NetMRI uses internal and external authentication systems to control user authentication for performing all administrative tasks. For a simple rollout, you can use the NetMRI local authentication database, which is called the local authentication service, where all user accounts and login information are contained within the appliance. You can also link NetMRI to an external Active Directory, RADIUS, TACACS+, LDAP, SAML, or OCSP authentication server or server group in the enterprise network to perform user authentication and authorization for NetMRI tasks, using the same user roles and privileges defined on the local NetMRI system. Doing so requires creating new authentication services in NetMRI.
| Anchor | ||||
|---|---|---|---|---|
|
...
| NetMRI SAML Attribute Key | SAML Attribute Value | Description | Example |
|---|---|---|---|
uid | username | User name as specified in the IDP user record. | jdoe |
urn:oid:1.2.840.113549.1.9.1 or mail | This is the person’s Email ID in the IDP user record. | jdoe@example.com | |
urn:oid:2.5.4.42 or givenName | givenName | Given name (first name) as specified in the IDP user record. | john |
urn:oid:2.5.4.4 or surname | surname | Surname (last name) as specified in the IDP user record. | doe |
| Group Attribute | Custom group attribute | User's relation to the organization or group. | memberOf eduPersonAffiliation |
To configure a NetMRI SAML authentication service, complete the following:
- Go to the Settings icon > General Settings > Authentication Services.
- Click the New icon. The Add Authentication Service dialog box opens.
- Name: Enter the name of the SAML authentication service. This name will appear on the NetMRI login form. For example, Okta, Azure SSO, and so on.
- Description: Enter a textual description for the SAML authentication service.
- Priority and Timeout: These settings do not apply to the SAML authentication type.
- Service Type: Choose SAML.
- In the Service Specific Information section, specify the following:
- Entity ID: Enter the unique identifier of the SP entity (i.e. NetMRI) for the IDP.
- IdP Metadata Url: Enter the IDP metadata URL.
- IdP Group Attribute: User's relation to the organization or group. For example, memberOf.
- IdP CA Certificate: Choose the certificate file.
- Key: Choose the private key file.
- Disable service: By default, this setting is turned on. When you turn it off, the configured service becomes available on the NetMRI login form.
- Disable authorization: By default, this setting is turned on until remote groups are specified.
- Click Save. You can now proceed to remote group mapping or close the window.
Once When you save a SAML service configuration, NetMRI generates an SP Metadata link based on the data that you provided. To access the link, close the Add Authentication Service window and, in the Actions menu for the configured SAML service, select Edit. Click the SP Metadata link to open an XML document with the NetMRI metadata in a new window. Use this metadata to configure the connection between your IDP and NetMRI.
...