Enroll the NetBackup primary server with the IDP
The NetBackup primary server must be enrolled with the IDP as a service provider (SP). For step-by-step procedures that are specific to a particular IDP, see the following table:
Table: IDP-specific steps for enrolling the NetBackup primary server
IDP name | Link to steps |
|---|---|
ADFS | |
Okta | |
PingFederate | |
Azure | |
Shibboleth |
Enrolling an SP with an IDP typically involves the following operations:
The SP metadata XML file contains the SP certificate, the entity ID, the Assertion Consumer Service URL (ACS URL), and a log out URL (SingleLogoutService). The SP metadata XML file is required by the IDP to establish trust, and exchange authentication and authorization information with the SP.
Attribute mappings are used to map SAML attributes in the SSO with its corresponding attributes in the AD or LDAP directory. The SAML attribute mappings are used for generating SAML responses, which are sent to the NetBackup primary server. Ensure that you define SAML attributes that map to the userPrincipalName and the memberOf attributes in the AD or LDAP directory. The SAML attributes must adhere to the following formats:
Table:
Corresponding AD or LDAP attribute | SAML attribute format |
|---|---|
userPrincipalName | username@domainname |
memberOf | (CN=group name, DC=domainname) |
Note:
While adding the IDP configuration to the NetBackup primary server, the values entered for the user (-u) and user group (-g) options must match the SAML attribute names that are mapped to the userPrincipalName and the memberOf attributes in the AD or LDAP.
See Configure the SAML keystore and add and enable the IDP configuration.