Configuring SSO on a NetBackup Flex Scale cluster on which only media servers are deployed
Configuring SSO on NetBackup Flex Scale cluster on which only media servers are deployed involves the following steps:
Table:
Task | Description |
|---|---|
Configuring SSO on an NetBackup Flex Scale cluster | See To configure SSO on cluster on which only media servers are deployed |
Adding users/group | Note: SSO can be configured only for AD/LDAP users for media server only deployment. |
Configuring an identity provider | |
Logging into NetBackup Flex Scale with SSO | See Login with SSO |
To configure SSO on cluster on which only media servers are deployed
- Go to Settings > Security management > Single sign-on (SSO). Click Add.
- Give the IDP name and upload the IDP metadata xml and optionally provide the custom user field and group field values. The user field and group field values should be same as configured on the IDP. Click Save.
The UI displays a message that confirms that the add identity provider task is triggered. You can click View Details to see the progress of the task. Alternatively, you can also click the Recent Activity icon from the top right of the UI to see the status of the most recent operations.
- Once the configuration is complete, the SSO identify provider details are displayed on the screen. Click Download service provider xml to download the details and upload it on IDP server, if required.
To configure an identity provider
- Login with SSO works only if the configuration on the IDP side is done. Each IDP has different steps for configuration.
Refer to the following links for the configuration steps for each identity provider.
ADFS: Enrolling NetBackup Flex Scale primary server as a service provider to ADFS
Azure: Enrolling NetBackup Flex Scale primary server as a service provider to Azure
Okta: Enrolling NetBackup Flex Scale primary server as a service provider to Okta
PingFederate: Enrolling NetBackup Flex Scale primary server as a service provider to PingFederate
Login with SSO
- Navigate to infrastructure GUI login page. Click Sign-in with single sign-on (SSO).
- Enter SSO credentials and click Sign in.
There are some limitations when you configure SSO on a NetBackup Flex Scale cluster on which only media servers are deployed.
Identity provider cannot be edited. It can be removed and added again.
Single logout is not implemented. If SAML users log out of the application, and try to login with SSO again, the user is not asked for their login credentials unless the SSO session has expired. This applies to any other application using the same IDP.
If after identity provider configuration, External certificate authority (ECA) is configured, then login with SSO does not work until the identity provider is updated with the latest service provider metadata xml from the NetBackup Flex Scale. This can be done by downloading the service provider metadata xml from . This metadata needs to be updated on the IDP side.
AD/IDP server date, time, and time zone should be the same as the NetBackup Flex Scale cluster. Else, the SSO login fails.
The logs can be found by logging into the NetBackup Flex Scale CLISH, elevating to root and accessing the logs at:
/log/VRTSnas/ nbu_sso_config.log/log/VRTSnas/ isagui_webserver.log/log/VRTSnas/ isagui_sso_config.log
The Table: Common error messages lists the common error messages.
Table: Common error messages
Error message | Description |
|---|---|
User is not authorized | User is a valid AD/LDAP and IDP user but does not have the Appliance administrator role in NetBackup Flex Scale user management. |
User principal name missing/ Failed to get user details from identity provider | SAML response from the IDP does not contain the user field. This can be due to userPrincipalName field attribute mapping not being created on the IDP side or the custom attribute name is different on the IDP side as provided in the NetBackup Flex Scale. |
Authentication Failed, Invalid document signature | Date and time of Identity provider does not match with NetBackup Flex Scale cluster, Identity provider certificate is not updated with latest NetBackup primary certificate, or the certificate revocation check is not disabled on the identity provider. |
Authentication Failed, SAML assertion is not yet valid | Date and time of Identity provider do not match with NetBackup Flex Scale cluster. |
Single sign-on failed due to an internal error | Processing SAML callback response failed on NetBackup Flex Scale side due to some exception. |