UC_SAML_SETTINGS - Single Sign-On

This Variable (VARA) object defines the parameters to use the Automation Engine as a SAML (Security Assertion Markup Language) identity provider and allows you to link departments to one or more SAML identity providers. It is supplied with system client 0000.

You must set up this variable to use SAML single sign-on with the Automation Engine. For more information, see Setting up Single Sign-On.

This variable includes the following keys:

*SP

• Description: Service provider of the Automation Engine

  This key contains the medatada (xml) of the service provider of the Automation Engine.

  When the SAML key in the UC_SYSTEM_SETTINGS variable is set to Y, the system generates and populates the *SP key automatically. For more information, see SAML and UC_SYSTEM_SETTINGS - Systemwide Settings.

  You must edit the XML content and replace the three _INSERT_ values:

  1. entityID attribute at the beginning of the EntityDescriptor

     Replace the value of the entityID attribute the URI that points to the Service Provider. Usually, the domain name of the Service Provider (the AWI location) is used, such as "https://www.example.com/awi/".

     Example

     entityID="https://www.example.com/awi/"

  2. Location attribute for the HTTP-POST binding in the AssertionConsumerService element

     Replace the value of the Location attribute binding with the URI that points to your AWI instance or load balancer.

     Example

     Location ="https://www.example.com/awi/"

  3. Location attribute for the HTTP-Artifact binding in the AssertionConsumerService element

     Replace the value of the Location attribute binding with the URI that points to your AWI instance or load balancer.

     Example

     Location ="https://www.example.com/awi/"

• Restart required: No

Department

• Description: Department name to be linked to an Identity Provider

  Add this key as a department by clicking Add Key, and insert the downloaded XML content of the Identity Provider (IDPSSODescriptor) as a value.

  Note: If the department is configured to be used with SAML, the user password can no longer be changed through the drop-down list at the top right corner menu. You have to change it through your Identity Provider. Also, changing the password in the User object has no practical effect. It becomes effective again when SAML is removed for the department the user belongs to, or when SAML has been disabled in the UC_SYSTEM_SETTINGS variable. For more information, see SAML

• Restart required: No

• Example

  Key: TEST

  Value: Metadata for Okta as the Identidy Provider (IdP)

  <md:EntityDescriptor entityID="http://www.okta.com/exk1gy2l05kAuaBRJ0h8" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
      <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
          <md:KeyDescriptor use="signing">
              <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                  <ds:X509Data>
                      <ds:X509Certificate>MIIDnjCCAoagAwIBAgIGAV2hgZOLMA0GCSqGSIb3DQEBCwUAMIGPMQswCQYDVQQGEwJVUzETMBEG
  A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
  MBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2F1dG9taWMxHDAaBgkqhkiG9w0BCQEWDWlu
  Zm9Ab2t0YS5jb20wHhcNMTcwODAyMDU1MjI5WhcNMjcwODAyMDU1MzI5WjCBjzELMAkGA1UEBhMC
  VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM
  BE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdhdXRvbWljMRwwGgYJKoZIhvcN
  AQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgsqlEPXL
  XAJi0dgJOYknjZxmdissp3lnoUbB9a9gpek/VedXVXFamoZ1YflE8+up9BlZtsDPgkSqK+ucdx4r
  cqaxJlmGj5aJEEnBhrDl14jYfMxdCbMOpDNpYcvhUHKK3PZKUdtJ4d1cYg567ezW2mBeCeEaswdt
  UaAs4OzFFSyvmcVwcL85tQ2cpcPboct3HbzASYDXuRCTpbK1ePTVVl6L0oBLremOLbMyqVIVs/Wt
  a7bQe2myiJFxYcmViFZWss08GqdnOKaMM61rHVQb4on66svn3icebLSnzYUwu+Tp9EYFdogOG6lL
  UJ+2pjxhPlCo6YbtJdCE2/hO3wiVHwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAK/OxCCDdwgYwK
  OxejIMEWHr78jKNlzo7I/mRDNlcxnP+ipkCAfMgFFqg038FqIOWF6N3rwnp84vuQCoyAsuXCNK5h
  UjaB30unaRaPQYTtFQnH8l/zWN8lUABb8NPatFOGh2xOqGszt4yZQpH4AgKkTi9iyrY2jPDJ44ma
  B4ki30KBDxhD0DbRcXbuIOhQ0dN2zFSBYlSVxOacPBc1cVA5xDkxt29vSeR9xTXBC15/Ku0KiQtp
  ZzRXjF94m0Es0glJY26Jj9q1aFrb+vT2JYhcOJ9MAA1CnZngPlhs2Ktko3bnUIna/+uA6C1rQUyC
  TJ/Q5Abe0MtM3YOLBkbrw0V0</ds:X509Certificate>
                  </ds:X509Data>
              </ds:KeyInfo>
          </md:KeyDescriptor>
          <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
          <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
          <md:SingleSignOnService
              Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://mycompany.okta.com/app/mycompanysoftwaregmbhprod_awasamltestuc2tsclient100depsbb01_1/exk1gy2l05kAuaBRJ0h8/sso/saml"/>
          <md:SingleSignOnService
              Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://mycompany.okta.com/app/mycompanysoftwaregmbhprod_awasamltestuc2tsclient100depsbb01_1/exk1gy2l05kAuaBRJ0h8/sso/saml"/>
      </md:IDPSSODescriptor>
  </md:EntityDescriptor>

See also:

• List of VARA Objects for System and Client Values
• User-Defined VARA Objects