Referencia de configuración de SAML

To use SAML single sign-on (SSO) for authentication to , you must configure both your external SAML identity provider (IdP) and your enterprise or organization on . In a SAML configuration, functions as a SAML service provider (SP). For more information about authentication for your enterprise, see About identity and access management.

provides integration according to the SAML 2.0 specification. For more information, see the SAML Wiki on the OASIS website.

You must enter unique values from your SAML IdP when configuring SAML SSO for , and you must also enter unique values from on your IdP.

The SP metadata for Enterprise Cloud is available for either organizations or enterprises with SAML SSO. uses the urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST binding.

If you use Enterprise Managed Users, you can only enable SAML SSO at the enterprise level.

You can configure SAML SSO for an individual organization in your enterprise. You can also configure SAML SSO for an organization if you use an individual organization on Enterprise Cloud and do not use an enterprise account. For more information, see Managing SAML single sign-on for your organization.

The SP metadata for an organization on is available at https://.com/orgs/ORGANIZATION/saml/metadata, where ORGANIZATION is the name of your organization on .

Depending on your environment, the SP metadata for an enterprise on Enterprise Cloud is available at either:

• https://.com/enterprises/ENTERPRISE/saml/metadata, where ENTERPRISE is the name of your enterprise
• https://SUBDOMAIN.ghe.com/enterprises/SUBDOMAIN/saml/metadata, where SUBDOMAIN is the subdomain for your enterprise

The following SAML attributes are available for .

To specify more than one value for an attribute, use multiple <saml2:AttributeValue> elements.

<saml2:Attribute FriendlyName="public_keys" Name="urn:oid:1.2.840.113549.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
    <saml2:AttributeValue>ssh-rsa LONG KEY</saml2:AttributeValue>
    <saml2:AttributeValue>ssh-rsa LONG KEY 2</saml2:AttributeValue>
</saml2:Attribute>

requires that the response message from your IdP fulfill the following requirements.

• Your IdP must provide the <Destination> element on the root response document and match the ACS URL only when the root response document is signed. If your IdP signs the assertion, will ignore the assertion.

• Your IdP must always provide the <Audience> element as part of the <AudienceRestriction> element. The value must match your EntityId for .

  • If you configure SAML for an organization, this value is https://.com/orgs/ORGANIZATION.
  • If you configure SAML for an enterprise, this URL is https://.com/enterprises/ENTERPRISE or https://SUBDOMAIN.ghe.com/enterprises/SUBDOMAIN.

• Your IdP must provide a single assertion in the response with a digital signature. You can accomplish this by signing the <Assertion> element or by signing the <Response> element.

• Your IdP must provide a <NameID> element as part of the <Subject> element. You may use any persistent name identifier format.

• Your IdP must include the Recipient attribute, which must be set to the ACS URL. The following example demonstrates the attribute.

  <samlp:Response ...>
    <saml:Assertion ...>
      <saml:Subject>
        <saml:NameID ...>...</saml:NameID>
        <saml:SubjectConfirmation ...>
          <saml:SubjectConfirmationData Recipient="https://.com/enterprises/ENTERPRISE/saml/consume" .../>
        </saml:SubjectConfirmation>
      </saml:Subject>
      <saml:AttributeStatement>
        <saml:Attribute FriendlyName="USERNAME-ATTRIBUTE" ...>
          <saml:AttributeValue>monalisa</saml:AttributeValue>
        </saml:Attribute>
      </saml:AttributeStatement>
    </saml:Assertion>
  </samlp:Response>
  

To prevent a person from authenticating with your IdP and staying authorized indefinitely, periodically invalidates the session for each user account with access to your enterprise's resources. After invalidation, the person must authenticate with your IdP once again.

By default, if your IdP does not assert a value for the SessionNotOnOrAfter attribute, invalidates a session 24 hours after successful authentication with your IdP.

will support a customized session duration if your IdP provides the option to configure a SessionNotOnOrAfter attribute and value.

If you define a customized session duration value less than 24 hours, may prompt people to authenticate every time initiates a redirect.

To prevent authentication errors, we recommend a minimum session duration of 4 hours. For more information, see Troubleshooting SAML authentication.