SAML Configuration

On the Authentication Services page, select theSAML Configurationtab, move theEnabledslider to the right, and provide the necessary metadata and other settings, as follows. When finished, proceed toSAML Identity Provider Settings(below).

• Upload Metadata File: If checked, allows you to upload your SAML provider metadata file in theIdentity Provider Metadata Filefield. You can drag and drop the applicable file into the designated area. Alternatively, click inside the designated area to browse for the file.
Tip  "> TipThis file usually has a .xml extension.

If not checked, you must enter the following fields manually:

• Identity Provider SSO URL
• Identity Provider Issuer
• Identity Provider X.509 Certificate
• New User Default Role: IfRoleis not specified under Attribute Field Mappings (below), or does not match an existing role, theFME Flowroleto assign to new users, by default.
Warning  "> WarningIffmesuperuseris specified, all permissions are granted inFME Flowto new users.

Attribute Field Mappings(optional):FME FlowUser Attributes are assigned to new users according to a specified mapping. Enter attribute names from your identity provider to map them to the followingFME Flowuser attributes:

• First Name: This attribute is concatenated withLast Nameto map to theFull Nameof anFME Flowuser account.
• Last Name: This attribute is concatenated withFirst Nameto map to theFull Nameof anFME Flowuser account.
• Username: The attribute to map to the userNameof anFME Flowaccount.
• Email: The attribute to map to theEmailof anFME Flowuser account.
• Role:一个或多个attributes to map to therole(s) of anFME Flowuser account. If specified, this field overrides any value specified forNew User Default Role, above. The values of a specifiedRole必须匹配现有的角色FME Flow.
• Sign Requests(optional): If checked, complete the following to ensure that requests betweenFME Flowand the identity provider are signed:
  Note  "> NoteThis configuration may not be supported by your SAML identity provider.
  1. Provide aService Provider CertificateandService Provider Key. You can create a certificate and key with a third-party application such as OpenSSL, or ask your IT department to generate these.

  2. Upload or reference the certificate in your SAML identity provider.

Configure the following settings on your SAML identity provider:

• Entity ID (Audience URI): Set to<FMEServerWebURL>/fmesaml/saml2/service-provider-metadata/fmeserver

Where<FMEServerWebURL>is the fully-qualified hostname for yourFME Flow, including both the hostname and domain (for example,https://fmeserver.domain.com).

• Single Sign On URL (Application Callback URL, Assertion Consumer Service URL): Set to<FMEServerWebURL>/fmesaml/login/saml2/sso/fmeserver

Where<FMEServerWebURL>is the fully-qualified hostname for yourFME Flow, including both the hostname and domain (for example,https://fmeserver.domain.com).