SSO Checklist or Best Practices

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

IIQ 8.3 P1

We are planning to enable SAML bases SSO. We have gone through ‘IdentityIQ_System_Configuration’ document, but didn’t find any checklist or best practices around enabling SSO.

Question:

May I know checklist or best practices we have to follow when we enable SAML based SSO to have SSO login working without any issues?

2

Hi @rsingh7 ,

did you checked this document? IdentityIQ SAML support guide - Compass

Thanks

3 Likes
3

Thanks @Sriindugula for your reply, will go through shared Compass article.

4

Hi @rsingh7

if the above article is useful and you found what is required. please mark this thread as resolved.

Thanks,
Sri

5

I have gone through below URL

We have SAML based SSO setup, but when I am trying to use SPADMIN which is not in LDAP, it’s a local account (identity) then ‘Internal IdentityIQ Authentication’ not working for SPADMIN.

How to make this ‘Internal IdentityIQ Authentication’ method working along with SAML based SSO setup?

https://community.sailpoint.com/t5/Technical-White-Papers/IdentityIQ-Login-Configuration/ta-p/76904#toc-hId-819526555

IdentityIQ attempts to authenticate users by all enabled methods before reporting login failure to the user. The methods are executed in this order (skipping any disabled methods):

  1. Single Sign On (Rule-based or SAML)
  2. Pass-Through Authentication
  3. Internal IdentityIQ Authentication
6

@rsingh7

Authentication Method Processing Order

IdentityIQ attempts to authenticate users by all enabled methods before reporting login failure to the user. The methods are executed in this order (skipping any disabled methods):

  1. Single Sign On (Rule-based or SAML)
  2. Pass-Through Authentication
  3. Internal IdentityIQ Authentication

multiple authentication methods can be used together in a “failover” Configuration mode.

7

where do we do failover configuration?

8

We don’t have DR setup

9

Dont exist a failover configuration for Authentication, but @pravin_ranjan means that you can activated more than one configuration for use them for distinct services or if one fails another works

10

How do we set up order if one fails another work?

SSO login page presents it’s own login interface.

Expected order - If SSO doesn’t authenticate then should redirects to pass through authentication and if pass through doesn’t work then local credentials should work.

How to make ‘expected order’ working?

11

@rsingh7 pls check this document.

Pass-through authentication and single sign-on - Compass (sailpoint.com)

12

@rsingh7 Don’t see any document that say about order but my understanding

  1. Internal IdentityIQ authentication (default)
  2. Pass-Through Authentication (PTA) Configuration
  3. Single Sign-On (SSO) Configuration

Try to change your identity password by select identity from identity warehouse and change the password. now try with user username and change password. if it allows then it sailpoint first choose default one then others.

but i will look for more in details if somewhere it was mentioned about order.

thanks,

14

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.