---
title: "Authenticating Admins Using SAML"
canonical: "https://docs.infoblox.com/space/nios85/35882214/Authenticating%20Admins%20Using%20SAML"
format: markdown
---
<span style="color: #000000">NIOS uses SAML (Security Assertion Markup Language) 2.0 authentication support for Single-Sign-On in NIOS. SAML provides a standard vendor-independent grammar and protocol for transferring information about a user from one web server to another independent of the server DNS domains. SAML enables IT administrators to  manage user access rights in a single place. By enabling SAML, user management is delegated to an external application, thus relieving IT administrators the complexity of maintaining user accounts in all the applications (also known as Service Providers) being used by the organization. Instead, IT administrators need to maintain one account in the Identity Provider (IdP) which can be used across Service Providers (SPs). IdP is the application server that maintains the user accounts of the entire organization. IT administrators can manage users access rights at one place. User can login to the IdP directly and once logged in, they can be traverse towards the required SP without being prompted for the user ID and password. SAML helps NIOS delegate Identity Management to a third-party SSO application (IdP) and thereby eases administrative efforts.</span>

> ⚠️ ### Note
> ⚠️ 
> ⚠️ <span style="color: #000000">You need super user permissions to perform SAML-related configurations.</span>

# <span style="color: #000000">SAML Login Use Cases</span>

The following is a list of use cases and the outcome of NIOS users attempting to log in when using SAML authentication and when not using SAML authentication:

- <span style="color: #000000">If SAML is enabled and users have already logged in to the IdP account and the corresponding user account is present in NIOS, users can directly start using Grid Manager without logging in to NIOS. </span>
- If a user has logged in to the IdP account and th<span style="color: #000000">e corresponding IdP account is not present in NIOS</span>, if the <span style="color: #000000">**Auto Create User**</span><span style="color: #000000"> checkbox is selected, the user can directly start using Grid Manager without logging in to NIOS. For information about the </span><span style="color: #000000">**Auto Create User**</span><span style="color: #000000"> checkbox, see </span><span style="color: #0000ff">*[Auto Creating SAML Users in NIOS](#Auto_Creating_SAML_Users)*</span><span style="color: #000000">.</span>
- <span style="color: #000000">If a NIOS user who is not SAML-authorized tries to log in to NIOS using the </span><span style="color: #000000">**SSO Login**</span><span style="color: #000000"> button, the login fails. However, the user can log in using the </span><span style="color: #000000">**Login**</span><span style="color: #000000"> button.</span>

# Prerequisites for Configuring SAML Authentication  

Ensure that you meet the following prerequisites before you configure SAML for NIOS:

- When adding the NIOS application in IdP,  specify the Grid Manager URL in the https://<Grid Manager IP address>:8765/?acs format. <span style="color: #172b4d">This is referred to as the Assertion Consumer Service URL or ACS URL. </span><span style="color: #333333">The 8765 port is opened for SAML services.</span>
- After you add NIOS to the IdP, either copy the metadata or the metadata URL or specify it in the SAML configuration screen.
- Ports 443 (HTTPS) and 80 (HTTP) must be allowed on the firewall to allow NIOS to communicate with the IdP.
- Ensure that the group that you specify in the IDP also exists in NIOS with the same users as that in the IdP. If you did not specify a group attribute in the IdP, SAML authenticated users are added to the default SAML group: **saml-group**<span style="color: #333333">.</span>
- SAML authentication in NIOS requires configuring an Identity Provider (IdP) for authentication. Infoblox-verified named IdPs are listed in the **IDP Type** drop-down list. The **IDP Type** drop-down list also contains the **Others** option for users who wish to configure an IdP that is not listed.  Due to the lack of compliance to SAML standards and widely varying IdP vendor implementations, Infoblox is unable to provide configuration support if you select the **Others** option. Infoblox recommends that you contact the IdP vendor for support if you use this option.

# > Macro (anchor)

<span style="color: #000000">Enabling SAML Authentication</span>

<span style="color: #000000">To enable SAML authentication for NIOS users, perform the following steps:</span>

1. <span style="color: #000000">Login as a super user.</span>
2. <span style="color: #000000">Click the </span><span style="color: #000000">**SAML Authentication Services**</span><span style="color: #000000"> tab.</span>
3. <span style="color: #000000">From the Toolbar, click </span><span style="color: #000000">**Add **</span><span style="color: #000000">-> </span><span style="color: #000000">**SAML Service**</span><span style="color: #000000">.</span>
4. <span style="color: #000000">In the </span><span style="color: #000000">*Add SAML Authentication Service*</span><span style="color: #000000"> wizard:</span>
  - **Name**: Enter a name for the authentication service.
  - **IDP Type**: Select the IDP type that you want to configure for the authentication service. NIOS supports the following IdP types: Azure SSO, Okta, Ping Identity, Shibboleth SSO, Others.
  - **SSO Metadata URL**: Enter the metadata URL of the IDP. Alternatively, copy the metadata into a file and upload the file. For information on obtaining the metadata, see <span style="color: #0000ff">*[Obtaining Metadata](#Obtaining_Metadata)*</span>.
  - **SSO Redirect IP Address/FQDN**: Enter the IP address or the FQDN of Grid Master. <span style="color: #000000">If you enter a value other than the IP address or FQDN, the SAML service will not work. A best practice is to enter the FQDN because it is used by the IdP for the SAML response.</span>
  - **Session Timeout(s)**: Enter the amount of time that a SAML user can be idle after which the session must terminate. The time that you specify here supersedes the session timeout time specified in the **Grid Properties** - > **Security** - > **Session Timeout(s)** field. For more information about session timeout in the Grid, see *[Managing Security Operations](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35849662)*.
  - **IDP Group Attribute**: Enter a group attribute name. The group attribute name that you enter must have the same value as the **Group Attribute** in your IdP configuration. If the value in NIOS is different from what is configured in the IdP, or if the value is missing, the incoming SAML user is placed in the default SAML group **saml-group**.  If the value matches, the IdP’s group attribute filter passes the user’s group membership to NIOS. If there is a NIOS group that exactly matches a group name from the list of groups from the IdP, and the NIOS group is configured for SAML, the user get placed into that NIOS group. If there is no matching NIOS group, the user gets placed in the default SAML group **saml-group**.
  - **Comment**: Enter additional comments if any.
5. <span style="color: #000000">Click </span><span style="color: #000000">**Save & Close**</span><span style="color: #000000">.</span>

<span style="color: #000000">Now, if you log out and try to relogin, the </span><span style="color: #000000">**SSO Login**</span><span style="color: #000000"> button is displayed. </span>

<span style="color: #000000">When SAML authorized users try to login for the first time by clicking the </span><span style="color: #000000">**SSO Login**</span><span style="color: #000000"> button, they are directed to their IdP login page. If the user credentials they specified exist in the IdP, they are redirected to the NIOS home page.  </span>

## > Macro (anchor)

<span style="color: #000000">Obtaining Metadata</span>

<span style="color: #000000">This section explains how to obtain the metadata URL of the IdP. The procedures in this section may vary a little depending on the type of IdP that you select. The procedure in this section uses Okta as an IdP example. If you are using an IDP other than Okta, contact your IT administrator for the metadata URL.</span>

<span style="color: #000000">To obtain the metadata URL of Okta:</span>

1. <span style="color: #000000">Log in to your Okta account.</span>
2. Go to **My Applications **and click the URL of your Grid Manager.
3. You can either copy the XML metadata for the Grid Manager into a file or use the URL of the metadata.

# > Macro (anchor)

Auto Creating SAML Users in NIOS

After enabling <span style="color: #000000">SAML authentication, you can configure NIOS such that users who belong to a particular group in IDP are automatically created in NIOS. Once the users are automatically created in NIOS, if they log in to their IdP account, they can directly access Grid Manager.</span>

1. <span style="color: #000000">Login as a super user.</span>
2. <span style="color: #000000">Create a group by the same name as that of the group in the IdP account. For information about creating groups, see </span><span style="color: #000000">*[About Admin Groups](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35418824)*</span><span style="color: #000000">.</span>
3. <span style="color: #000000">Click the </span><span style="color: #000000">**Administration **</span><span style="color: #000000">→ </span><span style="color: #000000">**Administrators**</span><span style="color: #000000"> tab.</span>
4. <span style="color: #000000">Select the group that you created and click the Edit icon. The out-of-the-box group for SAML authenticated users is </span><span style="color: #000000">**saml-group**</span><span style="color: #000000">.</span>
5. <span style="color: #000000">Click the </span><span style="color: #000000">**SAML**</span><span style="color: #000000"> tab.</span>
6. <span style="color: #000000">Select </span><span style="color: #000000">**Auto Create User**</span><span style="color: #000000"> for users in the IdP group to be automatically created in NIOS. When a new IdP user logs in to NIOS, that user is created in NIOS.</span>
7. <span style="color: #000000">Select </span><span style="color: #000000">**Persist Auto Created User after logout**</span><span style="color: #000000"> if you want to retain the SAML user accounts in NIOS even after the session times out. The session timeout value is specified in the </span><span style="color: #000000">**Session Timeout**</span><span style="color: #000000"> field when you enabled SAML authentication. For more information, see </span><span style="color: #0000ff">*[Enabling SAML Authentication](#Enabling_SAML_Authentication)*</span><span style="color: #000000">. If you do not select the </span><span style="color: #000000">**Persist Auto Created User after logout**</span><span style="color: #000000"> checkbox, if the session times out, users for whom the </span><span style="color: #000000">**SAML Only**</span><span style="color: #000000"> option was selected in the </span><span style="color: #000000">**Authentication Type**</span><span style="color: #000000"> field, are deleted from NIOS. </span><span style="color: #172b4d">Not selecting the </span><span style="color: #172b4d">**Persist Auto Created User after logout**</span><span style="color: #172b4d"> checkbox also deletes the user account along with all the scheduled tasks associated with the user account when the user logs out of NIOS. </span><span style="color: #000000">For information about the </span><span style="color: #000000">**Authentication Type**</span><span style="color: #000000"> field, see </span><span style="color: #000000">*[Creating Local Admins](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35752076)*</span><span style="color: #000000">.</span>
8. <span style="color: #000000">Click </span><span style="color: #000000">**Save & Close**</span><span style="color: #000000">.</span>

> ⚠️ ### Note
> ⚠️ 
> ⚠️ I<span style="color: #000000">f you select the </span><span style="color: #000000">**Persist Auto Created User after logout**</span><span style="color: #000000"> checkbox and the session times out, you must manually verify whether the user account exists in IdP or not. If the user account is deleted from IDP, then you must manually delete the account in NIOS.</span>

# <span style="color: #555555">Authenticating SAML Users</span>

<span style="color: #000000">When you create administrators, you can authenticate them either as a SAML-only administrator or as a SAML/local administrator. Depending on the authentication type, administrators can log in using either the SSO Login button or the Login button. For more information see </span><span style="color: #0000ff">*[Creating Local Admins](https://infoblox-docs.atlassian.net/wiki/spaces/nios85/pages/35752076)*</span><span style="color: #000000">.</span>