SAML Authentication enables the integration of OnApp as a Service Provider into third-party systems via Single Sign-On possibility, so the users of third-party systems can use their credentials to access OnApp services, without the need to be previously registered in OnApp Cloud.

This Authentication is enabled by adding an Identity Provider (IdP) instance, which is used to direct OnApp login requests to the server configured with SAML.

  • It must be configured properly to be able to store OnApp mapping attributes (user role, time zone, etc.). 
  • It requires that only HTTPS protocol is used.

Selecting a SAML IdP on OnApp login screen or from the drop-down menu, a user will be redirected to the login screen of that identity provider. Upon logging in there with their email and password (or if they are already logged in), they will be redirected back to OnApp Control Panel. This final redirect will contain an email attribute of that user which is used for their recognition in OnApp system – if such a user already exists, he or she is recognized and authorized, if not - a new OnApp user will be automatically created. 

A new user will not be created without the OnApp Key attribute.

The attributes of the third party system users will be synchronized during every login, depending on the available keys for attributes mapping. This will enable a third-party system administrator to preset the main OnApp user properties (user role, time zone, group) without the necessity to enter OnApp and make the required configurations manually.

Users created without these attributes can be located and managed at Users > Users with Config Problems on your OnApp Control Panel. 

If required, you may configure the cloud access for SAML users only by using SAML credentials.
To do so, disable the switch Local Login for SAML Users at Control Panel > Admin > Settings > Configuration > System tab.

See also:

Leave feedback