SAML Authentication Tab - Manage Company

To avoid forcing your employees to manage a new password for Lucernex it can be configured to use a Single Sign-On (SSO) authentication service that your organization uses. This allows Lucernex users to sign in using their existing network credentials.

This does not provide a single sign-on service, but uses the SSO service that your organization chooses. Standards, such as SAML Security Assertion Markup Language. SAML is an XML-based framework that allows for the exchange of security information. SAML enables organizations with different security domains to securely exchange authentication and authorization information. Using SAML, your organization can deliver information about user identities and access privileges to a cloud provider in a safe, secure, and standardized way., have become the de facto standard for most cloud and SaaS service providers, including Lucernex, Salesforce, WebEx, and Google Apps.

Contact your Accruent representative if you want to use SAML authentication for your firm.

Method of Support

Federation Services Supported

Add custom TRAIN and PROD identifiers for Azure SAML SSO

Previously, our SAML Authentication page only allowed you to use Azure SAML single sign-on for one Lucernex environment at a time. This meant that most customers would only use Azure to authenticate for their production environments. This was frustrating for users, because they would need to remember a separate set of credentials to use for TRAIN or UAT instead of using their existing SSO login.

As of 22.08, we added the ability to add two custom entity IDs to your Azure SAML configuration. This enhancement allows you to use Azure to authenticate for both production and non-production environments.

To prevent existing SSO configurations from breaking, the entity ID fields are pre-populated with a default value that was previously hard-coded. This default value can be changed once you create unique entity IDs in Azure. Until the 22.08 Production release on August 5, you will only be able to change the ID for your non-production environment.

To create an entity ID in Azure:

Sign in to Azure.
Access the Enterprise Application you use to manage your SAML SSO.
Select Single sign-on from the Manage menu.
Click Edit button on the Basic SAML Configuration tile.

The Basic SAML Configuration panel opens.
Click Add identifier in the Identifier (Entity ID) section.

A new row appears.
Enter an identifier for your non-production environment in the field provided.

The identifiers for your production and non-production environments must be different. IDs can contain up to 20 standard alphanumeric characters, including hyphens and underscores.
Click Save button at the top of the panel.
Notify your Accruent representative that you want to modify the Entity ID for your non-production SAML configuration.
Provide the ID you created to your Accruent representative.

Your Accruent representative may need to add your SAML authentication credentials to your non-production environment.
After the Production release on August 5, repeat these steps if you want to create a unique Entity ID for your production environment.

Sample SAML Messages

Lucernex’s SAML support uses the user name in the Lucernex database to synchronize with users in the client's federation service.

Outbound to client federation services

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_8056c7e4-7683-49e5-b5b4-6776fdad930e" Version="2.0" IssueInstant="2013-07-09T12:06:27" ProtocolBinding="
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="http://localhost:8020/RolloutManager/samlresponse.jsp">
  <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.   0:assertion"> 
  https://app.   onelohhhgin.   com/saml/metadata/115064 
  </saml:Issuer> 
  <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.   0:nameid-format:unspecified" 
  AllowCreate="true"> 
  </samlp:NameIDPolicy> 
  <samlp:RequestedAuthnContext Comparison="exact"> 
  </samlp:RequestedAuthnContext> 
  <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.   0:assertion"> 
  urn:oasis:names:tc:SAML:2.   0:ac:classes:PasswordProtectedTransport 
  </saml:AuthnContextClassRef> 
</samlp:AuthnRequest>

Inbound to Lx Retail