Anodot business intelligence documentation

SAML SSO Authentication

We recommend not to enforce SAML authentication until after verifying that Anodot SAML Authentication has been set up correctly.  

To enable SSO Authentication, the Admin user must be the account owner of the organization's single sign-on service provider.

Note: If Okta is your IP service provider, see Configuring SAML 2.0 for Okta.

To enable Anodot SAML SSO

  1. From the Anodot Navigation Panel, click Settings > Authentication to open the Authentication page.
  2. In the Single Sign-On Configuration section, click the SAML option button to enable this option.

    SAML-signon.png

  3. To enforce SAML single sign-on, click the For Admin users... check box.
    Note: The default is for SSO not to be enforced. Anodot recommends not to enforce SAML authentication until after verifying that Anodot SAML authentication has been set up correctly.  As long as SAML SSO is not enabled, Admin users can by-pass SSO and, for example, if locked out can access the system using their Anodot password. 
  4. In a separate window, open your organization's Single Sign-on Identity Provider.
  5. Copy the single sign-on Login URL and 509 Certificate.
  6. In Anodot, paste the single sign-on Login URL and 509 Certificate in the Login URL  and 509 Certificate fields in the Identity Provider Details section (see above).
  7. In the Service Provider Details section, copy Anodot's Entity ID (issuer ID) and Assertion Consumer Service URL, and paste this data into your single sign-on provider.
  8. Use a browser incognito window to test that the SAML configuration has been completed successfully:
    Login using the Login URL on the SAML page
    OR
    Go directly to https://app.anodot.com 

Anodot Service Provider Details

  • Anodot supports the HTTP-POST binding for SAML2:
     urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
  • Anodot requires the NameID Policy in Assertion Requests to be in email format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
  • Assertions must be signed.
  • Note that Anodot does not generate assertion requests for the IDP, it just redirects to them.
  • The digest algorithm used is: sha256
  • For details about Anodot SP Metadata, click the More Details link (see screenshot above)

For more information see: Anodot Configuring SAML 2.0 for Okta and Okta - How to Configure SAML 2.0 for Okta.