Active Directory (LDAP, SSO, SAML)
Admin can provide access to the Active Directory to import users and groups to the Analytics hub.
Server AD
The system provides an LDAP connection to synchronize users and groups with Server AD. To establish a connection Admin should fill out the form.
| Item | Description | UI |
|---|---|---|
| Host | allows Admin to add a server path, a required field | input field |
| Base DN | allows Admin to add a Base DN path, a required field | input field |
| Username | allows Admin to add a username for an Active Directory user with access to read users' data, a required field | input field |
| Password | allows Admin to add a password for an Active Directory user with access to read users' data, a required field | input field |
| Auto sync | allows Admin to enable/disable auto sync users' data from AD while logging in | switcher |
The Base DN is the starting point an LDAP server uses when searching for users authentication within your Directory
Cloud AD
Additionally, Analytics hub connects with Azure Cloud AD for single-sign-on (SSO) authorization. To establish a connection, the admin should fill in the form with the Azure application credentials for SSO
| Item | Description | UI |
|---|---|---|
| Tenant ID | allows Admin to add a Tenant ID | input field |
| Client ID | allows Admin to add a Client ID | input field |
| Client Secret | allows Admin to add a Client Secret | input field |
| Group's pre-filter | allows Admin to specify Azure AD Group IDs to be synchronized when the application has limited permissions to retrieve groups. Group IDs provide a reliable way to identify the required groups and avoid issues with duplicate group names | input field |
| Groups to sync | allows Admin to select Azure AD groups from the available list for synchronization when the application has permission to retrieve all groups from Azure AD, several elements are separated by commas | dropdown list |
| Auto sync | allows Admin to enable/disable auto sync users' data from AD while logging in | switcher |
Single Sign On with SAML
Accton can authenticate users against your organization's Active Directory using one of three modes, selected from the tabs at the top of this settings page: Server (LDAP), Cloud (SSO), and SAML. This guide currently covers the SAML tab. If you need help, contact our support team using the Help Request button in the Accton menu.
Common fields
These fields apply regardless of the selected metadata Type:
| Item | Description | UI |
|---|---|---|
| Enabled | Turns SAML authentication on or off for this connection | switcher |
| Last updated at | Read-only timestamp of the last time this configuration was saved; shows "Never" if it hasn't been saved yet | read-only label |
The Metadata section below has a Type option that determines how the identity provider's (IdP) SAML metadata is supplied - IDP URL, XML config, or customizable. Each option is described separately below.
1. IDP URL
Used when the identity provider publishes a single metadata URL that Accton can fetch automatically.
| Item | Description | UI |
|---|---|---|
| Metadata | URL of the identity provider's SAML metadata document | input field |
2. XML config
Used when the identity provider's metadata is supplied as a downloaded XML file rather than a public URL.
| Item | Description | UI |
|---|---|---|
| XML config | IdP metadata XML file exported from the identity provider | file input |
3. Customizable
Used to enter the identity provider's SAML endpoint and signing certificate individually, when a combined metadata URL or file isn't available.
| Item | Description | UI |
|---|---|---|
| IDP's 'Assertion Consumer Service' URL | URL of the identity provider's SAML endpoint that receives the authentication response | input field |
| IDP's assertion signing certificate | Certificate the identity provider uses to sign SAML assertions, used to verify their authenticity | file input |
Service provider certificate
Applies to all three Type options above.
| Item | Description | UI |
|---|---|---|
| Generate own certificate | When on, Accton generates its own service provider certificate automatically and the certificate upload fields below are hidden. When off, upload your own certificate pair | switcher |
| Certificate (crt) | Service provider certificate file, in .crt format (shown only when Generate own certificate is off) | file input |
| Certificate (pem) | Service provider certificate file, in .pem format (shown only when Generate own certificate is off) | file input |
Form actions
| Action | Description |
|---|---|
| Save | Saves the entered SAML configuration for this connection |
| Cancel | Discards changes and closes the form |
| Clear | Clears all entered values from the form |