Managing identity providers (IDPs)
You can configure single sign-on (SSO) with any identity provider (IDP) that uses the SAML 2.0 protocol and AD or LDAP directory services. You can add up to three IDPs to the appliance but can use only one at a time.
Note:
The date and time of the appliance, the IDP, and the browser must be synchronized. Cohesity recommends that the date and time are set using NTP.
Use the following procedures to manage your IDPs.
To add an IDP
- Sign in to the Flex Appliance Console as a security administrator and click the gear icon in the upper-right corner of the page, then click Single sign-on.
- Under Appliance service provider URL, copy or download the appliance metadata file. Upload that file to your IDP and add the appliance as a service provider. For more specific instructions, see the following articles on the Support website:
- From the IDP, download and save the IDP metadata XML file.
- Gather the following information for the IDP:
Name: A name of your choosing to identify the IDP.
User field: The SAML attribute name that is mapped to the user attribute of the remote user domain. For example, userPrincipalName, displayName, identifier, uid, etc.
Group field: The SAML attribute name that is mapped to the group attribute of the remote user domain. For example, memberOf, role, etc.
- From the Single sign-on page on the Flex Appliance Console, click Add.
- Upload the IDP metadata file. Once the file has uploaded successfully, click View details and verify the certificate subject values and SHA-256 fingerprints.
- Fill in the other required fields, then click Save.
- If you have added only one IDP, enable SSO to start using it. See Enabling or disabling SSO.
If you have added more than one IDP, the first IDP is used by default. Switch to the new IDP if necessary. See Switching to a different IDP.
To edit an IDP
- If you need to change the IDP metadata XML file, download the file from the IDP.
- Sign in to the Flex Appliance Console as a security administrator and click the gear icon in the upper-right corner of the page, then click Single sign-on.
- Click the name of the IDP, then click Edit.
- Make the required changes. If you uploaded a new IDP metadata file, click View details and verify the certificate subject values and SHA-256 fingerprints.
- When you are done, click Save.
To switch to a different IDP
- Sign in to the Flex Appliance Console as a security administrator and click the gear icon in the upper-right corner of the page, then click Single sign-on.
- If you have not done so already, add the IDP that you want to use. See Adding an IDP.
- Make sure that SSO is enabled. Then select the IDP that you want to use and click Use.
To remove an IDP
- Sign in to the Flex Appliance Console as a security administrator and click the gear icon in the upper-right corner of the page, then click Single sign-on.
- Select the IDP that you want to remove and click Remove.
Note:
If you have more than one IDP, you cannot remove the one that is in use unless you remove the others first. If you have only one IDP or have already removed the others, you must disable SSO before you can remove it.
More Information