Authentication for Admin Console

Authentication flow overview #

The SAML authentication flow for the Administration Portal consists of the following steps:

• The user initiates a Service Provider (SP) Initiated flow which redirects the user to the Identity Provider Single Sign-On URL.
• The idP parses the SAML request and authenticates the user. Once the user is authenticated, the idP generates a SAML response.
• The idP returns the encoded SAML response to the browser.
• The browser sends the SAML response to Netgraph Connect for verification.
• If the verification is successful, Netgraph Connect will perform user authorization depending on the matching SAML Role Mapping.
  • If the SAML Response contains the preferred SAML Role Mapping, it will be used. Otherwise, the default SAML Role Mapping will be applied (described below).

Configuration #

1. In the side menu, Organization / Accounts / Federation click Add SSO Identity Provider

2. Enter a Descriptive name for the provider, e.g. ‘Azure Admin Portal’ and click Add Identity Provider..

3. Select ‘Admin Portal’ as Authentication Target

4. There are two ways of deciding user authorization, either by setting a Default Role Mapping or by making your idP include the Role Mapping as an attribute in the SAML Response. In this example, we will use Default Role Mapping.

5. Select the Default Role Mapping role. If no mappings are available, then define a new mapping as described in Configure SAML Role mapping and then resume the configuration.
6. By default, the SAML configuration allows Identity Provider (IdP) initiated SSO login flow, but by checking the Display Login Button and entering the button text, users will be able to initiate a Service Provider Initiated (SP-initiated) SSO via the Admin Console login page (as shown in the overview picture above).

1. Please note the Service Provider Recipient URL, it’s a unique identifier that is needed when configuring your idP in the next step.
2. Configure the Identity Provider Details for your Service Provider. Below are a few examples of how to set up your Identity Provider for:
   1. Azure AD configuration example
   2. Google configuration example

3. In the Identity Provider Single Sign-On URL field, enter the appropriate value from your idP (step 8).

4. In the Identity Provider Issuer field, enter the appropriate value from your idP (step 8).

5. In X.509 Certificate field, enter the appropriate value from your idP (step 8).

6. Click Update Identity Provider

7. Done.

   • If you checked the Display Login Button in step 6, a button will appear on the login page of your organization’s Administration Portal.