

    • You can find the service provider metadata under General. Send the service provider ID to your identity provider (IDP).

    Configure SAML using identity provider (IDP) metadata.

    1. Under General, enter the identity provider ID.

    2. Click Save Save.

    Optional: Configure the truststore.

    1. Under Truststore, click Upload Upload. The dialog opens. Select the truststore file from your file system and click Upload.

    2. Configure your truststore.

    3. Click Save Save.

    You have configured the truststore.

    Configure the user attributes.

    1. Under User attributes, specify the attribute fields, for example, the first name, the last name, or the e-mail.

    2. Click Save Save.

    You have configured the user attributes.

    Optional: Specify the advanced settings.

    1. Under Advanced settings, configure:

      • Authentication context classes

      • Authentication content comparison

      • NamedID format

      • Clock skew (in seconds)

      • Assertion lifetime (in seconds)

    2. Click Save Save.

    You have configured the advanced settings.