{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Pricefx Core is only one of many applications our customers use.\nTheir users do not want to have additional separate credentials, just because they’re using one more application.","type":"text"}]},{"type":"paragraph","content":[{"text":"Instead, they want to have one-time access to multiple applications, including Pricefx.\nSo they need to integrate Pricefx into their Single-Sign-On infrastructure.","type":"text"}]},{"type":"paragraph","content":[{"text":"Pricefx supports single sign-on (SSO) with SAML.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"SAML","type":"text"}]},{"type":"paragraph","content":[{"text":"SAML stands for Security Assertion Markup Language.\nIt is an XML-based open-standard for transferring identity data between two parties: an identity provider (IdP) and a service provider (SP).","type":"text"}]},{"type":"paragraph","content":[{"text":"Service Provider (SP)","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Trusts the ","type":"text"},{"text":"Identity Provider","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"authorizes","type":"text","marks":[{"type":"strong"}]},{"text":" the given user to access the requested resource.In our case the Service Provider is the ","type":"text"},{"text":"Pricefx Suite","type":"text","marks":[{"type":"em"}]},{"text":" application.","type":"text"}]},{"type":"paragraph","content":[{"text":"Identity Provider (IdP)","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Performs ","type":"text"},{"text":"authentication","type":"text","marks":[{"type":"strong"}]},{"text":" and passes the user’s identity and authorization level to the service provider.The whole authentication process is delegated to the “Identity Provider”, i.e., all password management (expiry, complexity, reuse, etc.).Access management is indirectly delegated too (by disabling the user on their end).Note: SAML is only one of the services the IdP provides.Pricefx can integrate with any IdP using SAML, for example:","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Azure","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Okta","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Salesforce (does IdP only for its apps)","type":"text"}]}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":2},"content":[{"text":"The Authentication Process","type":"text"}]},{"type":"paragraph","content":[{"text":"The authentication process could be initiated either by ","type":"text"},{"text":"SP","type":"text","marks":[{"type":"em"}]},{"text":" or by ","type":"text"},{"text":"IdP","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"SP Initiated","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":65.0},"content":[{"type":"media","attrs":{"width":2200,"alt":"SAML Flow","type":"external","url":"https://pricefx.vercel.app/content/docs/concepts/users-and-privileges/single-sign-on/images/SAML_Flow.png","height":1916}}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Notice that there is no direct communication between the IdP and the SP and that every communication exchange happens via the user’s browser.","type":"text"}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"User accesses the Pricefx application via URL.\nThe URL is in the format:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"none"},"content":[{"text":"https://.pricefx.eu/pricefx//saml/signon/?RelayState=","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"customer - 3rd level domain name, usually a name of the customer company.\nIf the ","type":"text"},{"text":"shared PROD","type":"text","marks":[{"type":"em"}]},{"text":" server is used, then it will be ","type":"text"},{"text":"www","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"partition - A name of the partition to access.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"signon - Name of the Pricefx service, which initiates the SAML handshake.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"samlcfg (optional) - Name of the SAML configuration from the Pricefx SAML configuration.\nUsed only if we have more SAML configurations.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RelayState (optional) - A value, which will be passed there and back between the SP and IdP, until it finally reaches the SP.\nUsed to find out, which resource the user should receive from Pricefx, for example:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"which screen should be opened","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"which specific Quote (see \"deep links\")","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"or which UI - Pricefx","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pricefx generates the SAML Authentication Request for the IdP and returns it as ","type":"text"},{"text":"redirection","type":"text","marks":[{"type":"em"}]},{"text":" back to the browser.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The URL of the IdP is set up on the Pricefx SAML configuration page, under ","type":"text"},{"text":"SAML Identity Provider URL","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The browser redirects the SAML Authentication Request to the URL of the IdP.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The IdP parses the SAML request and Authenticates the request.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the user is not yet authenticated, it will send them to the Login screen (of the IdP).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the user is already authenticated on IdP, the IdP generates the SAML response and sends it via redirection to the ACS URL to the browser.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The browser redirects the SAML response to the ACS URL (i.e., Pricefx URL) for verification.\nThe URL is in the format:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"none"},"content":[{"text":"https://.pricefx.eu/pricefx//saml/consume/?RelayState=","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"consume - The name of the Pricefx service, which validates SAML response from the IdP.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"RelayState (optional) - A value which traveled all the way from the beginning of the handshake.\nWill be used to decide, which resource to deliver to the user.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pricefx ","type":"text"},{"text":"consume","type":"text","marks":[{"type":"em"}]},{"text":" service verifies the SAML response.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the verification is successful, the user will be logged in to Pricefx and granted access to the resources that they are authorized to view/modify.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"IdP Initiated","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":60.0},"content":[{"type":"media","attrs":{"width":2020,"alt":"SAML Flow SdP Initialized","type":"external","url":"https://pricefx.vercel.app/content/docs/concepts/users-and-privileges/single-sign-on/images/SAML_Flow_SdP_Initialized.png","height":1156}}]},{"type":"paragraph","content":[{"text":"This approach could be used e.g., in Salesforce, which itself acts as an IdP.\nSo the Salesforce has already authenticated the user, and only redirects to the ACS URL with the SAML token.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The user is already on the website of the IdP, and only clicks on a link leading to the ACS URL of the service (Pricefx).\nSample ACS URL:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"none"},"content":[{"text":"https://.pricefx.eu/pricefx//saml/consume/?RelayState=","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pricefx ","type":"text"},{"text":"consume","type":"text","marks":[{"type":"em"}]},{"text":" service verifies the SAML response.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the verification is successful, the user will be logged in to Pricefx and granted access to the resources that they are authorized to view/modify.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"To configure SSO, you must configure it in several places:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Service Provider (Pricefx Core)","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SAML Configuration (IdP URL and the IdP certificate)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"User Management - If you want to disable direct login for particular users (i.e., allow only SSO for them).","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Identity Provider (Azure, OKTA, SalesForce)","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Define and configure Pricefx Core (the Service Provider) as ","type":"text"},{"text":"trusted/known service provider","type":"text","marks":[{"type":"em"}]},{"text":" (sometimes called a ","type":"text"},{"text":"trusted relying party","type":"text","marks":[{"type":"em"}]},{"text":", or ","type":"text"},{"text":"trusted application","type":"text","marks":[{"type":"em"}]},{"text":").\nThe configuration procedure and terminology used there is different for every IdP provider and the information you have to enter in the SAML configuration section varies.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Assign users and groups to this new trusted application.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pricefx Core Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"You can configure Pricefx Core for Single Sign-On using SAML 2.0.\nIn Pricefx UI, navigate to ","type":"text"},{"text":"Administration","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"›","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Configuration","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"›","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"External Systems","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"›","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"SAML Configuration","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":100.0},"content":[{"type":"media","attrs":{"width":1888,"alt":"PricefxSAMLConfigurationScreen Unity","type":"external","url":"https://pricefx.vercel.app/content/docs/concepts/users-and-privileges/single-sign-on/images/PricefxSAMLConfigurationScreen_Unity.png","height":1872}}]},{"type":"paragraph","content":[{"text":"SAML Configurations","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"There can be more SAML configurations, if needed.Either click on \"DEFAULT\" to do a setup of the default SAML configuration, or click ","type":"text"},{"text":"Add","type":"text","marks":[{"type":"em"}]},{"text":" button to create a new SAML configuration.If you use more SAML Configurations in one partition, then you need to add the configuration name, e.g., \"IPSTAGE\" to the URLs – then this configuration set is used.If you do not specify it, it means that the DEFAULT is used. Examples:","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"https://.pricefx.eu/pricefx//saml/consume/DEFAULT?RelayState=quoteConfigurator","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"https://.pricefx.eu/pricefx//saml/consume/IPSTAGE?RelayState=quoteConfigurator","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]}]}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Name ID Mapping","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Select the User attribute from the Pricefx User Management which contains the user ID which ","type":"text"},{"text":"matches to the one used by the IdP","type":"text","marks":[{"type":"strong"}]},{"text":".This value is used to identify the user from the IdP.It must be ","type":"text"},{"text":"unique","type":"text","marks":[{"type":"strong"}]},{"text":" per user – no two users can have the same value in that field, otherwise the login via SAML will fail.This is particularly important when you choose \"Email\", as unique email addresses are not enforced on the Pricefx side.The value is one of:","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"email","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"loginName","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"additionalInfo3","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"additionalInfo4","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Name ID Format","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"The format of the ","type":"text"},{"text":"Name Identifier","type":"text","marks":[{"type":"em"}]},{"text":" sent from IdP to Service Provider.You can specify the format that is used (unspecified, emailAddress, persistent, transient).Set this field only if required.Read more about ","type":"text"},{"text":"Persistent and Transient Identifiers","type":"text","marks":[{"type":"link","attrs":{"href":"http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"SAML IdP Provider URL","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Enter the URL address of the SAML SSO page of the Identity Provider.","type":"text"}]},{"type":"paragraph","content":[{"text":"SAML Base URL","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Used only if the system should be accessed by a custom DNS name (but the cluster’s main/real DNS is a different one).Example: ","type":"text"},{"text":"www.pricefx.eu","type":"text","marks":[{"type":"em"}]},{"text":" for a customer on shared PROD; using DNS ","type":"text"},{"text":".pricefx.eu","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"IdP Certificate","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Paste the public certificate of the Identity Provider.It can be found in the IdP metadata.It is used to check the digital signature of the authentication request.Make sure you include the BEGIN and END tags! As per Vesper 6.0 release, multiple certificates can be added simply by pasting them one after the other (including the start/end tags).","type":"text"}]},{"type":"paragraph","content":[{"text":"Pricefx Metadata","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"The description of Pricefx endpoints (how IdP should call Pricefx).This is what Pricefx (Service Provider) gives to the IdP to automatically configure SAML for Pricefx on the IdP side.The content is provided to the IdP in the form of metadata.xml file.","type":"text"}]},{"type":"paragraph","content":[{"text":"ADFS/Azure/O365/Okta Federation Metadata URL","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Provided by the IdP.Federation metadata are required to establish a trust relationship with the Identity Provider (IdP).The XML metadata found on that URL will be used by Pricefx to retrieve certificates and URL for SAML endpoint.The URL serves to do the settings dynamically, instead of statically (see ","type":"text"},{"text":"Dynamic_metadata_exchange","type":"text","marks":[{"type":"link","attrs":{"href":"https://en.wikipedia.org/wiki/SAML_metadata#Dynamic_metadata_exchange"}}]},{"text":").Once the metadata URL is set and saved here, the configuration will be automatically updated when the IdP changes it.By uploading the metadata from URL, you can shorten the process to set up a relationship between the IdP and SP.","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"If the IdP gave you a federation metadata URL:","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter it here.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the \"Load metadata from URL\" button to get and apply all the necessary SAML configuration information from the URL.","type":"text"}]}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Service Provider Request Signing Private Key","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"You can enter here a private key which will be used to sign the SAML request.Warning: This option is meant only for special cases when the IdP explicitly requires it.","type":"text"}]},{"type":"paragraph","content":[{"text":"RelayStates","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"The RelayState parameter tells the Pricefx Core (the Service Provider) to which web page to redirect after a successful user login. A RelayState is just a token to select a redirect target after successful authentication (i.e., after the SAML/consume URL is called). The relayStateName is arbitrary and can be defined freely (it should contain only letters, no whitespaces).","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"relayStateName - Is a name sent by the Identity Provider.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"relayStateURL - Is a URL to jump to. The value can contain:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"replacements","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deep links","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"For the definition of RelayStates, you can use the ","type":"text"},{"text":"RelayState Builder","type":"text","marks":[{"type":"link","attrs":{"href":"https://pricefx.atlassian.net/wiki/spaces/KB/pages/5296848988"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Authorization","type":"text"}]},{"type":"paragraph","content":[{"text":"Authorization management - i.e., ","type":"text"},{"text":"Roles","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"Groups","type":"text","marks":[{"type":"em"}]},{"text":" - must still be maintained in Pricefx.","type":"text"}]},{"type":"paragraph","content":[{"text":"The list of ","type":"text"},{"text":"Roles","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"Groups","type":"text","marks":[{"type":"em"}]},{"text":" - can be also synced by a custom integration job with Active Directory (or similar system).","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"User Provisioning","type":"text"}]},{"type":"paragraph","content":[{"text":"A matching ","type":"text"},{"text":"User","type":"text","marks":[{"type":"em"}]},{"text":" object has to exist in Pricefx. It cannot exist only at Identity Provider.","type":"text"}]},{"type":"paragraph","content":[{"text":"The list of Users can be also synced by a custom integration job with Active Directory (or similar system).","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Identity Provider Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"This configuration is done by customer on their side.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Azure Identity Provider Specific Settings","type":"text"}]},{"type":"paragraph","content":[{"text":"The customer (using Azure as ID provider) may ask you for the \"Identifier (Entity ID)\" and \"Reply URL\".\nIn both cases, the URL ","type":"text"},{"text":"https://www.pricefx.eu/pricefx//saml/signon","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":" (provide the right DNS name and partition) should be used.\nIn case you are using a dedicated instance with a hostname other than \"www.pricefx.eu\", use your hostname instead.","type":"text"}]},{"type":"paragraph","content":[{"text":"Identifier (Entity ID)","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Entity ID would be the so-called sign-on URL like ","type":"text"},{"text":"https://www.pricefx.eu/pricefx//saml/signon","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":" (provide the correct DNS name and partition).","type":"text"}]},{"type":"paragraph","content":[{"text":"Reply URL","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"Reply URL or ACS or assertion URL would be the \"consume URL\": ","type":"text"},{"text":"https://www.pricefx.eu/pricefx//saml/consume","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"OKTA Identity Provider Specific Settings","type":"text"}]},{"type":"paragraph","content":[{"text":"For details about the configuration options, see ","type":"text"},{"text":"SAML Configuration","type":"text","marks":[{"type":"link","attrs":{"href":"https://pricefx.atlassian.net/wiki/display/UNITY/SAML+Configuration"}}]},{"text":" in Documentation.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"References","type":"text"}]},{"type":"paragraph","content":[{"text":"Documentation","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configuration > SAML Configuration","type":"text","marks":[{"type":"link","attrs":{"href":"https://pricefx.atlassian.net/wiki/display/UNITY/SAML+Configuration"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set up SSO with Azure Active Directory","type":"text","marks":[{"type":"link","attrs":{"href":"https://pricefx.atlassian.net/wiki/display/UNITY/Set+up+SSO+with+Azure+Active+Directory"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set up SSO with Okta","type":"text","marks":[{"type":"link","attrs":{"href":"https://pricefx.atlassian.net/wiki/display/UNITY/Set+up+SSO+with+Okta"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SSO Troubleshooting","type":"text","marks":[{"type":"link","attrs":{"href":"https://pricefx.atlassian.net/wiki/display/UNITY/SSO+Troubleshooting"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SSO SAML2 Tutorial","type":"text","marks":[{"type":"link","attrs":{"href":"https://pricefx.atlassian.net/wiki/display/UNITY/SSO+SAML2+Tutorial"}}]}]}]}]},{"type":"paragraph","content":[{"text":"Knowledge Base","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set up SSO with Okta","type":"text","marks":[{"type":"link","attrs":{"href":"https://pricefx.atlassian.net/wiki/display/UNITY/Set+up+SSO+with+Okta"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set up SSO with Azure Active Directory","type":"text","marks":[{"type":"link","attrs":{"href":"https://pricefx.atlassian.net/wiki/display/UNITY/Set+up+SSO+with+Azure+Active+Directory"}}]}]}]}]},{"type":"paragraph","content":[{"text":"External","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SAML","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SAML Core 2.0","type":"text","marks":[{"type":"link","attrs":{"href":"http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Metadata Federation","type":"text","marks":[{"type":"link","attrs":{"href":"https://en.wikipedia.org/wiki/SAML_metadata#Dynamic_metadata_exchange"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"How SAML Authentication Works","type":"text","marks":[{"type":"link","attrs":{"href":"https://auth0.com/blog/how-saml-authentication-works/"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"How SAML works","type":"text","marks":[{"type":"link","attrs":{"href":"https://developers.onelogin.com/saml"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Beginner’s Guide to SAML","type":"text","marks":[{"type":"link","attrs":{"href":"https://support.okta.com/help/s/article/Beginner-s-Guide-to-SAML"}}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Authentication vs Authorization:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Wikipedia - Authentication","type":"text","marks":[{"type":"link","attrs":{"href":"https://en.wikipedia.org/wiki/Authentication"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Wikipedia - Authorization","type":"text","marks":[{"type":"link","attrs":{"href":"https://en.wikipedia.org/wiki/Authorization"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OKTA - Authentication vs. Authorization","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.okta.com/identity-101/authentication-vs-authorization/"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Azure - Authentication vs. Authorization","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/azure/active-directory/develop/authentication-vs-authorization"}}]}]}]}]}]}]}],"version":1}

Browser not supported