Skip to main content

Add SAML identity providers

You can give your organization users access to Aiven through identity providers (IdPs) that support SAML.

The following are general steps for setting up single sign-on with an IdP. Setup instructions are also available for these specific providers:

For all IdPs, Aiven recommends following security best practices.

Step 1: Add the IdP in the Aiven Console​

  1. In the organization, click Admin.
  2. Click Identity providers.
  3. Click Add identity provider.
  4. Select an identity provider and enter a name.
  5. Select a verified domain to link this IdP to. Users see linked IdPs on the login page.

On the Configuration step are two parameters that you use to set up the SAML authentication in your IdP:

  • Metadata URL
  • ACS URL

Step 2: Configure SAML on your IdP​

Use the metadata URL and ACS URL from the Aiven Console to configure a new application in your IdP.

Step 3: Finish the configuration in Aiven​

Go back to the Aiven Console to complete setting up the IdP. If you saved your IdP as a draft, you can open the settings by clicking the name of the IdP.

  1. Enter the IDP URL from your identity provider.

  2. Enter the Entity ID from your identity provider.

  1. Paste the certificate from the IdP into the Certificate field.

  2. Optional: Paste or upload a JSON file with configuration details for your IdP.

  3. Click Next.

  4. Configure the security options for this IdP and click Next.

    • Require authentication context: This lets the IdP enforce stricter security measures to help prevent unauthorized access, such as requiring multi-factor authentication.

    • Require assertion to be signed: The IdP checks for a digital signature. This security measure ensures the integrity and authenticity of the assertions by verifying that they were issued by a trusted party and have not been tampered with.

    • Sign authorization request sent to IdP: A digital signature is added to the request to verify its authenticity and integrity.

    • Extend active sessions: This resets the session duration every time the token is used.

    • Enable group syncing: This syncs the group membership from your IdP to the Aiven Platform.

      note
      • The Aiven Platform doesn't create groups with this feature. It only syncs the group membership between the groups in your IdP and the groups you create in Aiven. For user group provisioning, use SCIM.
      • User group membership automatically syncs when a user logs in.
      • The IdP is the single source of truth. If a group in the IdP doesn't exist in Aiven, it will be ignored. Likewise, if a user is added to a group in Aiven Console but not in the IdP, they will be removed from the Aiven group when the group membership syncs.

  5. Optional: Select a user group to add all users who sign up with this IdP to.

  6. Click Finish to complete the setup.

note

If you set up a SAML authentication method before and are now switching to a new IdP, existing users need to log in with the new account link URL to finish the setup.

You can manually link Aiven organization user accounts using the following URLs.

note

You don't need to manually link organization users who have an email address that matches a verified domain linked to one of your identity providers.

  1. On the Identity providers page, click the name of the IdP.

  2. In the Overview section there are two URLs:

    • Signup URL: Users that don't have an Aiven user account can use this to create an Aiven user linked to this IdP.
    • User account link URL: Users that already have an Aiven user account can link their existing Aiven user with this IdP.

  3. Send the appropriate URL to your organization users. If you set up a different IdP before and are now switching to a new IdP, existing users need to log in with the new account link URL to finish the setup.

  4. The process for users to link their Aiven user account with the IdP varies for new and existing users.

    • For existing users that are already logged in to the Aiven Console:

      1. Click the account link URL.
      2. Click Link profile to go to your IdP's authentication page.
      3. Log in to the IdP to link the accounts. You can use the IdP for all future logins.

    • For existing users that are not logged into the Aiven Console:

      1. Click the account link URL.
      2. Click Login.
      3. Log in to the Aiven Console. You are redirected to your IdP's authentication page.
      4. Log in to the IdP to link the accounts. You can use the IdP for all future logins.

    • For new users without an Aiven user account:

      1. Click the signup URL.
      2. Select the identity provider on the signup page. You are redirected to your IdP's authentication page.
      3. Log in to the IdP.
      4. Complete the sign up process in the Aiven Console. The IdP is automatically linked to your Aiven user account and you can use it for all future logins.

Troubleshooting​

If you have issues, you can use the SAML Tracer browser extension to check the process step by step.