---
title: "Configuring Authentication Profiles"
canonical: "https://docs.infoblox.com/space/BloxOneCloud/35462918/Configuring%20Authentication%20Profiles"
format: markdown
---
<span style="color: #000000">To manage access authentication for on-prem users and user group synchronization, you must first create profiles that define the authentication protocols and choose the third-party IdPs you want to use. For more information about access authentication and how to utilize it to set up automated security policy management, see </span>[*<span style="color: #000000">Managing Access Authentication</span>*](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35396331)<span style="color: #000000">.</span>

<span style="color: #000000">You can configure an authentication profile by choosing one of the supported protocols and IdPs, and then associate the profile with a server so users in your organization can be authenticated for specific Infoblox Service and resources. When you enable the Access Authentication service on a </span><span style="color: #000000">server</span><span style="color: #000000">, you integrate a third-party IdP federation to retrieve user group data, so you can build security policies based on user groups.</span>

<span style="color: #000000">When configuring an authentication profile, you choose a supported protocol and third-party IdP to suit your business requirements. You can create multiple authentication profiles and enable one of them immediately and save the others for future use. Note that you can enable only one profile at a time. However, you can associate multiple profiles with a </span><span style="color: #000000">server</span><span style="color: #000000"> as long as the profiles have different protocol types. For example, you can create four SAML authentication profiles for future use, but you can associate and enable only one of them with a </span><span style="color: #000000">server</span><span style="color: #000000"> at any given time. The same </span><span style="color: #000000">server</span><span style="color: #000000"> can however be associated with another profile as long as the profile uses a different protocol type, such as LDAP or OpenID Connect.</span>

> ⚠️ **Important Note**
> ⚠️ 
> ⚠️ <span style="color: #000000">Before you configure an authentication profile, ensure that you understand the prerequisites for configuring applications in the IdPs. For more information, see </span>[*<span style="color: #000000">Prerequisites for Configuring Access Authentication</span>*](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35430215)<span style="color: #000000">.</span>

<span style="color: #000000">To add a new authentication profile, complete the following:</span>

1. <span style="color: #000000">Ensure that you have successfully set up the IdPs of your choice. For information, see </span>[*<span style="color: #000000">Prerequisites for Configuring Access Authentication</span>*](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35430215)<span style="color: #000000">.</span>
2. <span style="color: #000000">From the Infoblox Portal, click </span>**<span style="color: #000000">Configure</span>**<span style="color: #000000"> > </span>**<span style="color: #000000">Administration</span>**<span style="color: #000000"> > </span>**<span style="color: #000000">Access Authentication</span>**<span style="color: #000000">, and then click the </span>**<span style="color: #000000">Authentication Profiles</span>**<span style="color: #000000"> tab.</span>
3. <span style="color: #000000">On the </span>**<span style="color: #000000">Authentication Profiles</span>**<span style="color: #000000"> tab, click </span>**<span style="color: #000000">Add Configuration</span>**<span style="color: #000000"> and choose one of the following authentication protocols:</span>
  - **<span style="color: #000000">LDAP</span>**<span style="color: #000000">: LDAP allows the use of Microsoft Windows Active Directory (MS AD) to verify the identity of users and user groups. One or more Active Directory servers can be used to implement security policies within an organization. When you choose this option, ensure that you enable the </span>**<span style="color: #000000">MS AD Sync</span>**<span style="color: #000000"> service, so you can synchronize user groups accordingly. For information on how to enable services, see </span>[*<span style="color: #000000">Enabling and Disabling Services on Servers</span>*](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneInfrastructure/pages/184648009)<span style="color: #000000">.</span>
  - **<span style="color: #000000">SAML</span>**<span style="color: #000000">: SAML authentication uses the SAML 2.0 protocol to authenticate users. This is a</span><span style="color: #000000">n open standard that allows IdPs to pass authorization credentials to service providers.</span>
  - **<span style="color: #000000">OpenID Connect</span>**<span style="color: #000000">: OpenID Connect is a</span><span style="color: #000000"> simple identity layer on top of the OAuth 2.0 protocol that allows clients to verify user identity based on the authentication performed by an authorization server. This protocol allows you to perform SSO (single sign-on) and introduces ID token, which allows the client to verify the identity of the user and obtain basic profile information about the user.</span>

When you choose **LDAP**, complete the following in the **Create Authentication Profile **dialog, and then click **Save** or **Save & Close** to save your configuration.

- **Name**: Enter a name for the authentication profile. This is a required field.
- **Description**: Enter a description for the authentication profile.
- **State**: Use the toggle switch to enable or disable the authentication profile. <span style="color: #000000">Only an enabled profile is available for on-prem association and user group synchronization, and only one profile can be enabled at any given time.</span>
- **LDAP Server Details**:
  - **FQDN/IP**: Enter the fully qualified domain name or IP address of the Active Directory server.
  - **LDAP Port**: Choose an LDAP port to be used for connection with the Active Directory server. 389 is the default LDAP port for directory, replication, user authentication, and group policies.
  - **Distinguishing Name**: Choose the base entry in the repository that uniquely identifies and describes the starting point in the AD or LDAP server.

<span style="color: #000000">When you choose </span>**<span style="color: #000000">SAML</span>**<span style="color: #000000">, complete the following i</span><span style="color: #000000">n the </span>**<span style="color: #000000">Create Authentication Profile</span>***<span style="color: #000000"> </span>*<span style="color: #000000">dialog, and then click </span>**<span style="color: #000000">Save</span>**<span style="color: #000000"> or </span>**<span style="color: #000000">Save & Close</span>**<span style="color: #000000"> to save your configuration.</span>

- **<span style="color: #000000">Name</span>**<span style="color: #000000">: Enter a name for the authentication profile.</span>
- **<span style="color: #000000">Description</span>**<span style="color: #000000">: Enter a description of the authentication profile.</span>
- **<span style="color: #000000">State</span>**<span style="color: #000000">: </span><span style="color: #000000">Use the toggle switch to enable or disable the authentication profile. </span><span style="color: #000000">Only an enabled profile is available for on-prem association and user group synchronization, and only one profile can be enabled at any given time.</span>
- **<span style="color: #000000">Select 3rd party IDP support</span>**<span style="color: #000000">: Choose one of the following. Depending on which IdP you choose, you must obtain all the required information for the following configuration. </span>
  - **<span style="color: #000000">Azure AD</span>**<span style="color: #000000">: Choose this to use the Microsoft Azure Active Directory as the IdP.</span>
  - **<span style="color: #000000">Okta</span>**<span style="color: #000000">: Choose this to use Okta as the IdP.</span>
  - **<span style="color: #000000">Open AM</span>**<span style="color: #000000">: Choose this to use the open-source OpenAM as the IdP.</span>
- <span style="color: #000000">In the </span>**<span style="color: #000000">SERVICE PROVIDER DETAILS</span>**<span style="color: #000000"> section, complete the following:</span>
  - **<span style="color: #000000">Entity ID</span>**<span style="color: #000000">: This field displays the Entity ID you need for setting up the connection with the third-party IdP. The default is </span>**<span style="color: #000000">http://captiveportal.infoblox.internal/</span>**
  - **<span style="color: #000000">Assertion Consumer Service URL</span>**<span style="color: #000000">: This field displays the Assertion Consumer Service URL you need for setting up the connection with the third-party IdP. The default is </span>**<span style="color: #000000">https://captiveportal.infoblox.internal/saml/login</span>**
  - **<span style="color: #000000">Metadata File</span>**<span style="color: #000000">: Click </span>**<span style="color: #000000">Download</span>**<span style="color: #000000"> to download the metadata file that contains information required to set up your IdP. If you download the metadata file, you can use the file for your IdP setup instead of copying the </span>**<span style="color: #000000">Entity ID</span>**<span style="color: #000000"> and </span>**<span style="color: #000000">Assertion Consumer Service URL</span>**<span style="color: #000000">.</span>
- <span style="color: #000000">In the </span>**<span style="color: #000000">IDENTITY PROVIDER DETAILS</span>**<span style="color: #000000"> section, complete the following:</span>
  - **<span style="color: #000000">Issuer</span>**<span style="color: #000000">: Enter the issuer URI from your selected IdP issuer. You can find this information when you configure the SAML application for the selected third-party IdP.</span>
  - **<span style="color: #000000">SSO URL</span>**<span style="color: #000000">: Enter the single-sign-on URL from your selected IdP. You can find this information when you configure the SAML application for the selected third-party IdP.</span>
  - **<span style="color: #000000">Signing Certificate</span>**<span style="color: #000000">: Click </span>**<span style="color: #000000">Select file</span>**<span style="color: #000000"> to navigate to the signature certificate you downloaded from your selected IdP.</span>
  - **<span style="color: #000000">Metadata URL</span>**<span style="color: #000000">: Select the </span>**<span style="color: #000000">Use Metadata URL</span>**<span style="color: #000000"> check box and then enter the metadata URL from your IdP. Typically, </span><span style="color: #000000">SAML metadata is an XML document that contains the information necessary for interacting with SAML-enabled identity or service providers. The document includes the IdP information such as the issuer, SSO URL, and signing certificate. When you select this check box, you do not need to enter information for the </span>**<span style="color: #000000">Issuer</span>**<span style="color: #000000">, </span>**<span style="color: #000000">SSO URL</span>**<span style="color: #000000">, and </span>**<span style="color: #000000">Signing Certificate</span>**<span style="color: #000000"> individually.</span>

<span style="color: #000000">When you choose </span>**<span style="color: #000000">OpenID Connect, </span>**<span style="color: #000000">complete the following in the </span>**<span style="color: #000000">Create Authentication Profile</span>***<span style="color: #000000"> </span>*<span style="color: #000000">dialog, and then click </span>**<span style="color: #000000">Save</span>**<span style="color: #000000"> or </span>**<span style="color: #000000">Save & Close</span>**<span style="color: #000000"> to save your configuration.</span>

- **<span style="color: #000000">Name</span>**<span style="color: #000000">: Enter the name for the authentication profile.</span>
- **<span style="color: #000000">Description</span>**<span style="color: #000000">: Enter a description of the authentication profile.</span>
- **<span style="color: #000000">State</span>**<span style="color: #000000">: </span><span style="color: #000000">Use the toggle switch to enable or disable the authentication profile. </span><span style="color: #000000">Only an enabled profile is available for on-prem association and user group synchronization, and only one profile can be enabled at any given time.</span>
- **<span style="color: #000000">Select 3rd party IDP support</span>**<span style="color: #000000">: Choose one of the following:</span>
  - **<span style="color: #000000">Azure</span>**<span style="color: #000000">: Choose this to use the Microsoft Azure Active Directory as the IdP.</span>
  - **<span style="color: #000000">Okta</span>**<span style="color: #000000">: Choose this to use OKTA as the 3rd party IdP.</span>
  - **<span style="color: #000000">Open AM</span>**<span style="color: #000000">: Choose this to use the open-source OpenAM as the 3rd party IdP.</span>
- <span style="color: #000000">In the </span>**<span style="color: #000000">CLIENT DETAILS</span>**<span style="color: #000000"> section, complete the following:</span>
  - **<span style="color: #000000">Login Redirect URI</span>**<span style="color: #000000">: Displays the URL for the login redirect URI. Click </span>**<span style="color: #000000">Copy</span>**<span style="color: #000000"> to copy the value and paste it into your IdP application.</span>
  - **<span style="color: #000000">Client ID</span>**<span style="color: #000000">: The user ID or username used to access the client that is connected to the authentication server.</span>
  - **<span style="color: #000000">Client Secret</span>**<span style="color: #000000">: The user password or secret used to access the client that is connected to the authentication server.</span>
- <span style="color: #000000">In the </span>**<span style="color: #000000">IDENTITY PROVIDER DETAILS</span>**<span style="color: #000000"> section, complete the following:</span>
  - **Issuer**: Enter the URI that you use to access your IdP issuer. Example: *https://sp.okta.local/adfs/services/trust*.

<span style="color: #000000">For more information about access authentication, see the following:</span>

- [*<span style="color: #000000">Managing Access Authentication</span>*](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35396331)
- [*<span style="color: #000000">Configuring Authentication Settings</span>*](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35463149)
- [*<span style="color: #000000">Synchronizing User Groups</span>*](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35397703)