Working with SAML

IBM Aspera Shares supports Security Assertion Markup Language (SAML) 2.0, an open, XML-based standard that allows secure web domains to exchange user authentication and authorization data. With the SAML model, you can configure the Shares web application as a SAML "online service provider" (SP) that contacts a separate online "identity provider" (IdP) to authenticate users who will use Shares to access secure content.

With SAML enabled and configured, a user logging into Shares is redirected to the IdP sign-on URL. If the user has already signed in with the IdP, the IdP sends a SAML assertion back to Shares. The user is now logged into Shares.

When SAML is enabled, Shares creates a user account based on the information provided by a SAML response, and therefore the Shares user account does not need to be created manually. However, any changes to the account that are made on the DS server are not picked up by SAML.

These instructions assume you are already familiar with SAML and already have an identity provider (IdP) -- either third-party or internal -- that meets the following requirements:

Note: SAML and directory services should not be enabled together. Although there is a directory service behind a SAML IdP, Shares users will not have access to it. If Shares is being set up to use SAML, the following is recommended: (1) directory service sync should be disabled; and (2) existing directory service users should first be removed from the Shares system.

Setting up an Identity Provider

Please refer to Configuring Your Identity Provider (IdP) for information on setting up an identity provider for Shares.

Enabling SAML Authentication in Shares

Please refer to Configuring SAML for instructions on how to enable SAML authentication in Shares.

Creating SAML Groups

Please refer to Creating SAML Groups for instructions on how to set up SAML groups in Shares.

Adding individual SAML Users to a Local Group

Please refer to Adding a SAML User to a Local Groups for instructions on how to add individual SAML users to a local group.

User Accounts Being Provisioned by SAML Just-In-Time (JIT) Provisioning

Please refer to User Accounts Being Provisioned by SAML Just-In-Time (JIT) Provisioning for information on SAML Just-In-Time (JIT) Provisioning for Shares.

Note: Shares provides a mechanism for administrators to bypass the SAML login and log in using a local username and password. This allows administrators to log in and correct server settings, including a misconfigured SAML setup. To bypass the SAML login and sign in with the regular login, add local=true to the end of the login URL. For example: