SAML Authentication

Purpose

The SAML Authentication page in the Admin Console allows you to configure Appian to authenticate users against external SAML identity providers (IdP), like Microsoft ADFS or Shibboleth, rather than against Appian authentication.

Access

To access the SAML Authentication page, go to the Admin Console. Then, in the left navigation menu, under Authentication, click SAML Authentication.

Configuring SAML settings

See SAML for Single Sign-On for an explanation of the global and per-IdP settings, as well as instructions for how to add a SAML identity provider for users to authenticate against.

Verify My Access

The Verify My Access button only appears when you use SAML authentication to sign in to Appian. When it is visible, before you can save your changes, you must verify that you can still sign in. Clicking this button will attempt SP-initiated sign-in to your identity provider in a new tab. If you successfully sign-in, you will be able to save your changes.

Additional configuration details and notes

• It is not possible to configure Appian to allow a user to authenticate multiple ways. Each user can authenticate through one of the following:
  • A single identity provider.
  • Appian authentication.
  • LDAP.
• If a user is in multiple SAML authentication groups, the highest identity provider in the list takes precedence.
• Starting a process model as a web service requires using Appian authentication and is therefore not available to users who are configured to authenticate via SAML.
• SAML authentication settings cannot be imported or exported from the Admin Console.
• A user configured to authenticate using SAML cannot be used to call Appian web APIs.
• Only users in the OAuth 2.0 SAML Bearer Assertion Users system group will use the OAuth 2.0 SAML Bearer Assertion Flow.

Security

• Appian signs its assertions using the SHA-1 hashing algorithm. Some identity providers, such as Microsoft ADFS, require you to specify this when configuring it to integrate with Appian.
• Appian supports signed, encrypted SAML assertions up to the AES-256 standard. In order to make use of this capability, the environment must be running on an Appian Cloud instance. Otherwise, self-managed environments will need to be running OpenJDK 17.

Feedback