- \n
- A 探花大神 administrator account.<\/li>\n\n\n\n
- 探花大神 SSO Package or higher or SSO add-on feature.<\/li>\n\n\n\n
- An Egnyte user account with administrator permissions with an Enterprise<\/a> subscription. <\/li>\n\n\n\n
- You need to generate an API Key.\u00a0<\/li>\n<\/ul>\n\n\n\n
<\/a>Important Considerations<\/strong><\/p>\n\n\n\n
- \n
- SSO must be configured for Egnyte prior to creating an Identity Management integration.<\/li>\n\n\n\n
- Due to an update on the SAML SSO connector to correctly support SCIM on Egnyte, if you have a pre-existing SSO integration, you will need to recreate the Egnyte SAML app in order to support SCIM provisioning.<\/li>\n\n\n\n
- When taking over an already existing user the IdP, Username will not be set and needs to be updated manually so it matches the username from 探花大神.<\/li>\n\n\n\n
- If you have to replace the SCIM Token, you must\u00a0deactivate the IdM integration<\/a>, change the token and then reactivate the integration.<\/li>\n\n\n\n
- The userType<\/kbd> attribute is required<\/strong>. When provisioning a new user, the userType<\/kbd> will be set to\u00a0power\u00a0<\/kbd>by default.<\/li>\n\n\n\n
- Groups are supported. <\/li>\n<\/ul>\n\n\n\n
Attribute Considerations<\/strong><\/p>\n\n\n\n
- \n
- A default set of attributes are managed for users. See the Attribute Mappings<\/a> section for more details.<\/li>\n<\/ul>\n\n\n\n
Creating a new 探花大神 Application Integration<\/strong><\/h2>\n\n\n\n
- \n
- Log in to the 探花大神 Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Click + Add New Application<\/strong>.<\/li>\n\n\n\n
- Type the name of the application in the Search <\/strong>field and select it.<\/li>\n\n\n\n
- Click Next<\/strong>.<\/li>\n\n\n\n
- In the Display Label<\/strong>, type your name for the application. Optionally, you can enter a Description<\/strong>, adjust the User Portal Image and choose to hide or Show in User Portal<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nIf this is a Bookmark Application, enter your sign-in URL in the Bookmark URL<\/strong> field.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Optionally, expand Advanced Settings<\/strong> to specify a value for the SSO IdP URL<\/strong>. If no value is entered, it will default to https:\/\/sso.jumpcloud.com\/saml2\/<applicationname><\/kbd>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nThe SSO IdP URL<\/strong> is not editable after the application is created. You will have to delete and recreate the connector if you need to edit this field at a later time.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- If successful, click:\n
- \n
- Configure Application<\/strong> and go to the next section <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
Configuring the SSO Integration<\/strong><\/h2>\n\n\n\n
To configure 探花大神<\/strong><\/h3>\n\n\n\n
- \n
- Create a new application<\/a> or select it from the the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab.<\/li>\n\n\n\n
- Replace any instances of SUBDOMAIN with your Egnyte value.<\/li>\n\n\n\n
- Add or change any attributes.<\/li>\n\n\n\n
- Click save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Download the certificate<\/strong><\/h4>\n\n\n\n
- \n
- Find your application in the Configured Applications<\/strong> list and click anywhere in the row to reopen its configuration window.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nThe certificate.pem will download to your local Downloads<\/strong> folder.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure Egnyte<\/strong><\/h3>\n\n\n\n
- \n
- Log in to Egnyte as an Administrator.<\/li>\n\n\n\n
- Click the menu icon in the upper right corner of the page, then select Settings<\/strong>.<\/li>\n\n\n\n
- Navigate to Security & Authentication<\/strong>:<\/li>\n\n\n\n
- Scroll down to the Single Sign-On Authentication<\/strong> section and enter the following values:\n
- \n
- Single sign-on authentication<\/strong> – select SAML 2.0<\/strong> from the dropdown menu.<\/li>\n\n\n\n
- Identity provider<\/strong> – select Generic HTTP Post<\/strong><\/strong> from the dropdown menu.<\/li>\n\n\n\n
- Identity provider login URL<\/strong> – copy and paste the 探花大神 IDP URL<\/strong>.<\/li>\n\n\n\n
- Identity provider entity ID<\/strong> – copy and paste the 探花大神 IdP Entity ID<\/strong>.<\/li>\n\n\n\n
- Identity provider certificate<\/strong> – copy the contents of the certificate downloaded in the previous section.<\/li>\n\n\n\n
- API key<\/strong> – leave API Key blank.<\/li>\n\n\n\n
- Default user mapping<\/strong> – Select Egnyte Username<\/strong> from the dropdown menu.<\/li>\n\n\n\n
- Toggle the Use domain-specific Issuer value<\/strong> to the enabled<\/strong> state.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Click Save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\")
<\/p><\/div>Important:<\/strong> \nIf you have existing users in Egnyte that are not SSO-enabled – find the user(s) in the Users & Groups<\/strong> tab. Hover over the user(s) and click Details <\/strong>> Edit user profile<\/strong>. Ensure that all the details match the user in 探花大神, change the Authentication type<\/strong> to Single Sign-on, set IdP username <\/strong>to match the username from 探花大神, and click Save<\/strong>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Authorizing User SSO Access<\/strong><\/h2>\n\n\n\n
Users are implicitly denied access to applications. After you connect an application to 探花大神, you need to authorize user access to that application. You can authorize user access from the Application Configuration<\/strong> panel or from the Groups Configuration<\/strong> panel. <\/p>\n\n\n\n
To authorize user access from the Application Configuration panel<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the <\/a>探花大神 Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Select the User Groups<\/strong> tab. If you need to create a new group of users, see Get Started: User Groups<\/a>.<\/li>\n\n\n\n
- Select the check box next to the group of users you want to give access.<\/li>\n\n\n\n
- Click save<\/strong>. <\/li>\n<\/ol>\n\n\n\n
To learn how to authorize user access from the Groups Configuration<\/strong> panel, see Authorize Users to an SSO Application<\/a>.<\/p>\n\n\n\n
Validating SSO user authentication workflow(s)<\/strong><\/h2>\n\n\n\n
IdP-initiated<\/strong> user workflow<\/strong><\/h3>\n\n\n\n
- \n
- Access the 探花大神 User Console<\/a><\/li>\n\n\n\n
- Go to\u00a0Applications<\/strong> and click an application tile to launch it<\/li>\n\n\n\n
- 探花大神 asserts the user’s identity to the SP and is authenticated without the user having to log in to the application<\/li>\n<\/ul>\n\n\n\n
SP-initiated<\/strong> user workflow<\/strong><\/h3>\n\n\n\n
- \n
- Go\u00a0to the SP application login – generally, there is either a special link or an adaptive username field that detects the user is authenticated through SSO<\/li>\n<\/ul>\n\n\n\n<\/p><\/div>Note:<\/strong> \n
This varies by SP.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Login redirects the user to 探花大神 where the user enters their 探花大神 credentials<\/li>\n\n\n\n
- After the user is logged in successfully, they are redirected\u00a0back to the SP and automatically logged in<\/li>\n<\/ul>\n\n\n\n
Configuring the Identity Management Integration<\/strong><\/h2>\n\n\n\n
To generate your Egnyte API Key<\/strong><\/h3>\n\n\n\n
<\/p><\/div>Note:<\/strong> \nThis portal generates a valid OAuth token for any Egnyte Identity Provider.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- To generate the API Key, visit Egnyte SCIM 2.0 Setup<\/a>.<\/li>\n\n\n\n
- You will need to log in with your domain administrator credentials. <\/li>\n\n\n\n
- Enter your Domain Name and click Get API Key<\/strong>.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Warning:<\/strong> \nThe Client ID and Secret (token) may only be shown once. Copy them to a secure location, like the 探花大神 Password Manager<\/a>, for future reference.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure 探花大神<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the 探花大神 Admin Portal<\/a>.<\/li>\n\n\n\n
- Navigate to USER AUTHENTICATION<\/strong> > SSO<\/strong>.<\/li>\n\n\n\n
- Search for Egnyte, then click on it to bring the information panel open. <\/li>\n\n\n\n
- Select the Identity Management<\/strong> tab., <\/li>\n\n\n\n
- Click Configure<\/strong>.<\/li>\n\n\n\n
- You\u2019re presented with two fields:\n
- \n
- Base URL<\/strong> – enter https:\/\/{SUBDOMAIN}.egnyte.com\/pubapi\/scim\/v2<\/kbd>\u00a0where {SUBDOMAIN}<\/kbd> is your Egnyte subdomain.\u00a0<\/li>\n\n\n\n
- Token Key<\/strong> – paste the API Key generated in the previous section.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Deselect Enable management of User Groups and Group Membership in this application<\/strong> if you don’t want to provision, manage, and sync groups.<\/li>\n\n\n\n
- Click Activate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Attribute Mappings<\/strong><\/h2>\n\n\n\n
The following table lists attributes that 探花大神 sends to the application. See Attribute Considerations<\/a> for more information regarding attribute mapping considerations. <\/p>\n\n\n\n
- Token Key<\/strong> – paste the API Key generated in the previous section.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Navigate to USER AUTHENTICATION<\/strong> > SSO<\/strong>.<\/li>\n\n\n\n
- To generate the API Key, visit Egnyte SCIM 2.0 Setup<\/a>.<\/li>\n\n\n\n
- Go to\u00a0Applications<\/strong> and click an application tile to launch it<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Identity provider<\/strong> – select Generic HTTP Post<\/strong><\/strong> from the dropdown menu.<\/li>\n\n\n\n
- Navigate to Security & Authentication<\/strong>:<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click IDP Certificate Valid > Download certificate<\/strong>.<\/li>\n<\/ol>\n\n\n\n
- Select the SSO <\/strong>tab.<\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- If successful, click:\n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Log in to the 探花大神 Admin Portal<\/a>.<\/li>\n\n\n\n
- The userType<\/kbd> attribute is required<\/strong>. When provisioning a new user, the userType<\/kbd> will be set to\u00a0power\u00a0<\/kbd>by default.<\/li>\n\n\n\n
- You need to generate an API Key.\u00a0<\/li>\n<\/ul>\n\n\n\n