Skip to main content

Configure SAML authentication

Contributors netapp-dbagwell netapp-mwallis netapp-thomi netapp-aaron-holt netapp-aherbin
PDFs

Beginning with ONTAP 9.3, you can configure Security Assertion Markup Language (SAML) authentication for web services. When SAML authentication is configured and enabled, users are authenticated by an external Identity Provider (IdP) instead of the directory service providers such as Active Directory and LDAP. When SAML authentication is disabled, the configured directory service providers such as Active Directory and LDAP are used for authentication

Enable SAML authentication

To enable SAML authentication with System Manager or with the CLI, perform the following steps. If your cluster is running ONTAP 9.7 or earlier, the System Manager steps you need to follow are different. Refer to the System Manager online help available on your system.

Note After you enable SAML authentication, only remote users can access the System Manager GUI. Local users cannot access the System Manager GUI after SAML authentication is enabled.

Workflow of the task to set up multfactor authentication with SAML

Before you begin

  • The IdP that you plan to use for remote authentication must be configured.

    Note

    See the documentation that is provided by the IdP that you have configured.

  • You must have the URI of the IdP.

About this task

  • SAML authentication applies only to the http and ontapi applications.

    The http and ontapi applications are used by the following web services: Service Processor Infrastructure, ONTAP APIs, or System Manager.

  • SAML authentication is applicable only for accessing the admin SVM.

The following IdPs have been validated with System Manager:

  • Active Directory Federation Services

  • Cisco DUO (validated with the following ONTAP versions:)

    • 9.7P21 and later 9.7 releases (refer to the System Manager Classic documentation)

    • 9.8P17 and later 9.8 releases

    • 9.9.1P13 and later 9.9 releases

    • 9.10.1P9 and later 9.10 releases

    • 9.11.1P4 and later 9.11 releases

    • 9.12.1 and later releases

  • Shibboleth

Perform the following steps depending on your environment:

System Manager

  1. Click Cluster > Settings.

  2. Next to SAML Authentication, click Actions icon.

  3. Ensure there is a check in the Enable SAML Authentication checkbox.

  4. Enter the URL of the IdP URI (including "https://").

  5. Modify the host system address, if needed.

  6. Ensure the correct certificate is being used:

    • If your system was mapped with only one certificate with type "server", then that certificate is considered the default and it isn't displayed.

    • If your system was mapped with multiple certificates as type "server", then one of the certificates is displayed. To select a different certificate, click Change.

  7. Click Save. A confirmation window displays the metadata information, which has been automatically copied to your clipboard.

  8. Go to the IdP system you specified and copy the metadata from your clipboard to update the system metadata.

  9. Return to the confirmation window (in System Manager) and check the checkbox I have configured the IdP with the host URI or metadata.

  10. Click Logout to enable SAML-based authentication. The IdP system will display an authentication screen.

  11. In the IdP system, enter your SAML-based credentials. After your credentials are verified, you will be directed to the System Manager home page.

Disable SAML authentication

You can disable SAML authentication when you want to stop authenticating web users by using an external Identity Provider (IdP). When SAML authentication is disabled, the configured directory service providers such as Active Directory and LDAP are used for authentication.

Perform the following steps depending on your environment:

System Manager

  1. Click Cluster > Settings.

  2. Under SAML Authentication, click the Enabled toggle button.

  3. Optional: You can also click Actions icon next to SAML Authentication, and then uncheck the Enable SAML Authentication checkbox.

Troubleshoot issues with SAML configuration

If configuring Security Assertion Markup Language (SAML) authentication fails, you can manually repair each node on which the SAML configuration failed and recover from the failure. During the repair process, the web server is restarted and any active HTTP connections or HTTPS connections are disrupted.

About this task

When you configure SAML authentication, ONTAP applies SAML configuration on a per-node basis. When you enable SAML authentication, ONTAP automatically tries to repair each node if there are configuration issues. If there are issues with SAML configuration on any node, you can disable SAML authentication and then reenable SAML authentication. There can be situations when SAML configuration fails to apply on one or more nodes even after you reenable SAML authentication. You can identify the node on which SAML configuration has failed and then manually repair that node.

Steps

  1. Log in to the advanced privilege level:

    set -privilege advanced

  2. Identify the node on which SAML configuration failed:

    security saml-sp status show -instance

    Example:

    cluster_12::*> security saml-sp status show -instance

                         Node: node1
                Update Status: config-success
               Database Epoch: 9
   Database Transaction Count: 997
                   Error Text:
SAML Service Provider Enabled: false
        ID of SAML Config Job: 179

                         Node: node2
                Update Status: config-failed
               Database Epoch: 9
   Database Transaction Count: 997
                   Error Text: SAML job failed, Reason: Internal error. Failed to receive the SAML IDP Metadata file.
SAML Service Provider Enabled: false
        ID of SAML Config Job: 180
2 entries were displayed.

  3. Repair the SAML configuration on the failed node:

    security saml-sp repair -node <node_name>

    Example:

    cluster_12::*> security saml-sp repair -node node2

Warning: This restarts the web server. Any HTTP/S connections that are active
         will be disrupted.
Do you want to continue? {y|n}: y
[Job 181] Job is running.
[Job 181] Job success.

    The web server is restarted and any active HTTP connections or HTTPS connections are disrupted.

  4. Verify that SAML is successfully configured on all of the nodes:

    security saml-sp status show -instance

    Example:

    cluster_12::*> security saml-sp status show -instance

                         Node: node1
                Update Status: config-success
               Database Epoch: 9
   Database Transaction Count: 997
                   Error Text:
SAML Service Provider Enabled: false
        ID of SAML Config Job: 179

                         Node: node2
                Update Status: config-success
               Database Epoch: 9
   Database Transaction Count: 997
                   Error Text:
SAML Service Provider Enabled: false
        ID of SAML Config Job: 180
2 entries were displayed.
Related information