1. In Client Certificate Configuration: select the method, which extracts the information from the certificate used to identify the user:
   1. User Principal Name (UPN)
   2. SAN Email (RFC822Name)
   3. Subject CN
   4. Subject Email
2. In Connection settings:

   1. In Connection string, enter the URL of the LDAP server and base address in the directory service, for example:

      Panel
      title Example: Connection string
      Connection string: ldap://localhost:389/ou=NexusEmployees,dc=nexus,dc=local

      where

      ou = organizationalUnitName
      dc = domainComponent
      
      For more information on LDAP string attributes, see RFC 2253, LDAP (v3): UTF-8 String Representation of Distinguished Names.

   2. In Username and Password, enter the Active Directory domain user name and password. 
3. In User search:

   1. Enter a Search pattern. Here are two examples:

      Panel
      title Example: Search pattern
      Search pattern: (userPrincipalName={0})

      
      

      Panel
      title Example: Search pattern using Distinguished Name (DN) of user
      Search pattern: cn={0},ou=users

      
      

   2. If password comparison was selected, enter the Attribute for password used in LDAP and, if applicable, the mechanism that LDAP uses for Password encryption.
4. In Group search:

   1. In Basis for group search, enter the subpath to the group information in LDAP.
      For example, if you find the group information under ou = groups, dc = myCompany, dc = de, enter the following:

      Panel
      title Example: Basis for group search
      Basis for group search: ou=groups

      
      

   2. In Filter for group search, enter a filter expression, that defines the search starting with the subpath above.
      

      For example, if the group membership of users is stored in a multi-value attribute member (via the DN), enter the following:

      Panel
      title Example: Filter for group search
      Filter for group search: (member={0})

      
      

   3. In Attribute for group, enter an attribute with unique values to define the group belonging. The groups to which the user belongs are compared in the last step with the assignment to the roles in the system and access to the system is assigned based on the assigned roles.

      For example, enter the following:

      Panel
      title Example: Attribute for group
      Attribute for group: cn

5. In Certificate settings: select the method, which extracts the information from the certificate used to identify the user:
   1. User Principal Name (UPN)
   2. SAN Email (RFC822Name)
   3. Subject CN
   4. Subject Email

6. 1. 
      

7. Group PermissionsGo to the LDAP Group Permissions tab Group Permissions
   1. Go to the LDAP Group Permissions tab to map the LDAP groups to internal Identity Manager roles.
   2. Click + to add an LDAP group to the Groups list
   3. Select the roles that should be assigned to that LDAP group in the Roles list.

1. In Certificate settings: select the method, which extracts the information from the certificate used to identify the user:
   1. User Principal Name (UPN)
   2. SAN Email (RFC822Name)
   3. Subject CN
   4. Subject Email
2. In User identification: enter details to map the userPrincipalName to a core object.
   
   1. In Identity template, select one or more core object types, for example, Employee and Contractor, on which the core object search will be performed. The first matching template will be used.
      
   2. In User name field, select the core object field to match the user, for example UPN or Email. Identity Manager will use it to search the core object in the selected identity template.
      
   3. In User display, enter fields in a comma separated list, for example FirstName,LastName. These fields are used to display the logged in user in Identity Manager Operator or Smart ID Self-Service.

1. Insert excerpt
   Set up authentication profile in Identity Manager Set up authentication profile in Identity Manager

1. Prepare the required SAML configuration files. For file examples, refer to Enable two-factor authentication to Identity Manager clients via SAML federation.
   1. You need one metadata file for each Service Provider, that is, one file for Identity Manager Operator, one file for Smart ID Self-Service and one file for other Service Providers that you configure.
   2. You also need the metadata file of your Identity Provider and a keystore containing all the keys you would like to use for encryption or signing.
2. Go to the SAML Configuration tab and do the following settings:
   1. In Identity Provider Configuration:

      1. Upload a Configuration file 
         Here you can upload and delete the metadata file for an identity provider. The metadata file must contain only one identity provider configuration and no service provider configurations.

      2. Select an Attribute Type
         This is the identifying element of a SAML response. Despite the name, it can contain other elements than attributes. It can have two values, Name ID and Attribute Statement. Name ID refers to the subject of a SAML response, Attribute Statement refers to attributes associated with the subject of a SAML response.

      3. Enter Attribute Name
         This field is only active when Attribute Statement is selected as Attribute Type. It can be any arbitrary value.

   2. In Keystore Configuration:
      1. Upload a Configuration file
         Here you can upload and delete key store file. The key store file must contain the certificates and the private key used for signing and decryption. A key store is mandatory.  When a key store is uploaded, the key store's password must be entered. Objects in the key store, if protected with a password, must have the same password as the key store itself.
      2. Available key aliases
         List of the aliases that mark private keys in the key store.
   3. In Service Provider Configurations:
      
      1. Click on the + button to add a service provider. 
      2. This view lists the aliases of the service providers. Any arbitrary number of service providers is allowed but at least one service provider is required. An uploaded service provider must use only private keys available in the key store. If you upload a service provider metadata file that violates the SAML metadata schema, this triggers an error message.
   4. In Service Provider Details:

      1. Alias
         In this context, Alias refers to the location and thus the service provider to use when sending the SAML response to the application for processing. An Alias is mandatory.
         
         This is an example of an excerpt from a typical metadata file that defines the Assertion Consumer Service responsible for processing the SAML response. The Alias in this case is "explorer".
         

         Code Block
         title Example: Excerpt from a metadata file
         ... <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://hostname:8080/prime_explorer/saml/SSO/alias/explorer" index="0" isDefault="true"/> ...

         
         

      2. Configuration File
         Click on the upload symbol and select the metadata file. 
         
         This field is mandatory. The metadata file must contain only one service provider configuration and no identity provider configurations. If the file is deleted and re-uploaded, Alias must be reset according to the metadata file.
      3. Alias for Signing Key
         The alias from the key store for the private key to use for signing. This field is mandatory.
      4. Alias for Encryption Key
         The alias from the key store for the private key to use for encryption purposes. This field is mandatory.

3. 
   

   Excerpt

   Go to the Core Object Configuration tab and do the following settings: In Identity template, select one or more core object types, for example, Employee and Contractor, on which the core object search will be performed. The first matching template will be used. In User name field, select the core object field to match the user principal, for example UPN or Email. Identity Manager will use it to search the core object in the selected identity template. In User display, enter fields in a comma separated list, for example FirstName, LastName. These fields are used to display the logged in user in Identity Manager Operator or Smart ID Self-Service.

   
   

1. Go to the SAML Configuration tab.
   1. Do the same settings as described above under heading "Configure SAML SSO Core Object profile".
2. Go to the LDAP Configuration tab.

   1. If you have already a configured LDAP profile, copy the information to here. See heading "Configure LDAP profile" above.
      

      Note
      The Direct binding and With password comparison selection are NOT used for the SAML SSO LDAP profile.

      
      

3. Go to the LDAP Group Permissions tab.
   1. See under heading "Configure LDAP profile" above.

This authentication profile analyzes the SAML response only to determine the user's roles after a successful login. The administrator has to configure the attribute which will be read/parsed from the SAML response.

1. Go to the SAML Configuration tab.
   1. Do the same settings as described above under heading "Configure SAML SSO Core Object profile".
2. Go to the SAML Group Mapping tab

   1. Specify the attribute name in the SAML response which will contain the user's groups.
      Example with "my-groups":

      Code Block
      title Example SAML response
      <saml:Attribute Name="my-groups" NameFormat="urn:oasis:names:tc:SAML:2.0:

      bindings:HTTP-POST" Location="http://hostname:8080/prime_explorer/saml/SSO/alias/explorer" index="0" isDefault="true"/> ...Configuration File
      Click on the upload symbol and select the metadata file. 
      This field is mandatory. The metadata file must contain only one service provider configuration and no identity provider configurations. If the file is deleted and re-uploaded, Alias must be reset according to the metadata file.
   2. Alias for Signing Key
      The alias from the key store for the private key to use for signing. This field is mandatory.
   3. Alias for Encryption Key
      The alias from the key store for the private key to use for encryption purposes. This field is mandatory.

1. Go to the General tab.
   1. Check Activate SAML Authentication.
      With this switch you decide if SAML authentication should be used or not. This switch is disabled by default.
   2. In User identification, select SAML SSO LDAP.
2. Go to the SAML Configuration tab.
   1. Do the same settings as described above under heading "Configure SAML SSO Core Object profile".
3. Go to the LDAP Configuration tab.

   If you have already a configured LDAP profile, copy the information to here. See heading "Configure LDAP profile" above.
   

   Note
   The Direct binding and With password comparison selection are NOT used for the SAML SSO LDAP profile.

   Go to the LDAP Group Permissions tab.
   1. See under heading "Configure LDAP profile" above

      attrname-format:basic"> <saml:AttributeValue xsi:type="xs:string">examplerole1</saml:AttributeValue> <saml:AttributeValue xsi:type="xs:string">another-role-of-your-user</saml:AttributeValue> </saml:Attribute>

      For more information see https://www.samltool.com/generic_sso_res.php.

   2. (copied from LDAP:)
   3. Map the groups from the SAML response to internal Identity Manager roles:
      1. Click + to add a group to the Groups list
      2. Select the roles that should be assigned to that group in the Roles list.
   4. Click Save.

In order for a process to be started after you login in Identity Manager Operator, the process must end with the service task Login - Finalize post-login process. The post-login process is available for all authentication profiles.

• A post-login process is automatically executed after successfully authenticating the user.
• The user will be forwarded to Identity Manager Operator only if the process completed successfully.
• The post-login process is executed under the internal user named loginProcessUser.
• Default is to not have a post-login process configured.

When you configure a post-login process for an authentication profile which is core object based (that is: Username with Password Core Object, Client Certificate Core Object, LDAP Core Object and SAML SSO Core Object), add the process for each core template with which it should be used, as additional command.

1. In Identity Manager Admin, Go to Home > Authentication Profiles.
2. Select an authentication profile.
3. In the Processes tab, select from the drop-down list, which process that shall run after a successful login in Identity Manager Operator.
4. Click Save.
5. Go to Home > Process Designer.
6. Select the same process as in step 3.
7. In the Task List tab, add the service task "Login: Finalize Post-Login Process" in the Attributes field.
8. In the Permissions tab, add the user loginProcessUser to Start process and to other service tasks, if applicable.
9. Click Save.

1. Log in to Identity Manager Admin as an admin user.