Single Sign-On

Purpose

The Single Sign-On page in the Admin Console enables you to configure single sign-on for users in your Appian environment.

Access

To access the Single Sign-On page, go to the Admin Console. Then, in the left navigation menu, under Authentication, click Single Sign-On.

Settings

Appian lets you set up one of three options for single sign-on (SSO) with an identity provider: OpenID Connect, PIEE, and SAML.

SSO settings cannot be imported or exported from the Admin Console.

OpenID Connect

The OpenID Connect page allows you to configure Appian to authenticate users with OpenID Connect. OpenID Connect can be used to configure single sign-on.

See OpenID Connect User Authentication for an explanation of how to configure connections with OpenID Connect identity providers.

SAML authentication

The SAML Authentication page allows you to configure Appian to authenticate users against external SAML identity providers (IdP), like Microsoft ADFS or Shibboleth, rather than against Appian authentication.

Configuring SAML settings

See SAML for Single Sign-On for an explanation of the global and per-IdP settings, as well as instructions for how to add a SAML identity provider for users to authenticate against.

Verify My Access

The Verify My Access button only appears when you use SAML authentication to sign in to Appian. When it is visible, before you can save your changes, you must verify that you can still sign in. Clicking this button will attempt SP-initiated sign-in to your identity provider in a new tab. If you successfully sign-in, you will be able to save your changes.

Additional configuration details and notes

• It is not possible to configure Appian to allow a user to authenticate multiple ways. Each user can authenticate through one of the following:
  • A single identity provider.
  • Appian authentication.
  • LDAP.
• If a user is in multiple SAML authentication groups, the highest identity provider in the list takes precedence.
• Starting a process model as a web service requires using Appian authentication and is therefore not available to users who are configured to authenticate via SAML.
• SAML authentication settings cannot be imported or exported from the Admin Console.
• A user configured to authenticate using SAML cannot be used to call Appian web APIs.
• Only users in the OAuth 2.0 SAML Bearer Assertion Users system group will use the OAuth 2.0 SAML Bearer Assertion Flow.

Security

• Appian signs its assertions using the SHA-1 hashing algorithm. Some identity providers, such as Microsoft ADFS, require you to specify this when configuring it to integrate with Appian.
• Appian supports signed, encrypted SAML assertions up to the AES-256 standard. In order to make use of this capability, the environment must be running on an Appian Cloud instance. Otherwise, self-managed environments will need to be running OpenJDK 17.

PIEE authentication

The PIEE Authentication page allows you to configure Appian to authenticate users against the Procurement Integrated Enterprise Environment (PIEE). PIEE is the primary enterprise procure-to-pay (P2P) application for the Department of Defense and its supporting agencies. PIEE user authentication can be used for single sign-on to procurement-related systems.

See PIEE User Authentication for an explanation of how to configure PIEE authentication.

Feedback