跳至主要內容
文件
文件
Adaptive Planning
上次更新時間 ：2023-06-23
Configure Your IDP for Encrypted SAML Assertion

Configure Your IDP for Encrypted SAML Assertion

A SAML assertion is the XML document that your identity provider sends to
Adaptive Planning
, the service provider. The document contains the user authorization. When users log in to
Adaptive Planning
 using SAML SSO, only a plain assertion is supported with signature validation. The assertion is not encrypted.
You can add an extra layer of security to your SAML SSO configuration. For enhanced security and privacy, encrypt the assertion too so that only the service provider can access your user info. Download an official
Adaptive Planning
 public key certificate to do this. During SAML SSO,
Adaptive Planning
 decrypts the SAML assertion with a private key and validates the signature. After successful validation and authentication, users can log into
Adaptive Planning
.
Adaptive Planning
 supports the following configurations of signing and encrypting the SAML assertion:
  • Signed response + Encrypted signed assertion
  • Unsigned response + Encrypted signed assertion
  • Unsigned response + Signed assertion
Adaptive Planning
 supports the following algorithms for encryption using the public key certificate:
  • Encryption algorithm: AES-256-CBC
  • Key Transport Algorithm: RSA-OAEP
  • Bits for private key: 2048 bits
  • Private key digest algorithm: SHA512

Before You Begin

Verify:

Download the SAML Encryption Certificate

  1. In
    Adaptive Planning
    , navigate to
    Administration > SAML SSO Settings.
  2. Scroll to the Certificate section and click
    Download Certificate.
    The certificate is saved to your local file system.

Encrypt the SAML Assertion

As an administrator, configure your IDP for encrypted assertion to SSO to your
Adaptive Planning
 instance.
In this procedure, we've used Okta as an example. Your IDP settings can vary from the Okta settings.
  1. Navigate to
    Okta> Admin> Applications
     and select the specific application.
  2. Under
    General
    , navigate to
    SAML Settings
     and edit the following advanced settings:
  3. Configure the following settings for connecting to
    Adaptive Planning
    :
    • Assertion Signature
      . Select
      Signed
      to digitally sign the SAML assertion. This ensures that only your IDP generated the assertion.
    • Signature Algorithm
      : Select the algorithm used to digitally sign the SAML assertion. Example: RSA-SHA 256.
    • Digest Algorithm
      : Select the digest algorithm used to digitally sign the SAML assertion. Example: RSA-SHA512
    • Assertion Encryption
      : Select
      Encrypted
      to encrypt the SAML assertion. This ensures that nobody but the sender and receiver understand the assertion.
    • Encryption Algorithm
      : Select the algorithm used to encrypt the SAML assertion. Example: AES256-CBC.
    • Key Transport Algorithm
      : Select the key transport algorithm used to encrypt the SAML assertion. Example: RSA-OAEP
  4. In the
    Encrypted Certificate
     field, upload the certificate that you downloaded from
    Adaptive Planning
     to send an encrypted SAML assertion.
  5. Navigate to
    Users> People
     and for each user you want to have access to
    Adaptive Planning
    , create an IDP account by specifying the SAML Federation ID and password.
  6. Navigate back to
    Applications
    and assign the users to the Okta application that you just configured.
Users can now log in to
Adaptive Planning
 using SAML SSO. For a login initiated by the service provider, they submit using their
Adaptive Planning
 username and leaving the password field blank. When redirected to their IDP login, they enter their IDP username and password.