Acquia recommends using Acquia Single Sign-On for secure, centralized, and federated login across supported Acquia products. For details, refer to Acquia Single Sign-On.
To add an IdP to your Cloud Platform organization:
The setup process requires you to register the Cloud Platform organization with your IdP.
The Cloud Platform’s SAML integration may be different from others that you have managed because it is an SP-initiated flow. For more information on the SP-initiated flow, see How does Federated Authentication work?.
The labels that Acquia uses for SAML concepts, as outlined in the following instructions, may be different from the labels that your IdP uses for the same concepts. Every IdP labels items differently.
Part 1: Confirm that Federated Authentication is available to your Cloud Platform organization
Confirm with your Account Manager that Acquia has enabled Federated Authentication for the Cloud Platform organization that you want to protect.
Verify if you can see the Register an IDP option. The system displays this option if Federated Authentication is enabled for your account. If you do not see the Register an IDP option, contact your account manager.
After you complete the earlier steps, click Register an
Identity Provider
and specify the following information:
Note
Some IdPs require an ACS link before they provide the entity ID or SSO URL. Cloud Platform generates the ACS link once all the listed values are specified. To avoid this issue, enter dummy values for the information that your IdP does not provide. Cloud Platform generates the ACS link despite the dummy values. Before enabling Federated Authentication, ensure that you specify the correct values once they are available.
Part 3: Register your Cloud Platform organization with your IdP
After you complete these steps, the Cloud Platform user interface displays a summary of the information that you must provide to your IdP. Do not forget to update any dummy values you provided while specifying IdP details in Cloud Platform. To update these values, select Edit.
To register with your IdP, provide the entity ID of Cloud Platform and your IdP’s ACS link.
Cloud Platform uses the information provided in Part 2 to generate an ACS link specific to your IdP.
If you specified dummy values in Entity ID or SSO URL in the previous section, update these fields with the values provided by the IdP.
Ensure that your IdP is configured with the following:
The response from your IdP and the assertion within the response must be signed. If not, validation fails. Your IdP must have ds:Signature... as a child of <saml:Assertion…
Important
Do not enable the external IdP in Cloud Platform until you register your Cloud Platform organization with your IdP and update any dummy values used in this section. If the configuration is incorrect, you and all members of your organization may be locked out of the Cloud Platform user interface. If you are locked out, create a Support ticket.
Cloud Platform displays a confirmation dialog box.
Select the confirmation checkbox and select Enable.
The Cloud Platform user interface displays a confirmation window indicating that your IdP is enabled.
After Federated Authentication is enabled, you and your users must authenticate with your external IdP when you access the Cloud Platform organization.
Setting up Federated Authentication
Note
Acquia recommends using Acquia Single Sign-On for secure, centralized, and federated login across supported Acquia products. For details, refer to Acquia Single Sign-On.
To add an IdP to your Cloud Platform organization:
The setup process requires you to register the Cloud Platform organization with your IdP.
The Cloud Platform’s SAML integration may be different from others that you have managed because it is an SP-initiated flow. For more information on the SP-initiated flow, see How does Federated Authentication work?.
The labels that Acquia uses for SAML concepts, as outlined in the following instructions, may be different from the labels that your IdP uses for the same concepts. Every IdP labels items differently.
Part 1: Confirm that Federated Authentication is available to your Cloud Platform organization
Confirm with your Account Manager that Acquia has enabled Federated Authentication for the Cloud Platform organization that you want to protect.
Verify if you can see the Register an IDP option. The system displays this option if Federated Authentication is enabled for your account. If you do not see the Register an IDP option, contact your account manager.
After you complete the earlier steps, click Register an
Identity Provider
and specify the following information:
Note
Some IdPs require an ACS link before they provide the entity ID or SSO URL. Cloud Platform generates the ACS link once all the listed values are specified. To avoid this issue, enter dummy values for the information that your IdP does not provide. Cloud Platform generates the ACS link despite the dummy values. Before enabling Federated Authentication, ensure that you specify the correct values once they are available.
Part 3: Register your Cloud Platform organization with your IdP
After you complete these steps, the Cloud Platform user interface displays a summary of the information that you must provide to your IdP. Do not forget to update any dummy values you provided while specifying IdP details in Cloud Platform. To update these values, select Edit.
To register with your IdP, provide the entity ID of Cloud Platform and your IdP’s ACS link.
Cloud Platform uses the information provided in Part 2 to generate an ACS link specific to your IdP.
If you specified dummy values in Entity ID or SSO URL in the previous section, update these fields with the values provided by the IdP.
Ensure that your IdP is configured with the following:
The response from your IdP and the assertion within the response must be signed. If not, validation fails. Your IdP must have ds:Signature... as a child of <saml:Assertion…
Important
Do not enable the external IdP in Cloud Platform until you register your Cloud Platform organization with your IdP and update any dummy values used in this section. If the configuration is incorrect, you and all members of your organization may be locked out of the Cloud Platform user interface. If you are locked out, create a Support ticket.
Cloud Platform displays a confirmation dialog box.
Select the confirmation checkbox and select Enable.
The Cloud Platform user interface displays a confirmation window indicating that your IdP is enabled.
After Federated Authentication is enabled, you and your users must authenticate with your external IdP when you access the Cloud Platform organization.
In Label, specify a human-readable name for the IdP configuration.
In Entity ID, specify the entity ID that you obtain from your IdP.
Note
If you integrate multiple Cloud Platform organizations with your IdP, you must have a unique entity ID for each organization. Therefore, you might need to set up a new application within your IdP where each application has a unique entity ID.
In SSO URL, specify the URL that you obtain from your IdP. Every IdP structures its SSO URL differently. Ensure that this URL uses the SP-initiated SSO method.
In Public Certificate, paste the public certificate of your IdP in the PEM format.
Select Submit.
.
Ensure that your IdP sends the RelayState to Cloud Platform.
Ensure that your IdP sends the email address of the user as the NameID value. The email address must match the email address associated with the user’s Acquia account. Authentication fails if theNameID is missing or contains a different value, such as a UPN, employee ID, or username.
Did not find what you were looking for?
If this content did not answer your questions, try searching or contacting our support team for further assistance.
In Label, specify a human-readable name for the IdP configuration.
In Entity ID, specify the entity ID that you obtain from your IdP.
Note
If you integrate multiple Cloud Platform organizations with your IdP, you must have a unique entity ID for each organization. Therefore, you might need to set up a new application within your IdP where each application has a unique entity ID.
In SSO URL, specify the URL that you obtain from your IdP. Every IdP structures its SSO URL differently. Ensure that this URL uses the SP-initiated SSO method.
In Public Certificate, paste the public certificate of your IdP in the PEM format.
Select Submit.
.
Ensure that your IdP sends the RelayState to Cloud Platform.
Ensure that your IdP sends the email address of the user as the NameID value. The email address must match the email address associated with the user’s Acquia account. Authentication fails if theNameID is missing or contains a different value, such as a UPN, employee ID, or username.
Did not find what you were looking for?
If this content did not answer your questions, try searching or contacting our support team for further assistance.
Cloud Platform