What are the pre-requisites for enabling SAML authentication in ONTAP System Manager?

Supported IdP Servers

• Microsoft Active Directory Federated Services (ADFS)
• Azure AD
  • How to set up SAML authentication in ONTAP System Manager with Azure AD as the IdP
• Open-source Shibboleth
• Cisco DUO with ONTAP 9.12.1 and later

Note: The claim rules mentioned above need to be configured/setup in IdP server.

• IdP server setup is done by an IdP admin and NetApp Support is not involved in this process.

Ports, local users setup and other configuration

• Ports 443 or 80 need to be open between the ONTAP cluster and IdP server 
• Access to Remote LAN Module (RLM) or Service Processor (SP) console of the ONTAP cluster 
  • Administrative users will not be able to log into System Manager if IdP is misconfigured
  • You will not be able to disable SAML from the cluster management LIF; you must disable SAML from the RLM  or SP console. 
• Active Directory Domain Groups configured on a cluster do not currently work with SAML
• Adding a SAML Domain User in ONTAP cluster using the ONTAP CLI

Notes:

• ONTAP is case-sensitive
• No need to use sAMAccountName (Domain\Username), just use the username
• In some cases you will need to use a user name pattern like user@domain to make it work because this comes from the IdP

• Example 1:

If Active Directory Domain Username is John with capital J, then add SAML user in Ontap cluster with the same name.

cluster::> security login create -user-or-group-name John -application http -authentication-method saml -role admin
cluster::> security login create -user-or-group-name John -application ontapi -authentication-method saml -role admin

• Example 2:

If Active Directory Domain Username is joHn with capital H.

cluster::> security login create -user-or-group-name joHn -application http -authentication-method saml -role admin
cluster::> security login create -user-or-group-name JoHn -application ontapi -authentication-method saml -role admin

DNS

• The cluster should be able to ping the IdP server fully qualified domain name

::> dns hosts show

::> ping <IDP_server_name>

• The IdP server should be able to ping the cluster management lif or cluster fully qualified domain name

IdP server CLI --> ping <cluster_FQDN>

• Check to make sure the cluster certificate is not expired

::> security certificate show -vserver <cluster_name> -common-name <clustername>

IdP (Identity provider) URL

• Capture the IdP URL from ADFS or Shibboleth server
  • OKTA and Ping Federate have been configured successfully but not tested within NetApp.
  • The URL is needed to configure SAML on ONTAP System Manager.
• OkTA URL should not contain the Token groups Unqualified name

Correct URL  --   https://netapp.okta.com/app/abc1a23a1234567abcd/sso/saml/metadata
Incorrect URL --  https://netapp.okta.com/app/netapp_app_1/abc1a23a1234567abcd/sso/saml/metadata

• Ping Federate URL will be similar to the following:

https://companysaml.domain.com/pf/federation_metadata.ping?PartnerSpId=https://cluster_fqdn