> Make sure below details customer has to keep ready to configure Zephyr with SSO authentication.
* Identity provider URL ( This should point to their SSO login URL. When we click on Login via SSO button in the Zephyr login desktop, this click navigates to IDP URL. So please make sure that IDP URL they are entering should be able to access from the browser & that should navigate to their SSO login page)
* Identity provider issuer ID ( This value is Entity ID in their SAML metadata)
* SSO Certificate
> Users have to use the below as SSO & Audience URLs while performing SAML configuration at their end.
Single Sign-On URL: <Zephyr_hostname>/flex/saml/sso
Audience URL: <Zephyr_hostname>/flex/saml/sso* This Audience URL allows our Zephyr instance to verify that is it the intended recipient of a SAML response.
> How to handle below errors?
Error1:
2018-07-06 07:06:22,967 ERROR [http-nio-443-exec-4] SAMLResponseUtil.processSAMLResponse(144) | The assertion issuer didn't match the expected value
2018-07-06 07:07:31,531 ERROR [http-nio-443-exec-1] SAMLResponseUtil.processSAMLResponse(130) | org.opensaml.common.SAMLException: Issuer invalidated by issuer value http://COMPANY.COM/adfs/services/trust : http://company.com/adfs/services/trust
Handling: Identity provider issuer id is case sensitive. So if you see above error in Zephyr log Check the issuer ID in their metadata & enter exactly the same value under Identity provider issuer id box under Zephyr SSO configuration page.
ERROR [http-nio-443-exec-5] SAMLResponseUtil.processSAMLResponse(150) | The NameID value is missing from the SAML response; this is likely an IDP configuration issue
Handling:
For fixing the above error have changed below things :
* Changed the attribute of NameID to the email address
ERROR [http-nio-443-exec-9] SAMLResponseUtil.getCredential(210) | java.security.cert.CertificateException: Could not parse certificate: java.io.IOException: Illegal header: -----BEGIN CERTIFICATE-----
Handling:
* Seems there are some additional space/characters added in the saved certificate, that results to above error. Open the certificate file & re-save the file by removing unknown characters/space.
> In Zephyr Cluster environment if they are configuring SSO authentication, make sure to have SSO certificate in both servers under the path Zephyr installation directory\zephyrdata\persist folder. If this certificate is in one server & not in another server you will get #35 error in the URL while logging via SSO.