Federate BlueXP with PingFederate
Suggest changes
PDFs
Federate with your PingFederate IdP provider to enable single sign-on (SSO) for BlueXP. This allows users to log in using their corporate credentials.
Organization admin or Federation admin is required to make create and manage federations. Federation viewer can view the Federation page. Learn more about access roles.
|
You can federate with your corporate IdP or with the NetApp Support Site. NetApp recommends choosing one or the other, but not both. |
NetApp supports service provider-initiated (SP-initiated) SSO only. You need to first configure the identity provider to trust NetApp as a service provider. Then, you can create a connection in BlueXP that uses the identity provider's configuration.
You can set up a federated connection with PingFederate to enable single sign-on (SSO) for BlueXP. The process involves configuring your PingFederate server to trust BlueXP as a service provider and then creating the connection in BlueXP.
-
An IdP account with administrative privileges is required. Coordinate with your IdP administrator to complete the steps.
-
Identify the domain you want to use for federation. You can use your email domain or a different domain that you own. If you want to use a domain other than your email domain, you must first verify the domain in BlueXP. You can do this by following the steps in the Verify your domain in BlueXP topic.
-
In the upper right of the BlueXP console, select
> Identity & Access Management. -
Select the Federation tab.
-
Select Configure new federation.
-
Enter your domain details:
-
Choose whether you want to use a verified domain or your email domain. The email domain is the domain associated with the account you are logged in with.
-
Enter the name of the federation you are configuring.
-
If you choose a verified domain, select the domain from the list.
-
-
Select Next.
-
For your connection method, choose Provider and then select PingFederate.
-
Select Next.
-
Configure your PingFederate server to trust NetApp as a service provider. You need to do this step on your PingFederate server.
-
Use the following values when configuring PingFederate to trust BlueXP:
-
For the Reply URL or Assertion Consumer Service (ACS) URL, use
https://netapp-cloud-account.auth0.com/login/callback -
For the Logout URL, use
https://netapp-cloud-account.auth0.com/logout -
For Audience/Entity ID, use
urn:auth0:netapp-cloud-account:<fed-domain-name-saml>where <fed-domain-name-pingfederate> is the domain name for the federation. For example, if your domain isexample.com, the Audience/Entity ID would beurn:auth0:netappcloud-account:fed-example-com-pingfederate.
-
-
Copy the PingFederate server URL. You will need this URL when creating the connection in BlueXP.
-
Download the X.509 certificate from your PingFederate server. It needs to be in Base64-encoded PEM format (.pem, .crt, .cer).
-
-
Return to BlueXP, and select Next to create the connection.
-
Create the connection with PingFederate
-
Enter the PingFederate server URL that you copied in the previous step.
-
Upload the X.509 signing certificate. The certificate must be in PEM, CER, or CRT format.
-
-
Select Create connection. The system creates the connection in a few seconds.
-
Select Next.
-
Select Test connection to test your connection. You are directed to a login page for your IdP server. Log in with your IdP credentials to complete the test and return to BlueXP to enable the connection.
-
Select Next.
-
On the Enable federation page, review the federation details and then select Enable federation.
-
Select Finish to complete the process.
After you enable the federation, users can log in to BlueXP using their corporate credentials.