SAML Settings

Your server's data is an XML file that contains a data schema request. The XML file contains the fields and the structure that your Identity Provider (IdP) must export. To download your server's XML file:

1. Open the System Admin tab in your server.

2. Hover the Settings menu.
   A drop-down list displays.

3. Select SAML Settings.
   The SAML Settings Page displays.

4. Click Download SP Metadata.xml at the top of the pane.
   The download starts automatically.

Wait for the download to complete. From the XML file, you can configure the specific schemas (formats) in which the attributes are pulled from your IdP.

Read the Section 3.2 of the Authentication Context for the OASIS Security Assertion Markup Language (SAML) V2.0 for information on the schemas for SAML SSO and MFA.

If you are not an administrator of your Identity Provider, contact the administrator.

The process to upload your server's XML file to your IdP changes depending on which provider you use for your users. Currently, you can only configure SAML with the providers in the following list. Navigate your IdP documentation to upload your server's XML and download your IdP Metadata file.

Contact your IdP manager for assistance.

Ensure that your IDP Metadata file contains the following information:

• EntityID

• Endpoints

  • Single Sign On Service Endpoint

  • Single Logout Service Endpoint

• Public X.509 Certificate

• Name ID Format

• Organization Information

• Contact Information

Additionally, it is recommended that you validate the attributes and values of your IdP XML file to match the following expectations of your server.

Entra ID or ADFS Integration

Attribute	Existing Attribute Name	New Name(s) Accepted
User ID*	http://schemas.microsoft.com/ws/2013/11/alternateloginid	userid	username
Name*	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname	http://schemas.xmlsoap.org/claims/CommonName	name
Email*	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress	email	mail
Groups**	http://schemas.xmlsoap.org/claims/Group	groups	usergroups
Phone	none	phone
Alternate Phone	none	altphone	alternatephone
Department	none	department	dept
Notes	none	notes
Manager	none	manager
Roles	none	none	none

*: Required Fields

**: Required for Group or Role sync

Okta Integration

Attribute Statements	Name	Name Format	Value
User ID*	userid	unspecified	user.firstName+"."+user.lastName or user.name
Name*	name	unspecified	user.firstName+" "+user.lastName
Email*	email	unspecified	user.email
Groups**	groups	Basic	Matches regex: .*
Roles**	roles	Basic	Matches regex: .*

*: Required Fields

**: Required for Group or Role sync

To finalize the configuration, return to your SAML Settings Page and Upload your IDP Metadata file. Complete the SAML Settings Page considering the following table.

Advanced Settings

The Advanced Settings enable you to configure the MFA rules and protocols for your users to authenticate and access your server. Read the descriptions and configurations of each attribute carefully to configure MFA properly.

• NameID Format: Define the expected schema (format) when your server's enforces MFA through your IdP.

• Required authentication level: Define the MFA expected response from the user that attempts to sign in or log in.

• SAML Auth Context reference: Specify the structure in which your server and your IdP relate a single user's identity and authentication.

• Entity ID for the server: Provide the name of your server exactly as you provided it for your IdP to grant access to the user database.

• Excluded Role Names from Role Sync: Provide the types of user roles that do not receive an automatic role when signing in to your server.

To submit the changes to your server, click Submit on the SAML Settings Page.

After your server reloads the page, ensure that your IdP manager also refreshes your IdP authorizations for previously signed on users. If you do not refresh your authorizations directly on the IdP, the system will lock.