Questions
Answers
What parameters are required from the Identity Provider (IdP) that should be configured in the inSync Management Console?
Currently, inSync supports the following parameters from anIdP:
ID Provider Login URL
ID Provider Certificate
Which RelayState parameters are required for configuring SSO for users and administrators?
RelayState is a parameter used by SAML protocol implementation to identify the specific resource as the resource provider in an IdP initiated single sign-on scenario.
RelayState Parameter | Value |
Administrators |
|
Users |
If you are using ADFS as an IdP, specify |
What parameters are required from service providers that should be configured with IdP?
In this case, inSync is the service provider, and the other party is the IdP. The parameters that are required by the IdP are as follows:
RelayState or Entity ID
Claim Rules
EndPoint URL
inSync_auth_token
What are the Default Claim Rules that are required to be configured at IdP?
LDAP Attribute | Outgoing Claim Type |
E-mail addresses | Name ID |
E-mail addresses | E-mail address |
User-Principal-Name | Name |
Does inSync support two-factor authentication in case of SSO?
Yes. inSync supports two-factor authentication. First authentication is done when the request is redirected from Service Provider to IdP.
Second authentication takes place with the use of “inSync_auth_token” parameter generated from the inSync Management Console. To generate SSO token,inSync Management Console. To generate SSO token:
Navigate to Manage > Settings > Single Sign-On and then click Generate SSO Token.
Copy the token and enter it in IdP console.
📝 Note
Druva recommends that you generate the SSO token only once. If you generate the SSO token again, the old SSO token (that you shared with your IdP) becomes inactive. You must then again share the newly generated SSO token with your IdP.
Does inSync support Metadata file and Logout URL?
No. Currently, inSync does not support metadata file provided by an IdP and logout URL. Contact Druva Support for more details.
Can an administrator except Druva Cloud Administrator configure SSO for administrators?
No. Only a Druva Cloud Administrator has permission to configure SSO for administrators.
Which certificate is required from ADFS that needs to be configured with inSync?
inSync requires a Token Signing Certificate or ID Provider Certificate from ADFS. It must be configured in inSync Management Console.
To obtain ID Provider Certificate,
On the ADFS 2.0 console, click Service >Certificates.
In the Certificates window, select the token signing certificate placed under Token-signing category.
Certificate properties windows appear.Click on the Details tab and then click Copy to File.
Certificate Export Wizard appears. Click NextSelect
Base-64 encoded X.509 (.CER)and click Next.The ID Provider Certificate is exported.
How to resolve the Invalid Password error seen when trying to activate the inSync Client or while logging on to the user's Web Console but when the old password still works?
inSync uses inSync password as a fallback mechanism if the IdP redirection is failing. There can be various reasons for this fallback, such as an invalid IDP URL or IDP certificate. If you run into this problem, please contact Support.