Verify users' identities using SAML-based identity providers during self-service password reset and account unlock
SAML authentication is one of the available methods among the extensive range of MFA options supported by ADSelfService Plus. Verification of a user's identity is done using SAML-based identity providers like OneLogin, Okta, or custom SAML-based identity providers.
When SAML authentication is enabled in ADSelfService Plus, users are routed to their identity provider for authentication during password self-service operations.
After successful authentication in the identity provider, users are redirected back to the ADSelfService Plus portal where they can reset their password or unlock their account. To use SAML authentication for self-service password reset, users do not have to enroll in ADSelfService Plus.
Note: This option will work only if the identity providers have SAML 2.0 enabled.Prerequisites
Log in to your identity provider application web-console with admin credentials and navigate to ADSelfService Plus from the list of applications provided. If ADSelfService Plus is not supported by default, configure a new application for ADSelfService Plus in your identity provider application.
Either download the metadata in XML format, or copy the Issuer URL/Entity ID, IdP login URL, and the X.509 certificate.
Configuration steps
- Log in to the ADSelfService Plus web console with admin credentials.
- Navigate to Configuration > Self-Service > Multi-factor Authentication.
- Click SAML Authentication in the Authenticators Setup tab.
- In the Configure Identity Provider (IdP) section, choose Custom SAML from the Select IdP drop-down list.
- Provide an appropriate IdP name.
- There are two SAML configuration modes: Upload Metadata File and Manual Configuration.
- Select Upload Metadata File to manually upload the IdP metadata file (refer to step 2 of Prerequisites).
- Click Browse to upload the IdP metadata file.Fig. 1: Configuring SAML authentication in ADSelfService Plus by uploading the metadata file
- Select Manual Configuration to manually configure the URLs and certificates.
- Enter the Issuer URL/Entity ID obtained from the identity provider in the respective field (refer to step 2 of Prerequisites).
- In the IdP Login URL field, enter the login URL obtained from the identity provider (refer to step 2 of Prerequisites).
- In the X.509 Certificate field, enter the public certificate key fetched from the identity provider (refer to step 2 of Prerequisites).
Fig. 2: Configuring SAML authentication in ADSelfService Plus through manual configuration. - Click Save.
- Navigate to the MFA for Reset/Unlock tab and specify the number of authenticators required for user verification.
- From the Select the authenticators required drop-down, choose SAML Authentication.
And that's it! You are all set to authenticate users through SAML-based identity providers for self-service password reset and account unlock.
New to ADSelfService Plus?
Related Articles
ADSelfService Plus self-service password reset configuration: Reset & Unlock tab
Reset & Unlock tab The Reset & Unlock tab consists of settings related to the self-password reset and account unlock features. Learn how to configure these settings to suit your requirements. Here are the settings under the Reset & Unlock tab: Unlock ...Configuring the ADSelfService Plus login agent for machine MFA and password self-service in Linux
Securing data and resources on the corporate network is of paramount importance to organizations. In a world where most corporate attacks originate at an endpoint, ADSelfService Plus offers 20 MFA factors to protect endpoints by allowing access only ...Self-service password reset for Windows 7, 8, and 10
We've all had to reset a forgotten password at some point in our lives. But have you ever wondered what goes on behind the scenes when you initiate a password reset? Have you considered the security risks that can arise due to poor password ...Multi-factor authentication techniques in ADSelfService Plus
Let's take a look into the various authentication methods supported by ADSelfService Plus for enterprise multi-factor authentication (MFA). Why should you use MFA? Authentication based solely on usernames and passwords is no longer considered secure. ...Configuring Duo Security for Active Directory password reset
Duo Security is an access security focused application that is primarily used for multi-factor authentication. One of the ways Duo Security can be used to verify users identities is using passcodes. Here, once the user has provided their username and ...